STATE OF WASHINGTON C/O OFFICE OF FINANCIAL MANAGEMENTState Government

2025-003       The University of Washington did not have adequate internal controls over and did not comply with equipment management requirements for the Research and Development programs. Assistance Listing Number and Title: Various, Research and Development Cluster – University of Washington Federal Grantor Name: Various Federal Award/Contract Number: Various Pass-through Entity Name: Various Pass-through Award/Contract Number: Various Applicable Compliance Component: Equipment Known Questioned Cost Amount: None Prior Year Audit Finding: No     Background The federal government sponsors research and development (R&D) activities under a variety of types of awards. Most commonly, these are grants, cooperative agreements, and contracts to achieve objectives agreed upon between the federal awarding agency and the non-federal entity. The types of R&D activities conducted under these awards vary widely. Grants for R&D are awarded to recipients on the basis of applications or proposals submitted to federal agencies or pass-through entities. An award is then negotiated that will include the purpose of the project, the amount of the award and the terms and conditions. Recipients are required to appropriately safeguard and maintain all equipment purchased with R&D awards. Federal requirements stipulate that states receiving federal funds must use, manage and dispose of any equipment in accordance with the state’s laws and procedures. In Washington, the State Administrative and Accounting Manual (SAAM), published by the Office of Financial Management (OFM), specifies how agencies must manage and account for equipment. SAAM defines equipment as tangible property other than land, buildings, improvements other than buildings, or infrastructure, which is used in state operations and with a useful life of more than one year. For these assets, agencies are required to: Mark and identify both capitalized and non-capitalized assets Conduct physical inventories of state-owned assets at least once every other year Establish a capitalized asset inventory system, which includes adding and removing assets from the inventory Implement an inventory records policy Reconcile physical inventories Establish policies and procedures for reporting surplus, lost and/or stolen items The University’s Equipment and Inventory Office (EIO) is responsible for monitoring equipment and inventories for the entire University through its Workday system. Physical inventories of University-owned equipment, including federal equipment, must be completed every two years. During fiscal year 2025, the University acquired more than $51 million of equipment with federal R&D awards. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.    Description of Condition The University did not have adequate internal controls over and did not comply with equipment management requirements. The University did not conduct a complete physical inventory of equipment assets within the last two years, as required by state regulations outlined in the SAAM. The University’s most recent physical inventory was completed in June 2023.  Maintaining Accurate Inventory Records We used a statistical sampling method and randomly selected and examined 59 out of a total population of 4,578 assets in the University’s inventory system to verify the assets were in the possession of the appointed custodian, appropriately safeguarded and maintained, and in adequate working condition, as determined through visual inspection. We found the inventory records for five assets (8%) were not properly maintained to reflect the current status of the assets. Two of these assets had been moved to surplus, one had been returned to the project sponsor, one was replaced without updating the University’s inventory records and one asset was missing. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The University implemented a new Workday financial and reporting system in July 2023, which is also used as the University’s capital asset management system. In the process of migrating inventory records from its legacy systems into Workday, the University did not ensure all records imported to Workday were complete and accurate. University management stated that the EIO could not conduct a complete physical inventory during the audit period due to the large number of departments and campuses it had to oversee and scheduled a cycled inventory process to begin in fiscal year 2026, after the audit period had ended. This, in addition to implementing the new Workday system for inventory management purposes, further delayed the EIO in beginning to establish new inventory procedures. Additionally, management did not effectively monitor campuses and departments to ensure all assets that were moved for surplus, sold, transferred, or identified as lost or stolen were reported immediately to the EIO. Effect of Condition By not establishing adequate internal controls over its management of federal equipment, the University is at a higher risk of failing to detect asset losses. Recommendations We recommend the University: Improve its internal controls to ensure all additions to and removals from the University inventory are reviewed by the EIO for accuracy and appropriateness Ensure a physical inventory is conducted at least every other fiscal year, as required by state regulations, and ensure the inventory is reconciled by the EIO Ensure all assets moved for surplus, sale or transfer are communicated to the EIO to ensure the inventory records for the assets are properly maintained Ensure University inventory policies and procedures are followed Follow up on the missing asset to determine if a loss has occurred, and consider reporting any losses to our Office, as required by law University’s Response The University acknowledges the finding and is committed to substantially strengthening the controls and processes to ensure the timeliness and accuracy of our physical inventory. As noted by SAO, this is the first State R&D audit for capital equipment since the University implemented Workday Financials in July 2023 and Mobile Asset Scanning (MAS) gap application for physical inventory in May 2025. Various aspects of the University’s transition from legacy tools to modern technologies encountered delays and challenges, which impacted the University’s ability to complete the requisite work in a timely manner. System capabilities now in place will enable the University to perform inventory procedures in a timely fashion.  In addition to stabilizing new processes, the University is exploring multiple strategies to continue to streamline administrative processes and the control environment to ensure compliance with applicable regulatory requirements. The University has completed follow up on the asset SAO identified as missing during the course of the audit and took appropriate action on February 6, 2026 to comply with applicable state law. Auditor’s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The Washington State Office of Financial Management, State Administrative and Accounting Manual (SAAM), Section 30.40 – Capital Asset Inventory Records Policy outlines the requirements for capital asset inventories.  State Administrative and Accounting Manual (SAAM), Section 30.45 – Capital Asset Physical Inventory Policy outlines the requirements for conducting physical inventory reconciliations.  State Administrative and Accounting Manual (SAAM), Section 35.10 – Inventories outlines the requirements for physical inventory procedures.

2025-004       ​​The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Research & Development programs received required single audits, and that it appropriately followed up on findings and issued management decisions.​ Assistance Listing Number and Title: Various, Research and Development Cluster – University of Washington Federal Grantor Name: Various Federal Award/Contract Number: Various Pass-through Entity Name: Various Pass-through Award/Contract Number: Various Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No   Background The federal government sponsors research and development (R&D) activities under a variety of types of awards. Most commonly, these are grants, cooperative agreements, and contracts to achieve objectives agreed upon between the federal awarding agency and the non-federal entity. The types of R&D activities conducted under these awards vary widely. Grants for R&D are awarded to recipients on the basis of applications or proposals submitted to federal agencies or pass-through entities. An award is then negotiated that will include the purpose of the project, the amount of the award and the terms and conditions. Federal regulations require the University to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more on federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes to subrecipients, the University must follow up with them to ensure they take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the Federal Audit Clearinghouse (FAC). The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. To monitor its compliance with these requirements, the University’s Office of Sponsored Programs (OSP) uses an Excel workbook to track subrecipients’ single audits along with identifying any program-funded findings. The OSP includes subrecipients on this listing upon receipt of the subrecipients entity certification form, which is required prior to executing a subaward with the subrecipient. During fiscal year 2025, the University spent about $1.2 billion in R&D award funds, and of that amount, it passed through more than $187 million to subrecipients. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the R&D programs received required single audits, and that it appropriately followed up on findings and issued management decisions. We examined the University’s subrecipient single audit tracking spreadsheet used to track and verify subrecipients receive a single audit, if required, and compared this subrecipient list to the University’s accounting system for all 471 subrecipients that received payments from R&D awards during the audit period. We also examined federal audit clearing house reports for audit reports issued during our audit period for subrecipients with the University listed as a passthrough entity. We found: ·         108 (23%) of the University’s subrecipients in its accounting records were not listed on the OSP audit tracking spreadsheet ·         33 of the University’s subrecipients filed audit reports in the FAC during the audit period, of which the University failed to identify 20 (61%) on its tracking spreadsheet ​We also found one subrecipient received an audit finding that required a management decision letter to be issued during the audit period. The University failed to issue a management decision to this subrecipient. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The University did not implement adequate internal controls to ensure proper monitoring and review of subrecipient single audit submissions and issuance of management decision letters. OSP did not maintain a complete list of subrecipients in the single audit tracking spreadsheet. While the subrecipients included in the listing were being tracked, the listing was not properly maintained to identify all program subrecipients. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients received single audits when they were required. Additionally, the University cannot ensure it follows up on subrecipient single audit findings and communicates required management decisions to subrecipients. When it fails to ensure subrecipients establish corrective actions and management monitors them for effectiveness when required, the University cannot determine whether its subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ·         Monitor all subrecipients to ensure all required audit reports are submitted and reviewed to determine if any additional subrecipients are required to take corrective action to address audit recommendations ·         Strengthen internal controls to ensure all subrecipients are included within its single audit tracking documentation ·         Establish effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ·         Ensure subrecipients develop and take acceptable corrective actions to adequately address all audit recommendations ·         Issue a written management decision for applicable audit findings, if necessary University’s Response The University acknowledges this finding and remains dedicated to strengthening the controls, processes, and tools used to ensure ongoing compliance with federal requirements. This commitment includes enhancing documentation protocols and establishing robust practices for effective compliance tracking.  The University will implement improved controls to ensure all subrecipient audits are reviewed annually, including the issuance of written management decisions when appropriate. Verification will leverage the information in the Federal Audit Clearinghouse in addition to other public resources such as the Federal Demonstration Partnership Expanded Clearinghouse. Auditor’s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-005       The University of Washington did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Research and Development Cluster programs. Assistance Listing Number and Title: Various, Research and Development Cluster – University of Washington Federal Grantor Name: Various Federal Award/Contract Number: Various Pass-through Entity Name: Various Pass-through Award/Contract Number: Various Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No     Background The federal government sponsors research and development (R&D) activities under a variety of types of awards. Most commonly, these are grants, cooperative agreements, and contracts to achieve objectives agreed upon between the federal awarding agency and the non-federal entity. The types of R&D activities conducted under these awards vary widely. Grants for R&D are awarded to recipients on the basis of applications or proposals submitted to federal agencies or pass-through entities. An award is then negotiated that will include the purpose of the project, the amount of the award and the terms and conditions. During fiscal year 2025, the University spent about $1.2 billion in R&D award funds, and of that amount, it passed through more than $187 million to subrecipients. Pass-through entities are required to monitor the activities of their subrecipients to ensure they are properly using federal funds. To determine the appropriate level of monitoring, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. The University’s Office of Sponsored Programs (OSP) reviews subrecipient proposals to determine if the subrecipient must undergo a risk assessment based on whether or not the University has entered into any other subawards with the subrecipient on similar R&D projects. OSP performs risk assessments for all new subrecipients, as well as subrecipients that have not had a risk assessment performed by the University within the previous three years. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the R&D programs. During state fiscal year 2025, the University awarded more than $52 million in R&D funding to 423 subrecipients. We used a statistical sampling method to randomly select and examine 55 subrecipients to verify the University performed a risk assessment of the subrecipient related to the subaward(s) issued to the subrecipient during the audit period. We found the University did not perform a risk assessment for 42 subrecipients (76%) related to the subawards issued during the audit period. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The University did not believe it was required to conduct a risk assessment of each subrecipient for every subaward it executed with federal funds. Instead, management relied on OSP’s review of the most recent risk assessment for the subrecipient to determine if any new information should be considered for monitoring the new subaward. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments for subrecipients on each subaward, the University cannot ensure that it determined the appropriate level of monitoring of the subrecipient. Not performing new risk assessments also makes the University less likely to detect subrecipient noncompliance with federal regulations and the terms and conditions of subawards. Recommendations We recommend the University: Improve internal controls to ensure all subrecipients undergo a risk assessment at the time of receiving a subaward, to determine the appropriate level of monitoring for the subrecipient Ensure it performs and documents the required risk assessments for management to evaluate the results, determine the appropriate level of monitoring for the subrecipient, and demonstrate compliance with federal requirements University’s Response The University acknowledges this finding and remains dedicated to strengthening the controls, processes, and tools used to ensure ongoing compliance with federal requirements. This commitment includes enhancing documentation protocols and establishing robust practices for effective compliance tracking.  The University will implement improved controls to ensure subrecipient risk is assessed and documented in the context of each subaward. Auditor’s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-006     The Department of Health did not have adequate internal controls over cash management for the Epidemiology and Laboratory Capacity for Infectious Diseases, the Immunization Cooperative Agreements and the WIC Special Supplemental Nutrition Program for Women, Infants, and Children programs.   Assistance Listing Number and Title: 10.557 WIC Special Supplemental Nutrition Program for Women, Infants, and Children 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases  93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Agriculture U.S. Department of Health and Human Services Federal Award/Contract Number: Too numerous to list Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Cash Management Known Questioned Cost Amount: $160,206 Prior Year Audit Finding: Yes, Finding 2024-033 & 2024-036   Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports several specific infectious disease programs and projects and provides special appropriations in response to infectious disease emergencies. For the ELC program, the Department spent more than $99 million in federal grant funds during fiscal year 2025. The Department of Health also administers the Immunization Cooperative Agreements (Immunization) program. The objective of the program is to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. The program places emphasis on populations at highest risk for under-immunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2025, the Department spent more than $40 million in federal program funds for the Immunization program and received more than $114 million in noncash assistance from the federal grantor in the form of vaccines. The Department of Health also administers the WIC Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) program. The program provides supplemental nutritious foods, nutrition education (including breastfeeding promotion and support), and referrals to health care for low-income persons during critical periods of growth and development. Such persons include pregnant women, breastfeeding women up to one year postpartum, non-breastfeeding women up to 6 months postpartum, infants (children under one year of age), and children under age 5 determined to be at nutritional risk. In fiscal year 2025, the Department spent more than $162 million in federal program funds for the WIC program and received almost $25 million in infant formula rebates from private companies. The ELC and WIC programs are subject to the Cash Management Improvement Act (CMIA) and are included in the Treasury-State Agreement for Washington. The Immunization program is not subject to the CMIA. The primary purpose of the CMIA agreement is to ensure states request federal funds when they are needed so that no interest is gained or lost by either the federal or state governments. The agreement specifies the funding technique the Department should use when requesting federal funds. The Department shall draw funds semi-monthly, according to the state payroll schedule.  The Department maintains the Grant Management System (GMS) that is used to calculate cash draw amounts. The Department also utilizes the Cost Allocation System (CAS) to calculate indirect costs associated with expenditures. The Department uses these systems as agency-wide tools to manage all its federal grants. Daily, federal grant revenue and expenditures are automatically uploaded from the Department’s accounting system into its AFRS Data Distribution Services (ADDS) database. Department staff can pull data from ADDS by running queries in GMS and CAS.  To ensure that the data is properly uploaded, Department staff perform a manual reconciliation between ADDS and the accounting system every workday. The Department also maintains a chart of accounts (COA) system that feeds coding information into GMS and CAS to instruct these systems how to allocate grant expenditures.  Department staff generate a Grant Draw Report from GMS that provides the necessary information to complete a cash draw. This report includes calculations for the cash draw amount performed by GMS, as well as indirect costs calculated by CAS, using expenditure and revenue data received from the ADDS system.  Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.   In prior audits, we reported the Department did not have adequate internal controls over cash management for the ELC and Immunization programs. The prior finding numbers were 2024-036 and 2024-033. Description of Condition The Department did not have adequate internal controls over cash management for the ELC, Immunization, and WIC programs.   Since the Department’s internal controls reviewed are a centralized process, our testing included all its federal programs we reviewed for this audit.  We judgmentally selected three cash draws and found two instances where indirect expenditures reported on the Grant Draw Report exceeded the amounts reflected on the Cost Allocation System Reports. The Department was unable to provide an explanation for the discrepancies by the completion of testing. These discrepancies resulted in an overdraw of $160,206.  We also examined the Department’s internal controls over updating the COA to determine if the coding associated with each award entered in GMS and CAS was accurate. We found:  The Department did not have documented change management procedures for changes to the GMS stored procedures. Certain individuals could update account coding information in the COA without review or approval. Automated notifications were not sent out to alert staff when changes were made to COA data, increasing the risk that unauthorized changes could be made and not detected in a timely manner.  The Department did not have adequate controls in place to prevent or identify when an Organization Index is assigned to more than one revenue source in the COA. Having more than one revenue source code assigned to the same index code can result in inaccurate amounts recorded for federal grants.   We consider these internal control weaknesses to be a significant deficiency. These issues are also noted in finding 2025-022. Cause of Condition The Department did not have adequate internal controls to ensure the data used to complete cash draws was accurate and complete. The Department also does not have adequate controls in place to detect coding errors that would result in incorrect data being used to calculate the federal draw. Coding errors in the chart of accounts resulted in indirect expenditures being overcharged to the grant. Effect of Condition and Questioned Costs Not implementing adequate internal controls can result in inaccurate amounts recorded and drawn for federal grants. The Department overdrew indirect expenditures by $160,206, which we are reporting as questioned costs. Overdraws can result in the Department having to repay the grantor.  We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Department ensure it:  Has adequate internal controls in place over the updating and accuracy of the chart of accounts and GMS stored procedures Has adequate controls in place to properly calculate cash draw amounts in GMS  Department’s Response The Department acknowledges the importance of maintaining strong internal controls over cash management to ensure federal funds are drawn accurately, timely, and in compliance with applicable federal requirements. During the audit period, the Department identified issues within the Grants Management System and made every effort to fix the issue although we were unable to implement system enhancements prior to the end of the audit period. The Department continues to evaluate these issues and is actively working to update the system to ensure accurate and compliant drawdowns. In the interim, the Department has implemented compensating controls to mitigate the risk associated with this finding. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 31 U.S. Code of Federal Regulations (CFR) Part 205, Rules and Procedures for Efficient Federal-State Funds Transfers, section 11, What requirements apply to funding techniques?, states in part:  (b) A State and a Federal Program Agency must limit the amount of funds transferred to the minimum required to meet a State's actual and immediate cash needs.  Title 31 CFR Part 205.29, What are the State oversight and compliance responsibilities? states in part:  (d) If a State repeatedly or deliberately fails to request funds in accordance with the procedures established for its funding techniques, as set forth in § 205.11, § 205.12, or a Treasury-State agreement, we may deny the State payment or credit for the resulting Federal interest liability, notwithstanding any other provision of this part.  (e) If a State materially fails to comply with this subpart A, we may, in addition to the action described in paragraph (d) of this section, take one or more of the following actions, as appropriate under the circumstances:  (1) Deny the reimbursement of all or a part of the State's interest calculation cost claim;  (2) Send notification of the non-compliance to the affected Federal Program Agency for appropriate action, including, where appropriate, a determination regarding the impact of non-compliance on program funding;  (3) Request a Federal Program Agency or the General Accounting Office to conduct an audit of the State to determine interest owed to the Federal government, and to implement procedures to recover such interest;  (4) Initiate a debt collection process to recover claims owed to the United States; or  (5) Take other remedies legally available.   Title 31 CFR Subpart B—Rules Applicable to Federal Assistance Programs Not Included in a Treasury-State Agreement part 205.33 How are funds transfers processed? states in part: (a) A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102. Title 45 U.S. Code of Federal Regulations (CFR) Part 75 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards section 2 establishes definitions for questioned costs. Title 45 Part 75 section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.  Title 45 Part 75 section 403 establishes the factors affecting the allowability of costs.  Title 45 Part 75 section 410 establishes requirements for the collection of unallowable costs.  Title 45 Part 75 section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.  The Cash Management Improvement Act (CMIA) Agreement of 2025, states in part:  6.2.4 The following are terms under which State unique funding techniques shall be implemented for all transfers of funds to which the funding technique is applied in section 6.3.2 of this Agreement.  Modified Direct Program Costs - Admin, Payroll, Payments to Providers:  The State shall request funds for all direct administrative costs and/or payroll costs, and/or payments made to providers and to support providers. The request shall be made in accordance with the appropriate Federal agency cut-off time specified in Exhibit I. The amount of the funds requested shall be based on the amount of expenditures recorded for direct administrative costs and/or payroll costs and/or payments made to providers or to support providers since the last request for funds. The State payroll cycle is payday twice a month. Draws made the day before payday are for deposit on payday. The draw request will be made in accordance with the cutoff time in Exhibit 1. The amount of the funds requested shall be based on the amount of expenditures recorded for direct administrative costs and/or payroll costs and/or payments made to providers or to support providers since the last request for funds. This funding technique is interest neutral.  Modified Direct Program Costs: Except for managed care payments, the State shall request funds for direct program costs to providers and clients. The draw will occur on fixed intervals. Managed care payments will have a separate draw. The request shall be made in accordance with the appropriate Federal agency cut-off time specified in Exhibit I.  Managed care payments will be drawn the day before the payment to providers, so funds are received on date of managed care payments. The amount of the draw will be an accumulation of program costs since the last draw. This funding technique is interest neutral. 6.3.2 Programs  10.557 Special Supplemental Nutrition Program for Women, Infants, and Children Recipient: Department of Health % of Funds Agency Receives: 66 Component: Direct program/benefit payments for food voucher redemption. Rebates offset the direct program/benefit payments. This is a zero balance account. Technique: Modified Direct Program Costs Average Day of Clearance: 0 Days   10.557 Special Supplemental Nutrition Program for Women, Infants, and Children Recipient: Department of Health % of Funds Agency Receives: 34 Component: Administrative costs including payroll - salary, benefits, contractual and related expenditures Technique: Modified Direct Program Costs - Admin, Payroll, Payments to Providers Average Day of Clearance: 0 Days   93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC)   Recipient: Department of Health   % of Funds Agency Receives: 100   Component: Admin, payroll, payments to providers   Technique: Modified Direct Program Costs - Admin, Payroll, Payments to Providers  Average Day of Clearance: 0 Days

2025-007    The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Child and Adult Care Food Program. Assistance Listing Number and Title: 10.558 Child and Adult Care Food Program Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 247WAWA3N1199;247WAWA3N1099; 247WAWA3N2020;247WAWA4N1150; 247WAWA4N1050;257WAWA3N1199; 257WAWA3N1099;257WAWA3N2020; 257WAWA4N1150; Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-004       Background The Child and Adult Care Food Program (CACFP) reimburses child and adult care institutions and family or group day care homes for providing nutritious meals and snacks that contribute to the wellness, healthy growth, and development of young children, and the health and wellness of older adults and people with disabilities. In Washington, the Office of Superintendent of Public Instruction administers CACFP. The Office spent about $48.2 million in federal funds, more than $47.4 million of which it paid to subrecipients. The Office is responsible for monitoring all institutions participating in CACFP to ensure compliance with meal pattern, recordkeeping and other program requirements. Institutions that provide meals can participate through a sponsoring organization that will be financially and administratively responsible, or they can apply directly to the state agency and operate as an independent center. Federal regulations require pass-through entities to ensure that every subaward is clearly identified to a subrecipient as a subaward, and that it includes 14 federal award identification elements. These elements include the subrecipient's unique entity identifier, the Federal Award Identification Number, name of the federal awarding agency, the program's Assistance Listing Number and title, obligation amounts, project periods and more. When some of this information is not available, the pass-through entity must provide the best information available to describe the federal award and subaward. In addition, pass-through entities must impose requirements on subrecipients so that they use the program funds in accordance with federal statutes, regulations, and the federal award's terms and conditions. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Office did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the program. The prior finding numbers were 2023-003 and 2024-004.  Description of Condition The Office did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the CACFP. We identified 430 subrecipients of the program who were paid with federal funds during fiscal year 2025 and were subject to the Uniform Guidance requirements. We examined the various methods that the Office used to communicate the required federal award identification elements to subrecipients. These methods included periodic permanent agreements, an annual application process, and an award letter that was sent to each subrecipient. We found that the Department did not properly communicate, in a timely manner, all federal award elements, terms and conditions, and other federal award requirements to all 430 subrecipients. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition Although the Office developed new tools and written procedures in response to the prior year’s finding, these improvements were not fully implemented in a timely manner during the audit period. Effect of Condition Without proper identification and communication of the federal award, the Office cannot properly notify subrecipients about the required federal award elements, nor impose requirements so the subrecipients use the federal award in accordance with its terms and conditions, federal statutes, and regulations. Further, the Office cannot impose any additional requirements of the pass-through entity on the subrecipient to meet its own responsibilities to the federal awarding agency, as well as other requirements as specified in the Uniform Guidance. Recommendation We recommend the Office strengthen policies and procedures to ensure subawards are clearly identified as a subaward and communicate all required information according to the Uniform Guidance. Office’s Response The OPSI/CNS Office concurs with the finding, CACFP– Subrecipient Monitoring Fed ID Elements. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to establish, document, and maintain effective internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200 Uniform Guidance, Section 332, Requirements for pass-through entities, establishes the requirements for pass-through entities. Title 2 CFR Part 200, Uniform Guidance, Section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-008       The Department of Social and Health Services did not have adequate internal controls to ensure payments were allowable and made only to eligible beneficiaries for the Summer Electronic Benefits Transfer Program for Children. Assistance Listing Number and Title: 10.646 Summer Electronic Benefits Transfer Program for Children Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 202424N117547; 202424N117547-001; 202424N117547-002, 202525N117547; 202525N117547-001; 202525N117547-002; 202424N180347; 202424N180347-001; 202424N180347-002; 202524N180347; 202524N180347-001; 202524N180347-002; 202524N180347-003; Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Eligibility Known Questioned Cost Amount: $55,454 Prior Year Audit Finding: No       Background The Summer Electronic Benefits Transfer (Summer EBT) Program for Children is a federally funded nutrition assistance program administered by the U.S. Department of Agriculture to provide food benefits to eligible children during the summer months when school is not in session. The program is funded through multiple federal grant awards that include both benefit funding and administrative funding. In Washington state, the Department of Social and Health Services (Department) administers the Summer EBT Program as the lead agency for the State, in coordination with the Office of Superintendent of Public Instruction (OSPI) as the partnering agency for the State. The Department is responsible for determining eligibility of recipients to receive Summer EBT benefits, as well as financial management, accounting and federal reporting for the program, while OSPI is responsible for coordinating the automatic enrollment of children who are individually certified for free or reduced-price meals through the National School Lunch Program (NSLP) and School Breakfast Programs (SBP) and are enrolled in a participating school. In fiscal year 2025, the Summer EBT Program issued about $76 million in EBT benefits to more than 631,000 participants in Washington state. Individuals can be eligible to receive Summer EBT benefits through multiple pathways, including streamlined eligibility based on their participation in programs such as Supplemental Nutrition Assistance (SNAP) or Temporary Assistance for Needy Families (TANF). Individuals may also qualify for assistance through a direct certification method if they are enrolled in the state’s Medicaid programs. Additionally, an individual is eligible if enrolled in a school participating in the Community Eligibility Provision offering free or reduced-price meals to all children, or submits a direct application to the Department, and meets the following eligibility requirements: The individual lives in a household with total income that is at, or below 185 percent of the Federal Poverty Level; and The individual meets the compulsory school age set by Washington State (age eight to eighteen years old) at any point during the immediately preceding instructional year. According to the Department’s rules for the program, school aged children are defined as those between ages eight and eighteen years old at any point during the instructional year, which is the period from July 1 through the last day of the  summer operational period. The summer operational period is defined as the period of time between the end of the child’s current school year and the start of the next school year. Children determined eligible to receive a benefit during the program operational period may receive a one-time $120 benefit payment, which is available for a period of 122 days from the date of deposit before they can be expunged from the participant’s account. Children referred for the program by OSPI are eligible between the ages of one and eighteen, if their school participates in the National School Lunch Program or School Breakfast Programs, and offers free or reduced-price meals throughout the school year. The Department entered into a contract with a third-party vendor to develop and maintain an application portal to solicit applications for Summer EBT benefits. The contractor transmits approved applications directly to the state’s third-party EBT processor to issue Summer EBT benefits to participants directly through EBT cards (called SUN Bucks cards) sent through the mail. Participants receive written instructions along with their SUN Bucks card to activate their benefits with the EBT processor before the card can be used for food purchases. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure payments were allowable and made only to eligible beneficiaries for the Summer EBT program. We found the Department did not obtain or review data from its third-party contractor detailing all participants determined eligible during the audit period. We requested a population of all applicants determined eligible to receive benefits during the audit period to test whether the participants determined eligible to receive benefits met the criteria as required by federal law and Department rules. We identified 28 participants who did not meet the applicable school age requirements, and were age 19, or older, prior to the start of the operational period, representing $3,360 in Summer EBT benefits that were improperly issued to the participants EBT accounts. We also identified 2,416 improper issuances of benefits, totaling $289,920 that the Department confirmed with OSPI to be improperly issued. The Department informed our Office that it did not inquire with the grantor to determine if the federal share of these improper issuances should have been returned. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not monitor eligibility determinations made by its third-party contractor, and did not request data to support the eligibility determinations made by the contractor to ensure participants were correctly determined to be eligible to receive benefits. Instead, the Department relied on its review of the third-party contractor’s applicant screening procedures to prevent any unauthorized benefits from being awarded. Additionally, the Department only followed up on potential improper payments that were identified by OSPI and did not implement effective internal controls to ensure all benefits awarded to participants were allowable. The Department also provided our Office with reports it received from the third-party contractor that summarized duplicate payments identified for beneficiaries that were reported multiple times by participating school districts, resulting in improper issuances of EBT benefits, as well as beneficiaries that were later identified by participating school districts as ineligible. The Department did not correctly interpret the federal requirements to report these improper benefit payments to the federal grantor. Effect of Condition and Questioned Costs In total, the Department improperly awarded $293,280 to ineligible participants who did not meet the minimum compulsory school age requirements or were otherwise ineligible as defined by the Department in regulations. Of that amount, we found the Department paid $55,454 to ineligible participants which were not recovered or returned to the federal grantor. The Department deactivated the remaining amount of $237,826 in improper issuances before they could be spent. The summary table below outlines the questioned costs identified during our audit: Issue Category Improper Payment Amount Benefits paid on behalf of participants determined ineligible $52,842 Benefits paid for participants age 19 and older (prior to the start of the instructional period) $2,612 Total known questioned costs $55,454   We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures.  Recommendations We recommend the Department: Establish internal controls to ensure all participants awarded benefits under the program meet eligibility criteria Improve internal controls to ensure any improper payments identified are documented Retain supporting documentation to demonstrate that all participants receiving benefits under the program are eligible Monitor its third-party contractor to ensure eligibility determinations are accurate and in accordance with state and federal requirements Consult with the grantor to determine if the questioned costs identified in the audit should be repaid Department’s Response The Department concurs with the auditor’s findings. The improper payments identified resulted from challenges of implementing a new program in its first year. Errors occurred when school and DSHS users migrated data into new templates, leading to the inclusion of ineligible students and inaccurate dates of birth. The Department agrees that thorough data validation prior to issuance would have better identified systemic issues related to age and enrollment. Upon discovery, the Department promptly expunged ineligible issuances to limit the state’s liability. We did not process overpayments on spent benefits based on 7 CFR 292.27(c)(2), “To the maximum extent practicable, Summer EBT agencies should limit claims against households to situations where there is evidence that the household knowingly obtained benefits through fraudulent activities.” In addition, our approved state plan with the federal grantor states the Department will not process overpayments for improper benefits unless there is evidence of fraud. To strengthen our internal controls, the Department’s Community Services Division (CSD) will: Implement a mandatory data reconciliation process. The contractor must provide full participant datasets, including dates of birth and eligibility status, to CSD for review and approval prior to benefit issuance. Implement an age review process to address questionable data before submission to the contractor. Request a system enhancement to automatically flag participants under age 1 or over age 22 for further review. Update the contract with the contractor to include specific reporting requirements for duplicate issuances and ineligible participant flags. Request the Electronic Benefits Transfer (EBT) vendor create a standard monthly report to show expenditures and expired benefits by client. If the grantor contacts the Department regarding the questioned costs identified in this finding, the Department will consult with the grantor to determine whether repayment is required. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200.1, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs.  Title 2 CFR Part 200.403, Uniform Guidance, establishes the factors affecting the allowability of costs.  Title 2 CFR Part 210, National School Lunch Program, section 2, Definitions, establishes definition of “child”. Title 2 CFR Part 210, National School Lunch Program, section 10, Meal requirements for lunches and requirements for afterschool snacks, establishes the meal requirements for schools to offer lunch and afterschool snacks to eligible children. Title 7 CFR Part 292, Summer Electronic Benefits Transfer Program, Subpart B – Eligibility Standards and Criteria, section 6, Eligibility, establishes the eligibility requirements for children to receive benefits through the program. Washington Administrative Code (WAC) Section 388-487-0010 What is the sun bucks program?, states in part: The sun bucks program is the summer electronic benefits transfer program that provides a one-time food benefit to eligible children during designated summer periods following an academic school year. The following definitions apply to this program: 1.Categorically eligible means a school age child, as defined in this section, who automatically qualifies for sun bucks because they are: a.A member of a household receiving the supplemental nutrition assistance program (SNAP) or temporary assistance for needy families (TANF); or b.A foster child, homeless child, migrant child, head start child, or runaway child; as defined in the Richard B. Russell act. 2.“CEP or provision 2 school” means a community eligibility provision or provision 2 school that provides free or reduced-price meals to all children regardless of meeting income eligibility guidelines. 3.“CNEEB” means a child nutrition eligibility and education benefit application for free or reduced-price meals, including sun bucks, submitted by a household for a child or children enrolled at a school that participates in NSLP/SBP. 4.“Department” means the department of social and health services. 5.“Direct certification” means automatic eligibility for free or reduced-price meals based on documentation provided by the department that a child is categorically eligible as defined in this section. 9.“Free or reduced-price meals” means meals provided to students qualified as eligible by the Richard B. Russell national school lunch act. 12.Instructional year” means the period from July 1 of the prior year through one day prior to the summer operational period. 13.“NSLP/SBP” means the national school lunch program established under the Richard B. Russell national school lunch act and the school breakfast program established under the child nutrition act. 14.“Period of eligibility” means the period of time from the first day of the instructional year immediately preceding the summer operational period, through the last day of the summer operational period. 15.“School-aged” means the age children are required to attend school as defined by state law; in Washington state this is age eight to 18 years old. 16.“Streamline certified” means automatically enrolling an eligible child for sun bucks without need for further application or confirmation of school enrollment. 17.“Summer operational period” means the period between the end of the current school year and the start of the next school year, as determined by the state. 18.“Sun bucks application” means an application available to households with potentially eligible children who do not automatically meet streamline certification criteria. 19.“Sun bucks card” means the unique EBT card that accesses sun bucks food benefits issued to individual eligible children.   Washington Administrative Code (WAC) 388-487-0020 Is my child eligible for sun bucks?, states in part: 1.To be streamline certified for sun bucks benefits, a child must be: a.School-aged and categorically eligible; b.Enrolled in a school that participates in the NSLP/SBP; and i.Attends a school that does not operate the CEP or provision 2 program and determined by the school to be individually eligible for free or reduced-price meals; or ii.Attends a school that operates the CEP or provision 2 program and eligible for free or reduced-price meals using direct certification. 2.For children who are not streamline certified, an adult household member must submit either a sun bucks application to the department or a CNEEB application to the child’s school during the period of eligibility and the child must be: a.Enrolled at a school that participates in the NSLP/SBP; and b.A member of a household that meets income eligibility guidelines for free or reduced-price school meals. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-009       The Department of Social and Health Services did not have adequate internal controls over financial reporting for the Summer Electronic Benefits Transfer Program for Children. Assistance Listing Number and Title: 10.646 Summer Electronic Benefits Transfer Program for Children Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 202424N117547; 202424N117547-001; 202424N117547-002, 202525N117547; 202525N117547-001; 202525N117547-002; 202424N180347; 202424N180347-001; 202424N180347-002; 202524N180347; 202524N180347-001; 202524N180347-002; 202524N180347-003; Pass-through Entity Name: None Pass-through Award/Contract Number: None Known Questioned Cost Amount: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No       Background The Summer Electronic Benefits Transfer (Summer EBT) Program is a federally funded nutrition assistance program administered by the U.S. Department of Agriculture to provide food benefits to eligible children during the summer months when school is not in session. The program is funded through multiple federal grant awards that include both benefit funding and administrative funding. In Washington state, the Department of Social and Health Services administers the Summer EBT Program as the lead agency for the State, in coordination with the Office of Superintendent of Public Instruction (OSPI) as the partnering agency for the State. The Department is responsible for determining eligibility of recipients to receive Summer EBT benefits, as well as financial management, accounting and federal reporting for the program, while OSPI supports program operations by providing education-related data to the Department’s third-party contractor to identify participants from the state’s National School Lunch and School Breakfast Programs that may be eligible for Summer EBT benefits. As a condition of receiving federal funding, the Department is required to comply with federal financial reporting requirements. These include submitting quarterly financial reports (SF-425) that contain information on award receipts, cumulative federal expenditures, state share of program costs, indirect costs and unobligated balances for the reporting period. The grantor uses these reports to monitor program expenditures, ensure recipient compliance with grant requirements and support federal oversight of program funds. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over financial reporting for the Summer EBT program. We used a nonstatistical sampling method to randomly select and examine four out of a total population of six financial reports submitted by the Department. We found the Department did not have documentation to demonstrate that a second employee reviewed and approved two of the reports (50%) before the Department submitted them to the grantor. We consider this internal control deficiency to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not ensure a second employee consistently reviewed the reports for accuracy and certified them before submitting them to the federal grantor. The Department stated it lacked adequate staffing during the audit period, which resulted in periods of limited capacity for accounting staff to review reports before they were due. The Department also stated that it conducted preliminary reviews of the reports informally, but that it did not have documentation to demonstrate these reviews occurred. Effect of Condition By not properly reviewing the SF-425 report, the Department risks inaccurate reporting and cannot reasonably ensure that the expenditures and cash receipts reported to the grantor are complete and accurate.  Accurate, complete and timely reporting is critical for the grantor to ensure that federal funds are properly accounted for, expenditures align with approved grant budgets, and that required matching contributions are being met. Recommendation We recommend the Department strengthen internal controls to ensure a supervisor reviewed and approved the SF-425 reports before certification. Department’s Response The Department concurs with the auditor’s finding. The Department maintains that both instances were anomalies that occurred during a staffing transition within the Division of Finance and Financial Resources. During a departing employee’s final week, the reviewing/approving manager performed a live review of the reporting entries via a Teams screen share. While the manager provided verbal approval and later documented the review, the formal documentation was finalized after the report had already been submitted to the grantor. The second instance occurred during the interim period between the employee’s departure and the start of their replacement. Due to concurrent staff leave and limited resources in the accounting unit, the designated reviewer/approver completed all report tasks personally. In both instances, the reports were complete, accurate and submitted timely. To strengthen the Department’s internal controls, we will update procedures to designate a backup reviewer/approver. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to establish, document, and maintain effective internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-010       The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure salaries and wages charged to federal awards for the Research and Development programs were allowable and adequately supported. Assistance Listing Number and Title: 12.420 Military Medical Research and Development 47.049 Mathematical and Physical Sciences 93.113 Environmental Health 93.172 Human Genome Research 93.242 Mental Health Research Grants 93.279 Drug Use and Addiction Research Programs 93.361 Nursing Research 93.393 Cancer Cause and Prevention Research 93.838 Lung Diseases Research 93.853 Extramural Research Programs in the Neurosciences and Neurological Disorders 93.855 Allergy and Infectious Diseases Research 93.865 Child Health and Human Development Extramural Research 93.866 Aging Research   Federal Grantor Name: U.S. Department of Defense National Science Foundation U.S. Department of Health and Human Services Federal Award/Contract Number: 1R21AI164028-01A1; 1R21NR021233-01; 2R01AG060942-06A1; 3GG015353-07; 5523AI153390-05; 5P30A1027757-38; 5P30AG066509-05; 5P30ES007033-30; 5R01CA258590-05; 5R01DA057559-03; 5R01HD023412-29; 5R01HG002385-24; 5R01HL153979-04; 5R01MH101221-13; 5R01NS125635-04; 5R25NS095377-09; 5R33HD103079-05; 5U19AG076581-03; 5UM1AI148573-07; DMS-2134012-002; W81XWH-21-1-0271; W81XWH-21-1-0272 Pass-through Entity Name: Various Pass-through Award/Contract Number: Various Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $17,191 Prior Year Audit Finding: No       Background The federal government sponsors research and development (R&D) activities under a variety of types of awards. Most commonly, these are grants, cooperative agreements, and contracts to achieve objectives agreed upon between the federal awarding agency and the non-federal entity. The types of R&D activities conducted under these awards vary widely. Grants for R&D are awarded to recipients on the basis of applications or proposals submitted to federal agencies or pass-through entities. An award is then negotiated that will include the purpose of the project, the amount of the award and the terms and conditions. R&D award terms and conditions often include limitations on compensation for time and effort spent on research projects. University activities, including research, instruction, administration, service and clinical activity, generally qualify as effort charged to research awards. The University’s policies and procedures incorporated through its Grants Information Memoranda 35 – Effort Reporting Policy for Sponsored Agreements stipulate that salaries of staff should be charged to sponsored projects by determining the percentage of the faculty member’s average work week devoted to the project(s) and charging no more than that percentage of the faculty member’s base salary to the project. The University utilizes effort certifications to track the effort of individuals paid from sponsored awards. These certifications contain two different report types: effort statements and project statements. Faculty participating in research projects submit effort statements on a semi-annual basis which are reviewed and approved by a grant manager. Non-faculty members, including graduate assistants, prepare project statements documenting their time and effort spent on R&D projects and submit the project statements to the principal investigator assigned to the project for approval on a quarterly basis. Individuals are required to appear on an effort statement or project statement if they are paid from federal awards and have a salary that is paid on a cost sharing federal award. During fiscal year 2025, the University spent more than $367 million on salaries and wages for faculty and non-faculty staff participating in federal R&D projects. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.  Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure salaries and wages charged to federal awards for the R&D programs were allowable and adequately supported. We used a statistical sampling method to randomly select and examine 59 out of a total population of 252,300 payroll transactions by employee, by pay period, to determine if they were allowable and supported by adequate documentation. We found 21 payroll transactions (36%) that were not supported by a signed project or effort statement from the principal investigator for the corresponding payroll period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The University said that when implementing its new Workday financial system in July 2023, effort certifications were delayed for one year as the University addressed data integration issues with its legacy system, Employee Compensation Compliance. After implementation of Workday, University staff were re-trained on the effort reporting procedures which led to noncompliance with effort requirements as staff were not familiar with the new effort reporting procedures. Additionally, the University did not effectively monitor the completion of effort and project statements to ensure they were being consistently reviewed and certified by grant managers and principal investigators. Effect of Condition and Questioned Costs By not establishing adequate internal controls over payroll costs, the University is at a higher risk of unallowable costs going undetected. We determined that for the exceptions identified, the related costs of $17,191 did not comply with federal cost principles requirements, specifically that costs were not supported by adequate documentation to demonstrate the amounts charged to federal awards were allowable and in accordance with award terms and conditions. The table below summarizes the questioned costs identified by federal program: Assistance Listing Number Federal Program Name Questioned Cost Amount 12.420 Military Medical Research and Development $83 47.049 Mathematical and Physical Sciences $1,585 93.113 Environmental Health $372 93.172 Human Genome Research $289 93.242 Mental Health Research Grants $1,223 93.279 Drug Use and Addiction Research Programs $2,325 93.361 Nursing Research $70 93.393 Cancer Cause and Prevention Research $1,646 93.838 Lung Diseases Research $1,435 93.853 Extramural Research Programs in the Neurosciences and Neurological Disorders $2,040 93.855 Allergy and Infectious Diseases Research $1,633 93.865 Child Health and Human Development Extramural Research $2,036 93.866 Aging Research $2,456 Total   $17,191 *Questioned costs above are rounded to the nearest dollar We used a statistical sampling method to randomly select the transactions examined in the audit. Based on the results of our testing, we estimate the total likely questioned costs paid with federal award funds to be $73,512,822. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95% confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely questioned cost projections are a point estimate and only represent our “best estimate of total questioned costs” as required by 2 CFR 200.516(a)(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the University: Strengthen internal controls to ensure that effort statements are reviewed and approved by grant managers and project statements are reviewed and approved by principal investigators, as required by University policies, to demonstrate that salaries and benefits of staff charged to research awards are allowable and accurate Monitor salaries and benefits charged to R&D awards to ensure University procedures for effort reporting are being followed Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid University’s Response The University acknowledges this finding and is committed to substantially strengthening the controls, streamlining processes and improving mechanisms to ensure timely certification of effort. As of February 24, 2026 the 21 payroll transactions totaling questioned costs of $17,191 as identified by SAO have been reviewed by the applicable principal investigator and effort certifications statements completed.  The University will conduct a full review of the effort certification process, staff trainings, control mechanisms and escalation pathways, and implement improvements by the end of the current fiscal year (2026). Auditor’s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs.  Title 2 CFR Part 200.403, Uniform Guidance, establishes the factors affecting the allowability of costs. Title 2 CFR Part 200.430, Uniform Guidance, establishes the requirements for charging compensation for personal services to federal awards. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-011       The Employment Security Department did not have adequate internal controls over the 2208A reporting requirements for the Unemployment Insurance program. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: 25A55UI000109-01; 24A55UI000032-01; 23A03UI039355-01; 25A55UT000068-01; 24A55UT000030-01; 24A55UI039303-01; UI372562255A53-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No       Background The Unemployment Insurance (UI) program was created by the Social Security Act, and it provides benefits to unemployed workers under the Unemployment Compensation program for periods of involuntary unemployment. The program provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Employment Security Department administers the state’s UI program. During fiscal year 2025, the Department paid more than $2.2 billion in unemployment insurance benefits to people in Washington. The Unemployment Insurance Handbook No. 336 – published by the U.S. Department of Labor, Employment and Training Administration (ETA), Office of Unemployment Insurance – outlines the requirements for states to submit performance measures for UI programs to the federal government so it can evaluate their programs. The ETA 2208A – Quarterly UI Above-Base Report is a quarterly report of the staff years worked (SYW) and staff years paid (SYP) by program category and provides the basis for determining above-base entitlements. The report is cumulative, starting each federal fiscal year. Reports are due 30 days after the end of the reporting quarter. The Department prepares ETA 2208A reports using budget information from the state’s Agency Financial Reporting System (AFRS), and the Department’s central budget office reviews and approves the report quarterly. The key line items in the report include: Line One – Claims Activities: Reports the number of staff years for claims activities including initial claims, weeks claimed, eligibility reviews, nonmonetary determinations, appeals and multi-claimant service. Line Two – Employer Activities: Reports the number of staff years for employer activities including wage records, tax and tax travel. Line Three – UI Performs: Reports the number of staff years for UI Performs activities, less UI performs administrative staff and technical services (AS&T). Line Four – Support/AS&T: Reports staff years for support activities for the UI and Trade programs. Line Five – Trade Claims Activities: Reports staff years for claims activities under the Trade Adjustment Assistance provisions and North American Free Trade Agreement program. Line Six – Other: Reports the staff years for special funded activities not included in lines one through five. Line Seven – Total Staff Hours: Reports the year-to-date totals (YTD) from Lines one through six.   Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.   Description of Condition The Department did not have adequate internal controls over the 2208A reporting requirements for the UI program. During the audit period, the Department was required to submit four quarterly reports that report on the SYW and SYP. We tested all four reports the Department submitted and we identified three carried over the incorrect amounts for lines five, six and seven. Specifically: In the quarter ending December 2024, the Department misstated Line Six – Other for both SYW and SYP by 1.21 years, which carried over to the YTD and Line Seven – Total Staff Years. In the quarter ending March 2025, the Department carried over the incorrect YTD totals from Line Six – Other and Line Seven – Total Staff Years. We identified the Department understated the SYW and SYP amounts by 0.55 years. In the quarter ending June 2025, the Department misstated the following: oLine 3 – UI Performs for SYW, SYP and YTD hours, causing an understatement of 62.07 for all three categories oLine Five – Trade Claims Activities for SYW, SYP, and YTD hours, causing an understatement of 17.89 for all three categories oLine Six – Other for SYW, SYP and YTD years, causing an overstatement of 60.95 for all three categories   We consider these internal control deficiencies to be a significant deficiency. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not adequately review complete source documentation before certifying the reports to ensure it correctly reported all labor totals. In addition, the Department did not retain all supporting documentation to demonstrate how it calculated the amounts it reported when carrying forward staff totals from prior quarters. Effect of Condition and Questioned Costs When management does not follow the Department’s established internal controls to ensure all required reports are accurate, the Department is at an increased risk of inaccurately reporting data to the federal grantor. Recommendation We recommend the Department improve internal controls to ensure management properly reviews all required fields in the reports before it submits them to the federal grantor. Department’s Response ESD thanks the Office of the State Auditor for its work to ensure federal reports are accurate. The Department notified our federal grantor when we became aware of the issue and submitted a corrected report for the period in question. The Department has updated internal processes to review and retain all support documentation for the required reports. The Department has implemented a new process to run a cumulative report to provide further backup and detect variances throughout the fiscal year. The Department noted at the time there is no dollar impact for this report. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to establish, document, and maintain effective internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200,Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Office of Management and Budget, 2 CFR Part 200, Appendix XI, Compliance Supplement, Unemployment Insurance, states in part:        L. Reporting               3. Special Reporting ETA 2208A, Quarterly UI Above-Base Report (OMB No. 1205-0132) – Quarterly report of staff years worked and paid by program category. Key line items are one through seven of Section A. The auditor is not expected to test sections B through E. Detailed information on this report can be found at: Appendix III of ET Handbook 336, 18th Edition, Change 4

2025-012       The Employment Security Department did not have adequate internal controls over and did not comply with requirements to ensure it profiled all claimants under the Unemployment Insurance program to identify people likely to need reemployment services and ensure reports are reviewed before submission to the federal government. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: 25A55UI000109-01;24A55UI000032-01; 23A03UI039355-01;25A55UT000068-01; 24A55UT000030-01; 24A55UI039303-01; UI372562255A53-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – UI Reemployment programs: Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-009       Background The Unemployment Insurance (UI) program was created by the Social Security Act, and it provides benefits under the Unemployment Compensation program to unemployed workers for periods of involuntary unemployment. The program provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Employment Security Department administers the state’s UI program. During fiscal year 2025, the Department paid more than $2.2 billion in unemployment insurance benefits to people in Washington. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as the primary programs that facilitate the reemployment of UI claimants. RESEA is authorized by Section 306 of the Social Security Act, and it uses an evidence-based integrated approach that combines an assessment for continuing UI eligibility and the provision of reemployment services. The Department uses a RESEA program to satisfy the WPRS mandate in accordance with federal requirements, and its program design is documented in the RESEA State Plan approved by the U.S. Department of Labor. According to the Department’s RESEA State Plan, the agency profiles unemployment claimants using a scoring model that is built into its Unemployment Tax and Benefit (UTAB) system to identify claimants who are likely to exhaust benefits and  need job search assistance to obtain new employment. The profiling model must statistically combine information on the person’s work industry, occupation, education level, county of residence, and other personal characteristics, including veteran and union status, and labor market characteristics to generate a numerical score indicating their likelihood of exhausting regular unemployment benefits before finding work. The claimants are to be ranked in a queue based on their individual score from most likely to least likely to exhaust benefits. On a weekly basis, the Department selects people from this queue for available appointments for reemployment evaluations. In July 2019, the Department implemented an online appointment scheduling system called the Reemployment Appointment Scheduler (RAS) to facilitate the appointment scheduling process for the Department’s WorkSource offices. In June 2021, the Department deployed a pilot program proposed by the U.S. Department of Labor known as a randomized control trial (RCT), to randomly assign profile scores instead of using the risk profile model to profile all unemployment claimants. The objectives of the trial were to assess the impact of the RESEA program concerning the length of unemployment claims, earnings and employment probability of claimants following the provision of RESEA services, and to assess whether the program improved the identification of claimant eligibility issues and improper payment detection. Under the RCT, the WPRS score used to rank claimants was replaced with a randomly generated score, after excluding the top 5% of claimants with the highest WPRS scores. In 2024, the U.S. Department of Labor issued guidance to states administering RESEA grant programs to submit quarterly performance reports on RESEA participant activity that include the ETA 9128 RESEA Workload Report. The Department is required to have RESEA staff and state UI staff members review this report for accuracy before submitting it to the grantor. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it profiled all claimants under the UI program to identify people likely to need reemployment services and ensure staff providing those services received required training. The prior finding numbers were 2023-010 and 2024-009. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it profiled all claimants under the UI program to identify people likely to need reemployment services and ensure reports are reviewed before submission to the federal government. Identification for People Eligible for Reemployment Services The Department did not adequately monitor its UTAB scoring model to ensure applicant risk profile scores were accurate to identify those claimants most likely to exhaust their unemployment benefits. The Department is required to use a scoring model to profile all claimants to identify those likely to need reemployment services. During the audit period, the score calculated by the model was only applied for 5% of claimants with the highest score. A random score was assigned to the remaining 95% of claimants. The random score assignment did not provide adequate assurance that people most likely to exhaust benefits were prioritized to receive reemployment services. To determine a claimant’s profile score, the scoring model assigns 10 different coefficient rates associated with attributes that the Department determined to signify how likely a claimant will be to exhaust their unemployment benefits. The Department could not explain the methodology for determining an applicant’s profile score based on these 10 attributes, or how to independently recalculate the score. As of our audit, the Department had not tested the calculation of the profile score to ensure it is functioning as intended and producing accurate results. In addition, management could not provide historical records to demonstrate the calculation had been tested since its first implementation. Therefore, the Department has no assurance that the calculation provides an accurate measurement of the risk a claimant will exhaust their benefits. In addition, management did not monitor to determine whether the RAS system had received all eligible claimants. There is a daily process to send eligible claimants to the RAS selection queue, but there were no internal controls in place to ensure RAS received and processed all files it was sent. In addition, RAS does not have a working test environment to test whether the system effectively schedules claimants based on defined rules and requirements. RESEA ETA Reporting  We reviewed all four quarterly ETA 9128 reports that were submitted during the audit period. The Department uses a tracking spreadsheet to ensure the reports are completed timely. However, the Department did not maintain supporting documentation to demonstrate the reports were reviewed by UI staff or reviewed and approved by management before they were submitted to the grantor. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Identification for People Eligible for Reemployment Services During the implementation of the RCT, the Department did not adequately monitor the profiling and prioritization of claimants for RESEA participation to determine whether claimants prioritized for receiving RESEA services were the most likely to exhaust their unemployment benefits. In the prior audit, our Office tested the Department’s UTAB risk scoring model and identified system weaknesses and recommended the Department review the design of its UTAB calculation to determine whether it was accurately identifying claimants most likely to exhaust regular UI benefits. However, during this audit period, the Department did not implement any system changes to the scoring model. RESEA ETA Reporting  The Department stated that management reviewed the reports after they were submitted to the federal government. However, the Department did not provide us with any documentation to support the reviews occurred. Effect of Condition Identification for People Eligible for Reemployment Services Without monitoring its automated scoring model for effectiveness, the Department cannot ensure that its systems select RESEA participants based on a valid risk profile and priority of need for reemployment services. By disabling the automated scoring model, the Department is not in compliance with provisions in the RESEA State Plan, and it cannot ensure claimants selected for RESEA appointment services should have received consideration over higher-risk claimants who may be excluded in the RCT. RESEA ETA Reporting  By not documenting the review and approval of the reports before submission, the Department cannot demonstrate that all reporting elements were verified to be accurate as required. Recommendation We recommend the Department: • Review the design of its UTAB calculation to determine an applicant’s risk profile score and test the calculation of the score to determine whether the system is accurately identifying claimants most likely to exhaust benefits. This understanding and testing should ensure that coefficient values are correctly determined and assigned by the UTAB system. • Reconcile the interface between the UTAB system and the scheduling system to ensure the RAS scheduling system receives all RESEA eligible claimants and prioritizes claimants in accordance with federal requirements • Consider implementing additional internal controls to ensure claimants are profiled and prioritized for reemployment services based on their risk of exhausting unemployment benefits, in accordance with federal requirements • Improve internal controls to ensure all quarterly ETA performance reports are reviewed by RESEA and UI staff before submitting them to the federal grantor, as required   Department’s Response The Employment Security Department thanks the Office of the State Auditor for their work to ensure RESEA eligible claimants are prioritized in accordance with federal requirements. When this condition was identified in the prior year audit, the Department allocated resources to identify the cause and determine processes to properly determine coefficient values. This resulted in the Department identifying the issue and conducting additional internal verification of its accuracy. This initial work was completed in August 2025, which was outside of the audit period. The Department anticipates the coefficient to be accurate after final verification is completed. The Department partially concurs with the recommendation to reconcile the UTAB and Reemployment Appointment Scheduler (RAS) interface. There is currently a process in place to notify the RAS team if a record fails at the time of data transmission between UTAB and RAS. The Department will review its processes to verify the complete UTAB exit file was successfully received by RAS. The Department is reviewing its procedures and providing additional training on these ETA reports to ensure documentation that they have been submitted is retained. The Department will continue to work with our federal partners to ensure they provide training and guidance on new federal systems and reporting requirements. The Department notes there is no fiscal impact to this finding. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to establish, document, and maintain effective internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 United States Code, Chapter 7 – Social Security, Subchapter III – Grants to States for Unemployment Compensation Administration, § 503 – State laws, states in part:           (j)    Worker profiling (1) The State agency charged with the administration of the State law shall establish and utilize a system of profiling all new claimants for regular compensation that – (A) Identifies which claimants will be likely to exhaust regular compensation and will need job search assistance services to make a successful transition to new employment; (B) Refers claimants identified pursuant to subparagraph (A) to reemployment services, such as job search assistance services; available under any State or Federal law; Revised Code of Washington (RCW), Title 50, Unemployment Compensation, Section 50.20.011, Profiling system to identify individuals likely to exhaust benefits – Confidentiality of information – Penalty, states in part:   1. The commissioner shall establish and use a profiling system for new claimants for regular compensation under this title that identifies permanently separated workers who are likely to exhaust regular compensation and will need job search assistance services to make a successful transition to new employment. The profiling system shall use a combination of individual characteristics and labor market information to assign each individual a unique probability of benefit exhaustion. Individuals identified as likely to exhaust benefits shall be referred to reemployment services, such as job search assistance services, to the extent such services are available at public expense. 2. The profiling system shall include collection and review of follow-up information relating to the services received by individuals under this section and the employment outcomes for the individuals following receipt of the services. The information shall be used in making profiling identifications. Washington State Employment Security Department, Wagner-Peyser Employment Service Policy 4050, Reemployment Services and Eligibility Assessments (RESEA) program, states in part:   3. Policy: B. Claimant selection for RESEA services RCW 50.20.11 states, in part, that a profiling system must be established to identify new permanently separated claimants most likely to exhaust regular UI benefits and that are in need of job search assistance services to make successful transitions to new employment. This system uses a combination of individual characteristics and labor market information to assign each individual a unique probability of benefit exhaustion known as the profile score. Claimants with a work search requirement will be given a profile score. Those still attached to an employer will not receive a profile score. Employment and Training Administration Advisory System – Unemployment Insurance Program Letter No. 08-24 – Guidelines for the FY 2024 UI RESEA grants to invite State Workforce Agencies to submit a RESEA State Plan. Section 4 – Guidance part ii – Subsequent RESEA, states in part: C. Reporting instructions for ETA 9128. The ETA 9128 has been revised to capture data on subsequent (in addition to initial) RESEA activities and account for individuals selected for RESEA that are later determined to be incorrectly selected or ineligible for RESEA participation. The UIPL discussing the additional items will be published in March 2024. The ETA 9128 report must be completed by states quarterly and submitted no later than the 20th day of the second month following the quarter of reference, i.e., February 20, May 20, August 20, and November 20. Before its quarterly submission, states must review the ETA 9128 Workload report for accuracy. In addition to appropriate RESEA staff members, this review must include state UI staff members.

2025-013       The Employment Security Department did not have adequate controls over and did not comply with requirements to ensure it filed reports timely and accurately as required by the Federal Funding Accountability and Transparency Act for the Workforce Innovation and Opportunity grant. Assistance Listing Number and Title: 17.258 Workforce Innovation and Opportunity Adult Program  17.259 Workforce Innovation and Opportunity Youth Activities  17.278 Workforce Innovation and Opportunity Dislocated Worker Formula Grants Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: 24A55AT000071-01-00; 24A55AT000071-01-01; 24A55AY000071-01-00; 24A55AW000101-01-00; 24A55AW000101-01-03 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-010       Background The Employment Security Department administers the Workforce Innovation and Opportunity Act (WIOA) grant to help job seekers access employment, education, training and support services to succeed in the labor market. WIOA provides employment and training programs for adults, dislocated workers and youth. In fiscal year 2025, the Department spent about $67 million in WIOA federal funding, including about $63 million paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The Act is intended to empower the public with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. When a new subaward is executed, Department staff prepare the Federal Funding Accountability and Transparency Act (FFATA) spreadsheet, which contains the required reporting information for the subawards. Staff then submit the report based on the FFATA spreadsheet. The Department was required to report 12 WIOA subawards and amendments in fiscal year 2025, totaling $52,997,109. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls.  In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act for the WIOA grant. The prior finding numbers were 2023-011 and 2024-010. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports timely and accurately as required by the Act for the WIOA grant. During the audit period, the Department was required to report 12 subawards, totaling more than $52 million of program funds, that it awarded to 12 subrecipients. We used a non-statistical sampling method to randomly select and examine five out of the total population of 12 subawards. We found: The Department reported all five subawards late. One subaward reported the incorrect subrecipient name and unique entity identifier. The Department obtained the correct unique entity identifier from the subrecipient, but the Department entered it incorrectly in FSRS and did not detect that the incorrect subrecipient name was returned. Four subawards reported incorrect subaward amounts. All five subawards reported incorrect obligation dates. The Department elected to use the federal award notification date as the obligation date on the subaward, rather than when the subaward was executed. All five subawards did not include a unique subaward identification number. Instead, the Department reported the WIOA federal program code to identify the funding source of the subaward, rather than the subaward agreement number. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department had procedures in place to ensure staff reported subawards and amendments in FSRS. However, management did not ensure staff reported subawards timely and correctly. Moreover, the Department asserted it used the WIOA program codes as the subaward identification numbers because of when the program funding is released. However, the subaward numbers used were not unique to a particular subaward. Effect of Condition Failing to submit the required reports on time and accurately diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendation We recommend the Department:  Improve internal controls to ensure all subawards are reported accurately and in a timely manner Update the subaward numbers to ensure each subaward number is unique Review and update its FFATA reporting procedures to ensure they contain all necessary steps to comply with federal regulations Provide training for employees who prepare and review the reports to ensure accurate and timely reporting of subaward information Department’s Response The Department appreciates the State Auditor’s Office work to ensure reports are filed accurately and timely. The Department is reviewing its procedures and providing additional training on FFATA reporting to verify the reports are correct and submitted on time. The Department will continue to work with our federal partners to ensure they provide training and guidance on new federal systems and reporting requirements. The Department notes there is no monetary impact related to this finding. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to establish, document, and maintain effective internal controls over federal programs and comply with federal program requirements Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I.Reporting Subawards and Executive Compensation a.Reporting of first-tier subawards. 1.Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2.Reporting Requirements. i.The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at https://www.fsrs.gov. ii.For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the subaward was made on November 7, 2025, the subaward must be reported by no later than December 31, 2025). The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-014       The Department of Transportation did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction program. Assistance Listing Number and Title: 20.205 Highway Planning and Construction Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-012       Background The Washington State Department of Transportation’s Local Programs Office administers Highway Planning and Construction Program funding to local agencies throughout the state for highway construction projects. The Department spent about $1.1 billion on highway projects during fiscal year 2025 and awarded more than $990 million to local agencies through subawards for 294 new and existing projects across the state. Pass-through entities are required to monitor the activities of their subrecipients to ensure they are properly using federal funds. To determine the appropriate level of monitoring, federal regulations require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. For the subawards made during fiscal year 2025, Department management delegated the responsibility to complete risk assessments for individual projects to the Local Programs Engineers who were assigned to the regional office that oversees the project. When the Department prepares to monitor or review a subrecipient, it selects an open and active project and evaluates the subrecipient based on its performance under that project. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction program. The prior finding numbers were 2024-012 and 2023-012. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction program. We used a nonstatistical sampling method to randomly select and examine 26 out of a total population of 294 projects awarded funding during the audit period to determine if the Department performed a risk assessment of each project to determine the appropriate level of monitoring required for the subrecipient. We found the Department did not complete risk assessments for seven of the 26 projects (27%). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management did not ensure the Local Programs Engineers performed risk assessments for each subrecipient project awarded program funds. While the Department has made some changes to its internal controls in response to the two previous findings, they have been insufficient to ensure compliance with federal requirements. Effect of Condition Not performing risk assessments makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the grant’s terms and conditions. Without verifying the Local Programs Engineers completed risk assessments for each awarded project, the Department cannot ensure it is performing risk assessments consistently and using the proper criteria to determine the appropriate amount of monitoring required for each subrecipient project. Recommendation We recommend the Department: Ensure it properly performs and documents the required risk assessments, which would allow management to evaluate the results and demonstrate compliance with federal requirements Improve its monitoring of regional Local Programs Engineers to ensure they complete risk assessments for each program-funded project Department’s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor’s Office audit of the Highway Planning and Construction program. WSDOT is committed to ensuring our programs comply with federal regulations. Risks assessments for subrecipients in this FHWA grant program are the responsibility of WSDOT’s Regional Local Programs Engineers, located in the six WSDOT Regions. While every attempt is made to complete a risk assessment at each phase of a project, staff turnover contributed to the lack of consistency and timeliness in completing these assessments.  As part of ongoing efforts and to help ensure consistency, the Department will send a reminder to the Regional Local Program Engineers of the procedures revised March 2022 for the Risk Assessment process. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to establish, document, and maintain effective internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, section 332, Requirements for pass-through entities, establishes requirements for pass-through entities to evaluate each subrecipients’ risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate level of subrecipient monitoring. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-015       The Housing Finance Commission did not have adequate internal controls over and did not comply with reporting requirements for the Homeowner Assistance Fund program Assistance Listing Number and Title: 21.026 COVID-19 Homeowners Assistance Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-017       Background The American Rescue Plan Act of 2021 provided $9.96 billion to the Homeowner Assistance Fund (HAF) program. The U.S. Department of the Treasury provides funds directly to states, U.S. territories and Indian tribes to assist eligible homeowners experiencing financial hardship due to the COVID-19 pandemic. Program funds can be used to prevent mortgage delinquencies and defaults, foreclosures, loss of utilities or home energy services, and homeowner displacement. The law prioritizes funds for homeowners who have experienced hardships, leveraging local and national income indicators to maximize the program’s impact.  The Housing Finance Commission administers the HAF program in Washington. In fiscal year 2025, the Commission spent about $58 million in HAF funds. The Commission implemented a pilot program before launching the main HAF program. The Commission contracted with an entity to help implement the main HAF program and maintain participant data. The Commission is required to submit an annual performance report that provides an overview of its intended and actual uses of funding to-date for the pilot and main HAF programs. The federal grantor identified two key lines items on the report that contained critical information: Key line item 1: Socially Disadvantaged Individuals (SDIs) – Quantifiable Objective Criteria: Participants are providing not less than 60% of funds to homeowners with income less than 100% area median income (AMI) or 100% of U.S. median income.  Key line item 2: Area Median Income  – Quantifiable Objective Criteria: Participants target homeowners that are classified as SDI and 100% AMI or less.  The HAF Plan, approved by the federal grantor, outlines the budget allocations, goals and types of assistance for the Washington HAF program. The HAF reporting portal automatically populates each section of the annual report template with information from this plan. The Commission is required to submit a narrative on the status of each section. Commission staff use participant data provided by the contractor to complete the report template. Once completed, management conducts a review to ensure it is complete and accurate before submitting the report to the Treasury reporting portal. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.   In prior audits we reported the Commission did not have adequate internal controls over reporting requirements for the HAF program. The prior finding numbers were 2024-017 and 2023-025. Description of Condition The Commission did not have adequate internal controls over and did not comply with reporting requirements for the HAF program. We reviewed the report submitted during the audit period that covered federal fiscal year 2024, and identified the following: The Commission underreported the number of homeowners assisted for key line item #1 by 124 or 5.52%. The Commission overreported the number of homeowners assisted for key line item #2 by 112 or 10.47%. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Commission stated staff responsible for preparing the report did not include all relevant data needed to complete the report. The review management conducted was insufficient in detecting this issue. Effect of Condition Without establishing adequate internal controls, which should include a thorough review of the reports and the detailed supporting documentation to ensure the correct data is reported, management cannot ensure that the reports are complete and accurate. Recommendation We recommend the Commission: Establish effective internal controls to ensure the reports are accurate and complete Ensure management performs and documents an adequate review of the supporting documentation before submitting reports to the grantor Consult with the federal grantor to determine if revision and resubmission of the reports are necessary to correct amounts reported Commission’s Response The Commission concurs with this finding. The Commission has refined their system of controls and management review to ensure that data reported to the federal grantor is complete and accurate. The auditor’s recommendations came before the FY 25 Annual Report was filed and was reflected in the FY 25 Annual Report numbers. Auditor’s Remarks We thank the Commission for its cooperation and assistance throughout the audit. We will review the status of the Commission's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to establish, document, and maintain effective internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The U.S. Department of the Treasury’s Homeowner Assistance Fund: Guidance on Participant Compliance and Reporting Responsibilities, states, in part:  HAF participants are required to submit an Annual Performance Report on an annual basis and demonstrate the impact of the HAF-financed programs. Reports should include data related to program outputs and outcomes against the stated objectives of the HAF participant’s HAF Grant Plan.  Performance Goals  HAF participants initially submitted performance goals on the use of HAF award funds in their approved HAF Plan. Each one of the performance goals should have identified how the HAF participant will address homeowner needs and should have been disaggregated by key characteristics such as mortgage type, racial and ethnic demographics, and/or geographic areas, as appropriate. HAF participants will be required to provide a status update and quantitative measures, if applicable, on each of their initial performance goals set forth in their HAF Plan. Please note, HAF participants will not have the ability to alter their original performance goals noted in their HAF Plan nor add additional performance goals in the Annual Report. Methods for Targeting and HAF Funding  HAF participants were asked in their original HAF Plan to describe how the HAF participant will effectively target HAF award funds to (1) homeowners with incomes equal to or less than 100% of the area median income or equal to or less than 100% of the median income for the United States, whichever is greater; and (2) socially disadvantaged individuals. The description included the HAF participant’s targeting strategies. HAF participants will be required to provide an update on their targeting methods and if they have appropriately executed targeting methods according to their original HAF Plan.

2025-016       The Department of Corrections improperly charged $222 to the Coronavirus State and Local Fiscal Recovery Funds program. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $222 Prior Year Audit Finding: No       Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2025, state agencies spent about $606 million in SLFRF funds, more than $333 million of which was spent by the Department of Corrections. The Department received authority to spend SLFRF funds on salaries and benefits for corrections officers and other support staff serving state correctional institutions. Federal requirements stipulate that states may use SLFRF funds to support public health expenditures, including COVID-19 prevention and mitigation efforts, medical and behavioral healthcare expenses, public health and safety, and premium pay for essential workers. States may only use funds to cover costs incurred during the period of performance, which began on March 3, 2021, and ended December 31, 2024. Federal regulations require recipients to establish, document and maintain effective internal controls to ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.  Description of Condition The Department improperly charged $222 to the SLFRF program. We found the Department had adequate internal controls to ensure it materially complied with requirements to use SLFRF funds only for allowable activities. We used a statistical sampling method to randomly select and examine 59 out of 32,650 monthly payroll expenses incurred by the Department to ensure they were allowable and supported by adequate documentation. During our testing, we found one overpayment totaling $222 for employee wages that should have been recorded as leave without pay but was paid as vacation time, as well as shift differential pay that the Department improperly paid. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a single audit exceed $25,000. We are issuing this finding because, as stated in the Effect of Condition and Questioned Costs section of this finding, the estimated questioned costs exceed that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition During regular payroll processing, an employee’s leave without pay hours were incorrectly processed as paid time off. In addition, the employee received shift differential pay that they were not eligible for based on their work hours. These errors led to an overpayment charged to the program. Department management did not verify the allowability of payroll expenses before charging the expenses to the federal award, including verifying the employee’s work hours qualified them to receive shift differential pay. Effect of Condition and Questioned Costs The Department improperly charged the SLFRF program for costs, as outlined in the table below: Projection to Population Known Questioned Costs Likely Questioned Costs Federal expenditures $222 $123,019   Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95% confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely questioned cost projections are a point estimate and only represent our “best estimate of total questioned costs” as required by 2 CFR 200.516(a)(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department’s Response The Department of Corrections (DOC) would like to thank the State Auditor’s Office (SAO) for the audit of the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) grant. The Department agrees that questioned costs were charged to the grant due to an employee’s overpayment. While the SAO has complimented our internal controls and processes for being able to track each line item in the SLFRF, we also know that internal controls can always be improved. The Department will work with the Office of Financial Management (OFM) to discuss questionable costs with the grantor. The Department appreciated the patience of the SAO in obtaining supporting documentation and having clarifying conversations during the audit. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings.  Title 2 U.S. Code of Federal Regulations (CFR) Part 200.1, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs.

2025-017 The Department of Commerce did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Coronavirus State and Local Fiscal Recovery Funds received required single audits, and that it appropriately followed up on findings and issued management decisions. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-023 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2025, state agencies spent about $605 million in SLFRF funds, more than $117 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects, including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2025, the Department expended about $116 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under projects with the Department. Federal regulations require the Department to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more on federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse (FAC) within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes to subrecipients, the Department must follow up with subrecipients to ensure they take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a Department-funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the FAC. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. To monitor its compliance with these requirements, the Department’s Internal Control Office uses an Excel workbook to track subrecipients’ single audits along with identifying any program-funded findings. In some cases, the subrecipients included on this list are provided to the Internal Control Office by program staff. The ICO also runs financial reports in an effort to identify subrecipients that should be monitored. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of SLFRF received required single audits, and that it appropriately followed up on findings and issued management decisions. The prior finding number was 2024-023. Description of Condition The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2025, state agencies spent about $605 million in SLFRF funds, more than $117 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects, including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2025, the Department expended about $116 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under projects with the Department. Federal regulations require the Department to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more on federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse (FAC) within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes to subrecipients, the Department must follow up with subrecipients to ensure they take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a Department-funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the FAC. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. To monitor its compliance with these requirements, the Department’s Internal Control Office uses an Excel workbook to track subrecipients’ single audits along with identifying any program-funded findings. In some cases, the subrecipients included on this list are provided to the Internal Control Office by program staff. The ICO also runs financial reports in an effort to identify subrecipients that should be monitored. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of SLFRF received required single audits, and that it appropriately followed up on findings and issued management decisions. The prior finding number was 2024-023. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the SLFRF received required single audits, and that it appropriately followed up on findings and issued management decisions. We examined the Excel workbook the Department used during the audit period to monitor compliance with these requirements and determined the Department did not sufficiently design it to ensure the Department was compliant with subrecipient single audit requirements for the following reasons. The workbook: •Lacks a field to calculate or track when the subrecipient single audit is due to allow the Department to determine if the subrecipient submitted its report on time •Contains a field that documents the date when the Department reviews the subrecipient’s single audit status in the FAC. The workbook shows the Department reviewed this once (over approximately a five-week period) during the audit period. Since subrecipients have different fiscal year end dates, this single review per year is not sufficient to ensure compliance with the nine-month single audit submission and six-month management decision letter issuance, if applicable. During the audit, we requested the spreadsheet used to monitor compliance with these requirements for SLFRF subrecipients. We compared the subrecipients on the spreadsheet to the FAC to determine which received single audits. We found 58 SLFRF subrecipients received a single audit during the audit period. We randomly sampled twelve subrecipients that were required to receive a single audit. The Department did not properly track four (33%) of the 12 subrecipients to ensure they had submitted single audit reports and reviewed their audits for program-funded findings. In these four instances, the Department’s records indicated it did not review for these audit reports until after the audits were past due, and the reports had already been filed in the FAC. Furthermore, in this workbook: •Three (5%) of the 58 subrecipients were not listed on the Department’s single audit tracker. •For one (2%) of the 58 subrecipients, we could not verify on the Department’s tracker the subrecipient’s fiscal year-end date nor verify if they had reported a single audit in the FAC. Additionally, we found 22 subrecipients received a SLFRF finding requiring a management decision letter to be issued by the Department during the audit period. We requested documentation to verify this occurred. The Department issued six management letters (27%) past the due date, with one being issued five months late. Additionally, the Department did not provide management decisions letters for seven (32%) other subrecipients. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not implement adequate internal controls to ensure proper monitoring and review of subrecipient single audit submissions and issuance of management decision letters, if applicable. ICO staff said it is complicated to identify all the subrecipients that need to be monitored. The Office relies heavily on information from program staff and does its best to verify the information is accurate by running its own reports. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure all subrecipients received single audits when they were required. Additionally, the Department cannot ensure it follows up on subrecipient single audit findings and communicates required management decisions to subrecipients. When it fails to ensure subrecipients establish corrective actions and management monitors them for effectiveness when required, the Department cannot determine whether its subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the Department: •Monitor all subrecipients to ensure all required audit reports are submitted and reviewed to determine if any additional subrecipients are required to take corrective action to address audit recommendations •Establish effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions for all findings, as required •Ensure subrecipients develop and take acceptable corrective actions to adequately address all audit recommendations •Issue a written management decision for all applicable audit findings, if necessary Department’s Response The Department acknowledges the Washington State Auditor’s Office’s (SAO) finding, and notes we have strong and comprehensive internal controls over subrecipient monitoring for audit requirements. The Internal Controls Office (ICO) completes the monitoring as required by 2 CFR 200.521 and Title 45 CFR Part 75 section 352 d 3 and f. Several exceptions reported included language regarding processes referencing a non-SLFRF population and does not accurately reflect the comprehensive monitoring performed. The following are the Department’s responses to deficiencies listed in order of reporting: •No criteria, including all CFR’s referenced in this finding, require the Department ensure a subrecipient receives or submits a single audit. The CFR’s require the Department to •monitor and document the results of that reporting and monitoring. The ICO does follow-up with program management when subrecipients are identified as non-reporters. •The ICO tracking process includes a field to track dates audits are submitted. The Department’s monitoring is documented based on the reporting year and the subrecipient’s submission. Each subrecipient determines their own submission date. The criteria cited in this finding nor other applicable CFR’s require specific fields be documented, they require submission monitoring, tracking and the issuance of management decision letters. •Four subrecipients reported as “not monitored” were monitored and tracked on the tracking spreadsheet provided to SAO during the audit. Three of the four did not submit their reports within the deadline. Commerce has no oversight over subrecipient submission, and no criteria exists for that process. Commerce is required to monitor. The Department requested this exception be removed through the technical change process. •The exception reported for dates tracked was copied from a non-SLFRF program finding and does not accurately report dates tracked which was provided to SAO during the audit. The Department tracked, monitored subrecipients and documented the action completed starting on 1/28/25 and ending on 3/6/25 with a total of 14 different dates submissions were monitored. The Department requested this exception be removed through the technical change request process. •The Department confirms four management decision letters were not issued within the six month timeframe. Two were issued prior to the draft finding being issued and two have been completed and are awaiting approval. •The Department did monitor the subrecipient who did not report and provided that support to the SAO during the audit. The subrecipient’s submission was reviewed first on 2/6/25 and no submission has been completed. The Department requested this exception be removed through the technical change process. •The Department confirms six management decision letters were issued past the six month deadline, most within a few days of the deadline. One decision issued required special handling and additional care for its issuance. •Of the seven deficiencies the SAO reported as exceptions, the Department issued two management letters prior to the issuance of the draft finding and two are completed and awaiting issuance. For the remaining three, the SAO did not verify the exceptions identified were within the Department’s oversight. The errors include the following: oOne subrecipient did not receive funding from the Department for any of the findings issued oOne subrecipient received their SLFRF funding directly from the Department of Treasury oOne subrecipient received a financial statement finding which are not included in the single audit requirements •The Department asserts it does have adequate internal controls in place that are working effectively as required by the CFR. The ICO runs a state financial system report of expenditures for subrecipients who receive federal funding. The ICO does not rely on lists provided by programs to confirm the subrecipients. That language was copied from a non-SLFRF finding issued which includes a different confirmation process for subrecipients It is important to note the Department was not provided with an opportunity to respond to the deficiencies before the draft finding was issued. This was confirmed via email from the Assistant Director of State Audit and Special Investigations on February 5, 2026. Had the Department been provided time to respond, we assert several of the exceptions reported should have been removed. The Department has requested the errors reported in the finding be removed through the technical change request process but no revisions have been completed as of the date of this response. Auditor’s Remarks The requirements for pass-through entities in the Uniform Guidance (2 CFR 200.332(g)) stipulate that pass-through entities must verify each subrecipient is audited as required under Subpart F (2 CFR 200.501). We maintain that the Department did not have adequate internal controls to monitor its SLFRF subrecipients to ensure each subrecipient was audited as required under Subpart F, and that it did not issue management decisions for all related findings to its subrecipients. The Department did not provide our Office with any documentation during this audit to demonstrate that it communicated with its subrecipients that had overdue single audits. Additionally, without tracking when single audits are due for each of its subrecipients, and without continuously monitoring its subrecipients for audit submissions throughout the fiscal year, the Department cannot ensure it is detecting when subrecipients do not comply with federal regulations to submit their single audit reports in the FAC. As stated above, the Department only monitored its subrecipients to determine if single audits were performed over a five-week period during the fiscal year. We also wish to point out that during this audit we requested and reviewed all management decisions provided by the Department to its subrecipients. We noted seven instances where no management decisions had been issued. We appreciate the Department following up on these instances immediately after they were detected, but we did not consider management decisions issued after the audit period had ended when determining our opinion on compliance. We reaffirm our finding and will follow up on the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-018       The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-022     Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury (Treasury), which the state’s Office of Financial Management (OFM) allocated to state agencies for various programs. In fiscal year 2025, state agencies spent about $605 million in SLFRF funds, more than $117 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support infrastructure projects and affordable housing construction through its affordable housing, broadband infrastructure, and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2025, the Department expended over $116 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of their subrecipients to ensure they are properly using federal funds. To determine the appropriate level of monitoring, federal regulations require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. The prior finding numbers were 2024-022, 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During state fiscal year 2025, the Department awarded more than $19 million in SLFRF funds for infrastructure projects to four subrecipients. We examined all four subrecipients, including one individually significant subrecipient, and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of the subrecipients (50%). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Program management stated it was not aware of the requirement to perform and document risk assessments of its subrecipients during the audit period as it executed subawards prior to the obligation cutoff date of December 31, 2024, established by the Department of Treasury and OFM. In prior years, the Department completed risk assessments during the initial phase of awarding new SLFRF projects, prior to obligating federal funding, and during the audit period, management inadvertently removed this step from its subaward execution processes. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards.   Recommendations We recommend the Department: Improve internal controls to ensure all subrecipients undergo a risk assessment at the time of receiving a subaward, to determine the appropriate level of monitoring for the subrecipient Ensure it performs and documents the required risk assessments for management to evaluate the results, determine the appropriate level of monitoring for the subrecipient, and demonstrate compliance with federal requirements Department’s Response The Department acknowledges the results of the Washington State Auditor’s Office’s audit of the fiscal year 2025 Coronavirus State and Local Fiscal Recovery Funds (SLFRF) audit of risk assessments for subrecipients.  Out of the SLFRF funding the Department expended for fiscal year 2025, the audit included the following SLFRF programs: Local Government Division - Infrastructure Programs Local Government Division Washington State Broadband Office – Broadband Infrastructure Grants Housing Division – Affordable Housing Transitional Housing Division – Affordable Housing Connections The SLFRF program monitoring finding reported deficiencies in one of the Department’s programs included as part of the audit:  Infrastructure Programs The Department confirms risk assessments were not conducted for two subrecipients.  The Infrastructure Projects program will not be granting any additional SLFRF awards and will not need to conduct any additional risk assessments since the obligation cutoff date of December 31, 2024 has passed. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-019    The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform program monitoring for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No       Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2025, state agencies spent about $605 million in SLFRF funds, more than $117 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support infrastructure projects and affordable housing construction through its affordable housing, broadband infrastructure, and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2025, the Department expended more than $116 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Under the Uniform Guidance, pass-through entities are required to monitor the activities of their subrecipients to ensure the subrecipients comply with federal statutes, regulations, and the terms of conditions of subawards. These requirements also include reviewing financial and performance reports required of the subrecipient. The Department’s Special Terms and Conditions included in subawards for capital projects include the requirement for each subrecipient to submit a Project Status Report with every payment request. This report must describe in narrative form the progress made on the SLFRF project since the last invoice was submitted for payment, and provide a detailed description of the project’s status to-date. The Department’s program managers are instructed to review these reports and withhold payment to subrecipients that do not submit a project status report with their invoices. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls.    Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform program monitoring for subrecipients of the SLFRF. We used a non-statistical sampling method to randomly select and examine 12 out of 26 subrecipients to determine whether the Department reviewed and approved Project Status Reports submitted by the subrecipients as required by the terms and conditions of the subaward. We also examined three individually significant subrecipients. We found six subrecipients (40%), five of the sampled subrecipients as well as one individually significant one, did not submit Project Status Reports with their invoices for payment, as required by the Department. In total, these subrecipients failed to submit 13 out of 117 (11%) reports that were due. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not follow up with subrecipients to request missing Project Status Reports when reviewing invoices for payment because it believed that the subrecipients could still be appropriately monitored without receiving the reports. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure it is appropriately monitoring subrecipients for all requirements imposed in the terms and conditions of the subaward, as required by the Uniform Guidance.   Without receiving project status reports of subrecipients that received SLFRF funding, the Department is less likely to be able to determine if the goal and objectives of the capital projects furnished by the subawards are being achieved. Not receiving and reviewing project status reports also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards.   Recommendations We recommend the Department: ·         Improve its monitoring of Project Status Reports to ensure subrecipients submit the reports with each request for payment, as required by the terms and conditions of the subaward ·         Ensure it reviews Project Status Reports for each subrecipient to ensure the goals and objectives of the project are being met and that the subrecipient has complied with all program requirements Department’s Response The Department acknowledges the results of the Washington State Auditor’s Office’s audit of the fiscal year 2025 Coronavirus State and Local Fiscal Recovery Funds (SLFRF) audit of program monitoring. Out of the SLFRF funding the Department expended for fiscal year 2025, the audit included the following SLFRF programs: ·         Local Government Division - Infrastructure Programs ·         Local Government Division Washington State Broadband Office – Broadband Infrastructure Grants ·         Housing Division – Affordable Housing Transitional ·         Housing Division – Affordable Housing Connections The SLFRF program monitoring finding reported deficiencies for two of the Department’s programs which were included as part of the audit: Infrastructure Programs and the Broadband Infrastructure Grants.  Each program provided responses for the deficiencies reported as follows: ·      The Infrastructure Grants program agrees with the identified exceptions.  To ensure compliance with the SLFRF subrecipient contract Special Terms and Conditions, all active subrecipients will be required to submit a project status report with each reimbursement request before the program manager will review and approve each payment.  ·      The WSBO acknowledges the exceptions included missing project status reports for two projects A-19 submissions and recognize this as an opportunity for improvement.  The standard process requires project managers collect all documentation submitted with A-19s, verify that costs are allowable, and confirm receipt of all required materials.  While this internal control is in place, it has not been consistently applied.    To strengthen compliance, the office will implement an additional layer of review including that leadership will conduct checks on project managers A-19 acceptances on a quarterly basis.  As a result of the identified deficiencies reported, the office has provided refresher training to project managers to reinforce documentation requirements and ensure that missing information is requested prior to invoice approval.  Additionally, the office has contacted subgrantees to obtain copies of available missing reports.  Moving forward, we have communicated to subgrantees that A-19s will not be processed until all required documentation has been received and reviewed by our office. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, describes the requirements for all pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The Washington State Department of Commerce American Rescue Plan Act, State and Local Fiscal Recovery Funds Capital Agreement (July 2021), Special Terms and Conditions, states in part: 1.      Billing Procedures and Payment COMMERCE shall reimburse the GRANTEE for eligible Project expenditures, up to the maximum payable under this Grant Agreement. When requesting reimbursement for expenditures made, the GRANTEE shall submit to COMMERCE a signed and completed Invoice Voucher (Form A-19), that documents capitalized Project activity performed for the billing period. The GRANTEE can submit all Invoice Vouchers and any required documentation electronically through COMMERCE’s Grants Management System (CMS), which is available through the Secure Access Washington (SAW) portal. The invoices shall describe and document, to COMMERCE's satisfaction, a description of the work performed, the progress of the project, and fees. The invoice shall include the Grant Number listed on the contract Face Sheet. If expenses are invoiced, provide a detailed breakdown of each type. A receipt must accompany any single expenses in the amount of $50.00 or more in order to receive reimbursement. The voucher must be certified (signed) by an official of the GRANTEE with authority to bind the GRANTEE. The final voucher shall be submitted to COMMERCE within sixty (60) days following the completion of work or other termination of this Grant Agreement, or if work is not completed or Grant terminated, within fifteen (15) days following the end of the state biennium unless Grant Agreement funds are reappropriated by the Legislature in accordance with Additional Special Terms and Conditions set forth in the Declarations page above. Each request for payment must be accompanied by a Project Status Report, which describes, in narrative form, the progress made on the Project since the last invoice was submitted, as well as a report of Project status to date. COMMERCE will not release payment for any reimbursement request received unless and until the Project Status Report is received. After approving the Invoice Voucher and Project Status Report, COMMERCE shall promptly remit a warrant to the GRANTEE.

2025-020       The University of Washington did not have adequate internal controls to ensure it notified the Department of Education of changes in student enrollment information accurately and in a timely manner for the Federal Pell Grant and Direct Student Loan programs. Assistance Listing Number and Title: 84.063 Federal Pell Grant Program 84.268 Federal Direct Student Loans Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: Various Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – NSLDS Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No       Background Title IV of the Higher Education Act authorizes programs that provide financial assistance to students to pursue postsecondary education at eligible institutions of higher education. These programs are the largest source of federal aid to postsecondary students and are designed to increase access to and completion of higher education programs.  The Federal Pell Grant program provides grants to eligible students enrolled in undergraduate programs and certain post-baccalaureate teacher certificate programs as financial aid. The Direct Loan Program makes subsidized and unsubsidized loans to eligible students in certain eligible undergraduate, graduate or professional degree programs to pay for the cost of attending college. As a condition of participating in the Title IV programs, the University is required to submit data to the U.S. Department of Education (Department) on students listed on the National Student Loan Data System (NSLDS) roster. The administration of Title IV programs heavily depends on the accuracy and timeliness of student enrollment information reported in NSLDS. The Department uses NSLDS enrollment information to ensure student loan repayments occur on time after graduation and accurately measure attendance and graduation rates of students in eligible programs, as well as determine if loan deferments are being appropriately granted. When students receiving a grant or loan have attendance changes, the institution must review, update and certify the student’s enrollment status, program information and enrollment effective dates in NSLDS to reflect any changes to the student’s enrollment status. The University is required to notify the Department of a student’s enrollment change that includes graduating, withdrawing, dropping out, enrolling but never attending classes, or any other change in the student’s academic courseload that impacts their enrollment status of either full-time, three-quarter-time, half-time or less-than half-time. The NSLDS Enrollment Reporting Guide published by the Department outlines the requirements for institutions of higher education to report student information, and the Department considers the following information to be high risk: The institution’s Office of Postsecondary Education Identification number Classification of Instructional Programs code and year for the program of study Credential level (undergraduate certificate, associate’s, bachelor’s or master’s degree) Published program length and program length measurement The date the student began attending the reported program The student’s program enrollment status The student’s program enrollment effective date For the Direct Loan programs, institutions are required to report changes to the Department in the subsequent updated Enrollment Reporting Roster, which is due within 60 days of the student’s enrollment change. This reporting is required for any student receiving a loan who is no longer enrolled at the institution on at least a half-time basis or has changed their permanent address. In fiscal year 2025, the University disbursed more than $367 million in federal Pell grants and direct loans to students. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure it notified the Department of changes in student enrollment information accurately and in a timely manner for the Federal Pell Grant and Direct Student Loan programs. We used a statistical sampling methodology to randomly select and examine 59 out of a total population of 9,724 students for which the University was required to report a change in enrollment during the audit period. While we determined the University materially complied with the NSLDS reporting requirements, we found seven students for whom the University incorrectly reported enrollment changes to NSLDS or failed to report an enrollment change. Specifically: Five students had their enrollment status incorrectly reported in NSLDS as withdrawn, when the students had actually graduated from the University. Two additional students had withdrawn from the University, and these withdrawals were not reported in NSLDS. We also found one student communicated a change to their permanent address to the University, and this change was not reported in NSLDS by the University for six months. We consider these internal control deficiencies to be a significant deficiency. This issue was not reported as a finding in the prior audit. Cause of Condition University management did not adequately review NSLDS reports to ensure changes to student enrollment statuses were reported accurately. Additionally, the University did not have adequate internal controls to monitor the timely reporting of student information changes to ensure the changes were reported for Direct Loan recipients within 60 days, as required by the Department. Effect of Condition By not establishing adequate internal controls, the University cannot reasonably ensure that changes in student enrollments are reported accurately and timely to the Department, which is critically important for the Department to assess the performance of the Federal Pell Grant and Direct Loan programs. Recommendation We recommend the University improve its internal controls to ensure student enrollment changes are reported accurately and timely in NSLDS. University’s Response The University does have internal controls in place to ensure enrollment reporting to NSLDS. However, we acknowledge the incorrect or late reporting of the students identified during the audit.  Upon review of our internal controls, we identified a lapse in backup staffing coverage during a period of personnel transition, which negatively contributed to the accuracy, timeliness, and the audit of reporting during the audit period.  Staffing has now been returned to sufficient levels.  Additionally, source documentation for the transmitted enrollment data was no longer available for the audit period and therefore the source and cause of the errors could not be identified. Improve internal controls to ensure student enrollment changes are reported accurately and timely in NSLDS. The Office of the University Registrar (OUR) will review the current staffing model and ensure a strengthened internal control structure for NSLDS reporting, which includes multiple responsible staff members, designated backup personnel, and ongoing training of an additional third staff member to ensure consistent and accurate quarterly enrollment reporting moving forward. The OUR will review current audit reports and establish a recurring quarterly audit protocol to ensure NSLDS enrollment information is aligned with University records after submission of data by the National Student Clearinghouse (NSC). We are currently conducting a comprehensive review of all enrollment reporting for the audit period and will submit corrected records to NSLDS as required.  OUR, OSFA and UWIT will partner to establish protocols and best practices for the retention of source files.   Auditor’s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to establish, document, and maintain effective internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 34 CFR Part 685, William D. Ford Federal Direct Loan Program, section 309, Administrative and fiscal control and fund accounting requirements for schools participating in the Direct Loan Program, establishes fiscal and administrative procedures for the Direct Loan programs. Title 34 CFR Part 690, Federal Pell Grant Program, section 83, Submission of reports, describes the requirements for institutions to report information on federal Pell grant recipients.

2025-021       The Department of Health did not have adequate internal controls to ensure payments to subrecipients were allowable and met cost principles for the Epidemiology and Laboratory Capacity for Infectious Diseases and the Immunization Cooperative Agreements programs. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases  93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: Too numerous to list Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Findings 2024-037 and 2024-032       Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports several specific infectious disease programs and projects and provides special appropriations in response to infectious disease emergencies. For the ELC program, the Department spent more than $99 million in federal grant funds during fiscal year 2025, more than $20 million of which it disbursed to subrecipients. The Department of Health also administers the Immunization Cooperative Agreements (Immunization) program. The objective of the program is to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. The program places emphasis on populations at highest risk for under-immunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2025, the Department spent more than $40 million in federal program funds for the Immunization program, about $7.3 million of which it disbursed to subrecipients. The Department also received more than $114 million in noncash assistance from the federal grantor in the form of vaccines. To help carry out the programs’ objectives, the Department issues consolidated contracts to Local Health Jurisdictions (LHJs) that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. The Department awards federal funds to subrecipients on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low-, moderate- and high-risk subrecipients for each of the following expense categories: Salaries and benefits Equipment ($5,000 or more) Materials and supplies Meals Outreach materials Travel Training Contracts and sub-sub-subrecipients Administrative/indirect costs   During the audit period, LHJs submitted invoices to the Department’s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The emails were sent to Department program staff requesting review to ensure the payment was allowable. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Program staff documented their review and approval of the reimbursement request in a tracking workbook. The workbook was only used at the program level, so it was not shared with the fiscal staff to communicate approval before issuing payment. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls to ensure payments to subrecipients of the ELC and Immunization programs were allowable and met cost principles. The prior finding numbers were 2024-037, 2024-032, 2023-046, 2023-044, 2022-033, and 2022-031. Description of Condition The Department did not have adequate internal controls to ensure payments to subrecipients were allowable and met cost principles for the ELC and Immunization programs. Department program staff are required to use the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, and included required supporting documentation. However, program staff did not communicate their approval to the accounting unit that issues payments. As a result, the Department paid the LHJs without knowing whether program staff reviewed and approved these expenditures. We consider this internal control deficiency to be a material weakness. Cause of Condition The Department’s established procedures allowed for paying LHJs without ensuring program staff reviewed and determined the payment was allowable and adequately supported. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes. Recommendation We recommend the Department improve internal controls to ensure program staff review, approve and communicate approval of expenditures to those issuing payment to verify they are for allowable activities and costs before payment. Department’s Response The Department concurs that enhancements to documentation and communication between program and fiscal staff will further strengthen the clarity and consistency of the subrecipient reimbursement review and approval process for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) and Immunization programs. The Department is implementing procedural refinements to better evidence programmatic approval prior to payment.  Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 2, Definitions, includes the definition of improper payment. 45 CFR Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. 45 CFR Part 75, section 403, Factors Affecting Allowability of Costs. 45 CFR Part 75, section 410, Collection of Unallowable Costs. 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 7/1/2022 This is the backup documentation required based on the determined risk level. Please ensure the detailed GL expenditure report clearly aligns with the A19 form. More supporting documentation may be requested by programs at any time due to programmatic requirements regardless of risk category. Expenditure Category Salaries and Benefits Low-Risk A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ·Employee name ·Salaries & Wages Example: Salary Bob Smith $5,324.75 Ann Brown $1,245.52 Benefits $1,750.35 Note: Salaries and benefits must be broken out as separate line items. Moderate-Risk A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ·Employee name ·Salaries & Wages Example: Salary Bob Smith $5,324.75 Ann Brown $1,245.52 Benefits $1,750.35 Note: Salaries and benefits must be broken out as separate line items. High-Risk A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ·Employee name ·Salaries & Wages ·Hours worked   Example: Salary Bob Smith $5,324.75 (168 hrs.) Ann Brown $1,245.52 (34 hrs.) Benefits $1,750.35 Note: Salaries and benefits must be broken out as separate line items.   Expenditure Category Equipment ($5,000 or more) Low-Risk A-19 and a detailed GL expenditure report. Moderate-Risk A-19 and a detailed GL expenditure report with DOH preapproval. High-Risk A-19 and a detailed GL expenditure report with DOH preapproval and copy of the invoice. Expenditure Category Materials and Supplies Low-Risk A-19 and a detailed GL expenditure report Moderate-Risk A-19 and a detailed GL expenditure report. Copies of invoices for transactions over $2,500. Note: If the subrecipient has a petty cash fund, they must supply 100% of the supporting documentation. High-Risk A-19 and a detailed GL expenditure report. Copies of invoices for transactions over $1,000. Note: If the subrecipient has a petty cash fund, they must supply 100% of the supporting documentation. Expenditure Category Outreach Materials All outreach materials must be allowable according to grant terms and conditions. Low-Risk A-19 and a detailed GL expenditure report. Moderate-Risk A-19 and a detailed GL expenditure report. Pre-approval required for all outreach materials in excess of $2,500. High-Risk A-19 and a detailed GL expenditure report. Pre-approval required for all outreach materials in excess of $1,000: AND ·Sample of Outreach materials Expenditure Category Meals Low-Risk A-19 and a detailed GL expenditure report and receipt. Moderate-Risk A-19 and a detailed GL expenditure report with receipt and number of participants or meeting invite. High-Risk A-19 and a detailed GL expenditure report with receipt, number of participants and sign in roster. Expenditure Category Travel Low-Risk A-19 and a detailed GL expenditure report. Moderate-Risk A-19 and a detailed GL expenditure report and purpose of travel. High-Risk A-19 and a detailed GL expenditure report and purpose of travel: AND ·Pre-approval for out of state travel. Expenditure Category Training Low-Risk A-19 and a detailed GL expenditure report. Moderate-Risk A-19 and a detailed GL expenditure report and receipt for training. High-Risk A-19 and a detailed GL expenditure report and receipt for training: AND ·Agenda Expenditure Category Contracts (If the DOH subrecipient is contracting out with an agency to perform work charged to the grant) Low-Risk A-19 and a detailed GL expenditure report. Moderate-Risk A-19 and a detailed GL expenditure report that provides: AND ·Invoices for individual transactions over $5,000. High-Risk A-19 and a detailed GL expenditure report that provides: AND ·Invoices for individual transactions over $1,000. Expenditure Category Sub-Sub recipients (If the DOH subrecipient is passing funds through to another agency as a subrecipient) Low-Risk A-19 and a detailed GL expenditure report. Moderate-Risk A-19 and a detailed GL expenditure report. ·A copy of all invoices over $5,000 with a detailed GL report. High-Risk A-19 and a detailed GL expenditure report. ·A copy of all invoices over $1,000 with a detailed GL report.           NOTE: Indirect costs included on A19s must include verification of the following: Indirect plan is current and on file with DOH Indirect rate is being applied accurately to allowable expenditures If the indirect cost rate plan has expired, no indirect costs can be charged If the subrecipient is using 10% de minimis they must complete DOH de minimis certification

2025-022    The Department of Health did not have adequate internal controls over and did not comply with reporting requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases and the Immunization Cooperative Agreements programs. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases  93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: Too numerous to list Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding:  Yes, Finding 2024-033   Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports several specific infectious disease programs and projects and provides special appropriations in response to infectious disease emergencies. For the ELC program, the Department spent more than $99 million in federal grant funds during fiscal year 2025. The Department of Health also administers the Immunization Cooperative Agreements (Immunization) program. The objective of the program is to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. The program places emphasis on populations at highest risk for under-immunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2025, the Department spent more than $40 million in federal program funds for the Immunization program and received more than $114 million in noncash assistance from the federal grantor in the form of vaccines. For each open grant the Department is required to submit an annual SF-425 Federal Financial Report (SF-425) to the federal grantor to report the financial status of the award. These reports summarize key financial information including revenue, unobligated balances, and direct and indirect expenditures, and is intended to reflect the recipient’s actual financial position as of the reporting date. The Department maintains the Grant Management System (GMS) that it uses to calculate cash draw amounts and pull financial data needed to complete the SF-425 reports. The Department also uses the Cost Allocation System (CAS) to calculate indirect costs associated with expenditures. The Department uses these systems as agency-wide tools to manage all its federal grants. Daily, federal grant revenue and expenditures are automatically uploaded from the Department’s accounting system into its AFRS Data Distribution Services (ADDS) database. Department staff can pull data from ADDS by running queries in GMS and CAS. The Department also maintains a chart of accounts system that feeds coding information into GMS and CAS to instruct these systems how to allocate grant expenditures. Department staff generate a report from GMS that provides the necessary information to complete a SF-425 report. Certain portions of the SF-425 are prepopulated or supported by information already captured within federal or agency financial systems, grantees remain responsible for ensuring the report is complete, accurate and based on current accounting records. Federal grantors use the SF-425 to monitor award activity, assess remaining funding availability and evaluate compliance with financial reporting requirements. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.   In prior audits, we reported the Department did not have adequate internal controls over reporting for the Immunization program. The prior finding number was 2024-033. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements for the ELC and Immunization programs. Since the Department’s internal controls reviewed are a centralized process, our testing included all its federal programs we reviewed for reporting requirements for this audit.  GMS Automated Control The Department’s preparation of the SF-425 reports relied on data compiled through the GMS, which automatically aggregates expenditures and revenues using information transferred from AFRS and indirect costs calculated through the CAS. As described in a separate audit finding related to cash management, we identified a significant deficiency in controls over the accuracy and review of data used by GMS, including weaknesses related to chart of accounts coding and indirect cost calculations. These control deficiencies affected the reliability of information used to prepare the SF-425 reports. See finding 2025-007 for additional details. SF-425 Reports We used a nonstatistical sampling method to randomly select and examine 13 out of a total population of 43 SF-425 reports submitted for the ELC and Immunization programs during state fiscal year 2025. We reviewed the reports and found five (38%) in which the Department did not accurately report unobligated balances. Instead of reporting currently obligated and unobligated totals, the Department reported the awards as fully obligated. We consider these internal control deficiencies to be material weaknesses, which led to material noncompliance. These issues are also noted in finding 2025–006.   Cause of Condition The Department did not have adequate internal controls in place to ensure the data used to complete reports was accurate and complete. The Department also did not have adequate controls in place to detect coding errors that would result in it using incorrect data for reports. Coding errors in the chart of accounts resulted in the Department reporting inaccurate amounts for the grant. Staff also inappropriately reported unobligated federal funds as obligated on the reports. Effect of Condition Not implementing adequate internal controls led to the Department reporting inaccurate amounts on the SF-425 for federal grants. Without accurately reporting unobligated balances on the SF-425, the Department’s financial reporting did not reflect the current award status for the ELC program. This misreporting could mislead the federal grantor regarding the Department’s actual use of funds. Without an accurate SF-425, the federal grantor is unable to make informed decisions regarding the grant. This condition limited the ability to rely on interim financial reporting as a monitoring tool and increased the risk that federal oversight and decisions were made based on incomplete or inaccurate information. Recommendation We recommend the Department: Implement adequate internal controls to ensure data used for the SF-425 is complete and accurate Follow federal guidance when completing SF-425 reports to ensure it fills out reports correctly Department’s Response The Department acknowledges the need to strengthen internal controls over financial reporting for the Epidemiology and Laboratory Capacity (ELC) and Immunization Cooperative Agreements programs. The Department recognizes the importance of maintaining effective internal controls over the systems and processes used to prepare SF-425 Federal Financial Reports, including data inputs, coding structures, indirect cost allocations, and review procedures. While processes were in place to support reporting, the Department has identified opportunities to enhance oversight, validation, and documentation to ensure continued compliance with federal reporting requirements. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.  Title 45 Part 75 section 341, Financial reporting, states: Unless otherwise approved by OMB, the HHS awarding agency may solicit only the standard, OMB-approved government-wide data elements for collection of financial information (at time of publication the Federal Financial Report or such future collections as may be approved by OMB and listed on the OMB Web site). This information must be collected with the frequency required by the terms and conditions of the Federal award, but no less frequently than annually nor more frequently than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes, and preferably in coordination with performance reporting. Title 45 Part 75 section 516, Audit findings, establishes reporting requirements for audit findings. CDC General Terms and Conditions for Research Grant and Cooperative Agreements, states in part:  Annual Federal Financial Report (FFR, SF-425): The Annual Federal Financial Report (FFR) SF- 425 is required and must be submitted no later than 90 days after the end of the budget period in the Payment Management System. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-023       The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure subrecipients of the Epidemiology and Laboratory Capacity for Infectious Diseases program received required single audits, and that it appropriately followed up on findings and issued management decisions.​​ Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases  93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: Too numerous to list Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-041       Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports many specific infectious disease programs and projects, and it provides special appropriations in response to infectious disease emergencies. The Department spent more than $99 million in federal grant funds during fiscal year 2025, more than $20 million of which it disbursed to subrecipients.  Federal regulations require the Department to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes to subrecipients, the Department must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a Department-funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the Federal Audit Clearinghouse. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. To monitor its compliance with these requirements, the Department uses an Excel spreadsheet to track subrecipients’ single audits. Federal regulations also require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure subrecipients of the ELC program received required single audits and appropriately followed up on findings and issued management decisions. The prior finding numbers were 2024-041 and 2023-049. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure its subrecipients of the ELC program received required single audits, and that it appropriately followed up on findings and issued management decisions. The Department did not have written policies or procedures over its process for tracking subrecipients’ single audits. To monitor compliance with these requirements, the Department used an Excel spreadsheet to track subrecipients’ single audits and the agency’s follow-up actions, if necessary. However, after examining the spreadsheet, we found seven subrecipients that required audit tracking were missing. We reviewed the federal audit clearinghouse and found the following information for the subrecipients that were not tracked by the Department:   One subrecipient had no audit submitted. Two subrecipients had completed single audits after the required deadline. Four subrecipients had completed single audits before the deadline.   During fiscal year 2025, one subrecipient received an ELC finding, which the Department documented in the tracking spreadsheet. However, the spreadsheet did not document any follow-up with the subrecipient or review of a corrective action plan. In addition, the Department did not issue a management decision letter for the finding, and the tracking spreadsheet did not document any management decision. We consider these internal control deficiencies to be material weaknesses, which led to material noncompliance. Cause of Condition There were no written procedures for the single audit tracking process. Management said they were working to define the process and training staff around the monitoring requirements. In addition, management did not exercise sufficient oversight to ensure staff completed the monitoring. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure all subrecipients requiring a single audit obtain one, and that subrecipients with audit findings receive required management decisions timely. Recommendation We recommend the Department strengthen internal controls to ensure: It verifies all subrecipients receive a single audit, if required It issues all required management decisions to subrecipients within six months, for applicable audit findings pertaining to the federal award Subrecipients take timely and appropriate action on all deficiencies pertaining to the federal award Department’s Response The Department agrees that opportunities exist to further formalize documentation and enhance consistency in tracking subrecipients’ single audits and related follow-up activities for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. Accordingly, the Department is taking steps to strengthen written procedures, documentation standards, and supervisory review. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, states, in part: All pass-through entities must: d.Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by section 75.521. f.Verify that every subrecipient is audited as required by subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in section 75.501. h.Consider taking enforcement action against noncompliant subrecipients as described in section 75.371 and in program regulations. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-024    The Department of Health did not have adequate internal controls over and did not comply with fiscal monitoring requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases  93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: Too numerous to list Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-040     Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports many specific infectious disease programs and projects, and it provides special appropriations in response to infectious disease emergencies. The Department spent more than $99 million in federal grant funds during fiscal year 2025, more than $20 million of which it disbursed to subrecipients. Federal regulations require the Department to monitor the activities of subrecipients to ensure they use subawards for authorized purposes and in compliance with federal statutes, regulations, and the terms and conditions of the subaward. This monitoring must include reviewing financial reports and taking timely and appropriate action on all deficiencies pertaining to the federal award. The Department assigns each subrecipient a compliance risk level based on standardized criteria. Subrecipients are monitored using a risk-based approach, with high-risk subrecipients being monitored more frequently. This process varies slightly for Local Health Jurisdictions (LHJ). LHJs are subrecipients that are contracted to provide a range of health services. Unlike other contracted subrecipients, LHJs receive fiscal monitoring every two calendar years. Management ensures on-site fiscal reviews are completed timely by maintaining a schedule that includes all subrecipients, their date of prior review, and risk level. This schedule is updated bimonthly to ensure completed on-site reviews are documented and any new subrecipients are included in the schedule. The Department’s Fiscal Monitoring Unit (FMU) conducts on-site fiscal reviews of all subrecipients, including LHJs. Reviewers complete a standardized template to document their work. Using the subrecipient’s reimbursement requests, reviewers judgmentally determine how many samples of payroll and other expenditures to review to ensure there is adequate supporting documentation. Reviewers also look at internal controls over processes and examine specific award and contract requirements to ensure the subrecipient was in compliance with these requirements. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with fiscal monitoring requirements for the ELC program. The prior finding numbers were 2024-040, 2023-050 and 2022-033. Description of Condition The Department did not have adequate internal controls over and did not comply with fiscal monitoring requirements for the ELC program. We requested a list of all subrecipients for the state fiscal year 2025 period and the Department provided a monitoring schedule. During the audit we identified 27 subrecipients with consolidated contracts and 10 subrecipients with non-consolidated contracts for a total of 37 subrecipients that received ELC funding during fiscal year 2025. After reviewing the Department’s monitoring schedule, we noted the following: The monitoring schedule was not updated for the audit period until three months after the start of the fiscal year. The schedule was not updated on a bi-monthly basis, as originally indicated by staff. The schedule was initially missing eight ELC subrecipients. These subrecipients were added to the spreadsheet by the end of the fiscal year. The ELC program was not listed as a program to review for most of the ELC subrecipients listed in the schedule. We also determined that the Department did not complete fiscal reviews for all of the ELC subrecipients on the schedule. The Department should have completed fiscal monitoring for ten LHJs and seven non-LHJ ELC program subrecipients listed in the spreadsheet during the audit period. However, only nine LHJs and six non-LHJ subrecipients received fiscal monitoring. Two subrecipients (11.7%) did not receive fiscal monitoring during the fiscal year. We consider these internal control deficiencies to be material weaknesses, which led to material noncompliance. Cause of Condition Management did not implement sufficient internal controls to ensure that subrecipients were properly identified and monitored. In addition, the Department performs centralized monitoring and decided not to include all programs in their monitoring visits. However, management felt it was sufficient to meet federal monitoring requirements even though federal law requires monitoring specific to each federal program. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are spending federal funds in accordance with grant requirements. Without adequately monitoring each subrecipient’s use of federal funds expended during the period of performance of the subaward, the Department does not have reasonable assurance that the subrecipient has complied with the terms and conditions of the subaward. Recommendations We recommend that the Department: Identify and track all subrecipients Strengthen internal controls to ensure that fiscal monitoring is completed timely for all subrecipients Department’s Response The Department respectfully disagrees with the conclusion that it lacked adequate internal controls or failed to comply with fiscal monitoring requirements for the ELC program and further disagrees with the characterization of these matters as material weaknesses resulting in material noncompliance. The Department has established a centralized Fiscal Monitoring Unit, a documented risk-based monitoring framework, standardized review tools, and procedures designed to comply with federal requirements. These controls were in place and operating during the audit period. At no time during the audit period were subrecipients operating without oversight, nor was there any identified misuse of funds, questioned costs, or programmatic noncompliance resulting from the issues described. The matters noted relate primarily to administrative tracking documentation and internal scheduling practices rather than a breakdown of fiscal monitoring controls. Monitoring Schedule Updates While the audited monitoring schedule was formally updated three months into the fiscal year, monitoring activities were ongoing during that period. The schedule is also not created and maintained on a fiscal year cycle. The timing of updating the centralized tracking document did not delay or prevent required oversight procedures. The schedule serves as an administrative control and is only one piece of control structure. The control activity is the performance of monitoring procedures, which continued throughout the fiscal year. Similarly, although the schedule was not updated on a strictly bi-monthly basis as initially described by staff, the manager did review executed contracts monthly and only updated the spreadsheet when additional contracts were identified.  There is no regulatory requirement mandating a specific update frequency for internal tracking tools. Variances in update cadence did not result in missed monitoring requirements. Subrecipients Initially Missing from the Schedule The eight subrecipients initially omitted from the spreadsheet were subsequently incorporated during the fiscal year. The processes utilized by the department are to update the subrecipients included on the spreadsheet when new contracts are executed. These entities were not excluded from oversight; rather, the centralized tracking document was updated when contracts were executed. Program Identification Within the Schedule The absence of explicit “ELC” program labeling within certain monitoring schedule fields does not indicate that the ELC program was not reviewed. When staff are assigned a monitoring visit, they are required to incorporate all active contracts into the review. Monitoring procedures are performed based on funding sources and risk assessments tied to all underlying contracts, including consolidated agreements. The documentation format of the spreadsheet does not negate the execution of a compete fiscal review Fiscal Monitoring Completion Rate The audit notes that two of seventeen required subrecipients (11.7%) did not receive fiscal monitoring within the fiscal year. While the Department acknowledges that one LHJ and one non-LHJ subrecipient were not monitored within the originally projected fiscal year timeframe, this represents a timing issue rather than a systemic control failure. Monitoring for these entities was addressed through alternative oversight mechanisms and/or scheduled in the subsequent monitoring cycle based on risk assessment and available resources. Neither subrecipient was missed, instead there were strategic discussions and considerations when assigning the reviews. Importantly: The majority (88.3%) of required subrecipients received fiscal monitoring during the audit period. There were no findings of questioned costs, fraud, waste, abuse, or improper expenditures associated with the two entities. There is no evidence demonstrating that the delay resulted in material noncompliance with federal requirements. Material Weakness Determination A material weakness requires a reasonable possibility that a material misstatement or material noncompliance would not be prevented or detected in a timely manner. The conditions described do not meet that threshold. Oversight mechanisms were functioning, subrecipients were subject to monitoring procedures, and no material compliance issues were identified as a result of the administrative deficiencies noted. The Department therefore maintains that: ·         The issues cited represent documentation and process standardization improvements. ·         Internal controls over fiscal monitoring were operational and effective. ·         The condition does not rise to the level of material weakness; and ·         The evidence does not support a conclusion of material noncompliance. Commitment to Process Enhancements Notwithstanding this disagreement, the Department recognizes opportunities to strengthen documentation controls and tracking standardization. Auditor’s Remarks The key control provided by the Department to ensure material compliance with this requirement was the use of its monitoring tracking workbook. This document should include the monitoring efforts for all subrecipients; however, it was incomplete and missing subrecipients for much of the audit period. These subrecipient contracts were not executed during the audit period but were in place before it began. Monitoring should have been documented for them for the entire period. Monitoring was not completed bi-monthly as indicated by staff, and written policies and procedures for how often tracking should be updated do not exist. While there is not a mandatory frequency at which subrecipients must be monitored, nor is there a requirement for how often tracking must be updated, the Department must comply with its own policies and procedures governing subrecipient monitoring. Additionally, the Department cannot rely on the monitoring efforts of other agencies to meet its monitoring obligations to subrecipients. In our judgment, these conditions resulted in a material weakness which led to noncompliance. We reaffirm our finding and appreciate the Department’s commitment to strengthening its documentation and tracking. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes requirements for pass-through entities.   Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings.   The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-025   The Department of Children, Youth, and Families did not have adequate internal controls to ensure payments to child care providers paid with Temporary Assistance for Needy Families funds were allowable and properly supported. Assistance Listing Number and Title: 93.558 Temporary Assistance for Needy Families Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2401WATANF; 2501WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $2,296 Prior Year Audit Finding: Yes, Finding 2024-042       Background The Department of Social and Health Services (DSHS), Community Services Division, administers the Temporary Assistance for Needy Families (TANF) grant that provides temporary cash assistance for families in need. To receive TANF benefits, participants must be engaged in activities listed in the Individual Responsibility Plan through the WorkFirst program, unless the TANF benefits are received only on behalf of a child. TANF grant funds are also used to pay clients’ child care costs to meet one of the program’s primary purposes of helping clients obtain employment. Washington has established the Working Connections Child Care (WCCC) program to help eligible working families pay for child care. The Department of Children, Youth, and Families (the Department) administers the program. The Department is responsible for establishing policies and procedures for licensing child care providers and paying them for allowable child care services. DSHS reimburses the Department for child care services it provides to TANF eligible clients under an agreement between the two agencies. In fiscal year 2025, DSHS paid $67,701,321 in TANF funds for child care services. There are three types of child care providers: licensed centers, licensed family homes, and licensed exempt providers referred to as Family, Friends, and Neighbor (FFN) providers. The Department uses the Social Service Payment System (SSPS) to process the payments it makes to child care providers. The system allocates payments to various funding sources based on the client’s eligibility. These funding sources include multiple federal programs, multiple CCDF federal grant awards, and state funding. The Department uploads the SSPS payment data into the state’s accounting system at a summary level based on the various funding sources. DSHS worked with the Department to set up coding in the Payment Allocating Model system that looks at the client-level information and then assigns the correct TANF source of funds. Once the source of funds is identified, that information is sent to SSPS for allocation assignment. The Department prepares electronic reports that include details to ensure proper support for funds allocated to TANF funding sources and sends DSHS a monthly bill. There is always a need to transfer the funding sources for some payments throughout the year to manage federal and state funding properly. Both the CCDF and TANF block grants fund some payments the Department makes for child care. While the two federal programs are separate, the requirements and policies for child care payments in Washington are consolidated under the WCCC program. Federal regulations require grant fund expenditures to be adequately supported to show that they have been used in accordance with program requirements.  Authorizations for child care To be authorized for child care services, parents must be determined to be eligible based on their income, residency and demonstrated need based on approved activities. Once parents are determined to be eligible, the Department authorizes the amount of care based on the hours a parent participates in approved activities. For licensed centers, the service levels are generally either 23 full-day units (up to 10 hours a day) or 30 half-day units (up to five hours a day), or 46 half-day units during the months of June, July and August, when authorizing care for households with more than 110 hours of activity. Care is authorized based on need when approvable activities are less than 110 hours. When more than 10 hours a day of care is needed, the Department may authorize additional care for overtime. For licensed family homes, providers are authorized monthly units of care either as full-time, part-time, full-time partial-day, or part-time partial-day. FFN providers are paid by the hour, and authorizations are made for either part-time care (up to 110 hours a month) or full-time care (up to 230 hours a month). When more than 10 hours a day of care is needed, the Department may authorize additional care for overtime.   Attendance records Child care providers must maintain attendance records to support their billing. All child care providers must use the Department’s electronic attendance recordkeeping system, a Department-approved electronic attendance recordkeeping system or receive an exception to rule to allow for paper attendance records. The attendance record requirement is the same for all providers. How the provider claims for payment varies depending on the provider type: Licensed center providers claim eligible units per month. Licensed family home providers claim eligible monthly unit(s). FFN providers claim eligible hours per month. To ensure payments are allowable and accurate, the Department conducts data analysis and audits payments. The Department’s subsidy audit unit, which is composed of six provider auditors, reviews payments each month using both random sections and focused referrals. The subsidy audit unit receives focused referrals from other divisions and programs within the Department. Department staff prepare audit request letters and mail them to providers who have 45 days to respond with records. The provider auditors review the records to determine whether the payments are properly supported. Federal regulations require the state to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with TANF funds were allowable and properly supported. The prior finding numbers were 2024-042, 2023-051, 2022-035 and 2021-028.  Description of Condition The Department did not have adequate internal controls to ensure payments to child care providers paid with TANF funds were allowable and properly supported. We used a statistical sampling method to randomly select and examine 59 out of a total population of 397,102 monthly payments for child care. Our sample included child care payments from each of the three provider types: licensed centers, licensed family homes and FFNs. With assistance from the Department, we requested attendance records, provider handbooks and other required receipts from providers that supported the payments. We reviewed each provider’s records to determine if the payments were allowed by federal and state regulations, Department policies and supported by adequate documentation.  We found three payments funded by the TANF grant that were noncompliant. The Department improperly paid $2,296 in federal TANF funds to these three providers. The reasons the overpayments occurred were: Two providers did not submit attendance records in response to our request One provider overbilled for services  not supported by attendance records While the Department has written procedures over its post-payment audit process, the procedures need improvement. The Department has a Child Care Subsidy Programs Integrity Plan that was most recently updated in February 2024. In the plan, the Department stated the frequency of billing and attendance audits is 240 per month. Program staff said that their goal was to complete these audits within four to six months after the month of service. We reviewed the results of the Department audits that occurred during the audit period which were: The Department completed 2,228 audits during the year. The Department’s post-payment audits were not timely. Most of the audits took place between six months and a year after the month of service. For four months of the year, the Department reviewed about 100 audits per month instead of 240 in its plan. The Department identified overpayments in 1,493 of the 2,228 (67%) post-payment audits it completed during the year. In total, the Department itself identified $2,185,753 in provider overpayments, or 22% of the payments it audited. The Department said these overpayments were submitted to the Department of Social and Health Services, Office of Financial Recovery (OFR), for collections. Providers are allowed due process via administrative hearing following this formal notification.   The Department also has a written Quality Control Provider Audit Procedure. This procedure states that six audit staff are to select both random and focused, or risk-based providers to audit. However, the procedures do not describe the specific methods or factors used by staff to make these selections.     We consider these internal control deficiencies to be a significant deficiency, which did not lead to material noncompliance. Cause of Condition The Department does not review supporting documentation to verify a payment request is allowable and supported before payment. Payment authorizations establish a maximum for what providers may bill without further approval, but this does not prevent providers from billing for unallowable days, hours or services. The Department said adequate resources are not available to review documentation before payments are made. Until SSPS is connected to attendance reporting systems, providers must maintain attendance records and submit supporting documentation when it is requested. The Department’s post-payment audits consistently identify provider overpayments, which is a detective control. However, management has not implemented internal controls that sufficiently prevent overpayments. The Department said the reason only 100 audits were performed for four months of the year was due to a lack of staffing resources.   Effect of Condition and Questioned Costs By not having adequate internal controls in place, the Department increases its risk of making improper payments for child care services.  We used a statistical sampling method to randomly select the payments examined in the audit. Based on the results of our testing, we estimate the total likely questioned costs paid with federal TANF funds to be $9,878,930.   Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95% confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely questioned cost projections are a point estimate and only represent our “best estimate of total questioned costs” as required by 2 CFR 200.516(a)(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department strengthen its internal controls over payments it makes to child care providers. Specifically, the Department should: Update its written procedures to better describe its post-payment audit process. This should include a description of how staff select random and focused providers to audit. Provide additional resources to fully execute its Child Care Subsidy Program Integrity Plan. Based on its own audits and the results of our statistical sampling in this audit, the Department should consider expanding its audit effort until it is able to implement pre-payment controls. Link its payment and attendance reporting systems to prevent making payments that lack required supporting documentation.   The Department should also:   ·         Follow up with the providers that did not respond to requests for records during this audit. ·         Consult with the grantor to discuss whether the known questioned costs identified in this audit should be repaid. Department’s Response The Department agrees with the three exceptions identified by the State Auditor’s Office (SAO) as part of their testing of attendance records and documentation from providers. In February 2026, overpayments were written for the exceptions identified by SAO and submitted for recovery to the Department of Social and Health Services, Office of Financial Recovery (OFR).   The Department requires additional funding to increase the number of monthly provider audits completed, or to fund an information technology solution and system linkage between the payment and all of the electronic attendance systems used by providers. Even with data system connections the Department will need significant resources to increase the number of payments reviewed. The Department’s current oversight is limited to the audit capacity of its six quality-assurance (QA) auditors for approximately 397,102 monthly child care payments as noted by SAO.   The Department employs automated system controls in the Social Services Payments System (SSPS) to limit provider authorizations to the maximum amount of care a child is eligible to receive and claim.  The detective internal controls, post-payment audits, implemented by the Department are designed to detect errors and assure prompt correction of these errors.  The QA auditors are identifying billing and electronic attendance system errors, identifying program weaknesses to be proactive to prevent future errors, analyzing data to update provider training materials and policies/procedures, and providing technical assistance to providers to reduce billing errors. Providers have reported appreciation of direct communication with the QA auditors through the technical assistance process.   Quality-Assurance Audits SAO Description of Condition: The Department’s post-payment audits were not timely. Most of the audits took place between six months and a year after the month of service. oDepartment Response: The Child Care Subsidy Programs Integrity Plan was updated 7/1/2025 but was not considered for this audit because it was outside the audit period being tested by SAO. oDepartment Response: Child care providers are allowed to claim for payments up to 3 months following the month of service.  In addition, a provider has 45 days to provide records to the Department for the month of service being requested.  Based on these legal requirements the Department has revised the Child Care Subsidy Programs Integrity Plan to reflect a more accurate goal of 6-12 months for audit completion. SAO Description of Condition: For four months of the year, the Department reviewed about 100 audits per month instead of 240 in its plan.  oDepartment Response: During the time period outlined above the Department had one vacant position. The remaining five QA auditors processed and completed 100 monthly audits.  In addition to reviewing documents for compliance, the QA auditors also work with providers daily to provide technical assistance by reviewing billing rules to help the providers comply with Department billing policies. These activities are focused on educating providers about child care subsidy rules to assist with reduction of billing errors in the future. oDepartment Response: As noted above, the Department requires additional funding to increase the number of monthly provider audits completed, or to fund an information technology solution and system linkage between the payment and all of the electronic attendance systems used by providers SAO Description of Condition: The Department identified overpayments in 1,493 of the 2,228 (67%) post-payment audits it completed during the year. oDepartment Response: Billing errors identified during the QA audit period included not providing attendance records, missing signatures, general billing mistakes, and incorrectly using an electronic attendance system.  As part of the administrative hearings process, a provider may request a hearing from Department of Social and Health Services (DSHS).  At these hearings the providers may submit attendance records or receipts that were not previously provided to the Department and have the overpayments reduced or removed completely.  oDepartment Response: Since 2018, the Department has supplemented random audits with focused audits. The Department is in process of increasing monthly focused audits received from referrals or providers identified with an Intentional Program Violation (IPV).  The remaining audit capacity incorporates random audits to meet the monthly target and ensure unbiased program oversight.    SAO Description of Condition: In total, the Department itself identified $2,185,753 in provider overpayments, or 22% of the payments it audited.  oDepartment Response: When overpayments are identified the Department writes an overpayment letter and provides it to the DSHS Office of Financial Recovery (OFR). OFR then sends the letter to the provider for recovery. Providers are allowed due process via administrative hearing following this formal notification. oDepartment Response: In fiscal year 2025, OFR recovered provider overpayments in the amount of $2,426,515.27. This amount may be inclusive of overpayments from previous fiscal years.   As to the auditor’s specific recommendations, the Department provides the following additional information: SAO Recommendation: Update its written procedures to better describe its post-payment audit process. This should include a description of how staff select random and risk-based providers to audit. o   Department Response: The Department is in the process of updating and improving quality assurance audit procedures. The current procedures provide an outline and high-level overview while the specific details are completed by the quality control specialists and their supervisor. The procedures state that the six QA auditors are assigned both random and focused providers to audit. Random audits are determined by the use of a random number generator. QA auditors also perform focused audits based on referrals from licensing, OFR, or program staff. However, the procedures do not describe the specific methods or factors used by the Department to make the selections. The updated procedures will provide detail on how cases are selected and assigned for the monthly audit totals. This update is in addition to the Child Care Subsidy Programs Integrity Plan which outlines the program integrity efforts. SAO Recommendation: Provide additional resources to fully execute its Child Care Subsidy Program Integrity Plan. Based on its own audits and the results of our statistical sampling in this audit, the Department should consider expanding its audit effort until it is able to implement pre-payment controls. o   Department Response:The Department agrees this would increase provider payment integrity. The Department will need investment to increase the number of staff who audit provider payments or significant investment in an information technology platform that allows a pre-payment review of all payments. The Department also recognizes that electronic attendance systems require manual input for tracking and is not a preventative internal control by itself.             SAO Recommendation: Link its payment and attendance reporting systems to prevent making payments that lack required supporting documentation. o   Department Response:The Department agrees this would increase provider payment integrity. The Department will need investment to increase the number of staff who audit provider payments or significant investment in an information technology platform that allows a pre-payment review of all payments. The Department also recognizes that electronic attendance systems require manual input for tracking and is not a preventative internal control by itself. ·         SAO Recommendation: Follow up with the providers that did not respond to requests for records during this audit. o   Department Response:In February 2026, the Department processed overpayments for the exceptions identified by SAO and submitted the overpayments to DSHS OFR for recovery. ·         SAO Recommendation: Consult with the grantor to discuss whether the known questioned costs identified in this audit should be repaid. o   Department Response:When the Department of Health and Human Services (HHS) issues a management decision letter for the fiscal year 2025 finding, the Department will work with HHS and follow the audit resolution process. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. 45 CFR Part 75, section 403, Factors affecting allowability of costs, establishes requirements for the collection of unallowable costs. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington Administrative Code (WAC) 110-15-0034 Providers Responsibilities. Child care providers who accept child care subsidies must do the following: 1.      Licensed or certified child care providers who accept child care subsidies must comply with all child care licensing or certification requirements contained in this chapter, chapter 43.216 RCW and chapters 110-06, 110-300, 110-300D, 110-300E, and 110-301 WAC. 2.      In-home/relative child care providers must comply with the requirements contained in this chapter, chapter 43.216 RCW, and chapters 110-06 and 110-16 WAC. 3.      In-home/relative child care providers must not submit an invoice for more than six children for the same hours of care. 4.      All child care providers must use DCYF's electronic attendance recordkeeping system or a DCYF-approved electronic attendance recordkeeping system as required by WAC 110-15-0126. Providers must limit attendance system access to authorized individuals and for authorized purposes, and maintain physical and environmental security controls. a.       Providers using DCYF’s electronic recordkeeping system must submit monthly attendance records prior to claiming payment. Providers using a DCYF-approved electronic recordkeeping system must finalize attendance records prior to claiming payment b.      Providers must not edit attendance records after making a claim for payment 5.      All child care providers must complete and maintain accurate daily attendance records. If requested by DCYF or the state auditor, the provider must provide to the requesting agency the following records: a.       Attendance records must be provided to DCYF within 45 calendar days of the date of a written request from either department; and b.      Attendance records must be provided to the state auditor’s office within 30 calendar days from the date of a written request 6.      Pursuant to WAC 110-15-0268, the attendance records delivered to DCYF may be used to determine whether a provider overpayment has been made and may result in the establishment of an overpayment and in an immediate suspension of the provider's subsidy payment. 7.      All child care providers must maintain and provide receipts for billed field trip/quality enhancement fees as follows. If requested by DCYF, the provider must provide the following receipts for billed field trip/quality enhancement fees: a.       Receipts from the previous 12 months must be available immediately for review upon request by DCYF; b.      Receipts for one to five years old must be provided within 28 days of the date of a written request from either department. 8.      All child care providers must: a.       Retain all records required by this chapter for a minimum of five years b.      Provide to the department records from the previous 12 months immediately upon the department’s written request c.       Provide to the department any records between 12 months and five years old within two weeks of the department’s written request 9.      All child care providers must collect copayments directly from the consumer or the consumer’s third-party payor, and report to DCYF if the consumer has not paid a copayment to the provider within the previous 60 days 10.  All child care providers must follow the billing procedures required by DCYF Washington Administrative Code (WAC) 110-15-0190 WCCC benefit Calculations 1.      DCYF determines the amount of care consumers may receive at application or reapplication. Once the care is authorized, the amount will not be reduced during the eligibility period unless a.       Consumers request reductions; b.      The care is for school-aged children c.       The authorization was for additional care needed for less than the entire length of the authorization period d.      The care was authorized by child protective services (CPS) or child welfare services (CWS) and is part of children’s case plans under WAC 110-15-4510 e.       Incorrect information was given at application or reapplication 2.      For parents age 21 years or younger who are attending high school or working towards completing a high school equivalency certificate, DCYF will authorize care based only on their student activity schedules. 3.      To determine the amount of weekly hours of care needed, DCYF reviews the child care scheduled with providers, and: a.       Consumers’ participation in approved activities and the number of hours their children attend school, including home school, which will reduce the amount of care needed; or b.      The days and times that approved activities overlap in a two parent or guardian household, and only authorize care during those overlapping times. Consumers are eligible for full-time care if overlapping care totals 110 hours in one month c.       Parents or guardians in two parent or guardian households who are not able to care for their children under WAC 110-15-0020 are considered by DCYF to be unavailable for care, regardless of their schedules 4.      Licensed or certified center child care is authorized as follows: a.       Full-time monthly unit of care, equal to 22 full day units, is authorized when:                                                               i.      WCCC or SCC consumers participate in approved activities at least 110 hours per month or full-time care is determined to be appropriate and included in a CPS or CWS case plan; and                                                             ii.      Their children have scheduled care with a single provider at least 110 hours per month b.      Part-time monthly unit of care, equal to the actual anticipated full- and half-day units of care needed averaged over a 12-month period, is authorized when the care scheduled with providers is less than 110 hours per month c.       Part-time partial-day monthly unit is authorized when school-age children attend care in a licensed family home and meets the criteria in subsection (5) of this section 5.      Licensed family home child care is authorized as the following monthly units of care: 6.      Additional monthly units of care may be authorized when: a.       Consumers request an authorization for additional care; b.      The need for care is verified; c.       The care is needed to supplement an existing monthly unit for unexpected care needed for an approved activity limited to the time frame needed, not to exceed three months; d.      For actual anticipated overtime when the overtime is included when determining eligibility for child care; or e.       For sleep time 7.      Full-time partial-day monthly unit. A single partial-day monthly unit equal to 17 partial days and five full days is authorized for school-age children attending a licensed family home child care when consumers have at least 110 hours of approved activity per month, and their children are: a.       Authorized for care with only one provider; b.      Scheduled for care of 110 hours or more in July and August; c.       In care less than five hours on a typical school day; and d.      Need care before and after school. 8.      When determining part-time care for families using licensed providers when their activity or amount of care needed is less than 110 hours per month: a.       A full-day unit is calculated for each day of care of at least five hours; b.      A half-day unit will be calculated for each day of care that is less than five hours; and c.       A partial-day unit is calculated for each day of care in a licensed family home when:                                                               i.      Their children are in care before and after school; and                                                             ii.      The total care for the day is less than five hours. 9.      Full-time care for families using in-home/relative providers is authorized when consumers participate in approved activities at least 110 hours per month: a.       Two hundred thirty hours of care are authorized when their children are in care five or more hours per day; b.      One hundred fifteen hours of care is authorized when their children are in care less than five hours per day; c.       One hundred fifteen hours of care is authorized during the school year for school-aged children who are in care less than five hours per day and their providers are authorized for contingency hours each month, up to a maximum of 230 hours; d.      Two hundred thirty hours of care is authorized during the school year for school-aged children who are in care five or more hours in a day; and e.       Supervisor approval is required for hours of care than exceed 230 hours per month 10.  Care cannot exceed 16 hours per day, per child 11.  When determining part-time care for families using in-home/relative providers: a.       Under the provisions of subsection (2) of this section, DCYF authorizes the number of hours of care needed per month when the activity is less than 110 hours per month; and b.      The total number of authorized hours and contingency hours claimed cannot exceed 230 hours per month. 12.  DCYF determines the allocation of hours or units for families with multiple providers based upon the information received from the parents or guardians 13.  DCYF may authorize more than the state rate and up to the provider’s private pay rate if: a.       The parent or guardian is a WorkFirst participant; and b.      Appropriate child care, at the state rate, is not available within a reasonable distance from the approved activity site. “Appropriate” means licensed or certified child care under WAC 110-15-0125, or an approved in-home/relative provider under WAC 110-16-0010. “Reasonable distance” is determined by comparing distances other local families must travel to access appropriate child care. 14.  Other feeds DCYF may authorize to a provider are: a.       Registration fees; b.      Field trip fees; c.       Nonstandard hours bonus; d.      Overtime care to licensed providers when care is expected to exceed 10 hours in a day when consumers are eligible and authorized; and e.       Special needs rates for a child

2025-026       The Department of Social and Health Services did not have adequate internal controls to ensure only eligible clients received cash benefits under the Refugee and Entrant Assistance program and improperly charged $4,440 to the program. Assistance Listing Number and Title: 93.566 Refugee and Entrant Assistance  - State Administered Programs Federal Grantor Name: U.S. Department of Health and Human Services  Federal Award/Contract Number: 2301WARCMA-01; 2301WARCMA-02 2401WARCMA-03; 2401WARCMA-04 2501WARCMA-00 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: $4,440 Prior Year Audit Finding: No       Background The Refugee and Entrant Assistance – State Administered programs provide states and replacement designees with funds to help refugees, asylees, trafficking victims, special immigrants, and certain humanitarian parolees during the first 12 months after their date of arrival, or date of eligibility, in the U.S to attain economic self-sufficiency as soon as possible after their initial placement. The U.S. Department of Health and Human Services administers this program by providing assistance through Cash and Medical Assistance (CMA) grants, as well as Refugee Support Services. Specifically, CMA covers Refugee Cash Assistance (RCA), Refugee Medical Assistance (RMA), Unaccompanied Refugee Minor assistance, medical screenings and administrative costs. RCA and RMA are intended for individuals who are ineligible for Temporary Assistance for Needy Families (TANF) or Medicaid. In Washington, the Department of Social and Health Services administer the state’s Refugee and Entrant Assistance programs. In fiscal year 2025, the Department spent about $83.7 million in federal program funding, including more than $11.4 million to people for Cash Assistance benefits. DSHS determines eligibility of a client for the RCA program using its Automated Client Eligibility System (ACES). Clients apply online or through a Community Services Office. Public Benefit Specialists are responsible for collecting immigration documentation (e.g., I-94, USCIS records, or certification letters from the Office on Trafficking in Persons), income verification and household composition information. ACES applies system logic to determine eligibility, calculate household benefit levels and track the 12-month eligibility for RCA recipients. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure only eligible clients received cash benefits under the Refugee and Entrant Assistance program and improperly charged $4,440 to the program. Program management are expected to run weekly caseload reports from ACES and BARCODE to identify potentially ineligible RCA recipients. A benefit would be flagged when these reports detect an eligibility concern, such as a client exceeding the 12-month RCA limit, receiving duplicate benefits or being coded under the wrong program (for example, minors incorrectly enrolled in RCA instead of TANF). Management is expected to review and document these flagged cases to ensure benefits are only provided to eligible clients. We randomly selected  11 weekly caseload reports out of a total of 52, and found in six instances, there was no evidence indicating a managerial review of the flagged eligibility caseload reports occurred. In addition, the Department did not have policies and procedures to prevent staff from resetting a client’s eligibility date when they left and reentered the country, resulting in benefits being improperly extended. We determined one person improperly received benefits because an eligibility worker improperly revised the original US entry date in ACES when the client reentered the country, inadvertently resetting the client’s eligibility date. ACES uses the US entry date to track the 12-month eligibility for RCA recipients. We consider this internal control deficiency to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Although DSHS established a control structure requiring weekly caseload monitoring reports, staff did not consistently run or review these reports to ensure only eligible clients received cash benefits under the program. Department staff said some reviews did not occur because the employee responsible for pulling and reviewing weekly caseload reports was out on leave or working a reduced schedule, and other staff stepped in. The absence of a documented backup process or oversight to ensure this control operated consistently weakened its effectiveness. In addition, ACES does not have controls in place to prevent a user from editing the client’s original date of entry into the country. Effect of Condition and Questioned Costs Because of these internal control weaknesses, there is an increased risk that ineligible individuals receive cash benefits. We found that the Department made $4,440 in RCA benefits to an ineligible person. We estimate the total likely questioned costs to be $394,332. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95% confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely questioned cost projections are a point estimate and only represent our “best estimate of total questioned costs” as required by 2 CFR 200.516(a)(3). We question costs when an agency has not complied with grant regulations or when there is no adequate documentation to support expenditures. Recommendation We recommend the Department: Strengthen internal controls to ensure staff consistently perform and document weekly caseload monitoring reviews Provide additional training and guidance to staff clarifying that the RCA 12-month eligibility period begins on the original date of entry and does not restart if a client exits and reenters the country Consult with the grantor to determine whether the questioned costs identified in this audit should be repaid Department’s Response The Department concurs with the finding. The Department acknowledges six weekly caseload reports were not reviewed for eligibility errors. Unfortunately, we are unable to retrieve the original, backdated weekly caseload reports. To rectify the lack of managerial oversight for these specific periods, the Department’s Office of Refugee and Immigrant Assistance (ORIA) will take the following corrective action: Request the Department’s ESA Management Analytics and Performance Statistics (EMAPS) team generate a report detailing all eligibility determinations made during the six weeks that lacked review. Thoroughly review the report to identify and immediately correct any eligibility determination errors. Additionally, to strengthen our internal controls and ensure ongoing compliance, the Department will: Develop, document, and implement a comprehensive process to ensure managerial reviews of flagged eligibility caseload reports are completed timely and include a backup process in the absence of the primary reviewer. Develop, document, and implement a formal oversight process to monitor the completion and documentation of managerial reviews of all flagged eligibility caseload reports. This process will include a recurring check or log to ensure 100% compliance. Develop and provide additional training and guidance to eligibility staff clarifying that the Refugee Cash Assistance (RCA) eligibility period begins on the client’s original date of entry and does not restart if a client temporarily exits and subsequently reenters the country. Submit a formal EMAPS work request to develop an RCA flagged eligibility caseload report. In addition to metrics already reviewed, this report must include a metric to flag cases where the US Entry Date field has been modified. If the grantor contacts the Department regarding the questioned costs identified in this finding, the department will consult with the grantor to determine whether repayment is required. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Guidance establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs. Title 45 CFR Part 400, Subpart E, Refugee Cash Assistance, establishes requirements for determining eligibility and the provision of cash assistance to refugees. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-027       The Department of Social and Health Services did not have adequate internal controls to ensure it filed reports on time as required by the Federal Funding Accountability and Transparency Act for the Refugee and Entrant Assistance program. Assistance Listing Number and Title: 93.566 Refugee and Entrant Assistance program Federal Grantor Name: U.S. Department of Health and Human Services  Federal Award/Contract Number: 2201WARSSS-00; 2301WARSSS-00; 2301WARSSS-01; 2401WARCMA-03; 2401WARCMA-04; 2501WARCMA-00 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-046       Background The Refugee and Entrant Assistance program provides states and replacement designees with funds to help refugees, asylees, trafficking victims, special immigrants, and certain humanitarian parolees during the first 12 months after their date of arrival, or date of eligibility, in the U.S to attain economic self-sufficiency as soon as possible after their initial placement. The U.S. Department of Health and Human Services administers this program by providing assistance through Cash and Medical Assistance (CMA) Grants, as well as Refugee Support Services (RSS). Specifically, CMA covers Refugee Cash Assistance, Refugee Medical Assistance, Unaccompanied Refugee Minor assistance, medical screenings and administrative costs. RSS provides formula funding to assist with facilitating employment and other social services for refugees for up to five years after their date of arrival to the U.S., or date of initial eligibility. In Washington, the Department of Social and Health Services administers the state’s Refugee and Entrant Assistance program. In fiscal year 2025, the Department spent about $83.7 million in federal program funding. Of that amount, the Department passed through almost $62 million to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Act Subaward Reporting System. Beginning March 1, 2025, the Federal Funding Accountability and Transparency Act Subaward Reporting System transitioned to SAM.gov. The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The Act is intended to empower the public with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. During fiscal year 2025, the Department issued 58 subawards and 91 subaward amendments totaling more than $50.3 million in federal funds to subrecipients that it was required to report. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. The prior finding numbers were 2023-052 and 2024-046. Description of Condition The Department did not have adequate internal controls to ensure it filed reports on time as required by the Act. We used a statistical sampling method to randomly select and examine 18 subawards out of a total population of 149. We determined the Department did not file 13 out of the 18 subawards (72%) on time. The reports were accurate and complete. We consider these internal control deficiencies to be a significant deficiency. Cause of Condition The Department lacked adequate staffing, which resulted in it submitting FFATA reports late. In April 2025, the FFATA data entry shifted to a different office within the Department to ensure on-time reporting. This office completed a full audit upon receiving the new workload and filed all past-due reports. Effect of Condition Failing to submit the required reports on time diminishes the federal government’s ability to ensure accountability and transparency of federal spending. The terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance, including suspending or terminating the federal award or withholding future awards.  Recommendation We recommend the Department strengthen internal controls to ensure it submits all required reports on time. Department’s Response The Department concurs with the finding. In response to prior year’s audit finding DSHS 2024-029, the Department implemented a process change to ensure timely and accurate reporting. Effective April 17, 2025, the Department transitioned the reporting responsibility for federal subawards from the Division of Finance and Financial Resources accounting team to the Office of Refugee and Immigrant Assistance (ORIA) program staff. This change places the reporting duty with the personnel closest to the data source. Because this transition occurred late in the 2025 fiscal year, the Department anticipated a repeat finding for the SFY2025 audit period. The full impact of the corrected process will be evident in the SFY2026 audit. To ensure ongoing compliance with FFATA subaward reporting requirements for awards exceeding $30,000, the following control measures have been established: 1.Designated and trained a primary and a backup staff member within the program to collect and report the required information for each subaward. 2.Created a verification process to ensure that subawards and subaward amendments are reported accurately and timely. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part:  Appendix A to Part 170 – Award Term  I. Reporting Subawards and Executive Compensation (a) Reporting of first-tier subawards — 1.Applicability.  Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2.Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. (For example, if the subaward was made on November 7, 2025, the subaward must be reported by no later than December 31, 2025). The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-028       The Department of Social and Health Services did not have adequate internal controls over and did not comply with federal and departmental requirements to perform fiscal and program monitoring of subrecipients for the Refugee and Entrant Assistance programs. Assistance Listing Number and Title: 93.566 Refugee and Entrant Assistance – State Administered Programs  Federal Grantor Name: U.S. Department of Health and Human Services  Federal Award/Contract Number: 2201WARSSS-00; 2301WARSSS-00; 2301WARSSS-01; 2401WARCMA-03; 2401WARCMA-04; 2501WARCMA-00 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-047       Background The Refugee and Entrant Assistance – State Administered programs provide states and replacement designees with funds to help refugees, asylees, trafficking victims, special immigrants, and certain humanitarian parolees during the first 12 months after their date of arrival, or date of eligibility, in the U.S to attain economic self-sufficiency as soon as possible after their initial placement.   The U.S. Department of Health and Human Services administers this program by providing assistance through Cash and Medical Assistance (CMA) Grants, as well as Refugee Support Services (RSS). Specifically, CMA covers Refugee Cash Assistance, Refugee Medical Assistance, Unaccompanied Refugee Minor assistance, medical screenings and administrative costs. RSS provides formula funding to assist with facilitating employment and other social services for refugees for up to five years after their date of arrival to the U.S., or date of initial eligibility. In Washington, the Department of Social and Health Services’ Office of Refugee and Immigrant Assistance (ORIA) administer the State’s Refugee and Entrant Assistance programs. During fiscal year 2025, the Department spent about $83.6 million in federal program funding, more than $61.8 million of which it passed through to subrecipients.  Federal regulations require the Department to monitor the activities of subrecipients to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. This includes reviewing financial and performance reports required by the pass-through entity.  Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with federal requirements to perform fiscal and program monitoring of subrecipients for the Refugee and Entrant Assistance programs. The prior finding numbers were 2023-054 and 2024-047. Description of Condition The Department did not have adequate internal controls over and did not comply with federal and departmental requirements to perform fiscal and program monitoring of subrecipients for the Refugee and Entrant Assistance programs. The Department’s Program and Fiscal Monitoring policies require ORIA staff to review caseload reports submitted by subrecipients and document their monitoring activities. During the audit, we found the Department did not have adequate internal controls in place to ensure: All caseload reports are consistently available, accessible and retained so ORIA staff can verify that monitoring occurred Ensure subrecipients clearly identify which clients received direct assistance versus other services so required monitoring can be completed Ensure ORIA staff document all required caseload reviews We identified 1,476 total caseload reports due in the fiscal year 2025. We used a statistical sampling method to randomly select and examine 58 of them. For 53 of the 58 caseload reports examined (91%), we could not determine whether they were reviewed in accordance with the Department’s Program and Fiscal Monitoring policies as there was no documentation showing which clients were reviewed or what program monitoring was performed. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Although the Department began developing new tools and procedures in response to the prior year’s finding, many of these improvements were not fully implemented during the audit period. The Department said it experienced access issues with some caseload reports, which prevented staff from retrieving or reviewing the reports as needed. In addition, ORIA program staff continued to document only cases that required corrections and did not document when reviews were performed, as required. Finally, the Department did not ensure subrecipients consistently identified which clients received direct assistance versus other services. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are spending federal funds in accordance with grant requirements. Without adequately monitoring each subrecipient’s use of federal funds expended during the period of performance of the subaward, the Department cannot reasonably ensure the subrecipient has complied with the terms and conditions of the subaward. Missing, unclear or undocumented monitoring limits the Department’s ability to identify issues, follow up with subrecipients, and ensure federal funds are used appropriately. Recommendation We recommend the Department:   Ensure all caseload reports are consistently available, accessible, and retained so ORIA staff can verify that monitoring occurred Ensure subrecipients clearly identify which clients received direct assistance versus other services so required monitoring can be completed Provide clear guidance to staff on documenting eligibility reviews, including documenting when cases are reviewed and correct, not only when corrections are needed Strengthen internal controls to ensure ORIA staff document all required caseload reviews Follow up with subrecipients on missing, incomplete or unclear reports and ensure any issues are corrected Department’s Response The Department concurs with the auditor’s findings. The Department acknowledges the identified deficiencies create a material weakness due to the insufficient subrecipient monitoring that may result in unmonitored services, a lack of documentation to support direct assistance versus other services, and the inability to verify monitoring activities were performed in accordance with policy. The Department’s Office of Refugee and Immigrant Assistance (ORIA) is committed to immediately implementing the following corrective actions to strengthen internal controls and ensure full compliance with all monitoring requirements: 1.Revise ORIA Program Monitoring Procedures to clearly define: a.A mandatory checklist for all program monitoring activities. b.Non-negotiable standards for subrecipients to clearly identify which clients received direct assistance versus other services so required monitoring can be completed. c.Required documentation standards for all caseload reviews. d.Required follow-up with subrecipients on missing, incomplete or unclear caseload reports and ensure any issues are corrected. 2.Develop and deliver mandatory training for all ORIA program monitoring staff on the revised procedures, focusing specifically on: a.Proper caseload report review, retention, and verification procedures. b.The new documentation standards for tracking all services and assistance. 3.Implement a secondary quality assurance (QA) step where an administrator or designated QA officer must review and sign off on a monthly sample of all completed subrecipient caseload reviews. 4.Re-review the 53 caseload reports identified in the audit finding to verify eligibility and document completion of the reviews. Follow-up on any exceptions identified during the review. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes the requirements for all pass-through entities. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Department of Social and Health Services, Administrative Policy 19.50.30, Subrecipient Monitoring, states in part:     Policy E. Fiscal and programmatic monitoring must be completed. (See Attachment C – Sample DSHS Subrecipient Fiscal Monitoring Site Visit Tool)   Based on the result of the risk assessment, a desk or on-site review must be completed. Each Program has control over the form and content of its risk assessment tools. 1.If the risk assessment shows the entity is of low to medium risk, the entity may not require an on-site review. The following items, if available, must be documented in a desk review: a.Entity’s invoices and documentation (A-19s). b.Entity’s program or service and financial reports. c.Surveys or feedback cards from clients. d.Client complaints. e.Entity’s audit or financial report follow up and ensuring all appropriate action has been taken on all items detected through audits, on-site reviews and any other means. f.Entity’s indirect rate certification (Certificate of Indirect Costs, form 02-568 or plan), if applicable. g.If any of the above are not reviewed within the desk review, supervisor approval and an explanation for the reason the items were unable or immaterial to be reviewed must be included within the desk review assessment tool. 2.If the risk assessment shows the entity is a high risk, an on-site visit is required. The program/division will assign the appropriate staff to conduct the on-site review. On-site reviews must include all items in a desk review. In addition, on-site reviews may include, as appropriate, the following items: a.A review of the delivery of program services. b.Discussions about the subrecipient’s problems and challenges. c.Follow-up on identified problems from previous visits. d.Review of faculty/personnel licensing. e.Review of surveys and inspections performed by outside parties. f.Interview of staff to determine whether they are familiar with the program. g.Inspection of the entity’s facilities and operations. h.Review of and compliance with the entity’s policies and procedures governing service delivery and financial processes. i.Review of the entity’s monitoring/production reports. j.Review of any independent limited scope program audits. k.Verification of performance from outside source (e.g. sub-contractors). l.Review of the entity’s self-risk assessment survey. m.Review of internal controls. n.Review of billing practices. o.Review of allocation of costs. p.Review of timesheets or activity reports. q.Review of financial records. F. Monitoring must be documented. 1.The ACD must be used to document all subrecipient-related monitoring activities. 2.Assigned staff must document all desk or on-site reviews performed. The program manager overseeing the contract is responsible for making sure that items included in the review are documented in the ACD by the end of the contract period. 3.Each program must maintain contract monitoring documentation per General Administration’s retention schedule (Administrative Policy 5.04, Records Retention).

2025-029       The Department of Commerce did not have adequate internal controls over and did not comply with the Cash Management Improvement Act requirements for the Low-Income Home and Energy Assistance Program.                                                          Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2101WALWC6, 2201WALIEA, 2301WALIEA, 2301WALIEE, 2301WALIEI,  2401WALIEA, 2401WALIEI, 2501WALIEA Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Cash Management Known Questioned Cost Amount: None Prior Year Audit Finding: No       Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia and U.S. territories. In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. Subawards are issued to community-based organizations to provide this assistance. In fiscal year 2025, the Department spent more than $70 million on federal funds, about $63 million of which it paid to subrecipients. The LIHEAP program is subject to the Cash Management Improvement Act (CMIA) and is included in the Treasury-State Agreement for Washington. The primary purpose of the CMIA agreement is to ensure states request federal funds when they need them so neither the federal or state governments lose or gain interest revenue. The agreement specifies the funding technique the Department should use when requesting federal funds. The Department shall draw funds semi-monthly, according to the state payroll schedule.  When a draw request is prepared, the Department determines the amount to request based on expenditures since its last draw. This amount is verified in a system it maintains called the Contract Management System. All cash draws are submitted into the federal Payment Management System (PMS) to request reimbursement. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with CMIA requirements. The CMIA for LIHEAP states that the Department must make cash draws one day before scheduled paydays throughout the year. We reviewed the timing of these draws made during the fiscal year to ensure the Department met the CMIA timing requirements. We determined there was no cash draw made for one payroll period of the year. We also identified seven cash draws to be noncompliant because the Department made them in the middle of a payroll period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department stated it was not aware that making additional draws outside of the CMIA timeline was not compliant with federal requirements. For the draws made outside of the payroll period, the Department’s executive leadership requested staff make additional draws due to the uncertainty of receiving future federal funds. In addition, at the end of the state fiscal year, the Department made additional draws to adjust prior draws in PMS between various open awards. For the one draw not completed for a payroll date, program staff requested that the draw not be made at that time because they wanted to expend remaining funds on the Department’s earliest open award before drawing from other grants, but were not confident of the amount to be drawn. Effect of Condition Violations of the CMIA can result in the grantor denying the state payment or credit for the resulting federal interest liability or other sanctions. Delaying federal draw-down requests also results in state funds being advanced longer than necessary and potentially losing interest revenue for the state.  Recommendation We recommend the Department establish and follow effective internal controls to ensure it performs cash draws on the schedule specified in the CMIA agreement. Department’s Response The Department acknowledges the Cash Management Improvement Act timeline draw requirements, however, during fiscal year 2024 the state experienced uncertainty regarding availability of federal funds and did not know the Act prevented the Department from making draws in addition to those allowed in the requirements.  Leadership approved the higher frequency of draws to ensure we could fund all of the programs expenditures already incurred by subrecipients.  The Department now understands the draw timeline requirements for the applicable laws and regulations and will make sure our draw processes mirror those requirements.  We thank the State Auditor’s Office for clarifying the requirements.  Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington State’s Agreement pursuant to the Cash Management Improvement Act (CMIA) of 2025, states in part:  6.2.4 The following are terms under which State unique funding techniques shall be implemented for all transfers of funds to which the funding technique is applied in section 6.3.2 of this Agreement.  Modified Direct Program Costs - Admin, Payroll, Payments to Providers:  The State shall request funds for all direct administrative costs and/or payroll costs, and/or payments made to providers and to support providers. The request shall be made in accordance with the appropriate Federal agency cut-off time specified in Exhibit I. The amount of the funds requested shall be based on the amount of expenditures recorded for direct administrative costs and/or payroll costs and/or payments made to providers or to support providers since the last request for funds. The State payroll cycle is payday twice a month. Draws made the day before payday are for deposit on payday. The draw request will be made in accordance with the cut-off time in Exhibit 1. The amount of the funds requested shall be based on the amount of expenditures recorded for direct administrative costs and/or payroll costs and/or payments made to providers or to support providers since the last request for funds. This funding technique is interest neutral. 6.3.2 Programs  93.568 Low-Income Home Energy Assistance Recipient: Department of Commerce % of Funds Agency Receives: 90 Component: Payments to providers Technique: Modified Direct Program Costs - Admin, Payroll, Payments to Providers Average Day of Clearance: 0 Days

2025-030       The Department of Commerce improperly charged $131,015 to the Low-Income Home Energy Assistance Program. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program    Federal Grantor Name: U.S. Department of Health and Human Services    Federal Award/Contract Number: 2101WALWC6, 2201WALIEA, 2301WALIEA, 2301WALIEE, 2301WALIEI, 2401WALIEA, 2401WALIEI, 2501WALIEA Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Period of Performance Known Questioned Cost Amount: $131,015 Prior Year Audit Finding: Yes, Finding 2024-050       Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families (ACF), administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia and U.S. territories.  In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. The Department administers and awards LIHEAP funds under two programs: the energy assistance program and the weatherization program. Subawards are issued to community-based organizations to provide this assistance. In fiscal year 2025, the Department spent more than $70 million in federal funds, about $63 million of which it paid to subrecipients. Federal regulations require the Department to obligate at least 90% of the LIHEAP block grant funds in the first federal fiscal year in which they are awarded. If funds are left over after the end of the first federal fiscal year, the Department must either return those funds or report to the grantor the amount it intends to carry over and reallot. The Department may carry over up to 10% of the funds payable for obligation no later than the end of the following federal fiscal year. Funds not obligated by the end of the second fiscal year of the award must be returned to ACF. The limits on the period for the expenditure of funds are communicated to award recipients.  LIHEAP awards typically have a two-year project period when the Department may obligate funds to subrecipients through subawards and incur administrative costs to execute the award. The subawards define the period of performance for subrecipients to spend these funds. Departmental administrative costs are considered obligated when the expenditure activity occurs. As such, the period of performance for administrative costs aligns with the project period start and end date. If the Department requires more than one year from the project period end date to liquidate allowable costs, it is required to notify the grantor. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls over and did not comply with period of performance requirements for LIHEAP. The prior finding number was 2024-050. Description of Condition The Department improperly charged $131,015 to LIHEAP. We found the Department had adequate internal controls to ensure material compliance with period of performance requirements. The Department properly obligated the federal fiscal year 2024 award during the audit period. Furthermore, subrecipient expenditures reviewed were within the period of performance requirements. However, during state fiscal year 2025, there were three awards with project end dates during this time. We analyzed expenditures charged to the awards in the accounting system and identified $122,516 of administrative activities that occurred after the period of performance. In addition, there was one award with a liquidation period ending during state fiscal year 2025. Through a review of expenditures charged to the award, we identified $8,499 in indirect payroll expenditures that occurred after the period of performance. Cause of Condition The Department misinterpreted federal regulations regarding administrative costs, which led management to believe it was compliant with period of performance requirements. Effect of Condition and Questioned Costs We identified $131,015 in known questioned costs for administrative expenditures that occurred outside of the period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Department: Design and implement internal controls to ensure it complies with period of performance requirements Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid  Department’s Response The Department appreciates the opportunity to respond to the finding but respectfully disagrees with the questioned costs reported.  The Department agrees with the Washington State Auditor’s Office (SAO) and commits to creating internal controls regarding how administrative activities and payroll are reviewed, approved and applied as program expenses.  To improve that process, the LIHEAP programs are working with the Department’s Budget, Accounting and Internal Controls Departments to implement processes to strengthen our internal controls. During the course of the audit, the Department discussed the program requirements as reported in the Code of Federal Regulations (CFR) with the auditors.  45 CFR §96.30, states, “Liquidation of funds under this award must relate back to obligations properly incurred during the obligation period of this award. If the recipient requires more than 1 year from the obligation period end date to liquidate allowable costs, it shall notify the Grants Management Officer.”  On January 13, 2022, program management sent the following question to R. Patrice West, Energy Assistance Program Specialist, HHS: “Is Commerce allowed to provide LIHEAP services outside the project performance period as long as the funds have been obligated within the project performance period?”  R. Patrice West’s responded, “You are correct.  As long as funds were obligated during the performance period you are allowed to provide LIHEAP services outside the project performance period.” In addition, in May 2025, the Department met with Tim Chappelle, Grants Management Specialist, HHS, who confirmed the process Commerce used for applying funds within the closeout period was allowed.  The Internal Controls Team subsequently met with the SAO Single Audit specialist who confirmed the process followed by the Department was in compliance with the LIHEAP specific CFR’s regarding the period of performance requirements.  As a result of the confirmation of understanding by the SAO, the guidance provided in writing and verbally by HHS, the Deputy Director, currently the Acting Director, approved the process to continue as instructed.    HHS as the federal grantor can update, change or modify any compliance requirements for programs they fund.  The Department has followed their guidance, has provided that guidance to the SAO, but the guidance has not been accepted by the SAO resulting in the questioned cost finding.  While we acknowledge LIHEAP expenditure process internal controls could be strengthened, we request SAO remove the questioned costs identified based on the approval of our practices provided by the grantor, HHS, which align with the requirements of the applicable CFR’s. We respectfully ask the SAO to provide clarity and a basis for the finding in light of the grantor approval of this practice. Auditor’s Remarks We took into consideration the communication the Department had with the federal grantor, as stated in its response. However, the Department is applying the federal grantor’s response to include administrative costs. The question from the Department related to providing services “as long as they were properly obligated”. As stated in the finding, administrative costs are considered obligated when the expenditure activity occurs. As such, the period of performance for administrative costs aligns with the project period start and end date. The federal grantor’s response was also specific in stating that obligations consist of legal agreements, it does not address the Department’s own administrative costs. We communicated this to the Department during our fieldwork. This finding does not report a significant deficiency or material weakness in internal controls. As stated above, we found the Department had adequate internal controls to ensure material compliance with period of performance requirements. The finding is being issued because the questioned costs exceeded $25,000. We reaffirm our finding and will review the status of the Office’s corrective action during the next audit.  Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs.   ACF Supplemental Terms and Conditions, LIHEAP, states in part:  7. Obligation Deadline:  a. According to 45 CFR §96.14(a)(2), the two-year funding (project) period for this award is concurrent with the obligation period: from the first day of the FFY for which these funds were awarded through the last day of the following FFY. (i.e., October 1, FFY 1 through September 30, FFY 2.) According to 42 USC 8626(b)(2)(B), a maximum of 10 percent of the federal funds issued under this award may be held available for obligation in the FFY 2 of the project period. If more than 10 percent of a recipient's federal funds remains unobligated at the end of the FFY in which they were allotted, those excess funds must be returned to HHS if previously drawn down or will be restricted in the Payment Management system. Such funds will be recaptured and are subject to reallotment among all eligible recipients in the next FFY. Any federal funds not obligated by the end of the two-year obligation period will be recouped by the Department. 8. Liquidation:  According to 45 CFR §96.30, all properly obligated federal funds issued under this award must be liquidated in accordance with the recipient’s own fiscal control and funds control procedures. Liquidation of funds under this award must relate back to obligations properly incurred during the obligation period of this award. If the recipient requires more than 1 year from the obligation period end date to liquidate allowable costs, it shall notify the Grants Management Officer identified on its latest Notice of Award and the assigned LIHEAP federal liaison found at this hyperlinked location: LIHEAP Contact Information. The notification shall include the reason for the delay and the anticipated timeframe for liquidation. Approval or disapproval will be provided in writing by OGM. Any federal funds from this award not liquidated by the date required under the recipient’s own fiscal control procedures, which may not exceed five years following the fiscal year of award, will be recouped by this Department.  ACF-OCS-LIHEAP-IM-2024-04 LIHEAP Obligations, Expenditures, and Refunds, states in part: Federal appropriations accounting law at 31 U.S.C. § 1502(a) states that the balance of an appropriation or fund limited for obligation to a definite period is available only for payment of expenses properly incurred during the period of availability or to complete contracts properly made within that period of availability. Grant recipients may not incur new expenditures beyond the period of performance unless necessary to liquidate obligations made during the period of performance under active agreements or subawards with partnering agencies. Grant recipients must liquidate obligations according to the same rules, including the timeframe, required of its own non-federal funding.

2025-031       The Department of Commerce did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 2101WALWC6, 2201WALIEA, 2301WALIEA, 2301WALIEE, 2301WALIEI,  2401WALIEA, 2401WALIEI, 2501WALIEA Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-052       Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia and U.S. territories. In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. Subawards are issued to community-based organizations to provide this assistance. In fiscal year 2025, the Department spent more than $70 million in federal funds, about $63 million of which it paid to subrecipients. The Federal Funding Accountability and Transparency Act (Act) requires the Department to collect and report information on each subaward of federal funds more than $30,000 in the federal reporting system. The Department must report subawards by the end of the month following the month in which it executed the subaward (or subaward amendment). The Act is intended to empower the public with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. The Department has two units – energy assistance and weatherization – that administer two different program activities. Each unit is responsible for complying with this reporting requirement and have similar processes for completing the reports. When a new or amended subaward is executed, program staff enter its information into the Department’s Contract Management System (CMS). Program staff use the information in the CMS to complete the report. There were 75 LIHEAP subawards and amendments that the Department was required to report in fiscal year 2025, totaling $59,020,129.  Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. The prior finding number was 2024-052. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. While the Department has written procedures for filing these reports, the procedures in place for the first seven months were not adequate to ensure compliance. The procedure states that a report is to be completed 30 days after the obligation memo is signed by the Assistant Director, not when each subaward or amendment is executed. If this process is followed, then reports may not be submitted on time. Additionally, the procedure states that amendments are reported when the obligation is $30,000 or more. If this process is followed, it is possible that amendments less than $30,000 would not be reported when the original subaward and amendment together meet the reporting threshold. The Department updated this procedure in February 2025 to correctly state the FFATA report is completed within 30 days after subawards are signed by the Assistant Director. However, it still states amendments will be reported if equal to or greater than $30,000. We used a non-statistical sampling method to randomly select and examine 13 out of a total population of 75 subawards and amendments from energy assistance and weatherization. Out of the 13 examined, we found: The Department did not report three (23%) energy assistance subawards in the reporting system The Department reported one weatherization subaward (8%) 68 days late One (8%) energy assistance subaward was submitted with an incorrect subaward amount One (8%) weatherization subaward was submitted with the incorrect subgrantee name and unique entity identifier Transactions Tested Subawards Not Reported Report Not Timely Subaward Amount Incorrect Subaward Missing Key Elements 13 3 1 1 1 Dollar Amount of Tested Transactions Subawards Not Reported Report Not Timely Subaward Amount Incorrect Subaward Missing Key Elements $18,670,860 $1,713,258 $299,631 $1,034,603 under reported $3,511,486   We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition In response to the prior year finding, the Department implemented a new process to strengthen internal controls, however, the new process was not in place when the Department submitted the reports.  For the two subawards with incorrect information and the three awards the Department did not submit, internal controls were not sufficient to ensure the Department correctly entered the information into the CMS. For the one award the Department did not submit on time, it stated that during this time there was a change in program management responsibilities that resulted in a delay in reporting. Effect of Condition Failing to properly submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendation We recommend the Department: Establish effective internal controls, including updating written procedures, to ensure it submits all required reports Ensure it correctly enters subaward details into the CMS Department’s Response The Department confirms the new process to address the findings issued in the prior year was not in place until the Department submitted the initial Federal Funding Accountability and Transparency Act (FFATA) report for the 2025 program year in January 2025. As included in the finding, the Department’s procedures require that reporting is to be completed within 30 days after the subrecipient contract is approved by the Assistant Director. The Departments LIHEAP programs will continue to review and update the FFATA procedure and include additional levels of review from both program and budget to ensure information entered is accurate and submitted in a timely manner. To address this, the LIHEAP programs have updated the process documents to improve the accuracy of FFATA data entry. Additionally, further internal controls have been implemented to strengthen the reporting process, which including: 1.Establishing a process for program staff to draft FFATA reports followed by the Program Manager’s review and then the Managing Director or Senior Weatherization Program and Evaluation Manager review and approval. 2.Implementing a process to ensure each new and amended awards are entered separately into the FFATA reporting system. 3.Budget staff will conduct a secondary review of prepared reports to verify financial accuracy before submission by the Program Manager in the FFATA system 4.LIHEAP programs along with the Internal Controls Office will review the FFATA procedure annually to ensure compliance with current federal requirements. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I.Reporting Subawards and Executive Compensation a.Reporting of first-tier subawards. 1.Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2.Reporting Requirements. i.The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at https://www.fsrs.gov. ii.For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the subaward was made on November 7, 2025, the subaward must be reported by no later than December 31, 2025). The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-032       The Department of Commerce did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Low-Income Home Energy Assistance program received required single audits, and that it appropriately followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2101WALWC6, 2201WALIEA, 2301WALIEA, 2301WALIEE, 2301WALIEI,  2401WALIEA, 2401WALIEI, 2501WALIEA Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-055       Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia and U.S. territories. In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. The Department administers and awards LIHEAP funds under two programs: the energy assistance program and the weatherization program. Subawards are issued to community-based organizations to provide this assistance. In fiscal year 2025, the Department spent more than $70 million in federal funds, about $63 million of which it paid to subrecipients. Federal regulations require the Department to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more on federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes to subrecipients, the Department must follow up with subrecipients to ensure they take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a Department-funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the Federal Audit Clearinghouse (FAC). The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. To monitor its compliance with these requirements, the Department’s Internal Control Office uses an Excel workbook to track subrecipients’ single audits along with identifying any program-funded findings. The subrecipients included on this list are provided to the Internal Control Office by program staff. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In the prior audit we reported the Department did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of LIHEAP received required single audits, and that it appropriately followed up on findings and issued management decisions. The prior finding number was 2024-055. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of LIHEAP received required single audits, and that it appropriately followed up on findings and issued management decisions. The Department does not have policies and procedures in place that align with its current practice to ensure compliance with subrecipient single audits and follow-up, if necessary. We examined the Excel workbook the Department used during the audit period to monitor compliance with these requirements and determined the Department did not sufficiently design it to ensure the Department was compliant with subrecipient single audit requirements for the following reasons. The workbook: Lacks a field to calculate or track when the subrecipient single audit is due to allow the Department to determine if the subrecipient submitted its report on time Contains a field that documents the date when the Department reviews the subrecipient’s single audit status in the FAC. The workbook shows the Department reviewed this once (over approximately a two-week period) during the audit period. Since subrecipients have different fiscal year end dates, this single review per year is not sufficient to ensure compliance with the nine-month single audit submission and six-month management decision letter issuance, if applicable. Additionally, during the audit period, this workbook included 31 LIHEAP subrecipients. By reviewing prior year LIHEAP expenditures, we identified 34 LIHEAP subrecipients that may have been required to receive a single audit. As a result, we concluded the Department did not properly track three (9%) of the 34 subrecipients to ensure it reviewed their audits for program-funded findings and completion of required management decisions, if applicable.  Furthermore, in this workbook: For 11 (35%) of the 31 subrecipients, the Department did not track the correct fiscal year-end date for the single audit due in the audit period. For one (3%) of the 31 subrecipients, we could not verify the subrecipient’s fiscal year-end date nor verify if they had reported a single audit in the FAC.   Finally, we identified two subrecipients that required a management decision letter to be issued during the audit period. We requested documentation to verify this occurred and the Department provided one letter that was issued almost six weeks late and did not provide evidence the second management letter was issued. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not implement adequate internal controls to ensure proper monitoring and review of subrecipient single audit submissions and issuance of management decision letters, if applicable. The Internal Control Office staff received an incomplete list of subrecipients from program staff, but did not verify the list was complete. Therefore, the list provided by program staff was tracked, but not the remaining subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure all subrecipients received single audits when they were required. Additionally, the Department cannot ensure it follows up on subrecipient single audit findings and communicates required management decisions to subrecipients. When it fails to ensure subrecipients establish corrective actions and management monitors them for effectiveness when required, the Department cannot determine whether its subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the Department: Monitor subrecipients to ensure all required audit reports are submitted and reviewed to determine if any additional subrecipients are required to take corrective action to address audit recommendations Establish effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required Ensure subrecipients develop and take acceptable corrective actions to adequately address all audit recommendations Issue a written management decision for all applicable audit findings, if necessary Department’s Response The Department understands the SAO’s description of condition and recommendations, and would like to highlight our strong and comprehensive internal controls over subrecipient monitoring for audit requirements which include the identification, tracking, verification and monitoring of subrecipients.  The Internal Controls Office (ICO) completes the monitoring as required by 2 CFR 200.521 and Title 45 CFR Part 75 section 352 d 3 and f.  The program specific requirements are completed by LIHEAP weatherization and energy department staff.  It appears most of the exceptions reported are based on the Washington State Auditor’s Office (SAO) preferences, not Code of Federal Regulations (CFR) requirements.  The following are the Department’s responses to the deficiencies listed in the Description of Condition in order of exception noted: The ICO tracking process includes a field to track dates audits are submitted by subrecipients.  The Department’s monitoring is based on the subrecipient’s submission which we document during monitoring.  Each subrecipient determines their own submission date.  The CFR does not require specific fields be documented. The Department tracked, monitored subrecipients and documented the action completed at least seven times during the monitoring period.  The Department provided the tracking information to the SAO during the audit and in response to the draft finding, showing all dates monitoring was performed.  Once subrecipients have completed their submission, monitoring for audit submissions is complete.  Subrecipients are not monitored to the prior year expenditures and they are not applicable to the process.  While the SAO has reported who “may have been” required to receive a single audit, the Department only tracks and monitors who is required to obtain and submit their single audit.  32 subrecipients were monitored.  Other inaccuracies to note include:  oOne subrecipient included as an exception was not a LIHEAP subrecipient and should have been removed as an exception oTwo subrecipients were monitored but the names were reported differently on the SAO report. oOne subrecipient was tracked as part of general monitoring completed by ICO, the information was provided to the SAO during the audit and after the draft finding was issued.  oThe Department acknowledges the ICO did not track two entities because one had their funding halted and neither were included in the list of subrecipients for ICO monitoring.  The Department has addressed this issue that created this discrepancy. The Department monitored subrecipients reported by program management based on the current program and reporting year as required by CFR.  The method to track the fiscal year-end date for the single audit due in the audit period is not required by CFR.  The Department monitors subrecipients annually, per the CFR, and can only monitor subrecipients after their submission has been completed.  The SAO exception timelines would require the Department monitor within the current submission period which is before or within the required submission timeframe.  One subrecipients fiscal year end date could not be verified because they did not complete their submission as required.  This entity was monitored by the Department several times, two of which were documented.  Once the determination of non-compliance was made by the ICO, it was reported to program management.  The Department provided this information to the SAO during the audit and after the draft finding was issued. Two management decision letters were required to be issued for LIHEAP subrecipients within the reporting period.  One was issued by ICO after the six month deadline, the other letter was not issued due to the finding issued including several federal awards and the inclusion of the LIHEAP funding was missed.  The ICO completed the monitoring and tracking but did not identify a management decision letter was required to be issued.  We continue to strive to make sure we capture all subrecipients to ensure we issue all management decision letters required.  Regarding the Cause of Condition, the Department asserts it does have adequate internal controls in place that are working effectively as required by the CFR.  The ICO obtains list of subrecipients three different ways, through reporting from our Contracts Monitoring and financial reporting Systems and from lists provided by the LIHEAP programs.  The subrecipient list provided by program management was the process used to confirm the population.    Additionally, the Department was subject to an in depth onsite federal audit of the LIHEAP program completed by Health and Human Services (HHS) during 2025.  The audit included single audit monitoring and the ICO provided all process, monitoring and tracking documentation as part of the audit.  HHS reported no findings or exceptions related to single audit monitoring or management decision letter issuance.  The Department remains willing to share these audit results based on federal requirements, should the SAO request them.  During the review of the draft report, ICO identified a CFR which was not applicable and requested SAO remove the reference.  The Department follows and complies with 2 CFR 200.521 and request that code be included in Applicable Laws and Regulation.  We continue our commitment to compliance and look forward to partnership to ensure integrity of our programs, including LIHEAP. Auditor’s Remarks The criteria we applied in the audit were solely federal law, not our preferences. The audit was conducted in accordance with Government Auditing Standards and the Uniform Guidance under 45 CFR Part 75.  Uniform Guidance requires agencies to establish and maintain effective internal controls over federal award compliance. In our judgment, the Department did not provide evidence to support its assertion that it tracked, monitored subrecipients, and documented the action at least seven times during the monitoring period. As the finding states, the documentation received shows the Department reviewed this once (over approximately a two-week period) during the audit period. Subrecipient expenditures in the prior year is an essential component to consider when determining if a subrecipient should be monitored for single audit reporting. To ensure compliance, all subrecipients that receive federal funding from the Department should be included in the population for monitoring to determine if an audit report was due. In its response, the Department stated “The method to track the fiscal year-end date for the single audit due in the audit period is not required by CFR.” This statement appears to be in relation to a misunderstanding of federal requirements that was presented to us by the Internal Control Office during the audit. The assertion that tracking the fiscal year end date is not a requirement is not correct. 45 CFR 75, section 352 (f) states the agency must “verify that every subrecipient is audited as required by subpart F.” Subpart F reference 45 CFR 75.512 which states subrecipients must submit their audits no later than nine months after the end of the audit period. If the Department does not track when audits are due, they cannot meet their legal obligation to verify the audits were completed timely and that their subrecipients complied with federal law. We did request the Department provide any audit reports from the federal grantor that were conducted during the audit period. The Department did not provide this report, inform us of its existence or inform us that an audit was conducted by the grantor until after our fieldwork was completed. The Department asserts that the wrong CFR is being used and specifically referenced 2 CFR 200.521. We informed the Internal Control Office during the audit that they were applying the wrong federal criteria. Each federal agency was required to implement the Uniform Guidance into its own specific CFR. The grantor did so and incorporated this requirement at 45 CFR Part 75, section 352, which is what we have referenced throughout the audit. The Department was offered many opportunities to provide evidence to support exceptions identified during fieldwork but did not provide additional documentation to support its assertions. We reaffirm our finding and will review the status of the Office’s corrective action during the next audit.  Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, states, in part:     All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 75.521. (f) Verify that every subrecipient is audited as required by subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 75.501. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 75.371 and in program regulations. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-033   The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers for the Child Care and Development Fund program were allowable and properly supported. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACDC6; 2303WACCDD; 2303WACCDF; 2403WACCDD; 2403WACCDF; 2403WACCDM; 2503WACCDD; 2503WACCDF; 2503WACCDM; 2503WACCDY Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $3,827 Prior Year Audit Finding: Yes, Finding 2024-056       Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2025, the Department spent about $369 million in federal funding. Of this amount, the Department spent more than $296.6 million in CCDF funds on monthly child care subsidy payments to child care providers. There are three types of child care providers: licensed centers, licensed family homes, and licensed exempt providers referred to as Family, Friends, and Neighbor (FFN) providers. The Department uses the Social Service Payment System (SSPS) to process the payments it makes to child care providers. The system allocates payments to various funding sources based on the client’s eligibility. These funding sources include multiple federal programs, multiple CCDF federal grant awards, and state funding. The Department uploads the SSPS payment data into the state’s accounting system at a summary level based on the various funding sources. There is always a need to transfer the funding sources for some payments throughout the year to manage federal and state funds properly. Authorizations for child care To be authorized for child care services, parents must be determined to be eligible based on their income, residency and demonstrated need based on approved activities. Once parents are determined to be eligible, the Department authorizes the amount of care based on the hours a parent participates in approved activities. For licensed centers, the service levels are generally either 23 full-day units (up to 10 hours a day) or 30 half-day units (up to five hours a day), or 46 half-day units during the months of June, July and August, when authorizing care for households with more than 110 hours of activity. Care is authorized based on need when approvable activities are less than 110 hours. When more than 10 hours a day of care is needed, the Department may authorize additional care for overtime. For licensed family homes, providers are authorized monthly units of care either as full-time, part-time, full-time partial-day, or part-time partial-day. FFN providers are paid by the hour, and authorizations are made for either part-time care (up to 110 hours a month) or full-time care (up to 230 hours a month). When more than 10 hours a day of care is needed, the Department may authorize additional care for overtime. Attendance records Child care providers must maintain attendance records to support their billing. All child care providers must use the Department’s electronic attendance recordkeeping system, a Department-approved electronic attendance recordkeeping systems or receive an exception to rule to allow for paper attendance records. The attendance record requirement is the same for all providers. How the provider claims for payment varies depending on the provider type: Licensed center providers claim eligible units per month. Licensed family home providers claim eligible monthly unit(s). FFN providers claim eligible hours per month. To ensure payments are allowable and accurate, the Department conducts data analysis and audits payments. The Department’s subsidy audit unit, which is composed of six provider auditors, reviews payments each month using both random sections and focused referrals. The subsidy audit unit receives focused referrals from other divisions and programs within the Department. Department staff prepare audit request letters and mail them to providers who have 45 days to respond with records. The provider auditors review the records to determine whether the payments are properly supported. Federal regulations require the state to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers were allowable and properly supported. We have reported this condition since 2008. The prior audit finding numbers were 2024-056, 2023-058, 2022-041, 2021-033, 2020-038, 2019-035, 2018-034, 2017-024, 2016-021, 2015-023, 2014-023, 2013-016, 12-28, 11-23, 10-31, 9-12 and 8-13. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers for the CCDF program were allowable and properly supported. We used a statistical sampling method to randomly select and examine 59 out of a total population of 397,102 monthly payments for child care. Our sample included child care payments from each of the three provider types: licensed centers, licensed family homes and FFNs. With assistance from the Department, we requested attendance records, provider handbooks and other required receipts from providers that supported the payments. We reviewed each provider’s records to determine if the payments were allowed by federal and state regulations, Department policies and supported by adequate documentation.  We found 11 payments funded by the CCDF grant that were noncompliant. The Department improperly paid $3,827 with federal CCDF funds to these 11 providers. The reasons the overpayments occurred were: Four providers did not submit attendance records in response to our request Three providers overbilled for services not supported by attendance records One provider billed for field trips that were not properly supported by receipts Two providers did not provide required signatures from parents or guardians One provider billed for field trips that were not properly supported and did not provide required signatures from parents or guardians While the Department has written procedures over its post-payment audit process, the procedures need improvement. The Department has a Child Care Subsidy Programs Integrity Plan that was most recently updated in February 2024. In the plan, the Department stated the frequency of billing and attendance audits is 240 per month. Program staff said that their goal was to complete these audits within four to six months after the month of service. We reviewed the results of the Department audits that occurred during the audit period which were: The Department completed 2,228 audits during the year. The Department’s post-payment audits were not timely. Most of the audits took place between six months and a year after the month of service. For four months of the year, the Department reviewed about 100 audits per month instead of 240 in its plan. The Department identified overpayments in 1,493 of the 2,228 (67%) post-payment audits it completed during the year. In total, the Department itself identified $2,185,753 in provider overpayments, or 22% of the payments it audited. The Department said these overpayments were submitted to the Department of Social and Health Services, Office of Financial Recovery (OFR), for collections. Providers are allowed due process via administrative hearing following this formal notification.   The Department also has a written Quality Control Provider Audit Procedure. This procedure states that the six audit staff are to select both random and focused, or risk-based providers to audit. However, the procedures do not describe the specific methods or factors used by staff to make these selections.      We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department does not review supporting documentation to verify a payment request is allowable and supported before payment. Payment authorizations establish a maximum for what providers may bill without further approval, but this does not prevent providers from billing for unallowable days, hours or services. The Department said adequate resources are not available to review documentation before payments are made. Until SSPS is connected to attendance reporting systems, providers must maintain attendance records and submit supporting documentation when it is requested. The Department’s post-payment audits consistently identify provider overpayments, which is a detective control. However, management has not implemented internal controls that sufficiently prevent overpayments. The Department said the reason only 100 audits were performed for four months of the year was due to a lack of staffing resources. Effect of Condition and Questioned Costs By not having adequate internal controls in place, the Department increases its risk of making improper payments for child care services. We used a statistical sampling method to randomly select the payments examined in the audit. Based on the results of our testing, we estimate the total likely questioned costs paid with federal CCDF funds to be $27,175,817. In addition, five of the overpayments were partially funded by state dollars that totaled $365. We estimate the likely questioned costs paid with state funds was $2,135,341. This amount is not included in the federal questioned costs.   Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95% confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely questioned cost projections are a point estimate and only represent our “best estimate of total questioned costs” as required by 2 CFR 200.516(a)(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department strengthen its internal controls over payments it makes to child care providers. Specifically, the Department should: Update its written procedures to better describe its post-payment audit process. This should include a description of how staff select random and focused providers to audit. Provide additional resources to fully execute its Child Care Subsidy Program Integrity Plan. Based on its own audits and the results of our statistical sampling in this audit, the Department should consider expanding its audit effort until it is able to implement pre-payment controls. Link its payment and attendance reporting systems to prevent making payments that lack required supporting documentation.   The Department should also:   ·         Follow up with the providers that did not respond to requests for records during this audit. ·         Consult with the grantor to discuss whether the known questioned costs identified in this audit should be repaid. Department’s Response The Department agrees with the 11 exceptions identified by the State Auditor’s Office (SAO) as part of their testing of attendance records and documentation from providers.  In February 2026, overpayments were written for the exceptions identified by SAO and submitted for recovery to the Department of Social and Health Services, Office of Financial Recovery (OFR).   The Department requires additional funding to increase the number of monthly provider audits completed, or to fund an information technology solution and system linkage between the payment and all of the electronic attendance systems used by providers. Even with data system connections the Department will need significant resources to increase the number of payments reviewed. The Department’s current oversight is limited to the audit capacity of its six quality-assurance (QA) auditors for approximately 397,102 monthly child care payments as noted by SAO.   The Department employs automated system controls in the Social Services Payments System (SSPS) to limit provider authorizations to the maximum amount of care a child is eligible to receive and claim.  The detective internal controls, post-payment audits, implemented by the Department are designed to detect errors and assure prompt correction of these errors.  The QA auditors are identifying billing and electronic attendance system errors, identifying program weaknesses to be proactive to prevent future errors, analyzing data to update provider training materials and policies/procedures, and providing technical assistance to providers to reduce billing errors. Providers have reported appreciation of direct communication with the QA auditors through the technical assistance process.   Quality-Assurance Audits SAO Description of Condition: The Department’s post-payment audits were not timely. Most of the audits took place between six months and a year after the month of service. oDepartment Response: The Child Care Subsidy Programs Integrity Plan was updated 7/1/2025 but was not considered for this audit because it was outside the audit period being tested by SAO. oDepartment Response: Child care providers are allowed to claim for payments up to 3 months following the month of service.  In addition, a provider has 45 days to provide records to the Department for the month of service being requested.  Based on these legal requirements the Department has revised the Child Care Subsidy Programs Integrity Plan to reflect a more accurate goal of 6-12 months for audit completion. SAO Description of Condition: For four months of the year, the Department reviewed about 100 audits per month instead of 240 in its plan.  oDepartment Response: During the time period outlined above the Department had one vacant position. The remaining five QA auditors processed and completed 100 monthly audits. In addition to reviewing documents for compliance, the QA auditors also work with providers daily to provide technical assistance by reviewing billing rules to help the providers comply with Department billing policies. These activities are focused on educating providers about child care subsidy rules to assist with reduction of billing errors in the future. oDepartment Response: As noted above, the Department requires additional funding to increase the number of monthly provider audits completed, or to fund an information technology solution and system linkage between the payment and all of the electronic attendance systems used by providers SAO Description of Condition: The Department identified overpayments in 1,493 of the 2,228 (67%) post-payment audits it completed during the year. oDepartment Response: Billing errors identified during the QA audit period included not providing attendance records, missing signatures, general billing mistakes, and incorrectly using an electronic attendance system.  As part of the administrative hearings process, a provider may request a hearing from Department of Social and Health Services (DSHS).  At these hearings the providers may submit attendance records or receipts that were not previously provided to the Department and have the overpayments reduced or removed completely.  oDepartment Response: Since 2018, the Department has supplemented random audits with focused audits. The Department is in process of increasing monthly focused audits received from referrals or providers identified with an Intentional Program Violation (IPV).  The remaining audit capacity incorporates random audits to meet the monthly target and ensure unbiased program oversight.    SAO Description of Condition: In total, the Department itself identified $2,185,753 in provider overpayments, or 22% of the payments it audited.  oDepartment Response: When overpayments are identified the Department writes an overpayment letter and provides it to the DSHS Office of Financial Recovery (OFR). OFR then sends the letter to the provider for recovery. Providers are allowed due process via administrative hearing following this formal notification. oDepartment Response: In fiscal year 2025, OFR recovered provider overpayments in the amount of $2,426,515.27. This amount may be inclusive of overpayments from previous fiscal years.   As to the auditor’s specific recommendations, the Department provides the following additional information: SAO Recommendation: Update its written procedures to better describe its post-payment audit process. This should include a description of how staff select random and risk-based providers to audit. o   Department Response: The Department is in the process of updating and improving quality assurance audit procedures. The current procedures provide an outline and high-level overview while the specific details are completed by the quality control specialists and their supervisor. The procedures state that the six QA auditors are assigned both random and focused providers to audit. Random audits are determined by the use of a random number generator. QA auditors also perform focused audits based on referrals from licensing, OFR, or program staff. However, the procedures do not describe the specific methods or factors used by the Department to make the selections. The updated procedures will provide detail on how cases are selected and assigned for the monthly audit totals. This update is in addition to the Child Care Subsidy Programs Integrity Plan which outlines the program integrity efforts. SAO Recommendation: Provide additional resources to fully execute its Child Care Subsidy Program Integrity Plan. Based on its own audits and the results of our statistical sampling in this audit, the Department should consider expanding its audit effort until it is able to implement pre-payment controls. o   Department Response:The Department agrees this would increase provider payment integrity. The Department will need investment to increase the number of staff who audit provider payments or significant investment in an information technology platform that allows a pre-payment review of all payments. The Department also recognizes that electronic attendance systems require manual input for tracking and is not a preventative internal control by itself.             SAO Recommendation: Link its payment and attendance reporting systems to prevent making payments that lack required supporting documentation. o   Department Response:The Department agrees this would increase provider payment integrity. The Department will need investment to increase the number of staff who audit provider payments or significant investment in an information technology platform that allows a pre-payment review of all payments. The Department also recognizes that electronic attendance systems require manual input for tracking and is not a preventative internal control by itself. ·         SAO Recommendation: Follow up with the providers that did not respond to requests for records during this audit. o   Department Response:In February 2026, the Department processed overpayments for the exceptions identified by SAO and submitted the overpayments to DSHS OFR for recovery. ·         SAO Recommendation: Consult with the grantor to discuss whether the known questioned costs identified in this audit should be repaid. o   Department Response:When the Department of Health and Human Services (HHS) issues a management decision letter for the fiscal year 2025 finding, the Department will work with HHS and follow the audit resolution process.   Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. 45 CFR Part 75, section 403, Factors affecting allowability of costs, establishes requirements for the collection of unallowable costs. 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington Administrative Code (WAC) 110-15-0034 Providers Responsibilities. Child care providers who accept child care subsidies must do the following: 1.      Licensed or certified child care providers who accept child care subsidies must comply with all child care licensing or certification requirements contained in this chapter, chapter 43.216 RCW and chapters 110-06, 110-300, 110-300D, 110-300E, and 110-301 WAC. 2.      In-home/relative child care providers must comply with the requirements contained in this chapter, chapter 43.216 RCW, and chapters 110-06 and 110-16 WAC. 3.      In-home/relative child care providers must not submit an invoice for more than six children for the same hours of care. 4.      All child care providers must use DCYF's electronic attendance recordkeeping system or a DCYF-approved electronic attendance recordkeeping system as required by WAC 110-15-0126. Providers must limit attendance system access to authorized individuals and for authorized purposes, and maintain physical and environmental security controls. a.       Providers using DCYF’s electronic recordkeeping system must submit monthly attendance records prior to claiming payment. Providers using a DCYF-approved electronic recordkeeping system must finalize attendance records prior to claiming payment b.      Providers must not edit attendance records after making a claim for payment 5.      All child care providers must complete and maintain accurate daily attendance records. If requested by DCYF or the state auditor, the provider must provide to the requesting agency the following records: a.       Attendance records must be provided to DCYF within 45 calendar days of the date of a written request from either department; and b.      Attendance records must be provided to the state auditor’s office within 30 calendar days from the date of a written request 6.      Pursuant to WAC 110-15-0268, the attendance records delivered to DCYF may be used to determine whether a provider overpayment has been made and may result in the establishment of an overpayment and in an immediate suspension of the provider's subsidy payment. 7.      All child care providers must maintain and provide receipts for billed field trip/quality enhancement fees as follows. If requested by DCYF, the provider must provide the following receipts for billed field trip/quality enhancement fees: a.       Receipts from the previous 12 months must be available immediately for review upon request by DCYF; b.      Receipts for one to five years old must be provided within 28 days of the date of a written request from either department. 8.      All child care providers must: a.       Retain all records required by this chapter for a minimum of five years b.      Provide to the department records from the previous 12 months immediately upon the department’s written request c.       Provide to the department any records between 12 months and five years old within two weeks of the department’s written request 9.      All child care providers must collect copayments directly from the consumer or the consumer’s third-party payor, and report to DCYF if the consumer has not paid a copayment to the provider within the previous 60 days 10.  All child care providers must follow the billing procedures required by DCYF Washington Administrative Code (WAC) 110-15-0190 WCCC benefit Calculations 1.      DCYF determines the amount of care consumers may receive at application or reapplication. Once the care is authorized, the amount will not be reduced during the eligibility period unless a.       Consumers request reductions; b.      The care is for school-aged children c.       The authorization was for additional care needed for less than the entire length of the authorization period d.      The care was authorized by child protective services (CPS) or child welfare services (CWS) and is part of children’s case plans under WAC 110-15-4510 e.       Incorrect information was given at application or reapplication 2.      For parents age 21 years or younger who are attending high school or working towards completing a high school equivalency certificate, DCYF will authorize care based only on their student activity schedules. 3.      To determine the amount of weekly hours of care needed, DCYF reviews the child care scheduled with providers, and: a.       Consumers’ participation in approved activities and the number of hours their children attend school, including home school, which will reduce the amount of care needed; or b.      The days and times that approved activities overlap in a two parent or guardian household, and only authorize care during those overlapping times. Consumers are eligible for full-time care if overlapping care totals 110 hours in one month c.       Parents or guardians in two parent or guardian households who are not able to care for their children under WAC 110-15-0020 are considered by DCYF to be unavailable for care, regardless of their schedules 4.      Licensed or certified center child care is authorized as follows: a.       Full-time monthly unit of care, equal to 22 full day units, is authorized when:                                                               i.      WCCC or SCC consumers participate in approved activities at least 110 hours per month or full-time care is determined to be appropriate and included in a CPS or CWS case plan; and                                                             ii.      Their children have scheduled care with a single provider at least 110 hours per month b.      Part-time monthly unit of care, equal to the actual anticipated full- and half-day units of care needed averaged over a 12-month period, is authorized when the care scheduled with providers is less than 110 hours per month c.       Part-time partial-day monthly unit is authorized when school-age children attend care in a licensed family home and meets the criteria in subsection (5) of this section 5.      Licensed family home child care is authorized as the following monthly units of care: a.       Full-time monthly unit of care, equal to 22 full day units, is authorized when:                                                               i.      WCCC or SCC consumers participate in approved activities at least 110 hours per month or full-time care is determined to be appropriate and included in a CPS or CWS case plan; and                                                             ii.      Their children have scheduled care with a single provider at least 110 hours per month. b.      Part-time monthly unit of care, equal to the actual anticipated full- and half-day units of care needed averaged over a 12-month period, is authorized when the care scheduled with providers is less than 110 hours per month. c.       Full-time partial-day monthly unit is authorized when school-age children attend care in a licensed family home and meets the criteria in subsection (5) of this section. d.      Part-time partial-day monthly unit is authorized when school-age children attend care in a licensed family home before and after school and do not meet the criteria for a full-time partial-day monthly unit. 6.      Additional monthly units of care may be authorized when: a.       Consumers request an authorization for additional care; b.      The need for care is verified; c.       The care is needed to supplement an existing monthly unit for unexpected care needed for an approved activity limited to the time frame needed, not to exceed three months; d.      For actual anticipated overtime when the overtime is included when determining eligibility for child care; or e.       For sleep time 7.      Full-time partial-day monthly unit. A single partial-day monthly unit equal to 17 partial days and five full days is authorized for school-age children attending a licensed family home child care when consumers have at least 110 hours of approved activity per month, and their children are: a.       Authorized for care with only one provider; b.      Scheduled for care of 110 hours or more in July and August; c.       In care less than five hours on a typical school day; and d.      Need care before and after school. 8.      When determining part-time care for families using licensed providers when their activity or amount of care needed is less than 110 hours per month: a.       A full-day unit is calculated for each day of care of at least five hours; b.      A half-day unit will be calculated for each day of care that is less than five hours; and c.       A partial-day unit is calculated for each day of care in a licensed family home when:                                                               i.      Their children are in care before and after school; and                                                             ii.      The total care for the day is less than five hours. 9.      Full-time care for families using in-home/relative providers is authorized when consumers participate in approved activities at least 110 hours per month: a.       Two hundred thirty hours of care are authorized when their children are in care five or more hours per day; b.      One hundred fifteen hours of care is authorized when their children are in care less than five hours per day; c.       One hundred fifteen hours of care is authorized during the school year for school-aged children who are in care less than five hours per day and their providers are authorized for contingency hours each month, up to a maximum of 230 hours; d.      Two hundred thirty hours of care is authorized during the school year for school-aged children who are in care five or more hours in a day; and e.       Supervisor approval is required for hours of care than exceed 230 hours per month 10.  Care cannot exceed 16 hours per day, per child 11.  When determining part-time care for families using in-home/relative providers: a.       Under the provisions of subsection (2) of this section, DCYF authorizes the number of hours of care needed per month when the activity is less than 110 hours per month; and b.      The total number of authorized hours and contingency hours claimed cannot exceed 230 hours per month. 12.  DCYF determines the allocation of hours or units for families with multiple providers based upon the information received from the parents or guardians 13.  DCYF may authorize more than the state rate and up to the provider’s private pay rate if: a.       The parent or guardian is a WorkFirst participant; and b.      Appropriate child care, at the state rate, is not available within a reasonable distance from the approved activity site. “Appropriate” means licensed or certified child care under WAC 110-15-0125, or an approved in-home/relative provider under WAC 110-16-0010. “Reasonable distance” is determined by comparing distances other local families must travel to access appropriate child care. 14.  Other feeds DCYF may authorize to a provider are: a.       Registration fees; b.      Field trip fees; c.       Nonstandard hours bonus; d.      Overtime care to licensed providers when care is expected to exceed 10 hours in a day when consumers are eligible and authorized; and e.

2025-034       The Department of Children, Youth, and Families improperly charged $9,980 to the Child Care and Development Fund. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACDC6; 2303WACCDD; 2303WACCDF; 2403WACCDD; 2403WACCDF; 2403WACCDM; 2503WACCDD; 2503WACCDF; 2503WACCDM; 2503WACCDY Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: $9,980 Prior Year Audit Finding: No       Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2025, the Department spent about $369 million in CCDF federal funding. The Department determines child care eligibility for CCDF clients. In fiscal year 2025, the Department spent more than $296.6 million in CCDF federal grant funds on child care subsidy payments to providers. The requirements and policies in Washington for child care payments are consolidated under the Working Connections Child Care program. For a family to be eligible for child care assistance, state and federal rules require that at the time of application or reapplication, children must: Reside in Washington and be a citizen or legal resident of the United States for federal funding and only reside in Washington for state funding. Be younger than 13 years, or if for verified special needs, be younger than 19 years. Reside with a parent(s) or guardian whose countable income does not exceed 60% of the state median income at application or 65% of the state median income at reapplication or meet other specific criteria exempting them from this income limit. Reside with a parent(s) or guardian who works or attends a job-training or education program, experiencing homelessness, or has received protective services. State rules describe the information clients must provide to the Department to verify their eligibility. The information must be accurate, complete, consistent and from a reliable source. This information includes, but is not limited to, employer and wage information, and family household size and composition. The Department enters client data into the Barcode system.  Barcode is the Washington State Department of Social and Health Services’ (DSHS) electronic case management and document imaging system. It is used to store, organize, and route client information, verification documents, and eligibility-related actions for multiple public assistance programs. Once determined to be eligible for the program, a child is eligible for one year unless a change in income causes the household to exceed 85% of the state’s median income. The Department requires clients to self-report such income changes. A written notice communicates the recipients’ reporting requirement and the specific dollar threshold applicable to the household’s annual income. Once the client’s income exceeds this cutoff level, the Department terminates services. The Department has access to systems that contain wage and household benefit and composition data for some, but not all child care recipients. The Department uses this information in part to determine program eligibility, benefit level, including client copayment, and the amount of child care the family is eligible to receive. The Department will request verification from the family when unable to verify necessary information within these systems. If an ineligible client receives assistance, the payment made to the child care provider is not allowable and the client must repay the ineligible amount. The Department, in conjunction with DSHS, uses a Payment Allocation Model (PAM) within the Barcode system that uses statistical analysis (SAS) coding to review client eligibility data and determine the correct funding source. The PAM process occurs after eligibility is determined and child care is authorized. The payment is then assigned to the appropriate funding source based on funding criteria. The Department makes accounting adjustments between state and federal funding sources in its general ledger when needed to meet different spending requirements for CCDF. This process includes identifying allowable expenditures that can be moved to different funding sources. This can include moving funds originally charged as state funds to federal and federal to state or moving federal funds between different funding sources. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Department improperly charged $9,980 to CCDF. We found the Department had adequate internal controls to ensure material compliance with eligibility requirements.  We used a statistical sampling method to randomly select and examine 59 out of a total population of 75,093 clients. In all but one case, the clients tested were eligible to be paid with CCDF funds. For one sampled client (1.7%), we determined they were not eligible to be paid with CCDF funds but did meet eligibility criteria to be paid with state funds and therefore eligible for the Working Connections Child Care program. The Department paid $33 in child care payments for this client with federal CCDF after the eligibility determination that we tested was made. In addition, through its accounting adjustments, the Department moved an additional $1,650 in child care payments for this client from state funding to federal CCDF based on the PAM allocation, for a total of $1,683. Furthermore, during the payment review, we identified an additional $6,647 in federal CCDF funds, including $1,650 that was moved from state to federal funding, that was spent for this client prior to the eligibility determination we tested. Cause of Condition Management said it did not verify that the Payment Allocation Model’s (PAM) automated logic consistently aligned with program funding requirements. Furthermore, the Department said the accounting adjustment process relies on PAM’s automated source of fund determinations to identify allowable transactions when moving funds among different funding sources. Effect of Condition and Questioned Costs The PAM allocation error resulted in $1,683 of federal overpayments to providers, with an additional $8,297 in federal overpayments to providers identified prior to the eligibility determination. Because we used a statistical sampling method to randomly select the payments examined in the audit, we estimate the amount of likely questioned costs to be $2,142,060. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95% confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely questioned cost projections are a point estimate and only represent our “best estimate of total questioned costs” as required by 2 CFR 200.516(a)(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department’s Response The Department also concluded that due to a coding error federal funds were incorrectly used for one client who should have been paid with state funds. As stated in the Description of Condition, all clients who were audited met the eligibility requirements for the Working Connections Child Care (WCCC) program, meaning they were deemed eligible for subsidy payment.  The system coding error in the Payment Allocation Model (PAM) process led to the wrong source of funds being used for the client. PAM directs the specific funding source used for payments. This was a technical fiscal coding error, not a failure of program eligibility controls.  Funding sources are selected after eligibility is determined and used to ensure payments are for allowable activities. During the audit period, a coding error in PAM resulted in federal funds being allocated to this client instead of state funds. The coding error was corrected in November 2025 to prevent further occurrences of this specific error. To ensure the continued accuracy, the Department has implemented a monthly quality assurance review of a sample of PAM allocations in collaboration with the Department of Social and Health Services.  In addition, in February 2026, the Department processed an accounting adjustment to return the $9,980 in questioned costs to the CCDF grant. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs.

2025-035   The Department of Children, Youth, and Families improperly charged $543,205 to the Child Care Development Fund program. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: 2103WACDC6; 2303WACCDD; 2303WACCDF; 2403WACCDD; 2403WACCDF; 2403WACCDM; 2503WACCDD; 2503WACCDF; 2503WACCDM; 2503WACCDY Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Period of Performance Known Questioned Cost Amount: $543,205 Prior Year Audit Finding: Yes, Finding 2024-058       Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2025, the Department spent about $369 million in CCDF federal funding. Each federal grant specifies a performance period during which recipients must obligate and liquidate program costs. These periods typically align with the federal fiscal year of October 1 through September 30. Payments for costs charged before a grant’s beginning date or after the ending date are not allowed without the grantor’s prior approval. The CCDF consists of three distinct funding sources: Discretionary Fund, Mandatory Fund and Matching Fund. Each fund has specific period of performance requirements established in federal regulation (45 CFR 98.60(d)). The Department must obligate: ·         Discretionary funds by the end of the succeeding fiscal year after award and must expend them by the end of the third fiscal year after award ·         Mandatory funds by the end of the fiscal year in which they are awarded if the state also requests matching funds. If the state does not request matching funds for the fiscal year, then the Mandatory funds are available until liquidated. ·         Matching funds by the end of the fiscal year in which they are awarded and must liquidate them by the end of the succeeding fiscal year after award   The Department chooses to fully expend these awards within the obligation period. To ensure the Department is compliant with period of performance requirements and expenditures are within the allowed period of performance, it performs regular reviews of expenditures charged to open awards. This process includes a review of expenditures cost allocated to CCDF awards after they are recorded in the accounting system.  In prior audits we reported the Department did not have adequate internal controls over period of performance requirements for the CCDF program. The prior finding numbers were 2024-058, 2023-061, 2022-043, 2021-037 and 2020-041. Description of Condition The Department improperly charged $543,205 to CCDF program. We found the Department had adequate internal controls to ensure it materially complied with period of performance requirements. The Department properly expended the federal fiscal year 2023 Discretionary and the federal fiscal year 2024 Mandatory and Matching awards within the required obligation period. However, during state fiscal year 2025, there were three awards with project start dates during our audit period. We analyzed expenditures charged to these awards in the accounting system and identified $169,052 in expenditures that were cost allocated to two awards for activity that occurred before these awards opened. The Department provided documentation it said shows an adjustment was made to correct these charges. Because the adjustment occurred outside the audit period, we did not consider it during the audit. In addition, for two awards already open before the start of fiscal year 2025, we identified $5,782 in expenditures manually moved and $370 in expenditures cost allocated to these awards in the audit period that were for activities that occurred before these awards opened. Lastly, there were two awards with liquidation requirements during the audit period. Through a review of expenditures charged to these awards, we identified $368,001 for one award with expenditures that were charged to the award two weeks after the liquidation period had ended. Cause of Condition For the expenditures with activity that occurred before the award opened, management did not review the cost allocated expenditures timely to verify they were within the allowed period of performance. For the expenditures that were manually moved, the Department stated these exceptions occurred because there was a delay in processing the period of performance activity. For the expenditures charged after the liquidation period, the Department initially charged these expenditures during an allowed liquidation period to a different CCDF award. However, these expenditures were later moved over to the award that was closed to fully expend the award. Effect of Condition and Questioned Costs We identified $543,205 in known questioned costs for expenditures that occurred outside of the period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid.  Department’s Response The Department does not agree with the State Auditor’s Office (SAO) finding that $543,205 in expenditures were improperly charged to the CCDF grants.  The Department utilizes grant-level management for all federal funds, including the CCDF grant. This process consists of making grant adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements are met. The Department maintains that the expenditures were properly charged to the correct grants and provides the following additional details: SAO identified $169,052 in expenditures charged to the CCDF grant prior to the grant being opened. The Department manages multiple CCDF funding sources and federal grant years at the same time and uses the above-mentioned grant adjustments to move expenditures to the proper grant. The Department provided documentation to SAO showing the expenditures identified were corrected in state fiscal year 2026.  This correction was outside the SAO audit period and therefore not considered for this audit. No expenditure was improperly charged to the CCDF grant. SAO identified $6,152 as questioned costs for the federal fiscal year 2024 CCDF grant. The Department agreed during testing that this assumption was correct.  After further review of the data and discussion with SAO, the Department determined the credits were moved to the correct period to offset recoveries that were applied to the grant. As evidenced by the quarterly claims for those periods, all funds were appropriately documented and returned to the federal grantor. Expenditures were obligated and expended within the allowable grant period. SAO identified $368,001 that didn’t meet the liquidation requirements during the audit period because they were processed in calendar month October 2024.  The Department disagrees with this assessment. The initial expenditures identified by SAO were recorded in the proper liquidation period and were charged to the CCDF Discretionary grant.  The Department then processed an accounting adjustment to leverage the available grants funds as per our grant-level management practice.  This adjustment occurred in the Agency Financial Reporting System (AFRS) during September 2024, which was within the liquidation period.  AFRS records accounting adjustment based on fiscal month and not the date the document was entered into the system; therefore, the adjustment made in calendar month October was allowable per state financial rules because it was recorded in the proper fiscal month. When the Department of Health and Human Services (HHS) issues a management decision letter for the fiscal year 2025 finding, the Department will work with HHS and follow the audit resolution process. Auditor’s Remarks We are required to report noncompliance identified during the audit period. The Department asserts that it corrected $169,052 of the improper charges during the next fiscal year. Since this activity occurred in a different fiscal year than our audit, we did not review those transactions. The Department asserts it provided support for $6,152 of the questioned costs. Specifically, that they were moved to the correct period. During fieldwork, we received written confirmation the Department agreed with these exceptions, and no further support was provided. The liquidation period is when the Department is required to pay and account for all financial obligations for an award to allow the Department to close out the financial activity for this award. The Department asserts that the $368,001 was originally paid with FFY23 Discretionary funds during the allowable liquidation period. However, these expenditures were then moved to the FFY22 Discretionary award in October of 2024, which was after its liquidation period. We reaffirm our audit finding and will review the status of the Department’s corrective action during the next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 2, Definitions, includes the definition for questioned costs. Part 75.410 establishes requirements for the collection of unallowable costs. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, section 98.60 – Availability of funds, states in part: (d)    The following obligation and liquidation provisions apply to States and Territories: (1)   Discretionary Fund allotments shall be obligated in the fiscal year in which funds are awarded or in the succeeding fiscal year. Unliquidated obligations as of the end of the succeeding fiscal year shall be liquidated within one year. (2)     (i) Mandatory Funds for States requesting Matching Funds per section 98.55 shall be obligated in the fiscal year in which the funds are granted and are available until expended (ii) Mandatory Funds for States that do not request Matching Funds are available until expended (3)   Mandatory Funds for Territories shall be obligated in the fiscal year in which funds are granted and liquidated no later than the end of the succeeding fiscal year (4)   Both the Federal and non-Federal share of the Matching Fund shall be obligated in the fiscal year in which the funds are granted and liquidated no later than the end of the succeeding fiscal year.

2025-036       The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with health and safety requirements for the Child Care and Development Fund program. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACDC6; 2303WACCDD; 2303WACCDF; 2403WACCDD; 2403WACCDF; 2403WACCDM; 2503WACCDD; 2503WACCDF; 2503WACCDM; 2503WACCDY Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Health and Safety Requirements Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-060       Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2025, the Department spent about $369 million in CCDF federal funding. The Department oversees two types of providers: licensed providers and license-exempt Family, Friends, and Neighbor (FFN) providers. The Department is responsible for ensuring all these providers meet health and safety standards. The monitoring activity varies for licensed and FFN providers. The Department has an approved CCDF State Plan for federal fiscal year 2025-2027 that outlines how it will meet the health and safety requirements for licensed and FFN providers. Licensed providers Department licensors conduct annual monitoring visits of licensed providers. During visits, they complete an inspection checklist to verify whether providers have met required health and safety standards. The licensors use the WA Compass system to document their activities. The system allows licensing staff to monitor the completion of visits, make timely updates, and streamline their processes. When licensors identify health and safety violations during a monitoring visit, they document them on an inspection report. The inspection report contains the areas of provider noncompliance and establishes deadlines for correcting them. The Department is required to conduct timely follow-up visits on noncompliance issues to ensure providers correct them. Depending on the severity of the noncompliance, the Department has either five, 10, or 15 business days to verify the noncompliance has been corrected. FFN providers Washington’s CCDF State Plan and a state rule (WAC 110-16-0025) require nonrelative FFN providers to complete health and safety training within 90 days of their subsidy payment begin date. They also must complete ongoing health and safety training. The Department conducts an annual health and safety visit to ensure providers are following health and safety rules. The Department adopted a rule (WAC 110-16-0030) that states it must conduct annual technical assistance visits for nonrelative FFN providers within a year of subsidy payment begin date. During these visits, an FFN specialist reviews health and safety requirements and reminds the provider of the ongoing training requirements. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In the 10 prior audits, we reported that the Department did not have adequate internal controls over and did not comply with health and safety requirements. The previous finding numbers were 2024-060, 2023-064, 2022-045, 2021-039, 2020-042, 2019-039, 2018-035, 2017-025, 2016-022 and 2015-024. Description of Condition The Department did not have adequate internal controls over and did not comply with health and safety requirements for the CCDF program. Licensed provider annual monitoring and noncompliance follow-ups We used a statistical sampling method to randomly select 59 out of a total population of 7,014 licensed providers. We examined this sample of licensed providers to determine if they received an annual monitoring visit, the Department completed the child care inspection checklist, and the Department performed timely, appropriate follow-ups when they found noncompliance issues. We identified eight (14%) instances in which the licensor did not conduct the appropriate follow-up visit on noncompliance issues within the required time frame. In addition, we identified eight (14%) instances in which the licensor did not complete health and safety items on the child care inspection checklist. Items not checked included: Prevention of sudden infant death syndrome and use of safe sleeping practices Appropriate precautions in transporting children Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man-caused event Building and physical premises safety Handling and storage of hazardous materials Nonrelative FFN provider ongoing training and annual technical visits The Department asserted that it uses the FFN Household CCDF Monitoring Report in WA Compass to determine if the FFN meets all training requirements. After reviewing this report, we determined that while the report contains information on current training requirements, it does not contain information for training that has already occurred during the audit period. Due to the limitations of this report and the Department’s limited ability to extract data from WA Compass, 16 (29%) of the 55 license-exempt FFN providers selected to be tested for ongoing training requirements were not required to complete the ongoing training. We examined records for the remaining 39 providers in our sample and did not identify any issues.  In addition, the Department could not demonstrate how FFN specialists and management use this report to ensure all training occurred, as required. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Licensed provider annual monitoring and noncompliance follow-ups Department officials said the agency did not conduct eight out of 59 monitoring follow-up visits within the required time frame because it was unable to maintain a necessary level of staffing. Additionally, the Department did not complete eight out of the 59 inspection checklists because staff did not follow correct system steps. Additionally, management did not ensure monitoring follow-up visits on identified noncompliance occurred, as the CCDF program requires and that inspection checklists were completed. Nonrelative FFN provider ongoing training and technical visits Department officials said the FFN WA Compass system reports are based on real-time data. Therefore, the Department was unable to provide a report with FFN historical data to demonstrate  compliance with due dates and to document monitoring activities, including training requirements. The FFN providers can change circumstances throughout the fiscal year such as transitioning from relative to nonrelative care or opening and closing their service multiple times. Since the FFN reports are real-time, this prevents the Department from being able to demonstrate compliance with requirements.  Effect of Condition Licensed provider annual monitoring and noncompliance follow-ups By not following up on noncompliance in a timely manner or completing all health and safety components of the inspection checklist, the Department did not have assurance that providers met health and safety requirements, which can put children in jeopardy of harm, neglect and unhealthy environments. Nonrelative FFN provider ongoing training and technical visits By not retaining documentation of the monitoring activities over FFN nonrelative providers who required ongoing training during the audit period, the Department could not demonstrate that it was performing accurate monitoring. Recommendations We recommend the Department: Strengthen internal controls to ensure it sufficiently monitors all health and safety requirements Ensure management follows established policies and procedures to ensure licensors complete all monitoring visits and checklists, and conduct thorough, timely follow-ups on any identified noncompliance issues Improve documentation of internal controls to support that it performed monitoring activities during the audit period Department’s Response The Department is strongly committed to ensuring the health, safety, and well-being of all children in care.  As to the State Auditor’s Office (SAO) specific findings, the Department concurs and offers the following details: Licensed provider annual monitoring and noncompliance follow-ups The Department concurs that follow up visits were not completed timely for the eight out of 59 sample cases identified by SAO. During state fiscal year 2025 the Department completed 100% of on-site monitoring visits. Although the follow up visits were not completed within the timelines required, 100% of the follow up visits occurred. Licensed child care providers have increased by 22.6% since the end of 2020 with an average annual growth of 4.2% and 2025 has increased 7.3% since the end of 2024, without a corresponding increase in licensing staff.  Given the Department’s limited staffing resources and high volume of providers, the Department was unable to complete all follow up visits within the timelines required. Compared to the previous state fiscal year, there has been a positive trend in compliance for 2025. In state fiscal year 2024, SAO identified 16 instances (27%) in which the licensor did not conduct the appropriate follow-up visit on noncompliance issues within the required time frame compared to state fiscal year 2025 in which 8 instances (14%) have been identified. Management continues to follow established policies and procedures as well as continually reviewing reports to improve the timely response of follow-up visits. The Department concurs that eight out of the 59 inspection checklists were not complete because staff did not follow correct system steps. The Department will conduct an internal review of the system steps to complete an inspection checklist and make necessary adjustments to the system as well as provide additional training to licensing staff on the inspection process. During state fiscal year 2025 the Department took the following actions to strengthen internal controls and increase recruitment of licensing staff: WA Compass made steady improvements to the system each month to help the system run more smoothly and keep information accurate. These improvements make the system better for licensed child care and license-exempt staff and providers Established a new pre-licensing team to create an efficient and streamlined pathway for the initial licensure process, allowing licensors to remain focused on completing 100% annual inspections Conducted internal reviews and research of the annual inspection checklists and recheck follow up timelines to support future adjustments to the inspection and recheck process Established a plan for annual informational audit presentations for staff understanding and collaboration on compliance The Department has implemented data-driven decisions to assist providers and their staff to meet health and safety requirements. Additionally, as part of its Collaborative Compliance initiative, the Department is focused on strengthening internal controls around all health and safety requirements and is confident that corrective actions taken will improve this area moving forward. Collaborative Compliance promotes collaboration, encourages innovation, and will focus more on human-centered technical assistance. This initiative prioritizes compliance for all health and safety requirements. Nonrelative FFN provider ongoing training and technical visits The Department partially concurs with the audit finding.  The State Auditor’s Office (SAO) selected samples and examined 39 nonrelative providers that received child care payments during the audit period.  In all instances, SAO found no issues of noncompliance or exceptions, all providers had their required trainings and technical visits as outlined in the Departments applicable health and safety WACs. The MERIT system and the WA Compass system are monitored by staff to ensure providers comply with health and safety requirements. The current WA Compass reports are real-time dashboards to assist staff with determining requirements that are due within 30, 60, 90 days. MERIT is the system of record for individual providers training requirements. Staff perform monitoring activities outlined in the reports to verify compliance, to include checking training completion dates in MERIT and updating WA Compass with the information. Once requirements are met in WA Compass the completed tasks are no longer reflected on the dashboard. The SAO maintained that the program is not auditable without the historical data showing compliance due dates to document monitoring activities including training requirements. The Department is committed to collaborating with SAO to determine an appropriate methodology that identify a sampling unit that can be used to accurately test internal controls around monitoring activities. Staff will continue to track and monitor FFN health and safety requirements with available tools and determine how to retain documentation to demonstrate this compliance for SAO. Auditor’s Remarks Regarding the nonrelative FFN provider ongoing training and technical visits, the Department could not provide a population comprised of only FFN providers who were required to meet the ongoing training and technical visits during the audit period. As such, from the report provided by the Department, we selected 55 providers, but only 39 were applicable to the requirement. Because this report only contains information on current provider status and training requirements, we could not get an accurate population for testing.  We appreciate the Department’s commitment to improve its monitoring and compliance with health and safety requirements. We reaffirm our finding and will follow up on the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 98.41, Health and safety requirements, states: a.Each Lead Agency shall certify that there are in effect, within the state (or other areas served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to § 98.42, shall: 1.Include health and safety topics consisting of, at a minimum: i.The prevention and control of infectious diseases (including immunizations); with respect to immunizations, the following provisions apply: A.As part of their health and safety provisions in this area, Lead Agencies shall assure that children receiving services under the CCDF are age-appropriately immunized. Those health and safety provisions shall incorporate (by reference or otherwise) the latest recommendation for childhood immunizations of the respective State, territorial, or tribal public health agency. B.Notwithstanding this paragraph (a)(1)(i), Lead Agencies may exempt: 1.Children who are cared for by relatives (defined as grandparents, great grandparents, siblings (if living in a separate residence), aunts, and uncles), provided there are no other unrelated children who are cared for in the same setting. 2.Children who receive care in their own homes, provided there are no other unrelated children who are cared for in the home. 3.Children whose parents object to immunizations on religious grounds. 4.Children whose medical condition contraindicates immunization. C.Lead Agencies shall establish a grace period that allows children experiencing homelessness and children in foster care to receive services under this part while providing their families (including foster families) a reasonable time to take any necessary action to comply with immunization and other health and safety requirements. 1.The length of such grace period shall be established in consultation with the State, Territorial, or Tribal health agency 2.Any payment for such child during the grace period shall not be considered an error in improper payment under subpart K of this part 3.The Lead Agency may also, at its option, establish grace periods for other children who are not experiencing homelessness or in foster care 4.Lead Agencies must coordinate with licensing agencies and other relevant State, Territorial, Tribal, and local agencies to provide referrals and support to help families of children receiving services during a grace period comply with immunization and other health and safety requirements; ii.Prevention of sudden infant death syndrome and use of safe sleeping practices; iii.Administration of medication, consistent with standards for parental consent; iv.Prevention and response to emergencies due to food and allergic reactions; v.And physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; vi.Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; vii.Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man- caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; viii.Handling and storage of hazardous materials and the appropriate disposal of bio contaminants; ix.Appropriate precautions in transporting children, if applicable; x.Pediatric first aid and cardiopulmonary resuscitation; xi.Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e)of this section; and xii.May include requirements relating to: A.Nutrition (including age-appropriate feeding); B.Access to physical activity; C.Caring for children with special needs; or D.Any other subject area determined by the Lead Agency to be necessary to promote child development or protect children’s health and safety 2.Include minimum health and safety training on the topics above, as described in § 98.44 b.Lead Agencies may not set health and safety standards and requirements other than those required in paragraph (a) of this section that are inconsistent with the parental choice safeguards in §  98.30(f). c.The requirements in paragraph (a) of this section shall apply to all providers of child care services for which assistance is provided under this part, within the area served by the Lead Agency, except the relatives specified at § 98.42(c). d.Lead Agencies shall describe in the Plan standards for child care services for which assistance is provided under this part, appropriate to strengthening the adult and child relationship in the type of child care setting involved, to provide for the safety and developmental needs of the children served, that address: 1.Group size limits for specific age populations; 2.The appropriate ratio between the number of children and the number of caregivers, in terms of age of children in child care; and 3.Required qualifications for caregivers in child care settings as described at § 98.44(a)(4) e.Lead Agencies shall certify that caregivers, teachers, and directors of child care providers within the State or service area will comply with the State’s, Territory’s, or Tribe’s child abuse reporting requirements as required by section 106(b)(2)(B)(i) of the Child Abuse and Prevention and Treatment Act (42 U.S.C. 510a(b)(2)(B)(i)) or other child abuse reporting procedures and laws in the service area. Washington Administrative Code (WAC) 110-16-0025 Health and Safety Training: 1.A provider described in WAC 110-16-0015 (4)(b) or (c) must complete the following training within ninety calendar days of the subsidy payment begin date: i.Infant, child, and adult first aid and cardiopulmonary resuscitation (CPR): A.This training must be taken in person and the provider must demonstrate learned skills to the instructor. B.The instructor must be certified by the American Red Cross, American Heart Association, American Safety and Health Institute, or other nationally recognized certification program. ii.Prevention of sudden infant death syndrome and safe sleep practices when caring for infants; and iii.Department approved health and safety training which includes the following topics areas: A.Prevention and control of infectious diseases; B.Administration of medication; C.Prevention of, and response to, emergencies due to food and allergic reactions; D.Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; E.Prevention of shaken baby syndrome, abuse head trauma, and child maltreatment; F.Emergency preparedness and response planning for natural disasters and human-caused events; G.Handling and storage of hazardous materials and the appropriate disposal of bio contaminants; H.Appropriate precautions in transporting children; I.Recognition and reporting of child abuse and neglect, including the prevention of child abuse and neglect as defined in RCW 26.44.020 and mandatory reporting requirements under RCW 26.44.030; and J.Other topic areas as determined by the Department. 2.A provider described in WAC 110-16-0015 (4)(b) or (c) can meet the health and safety training in subsection (1)(c) of this section if the department verifies that the provider has completed any of the following either prior to or within ninety calendar days of the subsidy payment begin date: i.Child care basics, a department approved thirty-hour health and safety training ii.Washington state early childhood education initial certificate (twelve credits) that includes early childhood education and development 105 health, safety, and nutrition 3.A provider described in WAC 110-16-0015 (4)(b) or (c) must complete a minimum of two hours of health and safety training annually, using the subsidy payment begin date. The training must include, but is not limited to, one or more of the following: i.Prevention and control of infectious diseases; ii.Emergency preparedness and response planning for natural disasters and human-caused events; iii.Recognizing and prevention of shaken baby syndrome, head trauma abuse, neglect, and child maltreatment; and iv.Prevention of sudden infant death syndrome and safe sleep practices, if caring for an infant or toddler. WAC 110-16-0030 Health and safety activities: 1.A provider described in WAC 110-16-0015 (4)(b) or (c), must participate in an annual, scheduled visit conducted by department staff in the home where care is provided. 2.The purpose of the visit is to: a.Provide technical assistance to the provider regarding the health and safety requirements described in this chapter; b.Observe the provider’s interactions with the child, and discuss health and safety practices; c.Provide written information and local resources about child development to include the major domains of cognitive, social, emotional, physical development, and approaches to learning; and d.Provide regional contact information for FFN child care services and resources. 3.A provider will be considered out of compliance with the requirements of this chapter if, after three attempts, the department is not able to complete an annual, scheduled visit in the home where care is provided. 4.At the annual, scheduled visit, the provider must show, unless previously provided to the department: a.Proof of identify; b.Proof of current certification for first aid and cardiopulmonary resuscitation (CPR) in the form of a card, certificate, or instructor letter; c.Proof of vaccination against or acquired immunity for vaccine-preventable diseases for all children in care, if the provider’s children are on-site at any time with the eligible children. Proof can include: i.A current and complete department of health (DOH) certificate of immunization status (CIS) or certificate of exemption (COE) or other DOH approved form; or ii.A current immunization record from the Washington state immunization information system (WA IIS). d.Written permission from the parent to: i.Allow children to use a swimming pool; ii.Administer medication for treatment of illnesses and allergies of the children in care; iii.Provide for and accommodate developmental and special needs; and iv.Provide transportation for care, activities, and school when applicable. e.The written emergency preparedness and response plan required in WAC 110-16-0035 (8)(c).

2025-037       The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure Foster Care Maintenance payment rates were properly calculated. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2402WAFOST 2502WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – Payment Rate Setting and Application Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-071       Background The federal Foster Care Title IV-E program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state’s child welfare agency until they are returned home, placed with adoptive families or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for adults who are involved in the Foster Care program, including state agency staff, foster parents and certain private agency staff. In Washington, the Department of Children, Youth, and Families administers the Foster Care program. During fiscal year 2025, the Department spent about $164 million in federal grant funds, including about $18.8 million for foster care maintenance payments. The Department must establish payment rates for maintenance payments (for example, payments to foster parents, childcare institutions or directly to youth). The Department’s state plan approved by the Administration for Children and Families must provide for periodic review of payment rates for foster care maintenance payments at reasonable, specific, time-limited periods established by the Department to ensure the rate’s continuing appropriateness for the administration of the Title IV-E program. One of seven levels of maintenance payment amounts are assigned to each child based on a variety of factors such as medical needs. Each of the levels includes an overall increase of $342.50 from the previous level. The Department last recalculated its Foster Care maintenance payment rates in fiscal year 2024. At that time, the different rate level increases were between $50 and $1,302 per month. The Department has established rate structures for regular foster care maintenance payments, Behavioral Rehabilitation Service, and administrative service and management fees. The Department performs an economic analysis every four years to determine rates. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure Foster Care Maintenance payment rates were properly calculated. The prior finding number was 2024-071. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure Foster Care Maintenance payment rates were properly calculated. The Department has a policy that requires an analysis every four years to determine the basic Foster Care maintenance payments; however, the Department did not have written procedures to ensure it established maintenance payment rates exclusively for allowable, reasonable and necessary activities. During the prior audit, we reviewed the rate elements the Department used to determine the final maintenance rates and identified several that, in our judgment, appeared to be unnecessary or unreasonable. During the audit period, the Department did not recalculate the rate or establish procedures to support the following elements, identified in the prior audit, as necessary and reasonable: Apps/games/ringtones for handheld devices Multiple entertainment and recreation costs such as: oTV/video/audio oSatellite dishes oExercise equipment and gear/game tables oVideo game software oStreaming/downloaded audio oStamp and coin collecting oOnline gaming services Food that did not appear to be suitable for children’s activities, such as coffee, soda and other carbonated drinks, and sweets Baby food included in the calculation for older children  We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition In response to the prior year finding, the Department began drafting policies and procedures related to rate setting, but did not complete them during the audit period. In addition, the Department had no new documentation to demonstrate how each rate element was reasonable and allowable. Lastly, the state plan did not reference any procedures, laws or regulations regarding how rates should be calculated; it only referenced the policy stating that rates must be recalculated every four years. Effect of Condition Without policies and procedures to support the allowability of rates, the effect on the rates from the prior year audit still exists. In the prior audit, after removing the identified elements, rates for level one payments were roughly $50 less than what the Department determined. The Basic Rate difference was $49.79 for children up to five years old, $50.27 for children aged six to 11 years, and $52.29 for children aged 12 years and older. Additionally, the Department could not support the overall increase of $342.50 for each level. For levels higher than the basic rate, the Department was unable to support the increases, leading to the Department potentially paying more than what is allowable. Recommendation We recommend the Department develop and implement written procedures for setting payment rates to ensure established foster care maintenance payment rates only include allowable costs. Department’s Response The Department concurs that policies and procedures related to rate setting for Foster Care maintenance payment are not currently established. Due to the timing and frequency of the statewide single audits, the Department is not made aware of a finding until months after the state fiscal year (SFY) concludes. It is not always feasible to correct audit issues before a new audit cycle begins. Thereby, the previous year’s audit issues will remain outstanding up to nine months of the current audit period. For this reason, the Department anticipates receiving repeat findings for consecutive years. Due to limited staffing resources, in September 2024, the Department submitted a budget request for the 2025 supplemental budget.  The request included funding for a contractor to establish a formal governance process, policies and procedures, and create a public rate setting calendar and feedback structure for Department rate setting activities.  This budget request was not funded by the Legislature. In February 2025, the Department met with the SAO to gather an understanding of concerns and how reasonable and allowable rates could be documented to assist with compliance.  In July 2025, the Department began drafting the written policies and procedures and shared the drafts with SAO during the SFY25 audit period.  The Department is committed to strengthening internal controls and complying with federal requirements and will continue to follow internal processes to finalize the payment and rate setting policies and procedures during SFY26. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, Subpart E-Cost Principles Title 45 CFR Part 75, Subpart F-Audit Requirements, establishes standards for obtaining consistency and uniformity among HHS agencies for the audit of non-Federal entities expending Federal awards. Title 42 U.S. Code Chapter 7, Social Security Subchapter IV – Grants to States for Aid and Services to Needy Families with Children and for Child-Welfare Services. Section 675 Definitions Part 4 states in part: 4. The term “foster care maintenance payments” means payments to cover the cost of (and the cost of providing) food, clothing, shelter, daily supervision, school supplies, a child’s personal incidentals, liability insurance with respect to a child, reasonable travel to the child’s home for visitation, and reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement. In the case of institutional care, such term shall include the reasonable costs of administration and operation of such institution as are necessarily required to provide the items described in the preceding sentence. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-038       The Department of Children, Youth, and Families did not have adequate internal controls to ensure payments to providers were allowable and properly supported for the Social Services Block grant. Assistance Listing Number and Title: 93.667 Social Services Block Grant Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2402WASOSR; 2502WASOSR Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: $1,872,842 Prior Year Audit Finding: Yes, Finding 2024-072       Background The Department of Children, Youth, and Families administers the Social Services Block Grant (SSBG) program to provide services to children, youth and young adults for case management, foster care, protective services, transportation, childcare and other services such as child welfare services, intake and assessment, crisis counseling, family reconciliation and licensing staff. In fiscal year 2025, the Department paid about $44.1 million in federal funding. Of this amount, the Department paid about $20.3 million to providers for direct client services. SSBG gave the Department broad flexibility to design and administer the program based on its approved plan. The Department used the SSBG Pre-Expenditure Report and Intended Use Plan approved by the federal partner to identify activities eligible for the SSBG program. Payments to the providers were initially incurred for other programs and then transferred to the SSBG program to align with the amounts allocated in the Pre-Expenditure Report. The Department periodically processed journal vouchers to make these transfers. Federal law requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show they have been used in accordance with program requirements. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable and properly supported for the SSBG. The prior finding numbers were 2024-072 and 2023-070. Description of Condition The Department did not have adequate internal controls to ensure payments to providers were allowable and properly supported for the SSBG program. Department management said it used the approved SSBG Pre-Expenditure Report and Intended Use Plan to identify eligible activities initially charged to the Foster Care program, then periodically transferred them to them to the SSBG grant to align with the Pre-Expenditure Report. We examined the Department’s accounting records to determine if payments the Department transferred to the SSBG program were for activities that were allowed, authorized, accurate and supported. We identified total provider payments of $20,350,591 that were transferred to the SSBG program during fiscal year 2025. We analyzed provider payments and requested the Department verify whether it could provide adequate level of expenditure so we could determine whether the payments were allowable and supported. Based on our analysis and confirmation from the Department, we categorized the total expenditures into two categories, which we identified in the following table. Category Amount Provider payments for which the Department provided adequate level of support $18,477,749 Provider payments for which the Department could not provide an adequate level of support $1,872,842 Total payments to providers $20,350,591   Provider payments for which the Department provided an adequate level of support We used a statistical sampling method and randomly selected and examined 59 out of a total population of 13,921 payments. We also randomly selected and examined 12 out of a total population of 1,944 accrual payments. We reviewed supporting documentation, description of activities and payment approvals. We found the payments were for activities that were supported, allowable, authorized and accurate. Provider payments for which the Department could not provide an adequate level of support We were unable to perform testing on payments totaling $1,872,842 because the Department was only able to provide summary-level information. The Department was unable to provide an adequate level of support for us to determine whether costs were for activities that were allowed, authorized and within the period of performance. We consider these internal control deficiencies to be a significant deficiency. Cause of Condition The Department processed expenditure transfers at the grant level. As a result, the Department could not provide an adequate level of support for 4.2% of payments to providers charged to the SSBG program. Therefore, we could not determine whether the payments transferred to SSBG were accurate, for allowable activities and incurred during the period of performance. Effect of Condition and Questioned Costs By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition where our Office could not test some of the federal dollars it transferred to SSBG. We are questioning $1,872,842 in federal program costs the Department charged to the SSBG program during the audit period. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: Design and implement internal controls to ensure the funds it transfers to SSBG are supported by transaction-level support sufficient to comply with federal law Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Department does partially agree with the State Auditor’s Office’s (SAO) finding as outlined above. The Department utilizes grant-level management for all federal funds, including the SSBG grant. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements are met.  Beginning in November 2024, the Department limited journal voucher (JV) activities and began manually processing these JVs at the transaction-level by grant funding sources. These efforts were taken to address SAO’s concern that the SSBG program was not auditable without transaction-level data.  The Department agrees that two JVs identified by SAO processed prior to November 2024 did not include the transaction-level data. The Department maintains that funds were not improperly charged to the SSBG grant.  This is a two-year grant that the Department spends in one fiscal year. The Department does not agree with the finding that $505,707.39 was unallowable activities charged to the grant. This figure is an estimate for how much the Department may spend within the allowable timeframe, not the actual amount charged to the grant. Accruals are estimated outstanding costs at the conclusion of the closing period that are required by OFM as part of the state’s year end closing process. In response to the auditor’s prior recommendations for transaction-level tracking, the Department submitted a budget request for the 2024 supplemental budget. However, funding was removed in the final 2025 supplemental budget and 2025-27 biennial budget. The Department will continue to work within existing resources to build out the required databases between the Social Service Payment System and the Agency Financial Reporting System to allow transfers between funding sources to include transaction-level data related to the expenditures and reduce the current manual effort that is required. Auditor’s Remarks For the accounting adjustments (JVs) questioned prior to November 2024, there was not adequate transaction level payment data to verify that the expenditures were allowable and within the grant period of performance. Furthermore, the Department reports cash and accrued expenditures on the Schedule of Expenditures of Federal Awards and, as such, the accruals are required to be audited. We therefore tested the liquidations associated with these accruals. However, for the $505,707 in expenditures referenced by the Department (which is part of the $1.87 million in questioned costs), it was not able to provide support for the liquidation of these accruals for us to verify they were allowable and within the period of performance. We reaffirm our finding and will review the status of the Department’s corrective action in the next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   45 CFR Part 75, section 403, Factors affecting allowability of costs, establishes requirements for the collection of unallowable costs.   Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings.   Title 45 CFR, Section 96.30 – Fiscal and administrative requirements, states in part: a.Fiscal Control and accounting procedures. Except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures applicable to the obligation and expenditure of its own funds. Fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibition of the statute authorizing the block grant.   The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-039       The Health Care Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and Children’s Health Insurance Program.   Assistance Listing Number and Title: 93.767 Children’s Health Insurance Program 93.767 COVID-19 Children’s Health Insurance Program 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Grants to States for Medicaid 93.778 COVID-19 Grants to States for Medicaid Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2405WA5MAP; 2405WA5ADM; 2505WA5MAP; 2505WA5ADM; 2405WA5021; 2505WA5021 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions - Provider Eligibility (Screening and Enrollment) Known Questioned Cost Amount: $641 Prior Year Audit Finding: Yes, Finding 2024-075   Background The Health Care Authority administers both Medicaid and the Children’s Health Insurance Program (CHIP). Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and accounts for about half of the state’s federal expenditures. CHIP provides health coverage for more than 101,000 children and pregnant people whose families’ incomes are too high to qualify for Medicaid. During fiscal year 2025, the Medicaid program spent more than $23.7 billion in federal and state funds and CHIP spent more than $303.7 million in federal and state funds. The Authority ensures medical providers for both programs are eligible to provide services for clients. Providers must continue to meet eligibility requirements to receive payments under the programs. Washington had more than 215,000 participating providers in fiscal year 2025. During that time, the programs paid more than $19.1 billion to providers for direct client services. The Authority is responsible for performing screening measures appropriate for the provider type at application and initial enrollment. Federal Regulations require that the state Medicaid agency determine the exclusion status of providers through the Social Security Administration’s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities, the System for Award Management, and any other databases as the State or Secretary may prescribe. All providers in a Medicaid program must have a valid National Provider Indicator (NPI) provided through the NPPES system before enrollment. Without passing these database checks, providers cannot be enrolled in Medicaid. The state Medicaid agency must also revalidate the enrollment of all Medicaid and CHIP providers at least every five years. To meet this requirement, the Authority has implemented an automated revalidation notification process that sends a letter to providers in time for them to be revalidated before the end of the five-year period. Additionally, the ProviderOne system is supposed to automatically update the providers’ license information to ensure the provider’s license is not expired. Federal law also requires state Medicaid agencies check federal databases at least monthly to confirm the identity and exclusion status of providers, as well as any person with ownership, controlling interest, or acting as an agent or managing employee of the provider. During the fiscal year 2021 audit, our Office reported in finding 2021-047 that there was a problem with the automated revalidation notifications. Specifically, the notices were being sent to providers after the five-year deadline had passed. In December of 2023, the Authority reported that the issue was resolved, and an automated revalidation notice is being sent out 120 days before the revalidation due date. If the provider revalidation is not completed, the Authority’s Medicaid system (ProviderOne) is set to automatically deactivate the provider so that payments cannot be processed. The provider enrollment and revalidation processes are similar. The first step in both processes is to determine the providers’ screening risk level. A provider can be designated as one of three risk levels: limited, moderate, or high. Each risk level requires progressively greater scrutiny of the provider before it can be enrolled or revalidated. For providers enrolled with both Medicare and Medicaid, state Medicaid agencies must assign them to the same or higher risk category applicable under Medicare. Additionally, certain provider behaviors require them to be moved to a higher screening level. The following are the required screening procedures for all risk types: Verify that the provider meets applicable federal regulations or state requirements for the provider type before making an enrollment determination Conduct license verifications, including for licenses in states other than where the provider is enrolling Conduct database checks to ensure providers continue to meet the enrollment criteria for their provider type. Such database checks include the NPPES, List of Excluded Individuals/Entities, Excluded Parties List System, and Death Master File Index   If state Medicaid agencies assess providers at a moderate or high risk, they are required to conduct onsite visits for those that did not have one as part of their Medicare enrollment. Federal regulations require a high-risk provider, or a person with a 5 percent or more direct or indirect ownership in the high-risk provider, to receive a fingerprint-based criminal background check. The deadline to fully implement a fingerprint-based criminal background check was July 1, 2022, however the Authority currently does not perform fingerprint-based criminal background checks and does not have an implementation date. The Authority is also responsible for ensuring that providers obtain the proper signed attestations and disclosures. For servicing only providers, a direct link must be made to a billing provider that has an active Core Provider Agreement (CPA) on file. A CPA contains the required attestation of the billing provider to allow for the payment of medical claims. Ownership disclosures are also received from providers, ensuring the Authority can screen people with ownership interest. To ensure the Authority has completed all applicable screening and enrollment or revalidation steps before enrolling or revalidating providers, staff members use checklists for each enrollment and revalidation. The staff member signs and dates the checklist to indicate the provider is eligible to render services and receive payments. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements. The prior finding numbers were 2024-075, 2023-074, 2022-055, 2021-047, 2020-046, 2019-048, 2018-042, 2017-033, and 2016-035. Description of Condition The Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and CHIP programs. We reviewed the Authority’s procedures and determined that no process is in place to ensure enrollment staff are informed of providers who are high-risk due to Medicaid plan over-payments. Federal regulations and a state rule require providers identified as high risk to receive fingerprint based criminal background checks upon enrollment or revalidation. The Authority stated that they are not currently performing background checks for high-risk providers and are still developing resources and procedures to fulfil this requirement in the future. We tested the automated controls within ProviderOne to determine if the system had safeguards in place to prevent payments to providers with expired professional licenses. We determined that the system does not automatically update the providers’ license expiration dates within ProviderOne and therefore would process payments to providers with expired licenses. Additionally, we found that ProviderOne did not appropriately deactivate providers when they were not revalidated by the five-year deadline. During the audit period, the Authority processed over 14,000 new provider enrollments and was required to perform ongoing eligibility determinations for over 215,000 active providers. We used a statistical sampling method to randomly select and examine 59 newly enrolled providers and 59 active providers to determine if the Authority properly screened them based on their enrollment status and correctly determined their eligibility status. Of the 59 new providers examined, we found one instance (1.6%) where the provider did not have an updated ownership disclosure. During the audit period, we identified almost 3,500 providers who received a revalidation notification. We used a statistical sampling method to randomly select and examine 58 revalidations to determine if the Authority appropriately screened the providers prior to approval or if providers were deactivated by the deadline. Of the 58 providers examined, we found 35 instances (60%) when the Authority did not take sufficient action to ensure providers were either appropriately revalidated or deactivated by the revalidation deadline. Specifically, we found: Eleven providers who did not have an updated ownership disclosure. Nine providers who were not revalidated or deactivated by the revalidation due date. Fifteen providers who were missing both an updated ownership disclosure and were not revalidated or deactivated by the due date. We consider these internal control deficiencies to be a material weakness which led to material noncompliance. Cause of Condition Although the Authority has established processes to screen and enroll providers, they were ineffective to prevent or detect noncompliance. Management also did not ensure staff consistently followed the procedures in place. For active providers, the interface that updates license expiration dates in ProviderOne was inadequate and did not update license expiration dates appropriately. Our audit also found that providers were able to submit claims for reimbursement even when the license documented in ProviderOne was expired. For provider revalidation, the automated revalidation process was inadequate for ensuring the Authority complied with the revalidation requirements. A defect in ProviderOne restarted the revalidation timeline for providers when the revalidation was still incomplete. The Authority stated that this defect was corrected in June 2025. Management did not ensure adequate internal controls were established to comply with requirements that high-risk providers receive fingerprint-based background checks. Effect of Condition and Questioned Costs By not complying with federal fingerprint-based background checks for high-risk providers, the Authority risks the health and safety of Medicaid and CHIP clients and is at a higher risk of not detecting when medical providers are ineligible to provide services or be paid with Medicaid and CHIP funds. By not conducting required licensing, screening, and enrollment processes in a timely manner, the Authority is at risk of not detecting or preventing ineligible providers from providing services to clients and receiving federal Medicaid and CHIP funds. Payments to providers who are ineligible are unallowable, and the Authority could be required to repay the grantor for these payments. We determined the Authority paid providers who had not been revalidated $641 in federal Medicaid funds and $641 in state funds. We used a statistical sampling method and therefore estimate likely questioned costs to be $38,666 in federal funds and $38,666 in state funds. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with 95% confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely questioned cost projections are a point estimate and only represent our “best estimate of total questioned costs” as required by 45 CFR 75.516(a)(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Authority: Implement procedures to ensure high risk providers receive required fingerprint-based background checks Strengthen internal controls to ensure providers are adequately screened, licensed, enrolled, and eligible to provide and bill for services Implement internal controls designed to bring it into material compliance with the provider revalidation process Authority’s Response The Authority partially concurs with the finding. Fingerprint based criminal background checks The Authority concurs that a fingerprint-based criminal background check process for high-risk providers was not implemented during the audit period. In coordination with the Centers for Medicare & Medicaid Services (CMS) and the Washington State Patrol, the Authority has developed the required process and is in the final stages of implementation. The program is expected to be launched by March 31, 2026, and will apply to all providers designated as high risk. Updated license information in ProviderOne ProviderOne automatically end-dates associated taxonomies when a professional license on a provider record expires. However, when a provider is enrolled with multiple agencies and only one associated license has expired, the system does not currently end-date the related taxonomies. At this time, 37 of 113,940 servicing-only providers are affected. None of the approximately 9,000 billing providers are impacted. HCA will submit a system change request by March 1, 2026, to ensure applicable taxonomies are automatically end-dated in these scenarios. In the interim, HCA will implement a weekly report to identify affected providers and manually end-date the applicable taxonomies until the system enhancement is deployed. ProviderOne did not timely deactivate providers ProviderOne is designed to automatically inactivate a provider’s domain when revalidation is not completed timely. Due to an operational issue, a limited number of providers were not deactivated as required. Currently, 50 of approximately 9,000 billing providers are impacted. HCA will submit a system change request by March 1, 2026, to remediate this issue and prevent recurrence. In the interim, HCA will conduct weekly monitoring and manually inactivate affected provider domains until the system correction is implemented. Ownership disclosures The Authority does not concur with the determination that it is not in compliance with federal requirements governing ownership disclosures. The Authority’s process requires providers to review and attest to ownership disclosure information maintained by HCA as part of the revalidation process. The Authority believes this process meets the requirements of 42 C.F.R. 455.104 and appropriately balances regulatory compliance with administrative efficiency. The Authority submitted its procedures to CMS on February 23, 2026, and requested clarification and guidance to ensure continued alignment with federal expectations. Providers not revalidated or deactivated by the five-year deadline In July 2024, the Authority’s revalidation backlog totaled 792 providers. Through focused operational improvements and targeted resource deployment, the backlog was substantially reduced to three providers as of June 30, 2025. The Authority remains committed to continuous process improvement to sustain timely revalidations and prevent future backlog growth. Auditor’s Remarks Federal regulations require the Authority to obtain and review ownership disclosures from providers during the revalidation process. We reaffirm our finding and will review the status of the Authority’s corrective action during our next audit. Applicable Laws and Regulations Title 42 U.S. Code of Federal Regulations (CFR) Part 433, State Fiscal Administration, Subpart F – Refunding of Federal Share of Medicaid Overpayments to Providers, describes the requirements for identifying, reporting, collecting, and remitting Medicaid overpayments.   Title 42 CFR section 438 subpart H - Additional Program Integrity Safeguards, states in part:   Section 438.602 State responsibilities (b) Screening and enrollment and revalidation of providers. (1) The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PHIPs, and PAHPs, in accordance with the requirement of part 455 subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. (2) MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section of up to 120 days, but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120 day period without enrollment of the provider, and notify affected enrollees. (c) Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM, or PCCM entity, and any subcontractors as required in § 438.608(c). (d) Federal database checks. Consistent with the requirements at § 455.436 of this chapter, the State must confirm the identity and determine the exclusion status of MCO, PIHP, PAHP, PCCM, or PCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM, or PCCM entity through routine checks of Federal databases.   This includes the Social Security Administration’s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with § 438.610(c).   Title 42 CFR section 455 subpart B – Disclosure of Information by Providers and Fiscal Agents, states in part: Section 455.104 Disclosure by Medicaid providers and fiscal agents: Information on ownership and control. (a) Who must provide disclosures. The Medicaid agency must obtain disclosures from disclosing entities, fiscal agents, and managed care entities. (b) When disclosures must be provided. The Medicaid agency must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: (1) (i) The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agency, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location and P.O. Box address. (ii) Date of birth and Social Security Number (in the case of an individual) (iii) Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. (2) Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in an subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. (3) The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. (4) The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). (c) When the disclosures must be provided – (1) Disclosures from providers or disclosing entities. Disclosures from any provider or disclosing entity is due at any of the following times: (i) Upon the provider or disclosing entity submitting the provider application. (ii) Upon the provider or disclosing entity executing the provider agreement. (iii) Upon request of the Medicaid agency during the revalidation of enrollment process under § 455.414. (iv) Within 35 days after any change in ownership of the disclosing entity. (2) Disclosures from fiscal agents. Disclosures from fiscal agents are due at any of the following times: (i) Upon the fiscal agent submitting the proposal in accordance with the State’s procurement process. (ii) Upon the fiscal agent executing the contract with the State. (iii) Upon the renewal or extension of the contract. (iv) Within 35 days after any change in ownership of the fiscal agent. (3) Disclosures from managed care entities. Disclosures from managed care entities (MCOs, PIHPs, PAHPs, and HIOs), except PCCMs are due at any of the following times: (i) Upon the managed care entity submitting the proposal in accordance with the State’s procurement process. (ii) Upon the managed care entity executing the contract with the State. (iii) Upon renewal of the contract. (iv) Within 35 days after any change in ownership of the managed care entity. (4) Disclosures from PCCMs. PCCMs will comply with disclosure requirements under paragraph (c)(1) of this section. (d) To whom must the disclosures be provided. All disclosures must be provided to the Medicaid agency. (f) Consequences for failure to provide required disclosures. Federal financial participation (FFP) is not available in payments made to a disclosing entity that fails to disclose ownership or control information as required by this section.   Title 42 CFR section 455 Subpart E – Provider Screening and Enrollment, states in part: Section 455.410 Enrollment and screening of providers (a) The State Medicaid agency must require all enrolled providers to be screened under to this subpart. (b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. (c) The State Medicaid may rely on the results of the provider screening performed by any of the following: (1) Medicare contractors (2) Medicaid agencies or Children’s Health Insurance Programs of other States.   Section 455.412 Verification of provider licenses The State Medicaid agency must – (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. (b) Confirm that the provider’s license has not expired and that there are no current limitations on the provider’s license.   Section 455.414 Revalidation of enrollment The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years.   Section 455.436 Federal database checks The State Medicaid agency must do all of the following (a) Confirm the identity and determine the exclusion status of any providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. (b) Check the Social Security Administration’s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. (c) (1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and (2) Check the LEIE and EPLS no less frequently than monthly.   Section 455.450 Screening levels for Medicaid providers. A State Medicaid agency must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation or enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. (a) Screening for providers designated as limited categorical risk. When the State Medicaid agency designated a provider as a limited categorical risk, the State Medicaid agency must do all of the following: (1) Verify that a provider meets any applicable Federal regulations, or State requirements for the provider type prior to making an enrollment determination. (2) Conduct license verifications, including State licensure verifications in States other than where the provider is enrolling, in accordance with § 455.412. (3) Conduct database checks on a pre- and post-enrollment basis to ensure that providers continue to meet the enrollment criteria for their provider type, in accordance with § 455.436. (b) Screening for providers designated as moderate categorical risk. When the State Medicaid agency designates a provider as a “moderate” categorical risk, a State Medicaid Agency must do both of the following: (1) Perform the “limited” screening requirements described in paragraph (a) of this section. (2) Conduct on-site visits in accordance with § 455.432. (c) Screening for providers designated as high categorical risk. When the State Medicaid agency designated a provider as a “high” categorical risk, a State Medicaid agency must do both of the following: (1) Perform the “limited” and “moderate” screening requirements described in paragraphs (a) and (b) of this section. (2) (i) Conduct a criminal background check; and (ii) Require the submission of a set of fingerprints in accordance with § 455.434. (d) Denial or termination of enrollment. A provider, or any person with 5 percent or greater direct or indirect ownership in the providers, who is required by the State Medicaid agency or CMS to submit a set of fingerprints and fails to do so may have its – (1) Application denied under § 455.434; or (2) Enrollment reminder under § 455.416 (e) Adjustment of risk level. The State agency must adjust the categorical risk level from “limited” or “moderate” to “high” when any of the following occurs: (1) The State Medicaid agency imposes a payment suspension on a provider based on credible allegation of fraud, waste or abuse, the provider has an existing Medicaid overpayment, or the provider has been excluded by the OIG or another State’s Medicaid program within the previous 10 years. (2) The State Medicaid agency of CMS in the previous 6 months lifted a temporary moratorium for the particular provider type and a provider that was prevented from enrolling based on the moratorium applies for enrollment as a provider at any time within 6 months from the date the moratorium was lifted.   Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings.   Medicaid Provider Enrollment Compendium (MPEC) B. Enrolled Provider’s Payment Eligibility for Retroactive Dates of Service The practice of “backdating” enrollment involves approving an enrollment with a retroactive billing date. This practice allows a provider, once enrolled, to submit claims for services dated prior to the date upon which the SMA approved the enrollment. As discussed earlier, provider screening enables states to identify ineligible parties before they are able to enroll and start billing. Components of provider screening include database and licensure checks, and may also include site visits and FCBCs. To the extent a SMA approves the enrollment of a new provider and permits the provider to bill for services dated prior to applicable screening(s), this practice creates risk. For example, if a newly enrolling provider is subject to a site visit, and the SMA completes a site visit for the provider but nonetheless permits the provider to bill for services dated prior to the date on which the site visit occurred, there is risk the provider was not present at the site on the date of service for which the provider is subsequently approved to bill.   It is incumbent upon the SMA to mitigate risk of improper payments as it determines a provider’s eligibility for enrollment, including the date upon which a provider is deemed eligible to service Medicaid beneficiaries. The SMA should have a process to determine whether and when it is appropriate to approve an enrollment with a retroactive billing date, as doing so represents the SMA’s determination of prior compliance. This process should be designed to mitigate risk.   Factors the SMA must take into consideration when approving a retrospective billing date include, but may not be limited to:   • Survey or certification requirements that supersede a state’s ability to determine prior compliance   Factors the SMA might take into consideration when approving a retrospective billing date may include, but are not limited to: • Emergency access • Pre-authorization • Whether a provider is enrolled in Medicare or another state’s Medicaid Program   CMS recommends documenting the basis for establishing an enrollment with a retroactive billing eligibility date. Medicaid payment issued to a provider prior to the SMA’s screening and enrollment of the provider is an improper payment, unless an exception applies as described under Section 1.5.1.   Washington Administrative Code AC – 182-502-0005 Provider enrollment—Core provider agreement (CPA) or nonbilling provider agreement, states: (1) The agency only enrolls a health care professional, health care entity, supplier, or contractor of service through approval of an application for: (a) A core provider agreement (CPA); (b) A nonbilling provider agreement; or (c) Adding a servicing provider under either a CPA or a nonbilling provider agreement. (2) The agency may enter into a single case agreement or other forms of written agreements with a health care professional, health care entity, supplier, or contractor of service. (3) Servicing providers must comply with the requirements for providers in the agreement under which they are enrolled and agency rules. (4) Only a licensed health care professional whose scope of practice includes ordering, prescribing, or referring under their licensure may enroll as a nonbilling provider. (5) An individual who is enrolled through a nonbilling provider agreement is exempt from the rules in WAC 182-502-0160 and may bill a client for health care services when: (a) The provider is not enrolled with a managed care organization (MCO) that has a contract with the agency under WAC 182-538-067; (b) The provider is not acting in their capacity as an ordering, prescribing, or referring provider of health care services for clients; and (c) The provider documents that the client was informed prior to the delivery of services that: (i) The provider is enrolled only for purposes of ordering, prescribing, or referring health care services for clients; and (ii) The client may be billed for the health c

2025-040   The Health Care Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. Assistance Listing Number and Title: 93.767 Children’s Health Insurance Program 93.767 COVID-19 Children’s Health Insurance Program 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Grants to States for Medicaid 93.778 COVID-19 Grants to States for Medicaid Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2405WA5MAP; 2405WA5ADM; 2505WA5MAP; 2505WA5ADM; 2405WA5021; 2505WA5021 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions - Managed Care Financial Audit Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-074     Background The Health Care Authority administers both Medicaid and the Children’s Health Insurance Program (CHIP). Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and accounts for about half of the state’s federal expenditures. CHIP provides health coverage for more than 101,000 children and pregnant people whose families’ incomes are too high to qualify for Medicaid. During fiscal year 2025, the Medicaid program spent more than $23.7 billion in federal and state funds and CHIP spent more than $303.7 million in federal and state funds. Managed Care Organizations (MCOs) contract with the Authority under a comprehensive risk contract to provide prepaid health care services to eligible enrollees under their managed care programs. In fiscal year 2025, the Authority contracted with five MCOs and paid them more than $9.5 billion for Medicaid and CHIP services.   Under federal regulations, contracts between states and MCOs must include a requirement that MCOs annually submit an audited financial report to the state. MCOs must have these audits conducted in accordance with generally accepted accounting principles (GAAP) and generally accepted auditing standards (GAAS).   Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls.   In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. The prior finding numbers were 2024-074, 2023-073, 2022-054 and 2021-048.   Description of Condition The Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements.   The Authority’s MCO contracts, which applied to the audited financial reports submitted during the audit period,  allowed the option for MCOs to submit audited financial reports prepared in accordance with statutory accounting principles (SAP). This preparation method is not an acceptable accounting method under federal regulations. The Authority accepted audited financial reports in accordance with SAP from all five MCOs.   We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Authority officials said that MCOs were allowed to submit audited financial reports in accordance with SAP so the reports would be consistent with the Washington State Office of the Insurance Commissioner. The Office considers SAP an acceptable accounting method for determining and reporting the financial condition and the results of operations of an insurance company and determining its solvency under Washington insurance law. However, this accounting method does not comply with the federal requirements. The Authority implemented new MCO contract language in January 2025 requiring MCOs to submit audited financial reports in accordance with GAAP, but this requirement will only apply to reports submitted in future audit periods. Effect of Condition When it does not collect proper audited financial reports, the Authority increases its risk of relying on inaccurate or incomplete financial information. Recommendation We recommend the Authority ensure MCO contracts require audits of financial statements that are conducted in accordance with GAAP and GAAS. Authority’s Response The Authority implemented new contract language in January 2025 requiring MCOs to submit audited financial reports in accordance with GAAP and GAAS.  MCOs are required to submit the GAAP and GAAS statements beginning with the June 2026 submission. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings.   Title 42 CFR Part 438, section 3, Standard Contract Requirements, states in part: (m) Audited financial reports. The contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards.   The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-041       The Health Care Authority improperly charged $5,634,756 to the Medicaid Program. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Grants to States for Medicaid 93.778 COVID-19 Grants to States for Medicaid Federal Grantor Name: U.S. Department of Health and Humans Services Federal Award/Contract Number: 2405WA5MAP; 2405WA5ADM; 2505WA5MAP; 2505WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $5,634,756 Prior Year Audit Finding: No     Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and accounts for about half of the state’s federal expenditure. During fiscal year 2025, the program spent more than $23.7 billion in federal and state funds.   The Health Care Authority pays for Ground Emergency Medical Transportation (GEMT) using procedure code A0999. Providers are required to use procedure code A0999 to receive GEMT supplemental payments and the procedure code is set to pay the federal share of the difference between the Medicaid payable amount and the established average cost per transport. These services are calculated by using the average cost per transport minus the Medicaid reimbursement for transportation and milage multiplied by the federal medical assistance percentage. This is automatically calculated in the states’ Medicaid Management Information System, ProviderOne. In fiscal year 2025, the state Medicaid program paid about $80.6 million to providers for GEMT services.   Description of Condition The Authority improperly charged $5,634,576 to the Medicaid program.   We found the Authority had adequate internal controls to ensure it materially complied with requirements to use Medicaid funds only for allowable activities. However, for the period of January 1, 2025, to April 24, 2025, we found the Authority used an incorrect methodology and made payments to providers for GEMT services at the incorrect amounts. The Authority identified and corrected the error on April 25, 2025, but did not correct any payments during the remainder of the audit period. During our review, we identified 5,592 claims which were overpaid for GEMT services using the incorrect methodology.   Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a single audit exceed $25,000. We are issuing this finding because, as stated in the Effect of Condition and Questioned Costs section of this finding, the questioned costs exceed that threshold.   This issue was not reported as a finding in the prior audit. Cause of Condition After a rate update, the ProviderOne system began paying at the amount the provider billed instead of using the proper methodology. The system error was corrected after the Authority detected the ProviderOne system was using the improper payment rate. Effect of Condition and Questioned Costs The federally funded improper portion of the payments to providers for GEMT services totaled $5,634,756. We are questioning these costs.   We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: Ensure it uses the correct methodology to pay for GEMT services Consult with the federal grantor to discuss whether the questioned costs identified in the audit should be repaid Authority’s Response The Authority concurs there was an error that occurred during a system update that caused GEMT rates to pay incorrectly.  The Authority identified the issue prior to the audit and is in the process of recouping the funds from providers.  The funds will be returned during the one-year window allowed under 42 CFR 433.300.  The Authority will add this issue to its regression testing scenarios to prevent this error from happening in the future and will work with the Centers for Medicare & Medicaid Services to confirm the funds were returned.  Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority’s corrective action during our next audit. Applicable Laws and Regulations Title 42 U.S. Code of Federal Regulations (CFR) Part 433, State Fiscal Administration, Subpart F – Refunding of Federal Share of Medicaid Overpayments to Providers, describes the requirements for identifying, reporting, collecting, and remitting Medicaid overpayments.   Title 45 CFR Part 75.2, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards establishes definitions for questioned costs. Part 75.410 establishes requirements for the collection of unallowable costs.   Title 45 CFR Part 75, section 403, Uniform Guidance, establishes the factors affecting the allowability of costs.   Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings.

2025-042         The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Grants to States for Medicaid 93.778 COVID-19 Grants to States for Medicaid Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2405WA5MAP, 2405WA5ADM, 2505WA5MAP, 2505WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions - Utilization Control Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-081     Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and accounts for about half of the state’s federal expenditures. During fiscal year 2025, the program spent more than $23.7 billion in federal and state funds.   Under federal regulations, Medicaid state plans must include methods and procedures to safeguard against unnecessary utilization of care and services. The regulations require states to implement a statewide surveillance and utilization control program that: Safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments; Assesses the quality of those services; Provides for the control of the utilization of all services provided under the under plan; and Provides for the control of the utilization of inpatient services   Multiple state agencies in Washington manage aspects of the Medicaid program. The agencies include the Health Care Authority, Department of Social and Health Services, Department of Health, Office of the Attorney General, and Department of Children, Youth and Families. The Centers for Medicare and Medicaid Services considers the Authority to be Washington’s official Medicaid agency. Federal regulations require the Medicaid agency to: (1) Monitor the statewide utilization control program; (2) Take all necessary corrective action to ensure the effectiveness of the program; (3) Establish methods and procedures to implement this section; (4) Keep copies of these methods and procedures on file; and (5) Give copies of these methods and procedures to all staff involved in carrying out the utilization control program. Federal regulation also requires the Medicaid agency to have procedures for the ongoing evaluation, on a sample basis, of the need for, quality, and timeliness of Medicaid services. These reviews must occur on a post-payment basis so that the state can review beneficiary utilization and provider services profiles, as well as identify exceptions so that the Authority can correct misutilization practices of beneficiaries and providers.   Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.   In prior audits, we reported the Authority did not have adequate control over and did not comply with utilization requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. The prior finding numbers were 2024-081, 2023-082, 2022-061 and 2021-050. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program.   Washington’s Medicaid state plan asserted it met utilization and quality control requirements directly, but its policies and procedures did not fully address these requirements.   We found that the Authority performs various types of program integrity and control utilization reviews, but in our judgment, these efforts did not meet requirements of evaluating the appropriateness and quality of Medicaid services on a post-payment basis.   We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Authority has a Program Integrity unit that is responsible for safeguarding against unnecessary utilization of care and services for the Medicaid program. However, the Program Integrity unit does not have sufficient policies and procedures to adequately ensure the Authority has met all the compliance requirements for which it is responsible. These requirements include implementing and monitoring the statewide utilization control program, which includes overseeing and monitoring the activities of other state agencies. Additionally, the Program Integrity unit scope of reviews does not include post-payment review, on a sample basis, of the need for, quality, and timeliness of Medicaid services.   Furthermore, the federal grantor sustained the two prior audit findings for utilization control through issuances of management decision letters to the Authority. Despite this, the Authority has not implemented adequate internal controls to ensure compliance with all requirements. Effect of Condition By not establishing adequate methods and procedures to safeguard against unnecessary utilization of care and services, there is an increased risk of unnecessary or inappropriate use of Medicaid services and payments.   Furthermore, the Authority did not meet federal program integrity requirements, and it could be subject to federal sanctions because it has not established a statewide surveillance and utilization program and does not meet the utilization and quality control requirements directly as asserted in the Medicaid state plan. Recommendations We recommend the Authority:  Implement policies and procedures to sufficiently include all the methods and procedures necessary to safeguard against unnecessary utilization of care and services Implement and monitor a statewide surveillance and utilization control program Implement adequate internal controls to ensure they comply with utilization controls requirements Authority’s Response The Authority concurs with the finding and is committed to resolving the issues identified during the audit.  The Authority is assessing its statewide surveillance and utilization control program. The results of this analysis will be used to determine any additional work or staffing required to fully comply with standards and align existing statewide workflows within the program. The analysis will also be used to finalize policies, procedures, and internal controls. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings.   Title 42 CFR Subchapter C Medical Assistance Programs Part 456, Utilization Control, Subpart A, General Provisions states in part:   Section 456.1 Basis and purpose of part.   (a) This part prescribes requirements concerning control of the utilization of Medicaid services including –  (1) A statewide program of control of the utilization of all Medicaid services; …  (b) The requirements in this part are based on the following sections of the Act. Table 1 shows the relationship between these sections of the Act and the requirements in this part.  (1) Methods and procedures to safeguard against unnecessary utilization of care and services. Section 1902(a)(30) requires that the State plan provide methods and procedures to safeguard against unnecessary utilization of care and services. …  Section 456.2 State plan requirements.     (a) A State plan must provide that the requirements of this part are met.     (b) These requirements may be met by the agency by:  (1) Assuming direct responsibility for assuring that the requirements of this part are met; or   (2) Deeming of medical and utilization review requirements if the agency contracts with a QIO to perform that review, which in the case of inpatient acute care review will also serve as the initial determination for QIO medical necessity and appropriateness review for patients who are dually entitled to benefits under Medicare and Medicaid. …   Section 456.3 Statewide surveillance and utilization control program.  The Medicaid agency must implement a statewide surveillance and utilization control program that –  (a) Safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments;  (b) Assesses the quality of those services;  (c) Provides for the control of the utilization of all services provided under the plan in accordance with subpart B of this part; and  (d) Provides for the control of the utilization of inpatient services in accordance with subparts C through I of this part.         Section 456.4 Responsibility for monitoring the utilization control program.          (a) The agency must –  (1) Monitor the statewide utilization control program;  (2) Take all necessary corrective action to ensure the effectiveness of the program;  (3) Establish methods and procedures to implement this section;  (4) Keep copies of these methods and procedures on file; and  (5) Give copies of these methods and procedures to all staff involved in carrying out the utilization control program.  Section 456.5 Evaluation criteria.  The agency must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. This section does not apply to services in hospitals and mental hospitals. For these facilities, see the following sections: §§ 456.122 and 456.132 of subpart C; and § 456.232 of subpart D.  Title 42 CFR Subchapter C Medical Assistance Programs Part 456, Utilization Control, Subpart B, Utilization Control: All Medicaid Services states in part:  Section 456.21 Scope.  This subpart prescribes utilization control requirements applicable to all services provided under a State plan.  Section 456.22 Sample basis evaluation of services.  To promote the most effective and appropriate use of available services and facilities the Medicaid agency must have procedures for the on-going evaluation, on a sample basis, of the need for and the quality and timeliness of Medicaid services.  Section 456.23 Post-payment review process.  The agency must have a post-payment review process that –  (a) Allows State personnel to develop and review –  (1) Beneficiary utilization profiles;  (2) Provider service profiles; and  (3) Exceptions criteria; and  (b) Identifies exceptions so that the agency can correct misutilization practices of beneficiaries and providers.    The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-043         The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited financial and statistical records for inpatient hospital services. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Grants to States for Medicaid 93.778 COVID-19 Grants to States for Medicaid Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2405WA5MAP, 2405WA5ADM, 2505WA5MAP, 2505WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Inpatient Hospital and Long-Term Care Facility Audits Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-080       Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and accounts for about half of the state’s federal expenditures. In fiscal year 2025, the Medicaid program spent more than $23.7 billion in federal and state funds, including more than $339 million to hospitals for inpatient services.   The Health Care Authority, the state Medicaid agency, pays for inpatient services to hospitals by using rates that are economic, efficient and in accordance with the state plan. Federal law requires the Authority to periodically audit the financial and statistical records of participating providers, as established in the state plan.   The Medicaid State Plan, Attachment 4.19, lists the financial audit requirements for establishing payment rates for inpatient hospital services. Beginning January 1, 2024, the plan was amended stating that the financial and statistical records of participating providers will be periodically reviewed and audited by the Authority as necessary. Washington Administrative Code also says that the Authority will periodically audit the financial and statistical records of participating providers as needed. This should include the cost report data used for rate setting as well as hospital billings.   Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.   In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited cost report data for rate setting, hospital billings, and other financial and statistical records for inpatient hospital services. The prior finding numbers were 2024-080, 2023-081, 2022-060, 2021-051 and 2020-049.   Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited financial and statistical records for inpatient hospital services.   During the audit period, the Authority relied on internal audit reviews of provider claims to satisfy this requirement. These reviews of claims focused on identifying overpayments using hospital records. However, the Authority did not periodically audit financial and statistical records, including cost report data used for rate setting and hospital billings, which federal law, state regulations and the state plan require.   Additionally, federal law requires the state plan to establish specific audit requirements for the financial and statistical records of participating providers. The Authority does not have documented methodology, policies or procedures that describe when and how the audits will be performed.   We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Authority did not establish policies and procedures to ensure it periodically audited the financial and statistical records, including cost report data and hospital billings, for inpatient hospital services. The Authority has received findings and recommendations over this requirement each year since 2020. Despite the Centers for Medicare and Medicaid Services reviewing and concurring with the finding results for all fiscal years, the Authority has responded that is does not concur with the finding, and therefore with the federal grantor, and has not implemented corrective actions to address the issues identified. Effect of Condition By not ensuring that it periodically audits financial and statistical records, including cost report data and hospital billings, the Authority increases its risk of improperly paying for inpatient hospital services. Recommendations We recommend the Authority: Establish and implement adequate internal controls, including policies and procedures, to ensure it meets federal inpatient hospital audit requirements Document audit methodology in the state plan Authority’s Response The Authority does not concur with the finding and will continue to consult with the Centers for Medicare & Medicaid Services regarding resolution. Auditor’s Remarks The Center for Medicare and Medicaid Services has agreed with our prior findings in their previous management decisions on this issue. The Authority has not implemented sufficient corrective actions to ensure the financial and statistical records of impatient hospitals are audited. We reaffirm our finding and will review the status of the Authority’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   Title 45 CFR Part 75,  section 516, Audit findings, establishes reporting requirements for audit findings.   Title 42 CFR Part 447, Payments for Services, section 447.253, Other requirements, states in part: (a) State assurances. In order to receive CMS approval of a State plan change in payment methods and standards, the Medicaid agency must make assurances satisfactory to CMS that the requirements set forth in paragraphs (b) through (i) of this section are being met, must submit the related information required by § 447.255 of this subpart, and must comply with all other requirements of this subpart. (f) Uniform cost reporting. The Medicaid agency must provide for the filling of uniform cost reports by each participating provider. (g) Audit requirements. The Medicaid agency must provide for periodic audits of the financial and statistical records of participating providers. (i) Rates paid. The Medicaid agency must pay for inpatient hospital and long-term care services using rates determined in accordance with methods and standards specified in an approved State plan.   Medicaid State Plan, Attachment 4.19-A Part I Methods and Standards for Establishing Payment Rates for Inpatient Hospital Services, page 60 states in part: 3. Financial Audit Requirements The financial and statistical records of participating providers will be periodically reviewed and audited by the agency as necessary.   Washington Administrative Code (WAC) Chapter 182-550 – Hospital services specifies requirements for the Authority regarding hospitals providing Medicaid services.   WAC 182-550-5410 – CPE Medicaid cost report and settlements, states in part: (4)The medicaid cost report schedules and supporting documentation are subject to audit by the agency or its designee to verify that claimed costs qualify under federal and state rules governing the CPE payment program. The documentation required includes, but is not limited to: a. The revenue codes assigned to specific cost centers on the medicaid cost report schedules. b. The inpatient charges by revenue codes for uninsured patients and medicaid clients enrolled in an MCO plan. c. The outpatient charges by revenue codes for uninsured patients and medicaid clients enrolled in an MCO plan. d. All payments received for the inpatient and outpatient charges in (b) and (c) of this subsection including, but not limited to, payments for third party liability, uninsured patients, and medicaid clients enrolled in an MCO plan.   WAC 182-550-5700 Hospital reports and audits, states in part: (4) The agency will periodically audit the financial and statistical records of participating providers as needed.   The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-044       The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure timely review of hospital complaints. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers  93.778 Grants to States for Medicaid 93.778 COVID-19 Grants to States for Medicaid Federal Grantor Name: U.S. Department of Health and Human Services  Federal Award/Contract Number: 2405WA5MAP; 2405WA5ADM; 2505WA5MAP; 2505WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – Provider Health and Safety Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-076     Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and accounts for about half of the state’s federal expenditures. During fiscal year 2025, the program spent more than $23.7 billion in federal and state funds.   The Centers for Medicare and Medicaid Services (CMS), which administers the program at the federal level, relies on states to regulate and license hospitals that serve Medicaid clients. Medicaid coverage for hospitals is authorized only when services are provided in a facility that is licensed and certified by the state survey agency (for non-deemed hospitals) or an accrediting organization (for deemed hospitals). The term “deemed” means the facility has voluntarily requested and received permission from CMS to be certified by an accrediting organization, while hospitals that are “non-deemed” have not. The Department of Health is Washington’s state licensing agency and is also responsible for investigating hospital complaints. The Department’s Office of Investigative and Legal Services (OILS) is the front-line response system for providing the intake and assignment functions for complaints from staff, patients, accrediting organizations and the public. The Department’s Office of Health Systems Oversight is responsible for coordinating and performing investigation surveys.   Deemed hospitals are surveyed for CMS certification by their accrediting organizations. However, the Department performs an investigation survey for complaints that meet the federal prioritization level. People can submit complaints to OILS online or by mail, email or telephone. OILS uses the Integrated Licensing and Regulatory System (ILRS) to input and track complaints. OILS intake staff review report types regardless of delivery method before entering them into ILRS. Intake staff check for possible imminent danger and evidence their review by affixing a dated electronic stamp on the complaint document. The complaint is delivered to the Department’s Office of Health Systems Oversight and an electronic copy is uploaded to a secure drive.   The CMS State Operations Manual, which is binding on Medicare-certified and Medicare- Medicaid-certified providers, provides state agencies with procedural guidelines for surveying and managing complaints and incidents.   Hospitals are responsible for following the provider health and safety standards that are mandated by state and federal regulations.   When the Department receives hospital complaints, state regulations require staff to perform an initial assessment of the reports within 21 days. In addition, staff must review the reports for possible imminent danger within two working days of receiving them. If staff identify imminent danger, they must immediately forward the report for processing.   The following two tables outline the federal requirements for response times the Department must follow for deemed hospitals and non-deemed hospitals.   Priority levels and response times for non-deemed hospitals   Priority levels Required response times Immediate Jeopardy Initiate onsite survey within two business days of receipt Non-Immediate Jeopardy High Initiate onsite survey within 45 calendar days of prioritization Non-Immediate Jeopardy Medium Must investigate no later than when the next onsite survey occurs Non-Immediate Jeopardy Low Must track/trend for potential focus areas during the next onsite survey   Priority levels and response times for deemed hospitals   Priority levels Required response times Immediate Jeopardy Initiate onsite survey within two business days of receipt of regional office authorization Non-Immediate Jeopardy High Initiate onsite survey within 45 calendar days of receipt of regional office authorization Non-Immediate Jeopardy Medium Complainant is referred to the applicable accrediting organization(s) Non-Immediate Jeopardy Low Complainant is referred to the applicable accrediting organization(s)   The CMS State Operations Manual requires people with certain qualifications to assess each hospital complaint. These people must be professionally qualified to evaluate the nature of the problem based on their knowledge and experience of current clinical standards of practice and federal requirements.   If OILS determined possible imminent danger, the case manager and survey manager review the complaints for immediate jeopardy. If they determine there is possible imminent danger, then an Expedited Case Management Team is designated. If they do not identify immediate jeopardy, they prioritize the complaint at the next weekly case management meeting. Once case managers decide that a complaint at a non-deemed hospital meets the state and federal prioritization level for investigation, they assign it to field staff. For complaints at deemed hospitals that meet the federal prioritization level for investigation, case managers request authorization from the CMS regional office through the Aspen Complaint Tracking System to initiate an investigation.   Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.   In prior audits we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure timely review of hospital complaints. The prior finding numbers were 2024-076 and 2023-076.   Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure timely review of hospital complaints.   Complaint intake and monitoring The complaint intake staff review the complaints as they receive them to ensure they meet required initial assessment timelines. Staff evidence their review of the complaint through a dated electronic stamp on the complaint document. We used a statistical sampling method and randomly selected and examined 58 complaints out of a total population of 1,792. We found that four complaints (6.9%) were not stamped with a date.   In addition, the Department utilizes reports from the ILRS support team. The Operations Manager and Management analyst perform a monthly review with these reports to ensure the OILS unit met the initial assessment timeline. This monitoring control was new and was not in place for seven of the 12 months (58%) during our audit period.   Complaint review timeline The Department received 1,792 hospital complaints during state fiscal year 2025. We evaluated all of them to ensure the Department performed an initial assessment and review of the complaints for imminent danger within the required timelines. We found the Department did not review 237 complaints (13%) for imminent danger within two working days of receiving them. The review time for these complaints ranged between three and 25 days. In addition, the Department did not review 230 complaints (13%) within the 21-day basic assessment period. The review time for these complaints ranged between 22 and 55 days.   Response time to federal level complaints The Department determined 72 complaints met the federal investigation complaint threshold during state fiscal year 2025. We evaluated 13 of the 72 complaints to ensure the priority level and response times for each complaint were within the required timelines. We found that the Department did not initiate one investigation within the required timeline for non-immediate jeopardy (with high prioritization) against a deemed facility (8%). The investigation was initiated 50 days after it was authorized for investigation by CMS, five days later than the 45 days allowed.   We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not implement adequate internal controls to ensure staff reviewed the complaints within the required timeframe. Management also acknowledged that the Department experienced staffing shortages for a significant period, which contributed to its failure to comply with the 21-day basic assessment period. The Department also asserted that the ILRS system was not configured to accurately capture the dates of when program staff reviewed complaints for imminent danger until August 2024 and monitoring of performance measures were not developed until February 2025. Effect of Condition When the Department does not prioritize and perform a prompt initial assessment of complaints, vulnerable patients are at higher risk of abuse, neglect and substandard care. The delays in reviewing these complaints also affect the Department’s ability to initiate timely investigations of issues concerning providers. Further, when the Department does not promptly follow up on a complaint, the state also runs the risk of paying Medicaid funding to a noncompliant facility. Recommendation We recommend the Department strengthen internal controls to ensure it reviews complaints and documents the reviews for imminent danger within two working days of receiving the complaints and within the 21-day basic assessment, as state regulations and the CMS State Operations Manual require.    We also recommend staff communicate potential delays on investigations promptly to CMS to ensure response to federal complaints are initiated in accordance with required timelines. Department’s Response We appreciate the State Auditor’s Office audit of the Medicaid Special Tests Health and Safety Standards grant requirement. DOH is committed to ensuring our programs comply with federal regulations and concurs with the findings. The Department asserts that it now has adequate internal controls in place for timely review of hospital complaints and has developed performance measures which are actively monitored on a monthly basis to assess compliance with federal requirements. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings.   The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.   Washington Administrative Code 246-14-040 Uniform Procedures For Complaint Resolution, states:        Initial assessment of reports. 1.Initial assessment is the process of determining whether a report warrants an investigation and becomes a complaint. The complainant and credential holder or applicant will be notified as soon as possible after the initial assessment is complete. 2. The basic time period for initial assessment is twenty-one days. 3.All reports will be reviewed for imminent danger within two working days. If imminent danger is identified, the report will be immediately forwarded for processing.   The Centers for Medicare and Medicaid Services, State Operations Manual, Chapter 5 – Complaint Procedures, states in part: Section 5010 –General Intake Process A complaint is an allegation of noncompliance with Federal and/or State requirements. If the SA determines that the allegation(s) falls within the authority of the SA, the SA determines the severity and urgency of the allegations, so that appropriate and timely action can be pursued. Each SA is expected to have written policies and procedures to ensure that the appropriate response is taken for all allegations and is consistent with Federal requirements as well as with procedures in the Sate Operations Manual. This structure needs to include response timelines and a process to document actions taken by the SA in response to allegations. If a state’s time frames for the investigation of a complaint/incident are more stringent than the Federal time frames, the intake is prioritized using the State’s timeframes. The SA is expected to be able to share the logic and rationale that was utilized in prioritizing the complaint/incident for investigation. The SA response must be designed to protect the health and safety of all residents, patients, and clients. Section 5070 –Priority Assignment for Nursing Homes, Deemed and Non-Deemed Non- Long Term Care Providers/ Suppliers, and EMTALA An assessment of each complaint or incident intake must be made by an individual who is professionally qualified to evaluate the nature of the problem based upon his/her knowledge of Federal requirements and his/her knowledge of current clinical standards of practice…. For non-long term care providers/suppliers, in situations where a determination is made that immediate jeopardy may be present and ongoing, the SA is required to start the on-site investigation within two business days of receipt of the complaint or incident report, or, in the case of a deemed provider or supplier, within two business days of RO authorization for investigation. The same process applies to EMTALA complaints or a survey related to a report of a hospital or CAH Distinct Part Unit patient death associated with the use of restraint or seclusion. The SA’s investigation must be initiated within two business days of RO authorization for investigation. … CMS expects SAs to prioritize complaints at the appropriate level that is warranted. The timeframes in Section 5075 below represent maximum timeframes for investigation; … the SA is not precluded from investigating complaints and facility- reported incidents within a shorter timeframe. In addition, the SA is not precluded from taking other factors into consideration in its triage decision. For example, the SA may identify a trend in allegations that indicates an increased risk of harm to residents or the SA may receive corroborating information from other complainants regarding the allegation…. Section 5075.9 – Maximum Time Frames Related to the Federal Onsite Investigation of Complaints/Incidents Intake Prioritization Provider Type Non-deemed non-long term care providers/suppliers SA must initiate an onsite survey within 2 business days of receipt. Immediate Jeopardy (IJ) SA must initiate an onsite survey within 2 business days of receipt of RO authorization. Non-IJ High SA must initiate an onsite survey within 45 calendar days of prioritization. Non-IJ Medium SA must investigate no later than when the next onsite survey occurs. Non-IJ Low SA must track/trend for potential focus areas during the next onsite survey. Provider Type Deemed providers/suppliers Immediate Jeopardy (IJ) SA must initiate an onsite survey within 2 business days of receipt of RO authorization. Non-IJ High SA must initiate an onsite survey within 45 calendar days of receipt of RO authorization. Non-IJ Medium Complainant is referred to the applicable accrediting organization(s). Non-IJ Low Complainant is referred to the applicable accrediting organization(s). Provider Type EMTALA Immediate Jeopardy (IJ) SA must initiate an onsite survey within 2 business days of receipt of RO authorization. Non-IJ High SA must initiate an onsite survey within 45 calendar days of receipt of RO authorization. Non-IJ Medium N/A Non-IJ Low N/A

2025-045         The Department of Health did not have adequate internal controls to ensure it complied with transplant hospital survey statement of deficiencies and plan of corrections timelines. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Grants to States for Medicaid 93.778 COVID-19 Grants to States for Medicaid Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: 2405WA5MAP; 2405WA5ADM; 2505WA5MAP; 2505WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Provider Health and Safety Known Questioned Cost Amount: None Prior Year Audit Finding: No     Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and accounts for about half of the state’s federal expenditures. During fiscal year 2025, the program spent more than $23.7 billion in federal and state funds.   The Department must perform a federal certification survey of each transplant hospital at least every five years. The certification survey gathers information about the quality of service provided in a facility to determine compliance with participation requirements. The survey process also focuses on the transplant hospital’s performance of patient-focused and organizational functions and processes. Furthermore, the survey assesses compliance with federal health, safety and quality standards designed to ensure patients receive safe and quality care services.   The State must complete a standard survey of each transplant hospital within five years following the previous survey. All hospital surveyors should have the necessary training and experience to conduct a hospital survey. If a survey uncovers deficiencies, the Department must mail a Statement of Deficiency (SOD) to the facility within 10 working days of the survey date. The facility must submit a Plan of Correction (POC) that the Department determines is acceptable within 10 calendar days of receipt of the SOD. After the facility submits a POC, the Department determines the appropriateness of the POC. If the facility fails to submit a POC, the provider agreement may be terminated.   Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.   Description of Condition The Department did not have adequate internal controls to ensure it complied with transplant hospital survey SOD and POC timelines.   The Department is currently responsible for surveying 23 hospitals in the state, five of which are transplant hospitals (22%). The Department tracks the mailing of SODs and receipt of POCs for non-transplant facilities through the Department’s Integrated Licensing and Regulatory System (ILRS). Management and the surveyors use ILRS to monitor critical stages of the survey including the mailing of the SODs and when the POCs are received from the facilities. However, we determined the Department does not follow the same process for transplant hospitals. The survey lead for transplant hospitals creates a Microsoft Outlook calendar notification indicating when the POC is due from the facility. However, these reminders are not monitored and delays may occur without management’s awareness. We also found that the Department does not monitor SODs to ensure they are communicated to transplant hospitals within the required timelines.   We consider these internal control deficiencies to be a material weakness, which did not lead to material noncompliance.    This issue was not reported as a finding in the prior audit. Cause of Condition When designing internal controls, Department management did not implement adequate tracking for surveys conducted for transplant hospitals. Effect of Condition Without ensuring that SODs and POCs are communicated and received on time, the state is at risk of delaying implementation of corrective actions by noncompliant facilities providing Medicaid services. In addition, clients receiving care could be at increased risk of abuse, mistreatment, neglect or substandard care. Recommendation We recommend the Department establish adequate internal controls to ensure compliance with SOD and POC on-time requirements. Department’s Response We appreciate the State Auditor’s Office audit of the Medicaid Special Tests Health and Safety Standards grant requirement. DOH is committed to ensuring our programs comply with federal regulations and concurs with the finding. Prior to the commencement of this audit, DOH has developed and implemented a management tracker that actively monitors transplant hospitals SODs issuance and POCs due dates. The Department asserts that it now has adequate internal controls in place. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   Title 45 CFR Part 75,  section 516, Audit findings, establishes reporting requirements for audit findings.   The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.   Title 42 CFR. Part 488, Survey Certification, and Enforcement Procedures section 28 -  Providers or suppliers, other than SNFs, NFs, HHAs, and Hospice programs with deficiencies states in part: a.If a provider or supplier is found to be deficient in one or more of the standards in the conditions of participation, conditions for coverage, or conditions for certification or requirements, it may participate in, or be covered under, the Medicare program only if the provider or supplier has submitted an acceptable plan of correction for achieving compliance within a reasonable period of time acceptable to CMS. In the case of an immediate jeopardy situation, CMS may require a shorter time period for achieving compliance. b.The existing deficiencies noted either individually or in combination neither jeopardize the health and safety of patients nor are of such character as to seriously limit the provider's capacity to render adequate care. c.  1.If it is determined during a survey that a provider or supplier is not in compliance with one or more of the standards, it is granted a reasonable time to achieve compliance. 2.The amount of time depends upon the— (i)Nature of the deficiency; and (ii) State survey agency's judgment as to the capabilities of the facility to provide adequate and safe care. d.Ordinarily a provider or supplier is expected to take the steps needed to achieve compliance within 60 days of being notified of the deficiencies but the State survey agency may recommend that additional time be granted by the Secretary in individual situations, if in its judgment, it is not reasonable to expect compliance within 60 days, for example, a facility must obtain the approval of its governing body, or engage in competitive bidding. The Center for Medicare and Medicaid Services, State Operations Manual Chapter 5, Appendix A – Survey Protocol, Regulations and Interpretive Guidelines for Hospitals, states in part: Closure Explain that a statement of deficiencies (Form CMS-2567) will be mailed within 10 working days to the hospital. Explain that the Form CMS-2567 is the document disclosed to the public about the facility’s deficiencies and what is being done to remedy them.  The Form CMS2567 is made public no later than 90 calendar days following completion of the survey.  It documents specific deficiencies cited, the facility’s plans for correction and timeframes, and it provides an opportunity for the facility to refute survey findings and furnish documentation that requirements are met. Inform the facility that a written plan of correction must be submitted to the survey agency within 10 calendar days following receipt of the written statement of deficiencies.

2025-046             The Department of Social and Health Services, Home and Community Living Administration, did not have adequate internal controls over and did not comply with survey requirements for Medicaid nursing homes. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units  93.777 State Survey and Certification of Health Care Providers and Suppliers  93.778 Grants to States for Medicaid 93.778 COVID-19 Grants to States for Medicaid Federal Grantor Name: U.S. Department of Health and Human Services  Federal Award/Contract Number: 2405WA5MAP; 2405WA5ADM; 2505WA5MAP; 2505WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Test and Provisions – Provider Health and Safety Standards Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-079     Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and accounts for about half of the state’s federal expenditures. During fiscal year 2025, the program spent more than $23.7 billion in federal and state funds and had 195 Medicaid certified nursing homes.   Residential Care Services (RCS), under the Department of Social and Health Services, Home and Community Living Administration, is the State’s nursing home survey agency. A nursing home facility is an institution with the primary purpose of providing 24-hour supervised nursing care, personal care, therapy, nutrition management, organized activities, social services, room, board, and laundry to people who receive care and services under Medicaid.     The Department must perform a federal certification or recertification survey of each nursing home. The certification survey is a resident-centered inspection that gathers information about the quality of service provided in a facility to determine compliance with the participation requirements. The survey focuses on the facility’s administration and patient services. The survey also assesses compliance with federal health, safety and quality standards designed to ensure patients receive safe and quality care services.  The standard survey involves eight procedural steps that must be completed, as well as a review of nursing home employee background checks, to adequately assess each nursing home facility’s compliance with these standards.   The State must complete a standard survey for each nursing home facility within 15.9 months after the previous survey, and the statewide average for all nursing homes must not exceed 12.9 months, as required by Centers for Medicare and Medicaid Services (CMS). All staff surveyors are required to receive specific RCS training to be qualified to conduct surveys. If a survey uncovers deficiencies, the Department must mail a Statement of Deficiency (SOD) to the facility within 10 working days of the survey date. The facility must submit a Plan of Correction (POC) that the Department determines is acceptable within 10 calendar days of receipt of the SOD. The Department’s procedures require a review of the POC within five working days of receipt to verify that it is acceptable. The facility has a total of 60 days to be back in compliance or risk forfeiting its Medicaid certification.   Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls to ensure it conducted timely surveys and followed up on deficiencies.  The prior finding numbers were 2024-079, 2023-079 and 2020-054.   Description of Condition The Department did not have adequate internal controls over and did not comply with survey requirements for Medicaid nursing homes.      The Department uses a tracking spreadsheet as an internal control to monitor and track the survey frequencies as well as the statewide average frequency to ensure it meets the mandated 15.9-month survey frequency, and the statewide average of 12.9 months between surveys for each facility.   We found the Department did not ensure that all recertification surveys were completed timely. The Department did not adequately monitor the tracking sheet and complete surveys for 15 nursing homes in fiscal year 2025 within the required 15.9 months and did not meet the 12.9-month statewide average. The statewide average is calculated on the federal fiscal year. For federal fiscal year 2025, the statewide average for nursing home surveys was 25.39 months.     Additionally, we noted that two out of 21 surveys reviewed during the fiscal year contained POCs that were reviewed after the five-day period required by the Department.    We also noted that two out of 21 surveys conducted during the fiscal year did not complete all the required survey procedures, including one survey that did not include the necessary review of employee background checks.   We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The public health emergency created a backlog of recertification surveys that needed to be completed and the Department had a shortage of trained employees able to perform surveys, which extended the survey timelines.   In addition, management did not adequately monitor its survey schedules to ensure compliance in meeting the survey timeline or the survey process to ensure all surveys were completed. Effect of Condition Without conducting recertification surveys timely and completely, the State is at risk of paying facilities for services provided to Medicaid clients without assurance the facilities are complying with federal and state health standards and regulations. Clients residing in facilities that do not meet federal health and safety requirements for participating in the Medicaid program could be at increased risk of abuse, mistreatment, neglect or substandard care.     By not meeting the statewide average requirement for recertification surveys, the Department has not met federal Medicaid requirements and could be subject to sanctions by the grantor. Recommendations We recommend the Department:  Establish adequate internal controls to ensure compliance with facility survey completion and timeliness requirements  Conduct a follow-up on any surveys missing the required procedures and employee background check reviews Ensure it completes recertification surveys within 15.9 months for each nursing home and meets the 12.9-month statewide average  Department’s Response The Department partially agrees with the finding.  The Department’s internal controls are adequate to ensure compliance with facility survey completion and timeliness of requirements.  Due to the COVID pandemic there was a Public Health Exemption (PHE) that prevented the Department from completing surveys on the normal timeline. Once the PHE was lifted, the Department worked quickly to meet the backlog demand.  Multiple states, including Washington, voiced concern to CMS that statistically it would be impossible to meet the 12.9 month average immediately, and movement of the bell curve would take multiple years. CMS agreed with the states’ position and in FFY24 they removed the 12.9 data point from the State Performance measurement report. According to the Nov. 2025 State Performance measurement FY25 report, Washington State had improved and the Department is now at 12.9 months, which is better than the CMS reported national average of 14.3 months. In 2024, the CMS State Performance measurement for the FY24 report reflected that the Department was at 80.3% and “partially met” threshold for the 15.9 month recertification standard (CMS requires a corrective action plan for 70% or lower, therefore the Department was not required to submit a corrective action plan to CMS).  In FY25, the Department was at 93.2% demonstrating consistent improvement and that the Department’s process for regularly meeting and reviewing the data with our teams resulted in a steady decrease in the average intervals.  The Department will continue to use recertification reports, tracking sheets, and monthly meetings to ensure compliance with recertification timelines.  The Department will be in compliance with the 15.9 recertification standards by August 31, 2026. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 42 U.S. Code of Federal Regulations (CFR) Subchapter G Standards and Certification, Part 488 section 110, Procedural Guidelines states in part: SNF/ICF Survey Process. The purpose for implementing a new SNF/ICF survey process is to assess whether the quality of care, as intended by the law and regulations, and as needed by the resident, is actually being provided in nursing homes. Although the onsite review procedures have been changed, facilities must continue to meet all applicable Conditions/Standards, in order to participate in Medicare/Medicaid programs. That is, the methods used to compile information about compliance with law and regulations are changed; the law and regulations themselves are not changed. The new process differs from the traditional process, principally in terms of its emphasis on resident outcomes. In ascertaining whether residents grooming and personal hygiene needs are met, for example, surveyors will no longer routinely evaluate a facility's written policies and procedures. Instead, surveyors will observe residents in order to make that determination. In addition, surveyors will confirm, through interviews with residents and staff, that such needs are indeed met on a regular basis. In most reviews, then, surveyors will ascertain whether the facility is actually providing the required and needed care and services, rather than whether the facility is capable of providing the care and services.   Title 42 CFR, Part 488 Subpart E, Survey and Certification of Long-Term Care Facilities, states in part: Section 488.308 Survey frequency. (a) Basic period. The survey agency must conduct a standard survey of each SNF and NF not later than 15 months after the last day of the previous standard survey. (b) Statewide average interval. (1) The statewide average interval between standard surveys must be 12 months or less, computed in accordance with paragraph (d) of this section. (2) CMS takes corrective action in accordance with the nature of the State survey agency's failure to ensure that the 12-month statewide average interval requirement is met. CMS's corrective action is in accordance with § 488.320. (d) Computation of statewide average interval. The statewide average interval is computed at the end of each Federal fiscal year by comparing the last day of the most recent standard survey for each participating facility to the last day of each facility's previous standard survey.   Title 45 CFR Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings.   The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The Centers for Medicare and Medicaid Services, State Operations Manual, Chapter 2 – The Certification Process, states in part:   2138G – Schedule for Recertification The SA completes a recertification survey an average of every 12 months and at least once every 15 months (see Section 2141)   2728 – Statement of Deficiencies and Plan of Correction, Form-2567 The SA mails the provider/supplier a copy of form CMS-2567 within 10 working days after the survey. If there are deficiencies, the SA allows the provider/supplier 10 calendar days to complete and return the PoC. Requirements pertaining to submittal of the PoC can be found in subsection B.   The Department of Social and Health Services, Residential Care Services Division Standard Operating Procedure: Chapter 18G Electronic Plan of Correction (ePOC) - NH, states in part: Purpose When an entity has received a citation, they must provide RCS with an ePOC within 10 calendar days of receiving the SOD from RCS. The ePOC must include the date each deficiency has been or will be corrected. Correction dates must not exceed 45 calendar days from the exit date, unless approved by the FM. The 45-calendar day count begins with the next full day after exit. Procedure ePOC Notification 1. The regulator will:  a.     Inform the entity prior to exit that a SOD report will be issued within 10 WDs of exit date, through the ePOC system. b.     Inform the entity prior to exit that the POC must be completed for each cited deficiency in the SOD and returned to the department through the ePOC system within 10 calendar days of receiving the SOD report. c.     When necessary to protect resident health, safety, or welfare, the regulator may request a written safety plan submitted by the entity before exiting. Review of ePOC 1. The regulator will: a.     Review the ePOC within five WDs of receipt (or request the FM review if the regulator will not be available). Confirm the ePOC for each deficiency includes: 1) How the entity will correct the deficiency for each numbered resident. 2) How the entity will protect residents from similar situations. 3) Measures the entity will take or the systems it will change to ensure that the problem does not recur. 4) How the entity plans to monitor its ongoing performance to sustain compliance. 5) Dates corrective action will be completed; and 6) Title of person responsible for correction. b.     If the ePOC does meet the required elements listed above, notify the FM and Unit AA3 that the ePOC is accepted and save the survey packet to the shared drive. c.     If the ePOC does not meet the required elements listed above, review the missing elements with the FM to determine if the FM agrees that the ePOC does not meet the required elements. Document the reason for the rejection in ePOC for each deficiency cited and that the entity was contacted out of courtesy to ensure open communication. This should also be documented on the POC form or the CMS 807 as part of the revisit working papers. ePOC Not Received 1.     If the ePOC is not received by the 10th calendar day (or next WD if the 10th calendar day falls on a weekend or holiday): a.    the ePOC system will email the administrator and remind them to submit the documentation to the department. The system will continue to send daily reminders to both the entity and the FM until the ePOC is complete. b.    If the administrator does not respond to the first email reminder within one working day, the unit AA3 will: 1)    Call the administrator on the next WD and remind them to submit the ePOC within the next 24 hours. 2)     Document the date and time of the call. c.     If the ePOC is still not received by the 15th calendar day following the exit date, the FM will: 1)    Determine if an unannounced on-site revisit needs to be conducted. 2)    Call or meet with the NH to: a)    Review the department’s concerns related to the NH’s failure to submit an ePOC that meets the required elements; and b)    Obtain the ePOC. d.    If the NH is unable or unwilling to comply with ePOC requirements, initiate a recommendation for enforcement remedy through the Enforcement page in STARS.   Washington Administrative Code (WAC) 388-97-1800 Criminal history disclosure and background inquiries states in part: (1) As used in this section, the term "nursing home" includes a nursing facility and a skilled nursing facility. (2) The nursing home must:     (a) Have a valid criminal history background check for any individual employed, directly or by contract, or any individual accepted as a volunteer or student who may have unsupervised access to any resident;  and         (b) Repeat the check every two years.

2025-047                The Department of Social and Health Services, Home and Community Living Administration, did not have adequate internal controls over and did not comply with survey requirements for Medicaid intermediate care facilities. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units  93.777 State Survey and Certification of Health Care Providers and Suppliers  93.778 Grants to States for Medicaid 93.778 COVID-19 Grants to States for Medicaid Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2405WA5MAP; 2405WA5ADM; 2505WA5MAP; 2505WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Test and Provisions – Provider Health and Safety Standards Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-078     Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and accounts for about half of the state’s federal expenditures. During fiscal year 2025, the program spent more than $23.7 billion in federal and state funds and had three Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICF/IID) that were Medicaid certified. Residential Care Services (RCS), under the Department of Social and Health Services, Home and Community Living Administration, is the State’s ICF/IID survey agency. An ICF/IID is an institution with the primary purpose of providing health or rehabilitation services to people with intellectual disabilities or related conditions who receive care and services under Medicaid. The Department must perform a federal certification survey of each ICF/IID. The certification survey is a resident-centered inspection that gathers information about the quality of service provided in a facility to determine compliance with the participation requirements. The survey focuses on the facility’s administration and patient services, as well as the outcome of the facility’s implementation of ICF/IID active treatment services. The survey also assesses compliance with federal health, safety and quality standards designed to ensure patients receive safe and quality care services.  The State must complete a standard survey for each ICF/IID facility within 15.9 months after the previous survey, and the statewide average for all ICF/IID facilities must not exceed 12.9 months, as required by Centers for Medicare and Medicaid Services. All staff surveyors are required to receive specific RCS training in order to be qualified to conduct surveys. If a survey uncovers deficiencies, the Department must mail a Statement of Deficiency (SOD) to the facility within 10 working days of the survey date. The facility must submit a Plan of Correction (POC) that the Department determines is acceptable within 10 calendar days of receipt of the SOD. The facility has a total of 60 days to be back in compliance or risk forfeiting its Medicaid certification. In addition to federal requirements, the Department has established its own policies and procedures requiring that it review a submitted POC within five working days after receiving it. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls to ensure it conducted timely surveys and followed up on deficiencies. The prior finding numbers were 2024-078, 2023-078, 2020-053, 2019-061, 2018–052, 2017-042, 2016-037, 2015-045, and 2014-046. Description of Condition The Department did not have adequate internal controls over and did not comply with survey requirements for Medicaid intermediate care facilities.  The Department uses a tracking spreadsheet as an internal control to monitor and track the survey frequencies as well as the statewide average frequency to ensure it meets the mandated 15.9-month survey frequency, and the statewide average of 12.9 months between surveys for each facility. The Department uses a separate tracking spreadsheet to track individual surveys for SOD and POC due dates and approaching deadlines.  We found the Department did not ensure that all recertification surveys were completed timely. The Department did not adequately monitor the tracking sheet and complete surveys for all three of the ICF/IIDs within the required 15.9 months and 12.9-month statewide average. The statewide average is calculated on the federal fiscal year. For federal fiscal year 2025, the statewide average for the three surveys was 13.5 months. Additionally, we noted that one of the three surveys reviewed during the fiscal year contained POCs that were reviewed 53 days after receipt, considerably after the five-day period required by the Department.   We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition As a result of the public health emergency, the Department had an extensive backlog of complaints and recertification surveys. While trying to address the backlog, there were new complaints that also had to be prioritized. Although there are only three facilities, there is only one team that handles the surveys, complaints and revisits for this provider type across the entire state. In addition, management did not adequately monitor its survey schedules to ensure compliance in meeting the survey timelines.  Effect of Condition Without conducting recertification surveys timely, the State is at risk of paying facilities for services provided to Medicaid clients without assurance the facilities are complying with federal and state health standards and regulations. Clients residing in facilities that do not meet federal health and safety requirements for participating in the Medicaid program could be at increased risk of abuse, mistreatment, neglect or substandard care. By not meeting the statewide average requirement for recertification surveys, the Department has not met federal Medicaid requirements and could be subject to sanctions by the grantor. Recommendations We recommend the Department:  Establish adequate internal controls to ensure compliance with facility survey timeliness requirements  Ensure it completes recertification surveys within 15.9 months and within the 12.9-month statewide average  Department’s Response The Department partially agrees with the finding. The Department’s internal controls are adequate to ensure compliance with facility survey completion and timeliness of requirements.  Due to the COVID pandemic, there was a Public Health Exemption (PHE) that prevented the Department from completing surveys on the normal timeline. Once the PHE was lifted, the Department worked quickly to meet the backlog demand in addition to the complaint investigations that the ICF-IID team were responsible for. Multiple states, including Washington, voiced concern to CMS that statistically it would be impossible to meet the 12.9 month average immediately, and movement of the bell curve would take multiple years. CMS agreed with the states’ position and in FFY24 they removed the 12.9 data point from the State Performance measurement report.  In FY24, the auditor’s report stated the statewide survey interval average was 22.1.  The FY25 SAO audit showed the statewide survey interval average of 13.5, which is an 8.6-month improvement in the survey interval proving that the current internal controls are working effectively. The Department will continue to use the current tracking system, reports and monthly meetings to ensure survey timelines requirements are met by August 31, 2026. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 42 CFR, Part 442, Standards for Payment to Nursing Facilities and Intermediate Care Facilities for Individuals with Intellectual Disabilities, states in part:   Section 442.109 – Certification period for ICF/IIDs: General Provisions   (a)    A survey agency may certify a facility that fully meets applicable requirements. The State Survey Agency must conduct a survey of each ICF/IID not later than 15 months after the last day of the previous survey. (b)  The statewide average interval between surveys must be 12 months or less, computed in accordance with paragraph (c) of this section. (c)  The statewide average interval is computed at the end of each Federal fiscal year by comparing the last day of the most recent survey for each participating facility to the last day of each facility's previous survey.   Title 42 CFR, Part 488, Survey, Certification, and Enforcement Procedures, states in part:   Section 488.28 – Providers or suppliers, other than SNFs, NFs, HHAs, and Hospice programs with deficiencies   (a)  If a provider or supplier is found to be deficient in one or more of the standards in the conditions of participation, conditions for coverage, or conditions for certification or requirements, it may participate in, or be covered under, the Medicare program only if the provider or supplier has submitted an acceptable plan of correction for achieving compliance within a reasonable period of time acceptable to CMS. In the case of an immediate jeopardy situation, CMS may require a shorter time period for achieving compliance. (b)  The existing deficiencies noted either individually or in combination neither jeopardize the health and safety of patients nor are of such character as to seriously limit the provider's capacity to render adequate care. (c)      (1) If it is determined during a survey that a provider or supplier is not in compliance with one or more of the standards, it is granted a reasonable time to achieve compliance. (2) The amount of time depends upon the - (i) Nature of the deficiency; and (ii) State survey agency's judgment as to the capabilities of the facility to provide adequate and safe care. (d)  Ordinarily a provider or supplier is expected to take the steps needed to achieve compliance within 60 days of being notified of the deficiencies but the State survey agency may recommend that additional time be granted by the Secretary in individual situations, if in its judgment, it is not reasonable to expect compliance within 60 days, for example, a facility must obtain the approval of its governing body, or engage in competitive bidding.        Section 488.110, Procedural Guidelines states in part: SNF/ICF Survey Process. The purpose for implementing a new SNF/ICF survey process is to assess whether the quality of care, as intended by the law and regulations, and as needed by the resident, is actually being provided in nursing homes. Although the onsite review procedures have been changed, facilities must continue to meet all applicable Conditions/Standards, in order to participate in Medicare/Medicaid programs. That is, the methods used to compile information about compliance with law and regulations are changed; the law and regulations themselves are not changed. The new process differs from the traditional process, principally in terms of its emphasis on resident outcomes. In ascertaining whether residents grooming and personal hygiene needs are met, for example, surveyors will no longer routinely evaluate a facility's written policies and procedures. Instead, surveyors will observe residents in order to make that determination. In addition, surveyors will confirm, through interviews with residents and staff, that such needs are indeed met on a regular basis. In most reviews, then, surveyors will ascertain whether the facility is actually providing the required and needed care and services, rather than whether the facility is capable of providing the care and services.   Title 45 U.S. Code of Federal Regulations(CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   Title 45 CFR Part 75,  section 516, Audit findings, establishes reporting requirements for audit findings.   The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.   The Centers for Medicare and Medicaid Services, State Operations Manual, Chapter 2 – The Certification Process, states in part:        2138G – Schedule for Recertification        (Rev. 91, Issued: 09-27-13, Effective: 09-27-13, Implementation: 09-27-13) The SA completes a recertification survey an average of every 12 months and at least once every 15 months (see §2141).        2141 – Recertification – ICFs/IID        (Rev. 91, Issued: 09-27-13, Effective: 09-27-13, Implementation: 09-27-13) ·         The regulation at §442.15 provides that provider agreements for ICF/IID’s would remain in effect as long as the facility remains in compliance with the Conditions of Participation (COP’s). Regulations at §442.109 through §442.111. ·         Beginning on May 16, 2012, ICF/IID’s are no longer subject to time-limited agreements. However, they are to be surveyed for re-certification an average of every 12 months and at least once every 15 months. ·         If during a survey the survey agency finds a facility does not meet the standards for participation the facility may remain certified if the survey agency makes two determinations – The facility may maintain its certification if the survey agency finds Immediate Jeopardy doesn’t exist, and if the facility provides an acceptable plan of correction. ·         An ICF/IID may be decertified under procedures outlined in Section 3012 of the State Operations Manual. More specifically, a facility may be decertified if an immediate jeopardy finding remains unabated after 23 days or if it fails to regain compliance with conditions of participation after 90 days.   ICF/IID’s will be subject to survey an average of every 12 months and at least every 15 months, the same period that is applied to Nursing Homes.     The Department of Social and Health Services, Residential Care Services Standard Operating Procedure: Chapter 18H – Plan of Correction (POC) – ICF/IID states in part:   Purpose  When an entity has received a citation, they must provide RCS with a POC and/or Credible Allegation of Compliance (CA) within 10 calendar days of receiving the SOD from RCS. The POC and/or CA must include the date each deficiency has been or will be corrected. Correction dates must not exceed 45 calendar days from the exit date, unless approved by the FM. The 45-calendar day count begins with the next full day after exit.   Procedure POC Notification 1. The regulator will:  a. Inform the entity prior to exit that a SOD report will be issued within 10 WDs of exit date. b. Inform the entity prior to exit that the POC must be completed for each cited deficiency in the SOD and returned to the department within 10 calendar days of receiving the SOD report. c. When necessary to protect resident health, safety, or welfare, the regulator may request a written safety plan submitted by the entity before exiting.   Review of POC 1. The regulator will: a. Review the POC within five WDs of receipt (or request the FM review if the regulator will not be available). Confirm the POC for each deficiency includes: 1) How the entity will correct the deficiency for each numbered resident. 2) How the entity will protect residents from similar situations. 3) Measures the entity will take or the systems it will change to ensure that the problem does not recur. 4) How the entity plans to monitor its ongoing performance to sustain compliance. 5) Dates corrective action will be completed; and 6) Title of person responsible for correction. b. If the POC does meet the required elements listed above, notify the FM and Unit AA3 that the POC is accepted and save the survey packet to the shared drive. c. If the POC does not meet the required elements listed above, review the missing elements with the FM to determine if the FM agrees that the POC does not meet the required elements. Document the reason for the rejection in POC for each deficiency cited and that the entity was contacted out of courtesy to ensure open communication. This should also be documented on Attachment V as part of the revisit working papers.    POC Not Received 1. If the POC is not received by the 10th calendar day (or next WD if the 10th calendar day falls on a weekend or holiday): a. The Unit AA3 will email the administrator on the next WD and remind them to submit the POC within the next 24 hours.  b. Document the date and time of the call on the electronic tracking sheet. c. If the POC is still not received by the 15th calendar day following the exit date, the FM will: 1) Determine if an unannounced on-site revisit needs to be conducted. 2) Call or meet with the ICF/IID to: a) Review the department’s concerns related to the ICF/IID’s failure to submit an POC that meets the required elements; and b) Obtain the POC. d. If the ICF/IID is unable or unwilling to comply with POC requirements, initiate a recommendation for enforcement remedy by following all steps contained in SOP Chapter 7 - Enforcement.

2025-048        The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements to ensure it referred all credible allegations of provider fraud to the state’s Medicaid Fraud Control Unit. Assistance Listing Number and Title: 93.775 – State Medicaid Fraud Control Units   93.777 State Survey and Certification of Health Care Providers and Suppliers    93.778 Grants to States for Medicaid    93.778 COVID-19 Grants to States for Medicaid Federal Grantor Name: U.S. Department of Health and Human Services  Federal Award/Contract Number: 2405WA5MAP; 2405WA5ADM; 2505WA5MAP; 2505WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions - Medicaid Fraud Control Unit Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-077   Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and accounts for about half of the state’s federal expenditures. During fiscal year 2025, the program spent more than $23.7 billion in federal and state funds.   States are required as part of their Medicaid state plans to maintain a Medicaid Fraud Control Unit (MFCU). The primary mission of the MFCU is to investigate and prosecute fraud by Medicaid providers, to review and investigate complaints alleging abuse or neglect of patients in Medicaid funded healthcare facilities, and to review and investigate complaints of patient abuse or neglect in board and care facilities or involving Medicaid beneficiaries in noninstitutional and other settings.   States must have methods and criteria for identifying suspected fraud cases, methods for investigating these cases, and procedures, developed in cooperation with legal authorities, for referring credible allegations of fraud cases to law enforcement officials. Credible allegations of provider fraud must be referred to the state MFCU, a division within the Office of the Attorney General. States must have an agreement with the MFCU, which includes methods of coordination and procedures for referring potential fraud.   Case managers and field staff at the Department of Social and Health Services, as well as its contractor, Consumer Direct Care Network Washington (CDWA), who manages Individual Providers delivering direct care to clients, help identify potential and suspected provider fraud for the Department to consider. The program integrity units within the Aging and Long-Term Support Administration (ALTSA) and Developmental Disabilities Administration (DDA) at the Department receive allegations of potential fraud and conduct further research to determine if the potential fraud is credible. Before March 2025, if the allegation was credible, and the fraud had a potential loss of $1,000 or more, the Department would refer the case to MFCU. During that time, the Department and CDWA worked together to offer provider education and billing standards training. Fraud allegations less than $1,000 were reviewed and tracked to ensure that any repeat allegations could be compiled to show a pattern of possible fraudulent behaviors. Starting in March 2025, the Department changed its practice to refer all credible allegations, regardless of the monetary value of the allegation.   Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it referred all credible allegations of provider fraud to the state’s MFCU. The prior finding number was 2024-077.   Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it referred all credible allegations of provider fraud to the state’s MFCU.   To determine if the Department properly reviewed and investigated all allegations of fraud and referred those which were credible to MFCU, we reviewed allegations that program integrity units at ALTSA and DDA received.   For allegations of fraud ALTSA reviewed, we used a statistical sampling method to randomly select and examine 55 out of a total population of 468 allegations. We determined ALTSA did not properly refer 17 (31%) credible allegations of fraud to MFCU.   For allegations of fraud DDA reviewed, we used a nonstatistical sampling method to randomly select and examine 16 out of a total population of 116 allegations. We determined DDA did not properly refer two (13%) credible allegations of fraud to MFCU.   We determined the Department’s internal controls were ineffectively designed to prevent noncompliance with MFCU requirements. Specifically, the Department’s decision to only refer cases of fraud with a potential loss of more than $1,000 was not in compliance with federal law, which requires the Department to refer all credible allegations to MFCU regardless of the amount of potential loss.   We consider these internal control deficiencies to be a material weakness which led to material noncompliance. Cause of Condition Department management asserted in fiscal year 2024 that they believed MFCU only wanted them to refer allegations with a monetary value more than $10,000. However, the Department determined that it would refer credible allegations with a potential loss of $1,000 or more. During fiscal year 2025, in response to our audit recommendations, the Department changed the way it referred allegations. During fiscal year 2025, the Department changed its policy to refer all credible allegations, regardless of the monetary value of the allegation. Because this practice did not begin until March of 2025, there were still some cases that the Department did not refer to MFCU that it should have. Effect of Condition Because the Department used a monetary threshold for a majority of the audit period, it did not refer most credible allegations of fraud with a potential loss of less than $1,000 to MFCU, as required. This prevents MFCU from considering some credible allegations of fraud for investigation. The State is therefore at risk of not recovering Medicaid funds that may have been fraudulently paid to providers. Recommendation We recommend the Department continue to refer all credible allegations of fraud to MFCU. Department’s Response The Department concurs with the finding. The Department addressed the Fiscal Year 2024 Medicaid Fraud Control Unit (MFCU) audit finding by implementing enhanced internal controls to ensure that all fraud referrals, regardless of dollar amount, are submitted to MFCU.  The corrective action plan associated with the 2024 finding was completed in April 2025. The 17 credible allegations identified within Aging Long-Term Services Administration, and the two identified within Developmental Disabilities Administration occurred prior to April 2025, preceding both the process improvement and the completion of the 2024 corrective action plan.  All 19 credible allegations were under $1,000 and while those may not have been referred to MFCU, Consumer Direct Care Network Washington (CDWA) did provide provider education and ensured all funds were returned to Centers for Medicare and Medicaid Services. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings.   Title 42 CFR Part 455, section 21, Cooperation with State Medicaid fraud control units, states in part: (a). The agency must (1) Refer all cases of suspected provider fraud to the unit; The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-049   The Health Care Authority did not have adequate internal controls over and did not comply with Recovery Audit Contractor requirements for the Medicaid program. Assistance Listing Number and Title: 93.775 – State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers  93.778 Grants to States for Medicaid 93.778 COVID-19 Grants to States for Medicaid Federal Grantor Name: U.S. Department of Health and Human Services  Federal Award/Contract Number: 2405WA5MAP; 2405WA5ADM; 2505WA5MAP; 2505WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions - Medicaid Recovery Audit Contractors (RACs) Known Questioned Cost Amount: None Prior Year Audit Finding: No     Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and accounts for about half of the state’s federal expenditures. During fiscal year 2025, the program spent more than $23.7 billion in federal and state funds.   The Medicaid Recovery Audit Contractor (RAC) program was established under Section 1902(a)(42)(B)(i) of the Social Security Act (42 U.S.C. Section 1396a) and 42 CFR section 455, Subpart F. The program requires states to contract with one or more RACs to identify Medicaid underpayments and overpayments, and to recover overpayments made under the state plan or any waiver. States must also report recoveries on the CMS-64 report, ensure RACs coordinate with other auditing entities, refer suspected fraud or abuse to the Medicaid Fraud Control Unit (MFCU) or law enforcement and set limits on the number and frequency of medical records to be reviewed by the RACs. In Washington, the Health Care Authority (HCA) is the designated state Medicaid agency responsible for implementing RAC requirements. Washington previously operated under a State Plan Amendment (SPA 22-0030) approved by the Centers for Medicare and Medicaid Services (CMS), which waived RAC requirements through September 30, 2024. After the waiver expired, the requirement to establish and operate a RAC program became fully effective beginning October 1, 2024.   Approximately ninety percent of Washington’s Medicaid population are enrolled in managed care, which provides health services through distribution of a per member per month capitation payment. The remaining services are furnished under and made through the fee-for-service (FFS) payment model. States may exclude Medicaid managed care claims from review by Medicaid RACs. The Authority submitted SPA 25-0021 in July 2025 to begin establishment of a RAC program, effective September 2025, to review claims submitted by providers of items and services, and other coverage codes for which payment has been made from FFS funds and to identify underpayments and overpayments on behalf of the State.   Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls.   Description of Condition The Authority did not have adequate internal controls over and did not comply with RAC requirements for the Medicaid program.   During the audit period, the Authority did not execute a RAC contract or begin implementing the RAC program. The Authority did begin contract negotiations and filed SPAs to establish a RAC program effective September 2025; however, the Authority did not comply with federal requirements for the Medicaid RAC during the audit period. Because the Authority did not contract with a Medicaid RAC, we found it did not meet the following requirements of the RAC program:   ·     Perform claims reviews, overpayment recoveries and underpayment identifications; as such, it excluded RAC activities from the CMS-64 report. ·     Develop policies, procedures and internal controls to support RAC compliance requirements, such as setting limits on medical record requests, conducting provider outreach, coordinating recovery efforts with other auditing entities, and making fraud referrals.   We consider these internal control deficiencies to be a material weakness that led to material noncompliance.   We did not report this issue as a finding in the prior audit. Cause of Condition The Authority did not complete the procurement process before SPA 22-0030 expired. Negotiations with a potential successful bidder continued through the audit period, delaying implementation beyond the fiscal year end.  Effect of Condition Without implementing a RAC program, the state cannot ensure improper FFS Medicaid payments are identified and recovered under the program. This increases the risk that: Federal and state Medicaid funds are not safeguarded, since overpayments remain undetected and uncollected Underpayments to providers go unaddressed, which can affect provider participation and program integrity Fraud, waste and abuse are not referred to the appropriate authorities, weakening oversight and enforcement efforts The Authority would not meet CMS oversight expectations, as it did not report required RAC activities and recoveries on the CMS-64 report Recommendation We recommend the Authority establish internal controls over and complete implementation of the RAC program, including the development and execution of RAC-specific policies, conducting claims reviews and recoveries, establishment of fraud referral procedures, and ensuring compliance with CMS-64 reporting requirements.  Authority’s Response The Authority partially concurs with the finding.  It agrees it did not have a RAC contract in place during the fiscal year under review but expects to have the contract in place by October 2025.  However, it does not concur with the auditor’s recommendation. The work of a RAC contractor is one of many tools used by the Authority to identify and report fraud, waste, and abuse and is meant to supplement the Authority’s Program Integrity work.  The Authority has policies and procedures in place over claim reviews and recoveries, fraud referral procedures, and CMS reporting requirements, and will simply add the results of the RAC contractor reviews into its current workflow. Auditor’s Remarks The Authority states that additional program integrity work is performed to address similar objectives as the RAC. However, the compliance area that this finding addresses only includes activities performed as part of the RAC program. The additional activities the Authority refers to are not within the scope of this special test and are instead examined under other compliance areas. As such, we reaffirm our finding and will review the status of the Authority’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.   Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings.   The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.   Social Security Act §1902(a)(42)(B)(i) (42 U.S.C. §1396a), Requires states to establish programs to contract with Medicaid RACs to identify and recover overpayments and identify underpayments. Title 42 CFR part 455 section 502, Establishment of Program, states: (a) The Medicaid Recovery Audit Contractor program (Medicaid RAC program) is established as a measure for States to promote the integrity of the Medicaid program. (b) States must enter into contracts, consistent with State law and in accordance with this section, with one or more eligible Medicaid RACs to carry out the activities described in § 455.506 of this subpart. (c) States must comply with reporting requirements describing the effectiveness of their Medicaid RAC programs as specified by CMS. Section 506, Activities to be conducted by Medicaid RACs and States (a) Medicaid RACs will review claims submitted by providers of items and services or other individuals furnishing items and services for which payment has been made under section 1902(a) of the Act or under any waiver of the State Plan to identify underpayments and overpayments and recoup overpayments for the States. (1) States may exclude Medicaid managed care claims from review by Medicaid RACs. (b) States may coordinate with Medicaid RACs regarding the recoupment of overpayments. (c) States must coordinate the recovery audit efforts of their RACs with other auditing entities. (d) States must make referrals of suspected fraud and/or abuse, as defined in 42 CFR 455.2, to the MFCU or other appropriate law enforcement agency. (e) States must set limits on the number and frequency of medical records to be reviewed by the RACs, subject to requests for exception from RACs to States. Section 508, Eligibility requirements for Medicaid RACs An entity that wishes to perform the functions of a Medicaid RAC must enter into a contract with a State to carry out any of the activities described in § 455.506 under the following conditions: (a) The entity must demonstrate to a State that it has the technical capability to carry out the activities described in § 455.506 of this subpart. Evaluation of technical capability must include the employment of trained medical professionals, as defined by the State, who are in good standing with the relevant State licensing authorities, where applicable, to review Medicaid claims. (b) The entity must hire a minimum of 1.0 FTE Contractor Medical Director who is a Doctor of Medicine or Doctor of Osteopathy in good standing with the relevant State licensing authorities and has relevant work and educational experience. A State may seek to be excepted, in accordance with § 455.516, from requiring its RAC to hire a minimum of 1.0 FTE Contractor Medical Director by submitting to CMS a written request for CMS review and approval. (c) The entity must hire certified coders unless the State determines that certified coders are not required for the effective review of Medicaid claims. (d) The entity must work with the State to develop an education and outreach program, which includes notification to providers of audit policies and protocols. (e) The entity must provide minimum customer service measures including: (1) Providing a toll-free customer service telephone number in all correspondence sent to providers and staffing the toll-free number during normal business hours from 8:00 a.m. to 4:30 p.m. in the applicable time zone. (2) Compiling and maintaining provider approved addresses and points of contact. (3) Mandatory acceptance of provider submissions of electronic medical records on CD/DVD or via facsimile at the providers' request. (4) Notifying providers of overpayment findings within 60 calendar days. (f) The entity must not review claims that are older than 3 years from the date of the claim, unless it receives approval from the State. (g) The entity should not audit claims that have already been audited or that are currently being audited by another entity. (h) The entity must refer suspected cases of fraud and/or abuse to the State in a timely manner, as defined by the State. (i) The entity meets other requirements as the State may require. Section 516, Exceptions from Medicaid RAC programs A State may seek to be excepted from some or all Medicaid RAC contracting requirements by submitting to CMS a written justification for the request for CMS review and approval through the State Plan amendment process.

2025-050       The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Federal Funding Accountability and Transparency Act for the Block Grants for Community Mental Health Services and Block Grants for Substance Use Prevention, Treatment, and Recovery Services programs. Assistance Listing Number and Title: 93.958 Block Grants for Community Mental Health Services 93.958 COVID-19 Block Grants for Community Mental Health Services 93.959 Block Grants for Substance Use Prevention, Treatment, and Recovery Services 93.959 COVID-19 Block Grants for Substance Use Prevention, Treatment, and Recovery Services Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 6B09SM083998-01, 6B09SM083998-01M001, 6B09SM083998-01M002, 6B09SM083998-01M003, 6B09SM085912-01,6B09SM085912-01M001, 6B09SM085912-01M002,6B09SM085384-01, 6B09SM085384-01M001,6B09SM085384-01M002, 1B09SM087327-01,6B09SM087386-01, 6B09SM087386-01M001, 6B09SM087386-01M002, 6B09SM087386-01M003, 6B09SM089385-01, 6B09SM089385-01M001, 1B09SM089651-01, 1B09SM089651-01, 1B09SM089992-01, 1B09SM090369-01, 1B08TI083977-01,6B08TI083977-01M001, 6B08TI083977-01M002,1B08TI083519-01, 6B08TI083519-01M001, 6B08TI083519-01M002, 1B08TI084617-01, 6B08TI084617-01M001, 6B08TI084617-01M002,1B08TI085843-01, 6B08TI085843-01M002,1B08TI087075-01, 1B08TI088142-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2024-083       Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Community Mental Health Services Block Grant (MHBG) and the Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Utilizing MHBG funds, the Authority subawards funds to counties, tribes, and nonprofit organizations to provide mental health treatment and crisis services to adults diagnosed with serious mental illness and children diagnosed with serious emotional disturbances. In fiscal year 2025, the Authority spent about $34.6 million in federal program funds, $22 million of which it paid to subrecipients. The Authority also subawards federal funds under the SUPTRS program to counties, tribes, and nonprofit organizations to develop prevention programs and provide treatment and support services. In fiscal year 2025, the Authority spent about $44.8 million in federal program funds, including about $30.2 million it paid to subrecipients. The Federal Funding Accountability and Transparency Act (Act) requires the Authority to collect and report information on each subaward of federal funds more than $30,000 in the federal reporting system. The Authority must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The Act is intended to empower the public with the ability to hold the federal government accountable for spending decisions and therefore reduce wasteful government spending. The Authority includes a subaward identification form, which contains all the required reporting information, when it creates a new subaward or amendment. After all parties sign the form, contract unit staff email the subaward identification form to the federal financial reporting unit, which completes the report as required. Staff track the status of reportable subawards and amendments in monthly workbooks to ensure all subawards and amendments are included in the FFATA report. The Grants Compliance Manager reviews this monthly FFATA reconciliation workbook to ensure FFATA reports are submitted for all applicable subawards. There were 96 SUPTRS and MHBG subawards and amendments that the Authority was required to report in fiscal year 2025 totaling $74,884,110. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act for the MHBG and SUPTRS programs. The prior finding numbers for SUPTRS were 2024-083, 2023-086, 2022-069 and 2021-058. The prior finding number for MHBG was 2022-065. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Act. We used a non-statistical sampling method to randomly select and examine 15 of the 96 subawards and amendments with seven pertaining to each MHBG and SUPTRS and one pertaining to both. We found that six (40%) did not meet reporting requirements as follows. Out of 15 subawards, the Authority: Did not submit three (20%) Filed one (7%) 141 days late Submitted two (13%) with incorrect amounts  Transactions Tested Subaward Not Reported Report Not Timely Subaward Amount Incorrect Subaward Missing Key Elements 15 3 1 2 0 Dollar Amount of Tested Transactions Subaward Not Reported Report Not Timely Subaward Amount Incorrect Subaward Missing Key Elements $9,832,193 $228,753 $50,000 $2,442,106 (overreported) $0   We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department stated these errors were the result of incorrect information on the forms used to complete the FFATA entries. In addition, there were technical issues with the Authority’s system and the new federal reporting system that resulted in the report being submitted late. During the prior audit period, the Authority implemented a new monthly reconciliation process to ensure it properly identified all required subawards and amendments to report. This new process was not effective to ensure it submitted all reports as required. Effect of Condition Failing to submit the required reports on time or submitting incorrect obligation amounts diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendation We recommend the Authority: Establish effective internal controls to ensure it submits all required reports Provide training for employees who oversee reporting and who verify the submission and accuracy of the reports Ensure management monitors reporting of this information to ensure future reports are submitted completely and on time Authority’s Response The Authority concurs with the finding. After identification by auditors, the Authority submitted the three reports that had not been filed and corrected the two inaccurate reports. During the fiscal year, the Authority transitioned to a new state tracking system and a new federal reporting system. Several issues resulted from transitioning the reporting process to the new systems. The Authority will review its controls and processes to ensure accurate and complete reporting. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part:        Appendix A to Part 170 – Award Term I.Reporting Subawards and Executive Compensation a.Reporting of first-tier subawards. 1.Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2.Reporting Requirements. i.The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at https://www.fsrs.gov. ii.For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the subaward was made on November 7, 2025, the subaward must be reported by no later than December 31, 2025). The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-051       The Health Care Authority did not have adequate internal controls over and did not comply with federal level of effort requirements for the Block Grants for Substance Use Prevention, Treatment, and Recovery Services program. Assistance Listing Number and Title: 93.959 Block Grants for Substance Use Prevention, Treatment, and Recovery Services 93.959 COVID-19 Block Grants for Substance Use Prevention, Treatment, and Recovery Services Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 1B08TI083977-01,6B08TI083977-01M001, 6B08TI083977-01M002,1B08TI083519-01, 6B08TI083519-01M001, 6B08TI083519-01M002, 1B08TI084617-01, 6B08TI084617-01M001, 6B08TI084617-01M002,1B08TI085843-01, 6B08TI085843-01M002,1B08TI087075-01, 1B08TI088142-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Level of Effort Known Questioned Cost Amount: None Prior Year Audit Finding: No       Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). The Authority subawards federal funds under the SUPTRS program to counties, tribes, and nonprofit organizations to develop prevention programs and provide treatment and support services. In fiscal year 2025, the Authority spent about $44.8 million in federal program funds, including about $30.2 million it paid to subrecipients. The SUPTRS program included a level of effort requirement to maintain state expenditures for authorized activities by the state at a level at least equal to the average level of such expenditures the state maintained for the two state fiscal years before the fiscal year the state applied for the grant. If necessary, the Authority may request from the federal grantor an exclusion of non-recurring funds, which can inflate amounts. The Authority tracks level of effort requirements quarterly and maintains these calculations within tracking workbooks, which fiscal staff reviews and a Behavioral Health Grants lead or supervisor approves. Federal regulations require recipients to establish and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Authority did not have adequate internal controls over and did not comply with federal level of effort requirements for the SUPTRS program. We calculated the overall state spending for this requirement during state fiscal year 2025 and compared it to the state fiscal years 2023 and 2024 average. The Authority spent $3,481,637 less in state expenditures than it needed to meet the level of effort requirement. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition In the last quarterly level of effort tracking workbook for the state fiscal year, the Authority noted that this requirement was not on track to meet the requirement, but management did not take adequate action to address it. The Department stated noncompliance was the result of prior years’ state expenditures containing inflated spending amounts due to COVID funding and that it was not aware it could obtain a waiver from the federal grantor. Effect of Condition By not establishing adequate internal controls, the Authority was not able to ensure the state met the federal level of effort requirement for the SUPTRS program. By not complying with federal requirements, the Authority risks having to repay federal funds or having future federal funds withheld. Recommendation We recommend the Authority: Establish and follow effective internal controls to ensure it meets level of effort requirements Consult with the appropriate state-level authority to ensure the state maintains the level of effort required to comply with federal law Authority’s Response The Authority concurs it did not meet the level of effort threshold with the information it provided to the auditor during the audit.  However, after further review conducted during corrective action plan development, the Authority found it did not meet the threshold due to the timing of managed care expenditures moved between behavioral health programs in fiscal years 2023 and 2024.  This adjustment caused an overstatement of SUD expenditures in these two fiscal years that directly impacted the level of effort threshold for fiscal year 2025.  The Authority has initiated conversations with its grantor, SAMHSA, and will submit a formal request by the middle of January 2026 to restate and update the level of effort table.  This will result in accurately stated expenditures and allow the Authority to show SAMHSA that it met the threshold for fiscal year 2025.  The Authority has already implemented procedures to ensure timely processing of expenditure adjustments between behavioral health programs.  Additionally, it will strengthen its internal controls by updating procedures aimed at identifying areas of underspend through year-over-year expenditure analysis.  It will also document deadlines to ensure adequate time is allowed for timely waiver submission, should that be required.  These internal control enhancements will occur by the beginning of March 2026. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Part 96, section 134 - Maintenance of effort regarding State expenditures, states in part: (a) With respect to the principal agency of a State for carrying out authorized activities, the agency shall for each fiscal year maintain aggregate State expenditures by the principal agency for authorized activities at a level that is not less than the average level of such expenditures maintained by the State for the two year period preceding the fiscal year for which the State is applying for the grant. The Block Grant shall not be used to supplant State funding of alcohol and other drug prevention and treatment programs. (b) Upon the request of a State, the Secretary may waive all or part of the requirement established in paragraph (a) of this section if the Secretary determines that extraordinary economic conditions in the State justify the waiver. The State involved must submit information sufficient for the Secretary to make the determination, including the nature of the extraordinary economic circumstances, documented evidence and appropriate data to support the claim, and documentation on the year for which the State seeks the waiver. The Secretary will approve or deny a request for a waiver not later than 120 days after the date on which the request is made. Any waiver provided by the Secretary shall be applicable only to the fiscal year involved. “Extraordinary economic conditions” mean a financial crisis in which the total tax revenue declines at least one and one-half percent, and either unemployment increases by at least one percentage point, or employment declines by at least one and one-half percent. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2025-052       The Military Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act for the Fire Management Assistance Grant program. Assistance Listing Number and Title: 97.046 Fire Management Assistance Grant Federal Grantor Name: U.S. Department of Homeland Security Federal Award/Contract Number: FM-5397-WA, FM-5401-WA, FM-5455-WA, FM-5087-WA, FM-5090-WA, FM-5094-WA, FM-5101-WA, FM-5100-WA, FM-5104-WA, FM-5098-WA, FM-5103-WA, FM-5108-WA, FM-5106-WA, FM-5109-WA, FM-5113-WA, FM-5337-WA, FM-5351-WA Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No       Background The Robert T. Stafford Disaster Relief and Emergency Assistance Act, Public Law 93-288, as amended, 42 U.S.C. §5121, et seq. (Stafford Act) authorizes the President to provide Fire Management Assistance in response to a declared fire. Federal assistance is coordinated through the Department of Homeland Security’s Federal Emergency Management Agency (FEMA). Under the Fire Management Assistance Grant (FMAG) program, FEMA provides assistance in the form of grants for equipment, supplies, and personnel costs, to any state, tribal government, or local government for the mitigation, management, and control of any fire on public or private forest land or grassland that threatens such destruction as would constitute a major disaster. The FMAG Program replaced FEMA’s Fire Suppression Assistance Program when Section 420 of the Stafford Act was amended by the Disaster Mitigation Act of 2000, Public Law 106-390, and is effective for all fires declared on or after October 30, 2001. The FMAG is a “funds matching program” with a funding arrangement of 75 percent federal share and 25 percent non-federal share – subrecipient responsibility. The Washington Military Department acts as the intermediary between the subrecipients and FEMA, by answering questions about program requirements and documentation of costs, preparing project worksheets for funding, advising subrecipients of funding approvals, processing payment requests, and closing subrecipient subawards (grants). In fiscal year 2025, the Department received more than $45 million in FMAG federal funding, which was passed-through and expended by its subrecipients. The Federal Funding Accountability and Transparency Act (Act) requires the Department to collect and report information on each subaward of federal funds more than $30,000 in the federal reporting system. The Department must report subawards by the end of the month following the month in which it executed the subaward (or subaward amendment). The Act is intended to empower the public with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. FEMA issues subaward and amendment obligation of project funding notifications as an S1 report. FMAG program staff use the S1 report to enter obligation details into the Contract Unit’s Federal Funding Accountability and Transparency Act (FFATA) Reporting Spreadsheet that contains the required reporting information for the subawards. Contracts staff then submit the report based on the FFATA spreadsheet. There were 20 FMAG subawards that the Department was required to report in fiscal year 2025, totaling $47,190,192. Federal regulations require recipients to establish, document and maintain effective internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act for the FMAG program. During the audit period, the Department was required to report 20 subawards, totaling more than $47 million of program funds, that it awarded to three subrecipients. We examined all 20 and found the Department: Did not submit four of the required reports Did not accurately report the subaward obligation date for one report Submitted seven reports later than the last day of the month following the month in which the subaward was obligated Our testing results are summarized in the table below: Transactions Tested Subaward Not Reported Report Not Timely Subaward Amount Incorrect Inaccurate Subaward Key Elements 20 4 7 0 1 Dollar Amount of Tested Transactions Subaward Not Reported Report Not Timely Subaward Amount Incorrect Inaccurate Subaward Key Elements $47,190,192 $4,460,413 $11,641,985 $0 $142,059   We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department has procedures in place to ensure staff report subawards and amendments, however management did not ensure program staff entered all subaward information in the FFATA reporting spreadsheet correctly. Effect of Condition Failing to properly submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Department: Establish effective internal controls to ensure it submits all required reports on time and accurately Follow established procedures to ensure it enters all required information accurately and timely Department’s Response During SFY 2024–25, FEMA implemented significant methodology changes that affected the FMAG program. FEMA transitioned from using FEMA EMMIE reports to FEMA Grants Portal reports and FEMA GO for S1 forms. During this transition, FMAG program staff encountered difficulty identifying accurate obligation dates for each subrecipient, which led to discrepancies in the data reported in FFATA. Additionally, FEMA did not consistently follow its own notification process for several obligations, which resulted in the program not reporting those obligations until later months after staff became aware of the awards. At the same time, the Program Assistant position responsible for completing FFATA reporting remained vacant for most of the state fiscal year. Multiple team members filled the role on an interim basis, which contributed to missed or delayed entries. The program and contracts staff also attempted to enter several awards into FFATA, but SAM.gov would not accept the entries because the overall grant had not yet been entered into the system. The issue was discussed with FEMA but was not resolved for several months, resulting in additional late reporting. The combination of reporting system changes, SAM.gov limitations, increased operational workload, and staffing shortages contributed to the reporting inaccuracies. An additional check-and-balance process is needed to assist Public Assistance Program supervisory staff during final review. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I.Reporting Subawards and Executive Compensation a.Reporting of first-tier subawards. 1.Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2.Reporting Requirements. i.The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at https://www.fsrs.gov. ii.For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the subaward was made on November 7, 2025, the subaward must be reported by no later than December 31, 2025). The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-004 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Child and Adult Care Food Program. Assistance Listing Number and Title: 10.558 Child and Adult Care Food Program Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 237WAWA3N1199; 237WAWA3N1099; 237WAWA3N2020; 237WAWA4N1150; 247WAWA3N1199; 247WAWA3N1099; 247WAWA3N2020; 247WAWA3N1038; 247WAWA4N1150; 247WAWA4N1050 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-003 Background The Child and Adult Care Food Program (CACFP) reimburses child and adult care institutions and family or group day care homes for providing nutritious meals and snacks that contribute to the wellness, healthy growth, and development of young children, and the health and wellness of older adults and people with disabilities. In Washington, the Office of Superintendent of Public Instruction administers CACFP. The Office spent about $46.9 million in federal funds, more than $46.3 million of which it paid to subrecipients. The Office is responsible for monitoring all institutions participating in CACFP to ensure compliance with meal pattern, recordkeeping and other program requirements. Institutions that provide meals can participate through a sponsoring organization that will be financially and administratively responsible, or they can apply directly to the state agency and operate as an independent center. Federal regulations require pass-through entities to ensure that every subaward is clearly identified to a subrecipient as a subaward, and that it includes 14 federal award identification elements. These elements include the subrecipient’s unique entity identifier, the Federal Award Identification Number, name of the federal awarding agency, the program’s Assistance Listing Number and title, obligation amounts, project periods and more. When some of this information is not available, the pass-through entity must provide the best information available to describe the federal award and subaward. In addition, pass-through entities must impose requirements on subrecipients so that they use the program funds in accordance with federal statutes, regulations, and the federal award’s terms and conditions. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Office did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Child and Adult Care Food Program. The prior finding number was 2023-003. Description of Condition The Office did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Child and Adult Care Food Program. We identified 279 nonprofit subrecipients of the program who were paid with federal funds during fiscal year 2024 and were subject to the Uniform Guidance requirements. We examined the various methods that the Office used to communicate the required federal award identification elements to subrecipients. These methods included periodic permanent agreements, an annual application process, and program communications during the current program year. We found that these methods did not properly communicate all federal award elements, terms and conditions, and other federal award requirements to the subrecipient. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition Management responsible for ensuring compliance were not familiar with subrecipient monitoring requirements. As a result, management did not know that the program must identify and communicate the federal award identification elements to subrecipients, and that permanent agreements and annual application renewals do not constitute or substitute for a formal subaward. During the audit period, the Office developed written procedures to address this issue to ensure it submits all elements as required, but did not implement this process until after the end of the audit period. Effect of Condition Without proper identification and communication of the federal award, the Office cannot properly notify subrecipients about the required federal award elements, nor impose requirements so the subrecipients use the federal award in accordance with its terms and conditions, federal statutes, and regulations. Further, the Office cannot impose any additional requirements of the pass-through entity on the subrecipient to meet its own responsibilities to the federal awarding agency, as well as other requirements as specified in the Uniform Guidance. Recommendations We recommend the Office: • Establish policies and procedures to ensure subawards are clearly identified as a subaward and communicate all required information according to the Uniform Guidance • Establish internal controls to formally communicate federal award information and requirements to subrecipients • Consult with the grantor for additional guidance on subrecipient monitoring requirements Office’s Response OSPI concurs with the finding for federal award elements. This is an agreement based on the cycle year and that this was performed outside the audit timeline. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-005 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with required monitoring of subrecipients of the Child and Adult Care Food Program Assistance Listing Number and Title: 10.558 Child and Adult Care Food Program Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 237WAWA3N1199; 237WAWA3N1099; 237WAWA3N2020; 237WAWA4N1150; 247WAWA3N1199; 247WAWA3N1099; 247WAWA3N2020; 247WAWA3N1038; 247WAWA4N1150; 247WAWA4N1050 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-002 Background The Child and Adult Care Food Program (CACFP) reimburses child and adult care institutions and family or group day care homes for providing nutritious meals and snacks that contribute to the wellness, healthy growth and development of young children, and the health and wellness of older adults and people with disabilities. In Washington, the Office of Superintendent of Public Instruction administers CACFP. During fiscal year 2024, the Office spent about $46.9 million in federal funds, more than $46.3 million of which it paid to subrecipients. The Office is responsible for monitoring all institutions participating in CACFP to ensure compliance with meal pattern, recordkeeping and other program requirements. Institutions that provide meals can participate through a sponsoring organization that will be financially and administratively responsible, or they can apply directly to the state agency and operate as an independent center. Federal regulations require the Office to monitor the activities of subrecipients to ensure they use subawards for authorized purposes and in compliance with federal statutes, regulations, and the terms and conditions of the subaward. This monitoring must include reviewing financial and performance reports and taking timely and appropriate action on all deficiencies pertaining to the federal award. The federal grantor, the U.S. Department of Agriculture (USDA), requires states to monitor subrecipients at least once every three years. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Office did not have adequate internal controls over and did not comply with required monitoring of subrecipients of the CACFP. The prior finding number was 2023-002. Description of Condition The Office did not have adequate internal controls over and did not comply with required monitoring of subrecipients of the CACFP. During the audit period, the Office identified 228 subrecipients for monitoring in accordance with the federal regulations. However, the Office did not comply with the regulations, as it did not monitor 23 subrecipients within the required three-year timeframe. We examined a sample of 23 subrecipients that were scheduled to receive financial and programmatic monitoring by the Office during the audit period, to ensure they were performed properly. The Office did not monitor three of the subrecipients, which are included in the 23 referenced above. We found the other 20 subrecipients received adequate monitoring. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition A single Program Specialist was responsible for monitoring all 23 subrecipients that fell out of the required three-year monitoring cycle. Due to inadequate management oversight, these subrecipients were not monitored within the required timeframe. Effect of Condition Without establishing adequate internal controls, the Office cannot reasonably ensure that it can meet the minimum monitoring requirements imposed by the federal grantor. In addition, without proper and timely monitoring of financial and programmatic performance, the Office does not have reasonable assurance that each subrecipient has complied with the terms and conditions of the subaward. Recommendation We recommend the Office strengthen internal controls to ensure it monitors all subrecipients according to the grantor’s minimum requirements and other federal regulations. Office’s Response Based on the updated exceptions,  OSPI accepts the finding for CACFP (ALN 10.558) - Subrecipient Monitoring: Monitoring Activity. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities. Title 2 CFR Part 200, section 516, Audit findings, establishes reporting requirements for audit findings. Title 7 CFR Part 226.6, State agency administrative responsibilities state in part: (m) Program assistance — (6) Frequency and number of required institution reviews. The State agency must annually review at least 33.3 percent of all institutions. At least 15 percent of the total number of facility reviews required must be unannounced. The State agency must review institutions according to the following schedule: (i) At least once every 3 years, independent centers and sponsoring organizations that operate 1 to 100 facilities must be reviewed. A sponsoring organization review must include reviews of 10 percent of the sponsoring organization's facilities. (ii) At least once every 2 years, sponsoring organizations that operate more than 100 facilities, that conduct activities other than CACFP, that have been identified during a recent review as having serious management problems, or that are at risk of having serious management problems must be reviewed. These reviews must include reviews of 5 percent of the sponsoring organization's first 1,000 facilities and 2.5 percent of the sponsoring organization's facilities in excess of 1,000. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-006 The Office of Superintendent of Public Instruction did not have internal controls over and did not comply with requirements to verify single audits were completed for all subrecipients of the Child and Adult Care Food Program. Assistance Listing Number and Title: 10.558 Child and Adult Care Food Program Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 237WAWA3N1199; 237WAWA3N1099; 237WAWA3N2020; 237WAWA4N1150; 247WAWA3N1199; 247WAWA3N1099; 247WAWA3N2020; 247WAWA3N1038; 247WAWA4N1150; 247WAWA4N1050 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-004 Background The Child and Adult Care Food Program (CACFP) reimburses child and adult care institutions and family or group day care homes for providing nutritious meals and snacks that contribute to the wellness, healthy growth, and development of young children, and the health and wellness of older adults and people with disabilities. In Washington, the Office of Superintendent of Public Instruction administers CACFP. In fiscal year 2024, the Office spent about $46.9 million in federal funds, more than $46.3 million of which it paid to subrecipients. The Office is responsible for monitoring all institutions participating in CACFP to ensure compliance with meal pattern, recordkeeping and other program requirements. Institutions that provide meals can participate through a sponsoring organization that will be financially and administratively responsible, or they can apply directly to the state agency and operate as an independent center. Federal regulations require the Office to monitor its subrecipients’ activities. This includes: • Verifying that subrecipients obtain a single audit if they spend $750,000 or more in federal awards during a fiscal year • Following up and ensuring that subrecipients take timely and appropriate action on all deficiencies pertaining to the federal award • Issuing a management decision to the subrecipient for applicable audit findings pertaining to the federal award Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Office did not comply with requirements to verify single audits were completed for all subrecipients of the Child and Adult Care Food Program. The prior finding number was 2023-004. Description of Condition The Office did not have internal controls over and did not comply with requirements to verify single audits were completed for all CACFP subrecipients. The Office had processes in place to monitor that subrecipients received single audits. During the audit period, the Office had 464 CACFP subrecipients, and 45 of them were local education agencies (LEAs) or school districts. The Office’s federal compliance staff had a centralized process for LEAs to ensure they received the required audits, and we found these controls were effective. For the 419 subrecipients that were not LEAs, the Office used information in the Federal Audit Clearinghouse (FAC) to identify subrecipients requiring a single audit. If a subrecipient that required a single audit did not complete or file its audit report timely, then the information in the FAC database would lead the Office to erroneous conclusions. As a result, we determined that the Office did not have adequate controls to identify all subrecipients that required a single audit. We also determined the Office did not have adequate documentation that this single audit tracking process was completed during the audit period. We identified 75 subrecipients in this documentation that program staff compiled from the FAC database, and we used a statistical sampling method to randomly select and examine 13 of those subrecipients. We also judgmentally selected one subrecipient that had a program-related finding during the audit period, for a total of 13 testing samples. We found that one of these subrecipients required a single audit, but did not complete or did not submit its audit report during the audit period. The Office did not have any record that staff followed up with this subrecipient regarding the missing audit report. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Office developed written procedures to address issues identified in the prior audit to ensure it tracks all subrecipients that require single audits, but did not implement the process until after the audit period had ended. Effect of Condition Without establishing adequate internal controls, the Office cannot ensure that all subrecipients requiring a single audit receive one, that timely and appropriate action is taken for subrecipients that did not obtain a single audit, and that subrecipients with audit findings receive required management decisions. Recommendations We recommend the Office: • Establish effective internal controls to ensure it identifies all subrecipients requiring single audits and follows up on any program-related findings, if applicable • Follow up with the subrecipient we identified as not having an audit to ensure it obtains its required single audit Office’s Response The Office concurs with the finding. The Office continues to implement the corrective action plan from the previous audit finding February 2024. Note the single audit review takes place annually between August and December of each year. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Audit findings, establishes requirements for pass-through entities. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-007 The Employment Security Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the Benefit Accuracy Measurement program of the Unemployment Insurance program in a timely manner. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: UI-34748-20-55-A-53; UI-37098-21-55-A-53; UI-37256-22-55-A-53; UI-38013-22-60-A-53; UI-39303-23-55-A-53; UI-39355-23-55-A-53; UI-00003-23-60-A-53; UI-00056-23-60-A-53; UI-00101-23-60-A-53; UI-00032-24-55-A-53; UI-00030-24-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – UI Benefit Payments Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-009 Background The Unemployment Insurance (UI) program was created by the Social Security Act, and provides benefits to unemployed workers under the Unemployment Compensation program for periods of involuntary unemployment. The program provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Improper Payment Elimination and Recovery Act of 2010 requires state workforce agencies to maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is the U.S. Department of Labor’s quality control system designed to assess the accuracy of unemployment insurance benefit payments and denied claims in separation status. The program estimates error rates and dollar amount of benefits improperly paid or denied by projecting the results from investigations in a state. The Employment Security Department administers the state’s UI program. During fiscal year 2024, the Department paid more than $1.9 billion in unemployment insurance benefits to Washington residents. Under the BAM program, the Department is required to draw a weekly sample of payments and denied claims. The Department must complete this sampling promptly and conduct an in-depth investigation of the claims to determine the degree of accuracy in administering the state’s Unemployment Compensation program and compliance with federal law (20 CFR 602.21(d)). The Department has established a dedicated BAM unit to meet these requirements. The Benefit Accuracy Measurement State Operations Handbook, published by the U.S. Department of Labor’s Employment and Training Administration, indicates the time frame and requirements for conducting BAM program case sampling for paid claims. States must complete reviews of: • Seventy percent of the sampled cases within 60 days of the week ending date of the batch; and • Ninety five percent of the sampled cases within 90 days of the week ending date of the batch; and • Ninety eight percent of sampled cases within 120 days of the ending date of the annual report period. Additionally, states must sample denied claims and review: • Sixty percent of the sampled cases within 60 days of the week ending date of the batch; and • Eighty five percent of the sampled cases within 90 days of the week ending date of the batch; and • Ninety eight percent of the sampled cases within 120 days of the end of the calendar year. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported that the Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the BAM program of the UI program in a timely manner. The prior finding numbers were 2023-009, 2022-006, 2021-005 and 2020-011. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the BAM program of the UI program in a timely manner. The Department did not effectively recruit, develop and retain staff to ensure it materially complied with the BAM program’s case review requirements. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not adequately staff its BAM unit with resources sufficient to meet BAM program requirements. Management did not allocate sufficient resources to the BAM unit and did not effectively retain its investigative staff assigned to the BAM unit to support its minimum required caseload. Additionally, management did not adequately monitor investigative staff caseloads and case completion rates to ensure the Department would meet the minimum federal requirements for conducting case reviews. Effect of Condition The Department did not comply with the federally required timelines for completing its case sampling. For paid claims, we found the Department: • Failed to complete the minimum required annual allocation for sampling of paid claims, completing 441 of the required 480 samples as of the audit period end date • Completed only 430 (90%) of its 480 sampled cases within 90 days of the ending date of the annual report period, failing to meet the federal requirement of 95% • Completed only 441 (92%) of its 480 sampled cases within 120 days of the ending date of the annual report period, failing to meet the federal requirement of 98% For denied claims, we found the Department: • Failed to complete the minimum required annual allocation for sampling of denied claims, completing 440 of the required 450 samples as of the audit period end date • Completed only 145 (96%) of its 151 sampled cases of monetary denials within 120 days of the ending date of the annual report period, failing to meet the federal requirement of 98% • Completed only 146 (97%) of its 151 sampled cases of separation denials within 120 days of the ending date of the annual report period, failing to meet the federal requirement of 98% By not complying with the federally required timelines for completing case sampling, the Department cannot fully evaluate the accuracy of its claim decisions and is less likely to detect fraudulent payments. Recommendation We recommend the Department allocate the necessary staffing resources to ensure it complies with the U.S. Department of Labor’s timelines for BAM case sampling. Department’s Response The Department concurs with the recommendation. The Department did meet case sampling requirements for both paid and denied claims, but did not meet the timeliness requirements as stated in the effect of condition. The Department has implemented increased oversight of case load to ensure timelines for both claim types are met. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements.  Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 20 CFR Part 602, Quality Control in the Federal-State Unemployment Insurance System, section 21, Standard methods and procedures, establishes the requirements for states to conduct representative case sampling for quality control study of unemployment benefit claims, which state in part: 602.21 Standard methods and procedures. Each State shall: a. Perform the requirements of this section in accordance with instructions issued by the Department, pursuant to 602.30(a) of this part, to ensure standardization of methods and procedures in a manner consistent with this part; b. Select representative samples for QC study of at least a minimum size specified by the Department to ensure statistical validity (for benefit payments, a minimum of 400 cases of week paid per State per year; c. Complete prompt and in-depth case investigations to determine the degree of accuracy and timeliness in the administration of the State UC law and Federal programs with respect to benefit determinations, benefit payments, and revenue collections; and conduct other measurements and studies necessary or appropriate for carrying out the purposes of this part… f. Furnish information and reports to the Department, including weekly transmissions of case data entered into the automated QC system and annual reports, without, in any manner, identifying individuals to whom such data pertain; The U.S. Department of Labor, Employment and Training Administration Benefit Accuracy Measurement State Operations Handbook – ET Handbook No. 395, 5th Edition, Chapter VI – Investigative Procedures, Section 13: Completion of Cases and Timely Data Entry, states in part: The following time limits are established for completion of all cases for the year. (The “year” includes all batches of weeks ending in the calendar year.): • A minimum of 70% of cases must be completed within 60 days of the week ending date of the batch, and 95% of cases must be completed within 90 days of the week ending date of the batch; and • A minimum of 98% of cases for the year must be completed within 120 days of the week ending date of the calendar year. ET Handbook No. 395, 5th Edition, Chapter VI – Investigative Procedures, Section 12: Sampling Selection, states in part: The annual sample sizes for UI paid claims and the three types of denials are fixed by DOL for the calendar year. BAM supervisors may change the weekly sample sizes in the input control record to accommodate investigator vacation schedules or other staffing contingencies. However, states are expected to pull at least the minimum number of cases each week. States may not over sample during a portion of the year in order to meet the annual sample allocation and then suspend sampling for the remainder of the calendar year. The minimum weekly and quarterly samples, based on current annual sample allocations are: Sample Annual Allocation Normal Weekly Minimum Weekly Normal Quarterly Minimum Quarterly Paid Claims 360* 7 5 90 81 Paid Claims 480 9 6 120 108 Denials 150/450** 3 2 37-38 32 *Allocation for ten smallest states in terms of UI workload. **150 cases of each monetary, separation, and non-separation denials will be selected each year, for a total of 450 DCA cases. ET Handbook No. 395, 5th Edition, Chapter VIII – Denied Claims Accuracy (DCA), Section 7: Completion of DCA Cases and Timely Data Entry, states in part: As in paid claims, prompt completion of investigations is important to ensure the integrity of the information being collected by questioning claimant and employers before the passage of time adversely affects recollections. However, due to the fact that contacting the claimant and obtaining claimant information is more difficult than in paid claims, the timeliness standards differ as the following indicates: • A minimum of 60% of cases must be completed within 60 days of the week ending date of the batch, and 85% of cases must be completed within 90 days of the week ending date of the batch; and • A minimum of 98% of cases must be completed within 120 days of the ending date of the Calendar Year.

2024-008 The Employment Security Department did not have adequate internal controls to ensure compliance with federal requirements to annually certify that employer tax credits reported under the Federal Unemployment Tax Act are matched against employer contributions paid under the Unemployment Insurance program. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: UI-34748-20-55-A-53; UI-37098-21-55-A-53; UI-37256-22-55-A-53; UI-38013-22-60-A-53; UI-39303-23-55-A-53; UI-39355-23-55-A-53; UI-00003-23-60-A-53; UI-00056-23-60-A-53; UI-00101-23-60-A-53; UI-00032-24-55-A-53; UI-00030-24-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions - Match with IRS 940 FUTA Tax Form Known Questioned Cost Amount: None Prior Year Audit Finding: N/A Background The Unemployment Insurance (UI) program was created by the Social Security Act and provides benefits to unemployed workers under the Unemployment Compensation program for periods of involuntary unemployment. The program provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Employment Security Department administers the state’s UI program. During fiscal year 2024, the Department paid more than $1.9 billion in unemployment insurance benefits to Washington residents. The Federal Unemployment Tax Act (FUTA) provides for cooperation between the federal and state governments in establishment and administration of unemployment insurance. The IRS is responsible for receiving and processing the Form 940, Employer’s Annual Federal Unemployment Tax Return, or Schedule H for annual reporting of employer tax credits. The IRS uses the FUTA Certification Program to verify with states that the credits employers claimed on the Form 940, or Schedule H, were actually paid into the state unemployment fund. The IRS Guide for Certification of State FUTA Credits (Guide) establishes the instructions for the certification of the states FUTA Tax Credits. Every September, the IRS creates a FUTA Identification Data File containing employer information, including FUTA tax credits reported, and distribute the file to states to verify tax credits reported to the IRS are accurate. The Guide stipulates that each state is responsible for certifying that this report is correct by reviewing the first 50 employers that have total state wages reported at zero (Zero Certification) and the first 50 employers that have total state wages reported at more than zero (Non-Zero Certification). The Department is required to trace the employer’s tax payments in the Next Generation Tax System (NGTS). Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure compliance with federal requirements to annually certify that employer tax credits reported under the FUTA are matched against employer contributions paid under the UI program. The Department did not review the required minimum number of employer accounts before submitting its annual certification to the IRS. Specifically, we found the Department reviewed 98 of the 100 required samples of employers to ensure each employer reported the correct amount of unemployment contributions paid into the State's unemployment fund. We consider these internal control deficiencies to be a significant deficiency. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not effectively design its internal controls to ensure accuracy of the certification to the IRS. Additionally, management did not adequately review employer account reconciliations its staff performed to ensure they reviewed the required number of accounts. Effect of Condition By not establishing adequate internal controls to ensure it reconciles all employer accounts requiring review before certification to the IRS, the Department cannot comply with federal requirements to verify FUTA tax credits are accurately reported to the IRS. Recommendation We recommend the Department improve its internal controls to ensure it reviews all employer accounts in accordance with federal requirements before certifying the report to the IRS. Department’s Response The Department thanks SAO for its work in this area and concurs with the finding. The Department is committed to ensuring our programs comply with federal regulations. The Department will recommunicate the requirement of minimal account review prior to filing the report. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. IRS Guide for the Certification of State FUTA Credits (September 2023 edition), Review Procedures, states in part: After the FUTA Certification Data has been prepared and before transmission, the state should review the quality of the data. This review will minimize the number of re-transmission requests from the HQ staff. Follow these review procedures: 1. Print two copies of the first 50 Zero Certification records (records where the total state wages are zero) and of the first 50 Non-Zero Certification records (records where the total state wages are other than zero). Use one copy to verify the format and components of the records against the specifications in this Publication. 2. With the second copy, using the EIN, request manual certification of these records from your appropriate state function. Compare the manual certifications with the print of the computer certifications to verify the data is the same. Remember the state reporting number provided is an additional research tool to help find the certification data for the EIN.

2024-009 The Employment Security Department did not have adequate internal controls over and did not comply with requirements to ensure it profiled all claimants under the Unemployment Insurance program to identify people likely to need reemployment services and ensure staff providing those services received required training. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: UI-34748-20-55-A-53; UI-37098-21-55-A-53; UI-37256-22-55-A-53; UI-38013-22-60-A-53; UI-39303-23-55-A-53; UI-39355-23-55-A-53; UI-00003-23-60-A-53; UI-00056-23-60-A-53; UI-00101-23-60-A-53; UI-00032-24-55-A-53; UI-00030-24-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – UI Reemployment Programs: Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-010 Background The Unemployment Insurance (UI) program was created by the Social Security Act, and it provides benefits under the Unemployment Compensation program to unemployed workers for periods of involuntary unemployment. The program provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Employment Security Department (Department) administers the state’s UI program. During fiscal year 2024, the Department paid more than $1.9 billion in unemployment insurance benefits to people in Washington. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as the primary programs that facilitate the reemployment of UI claimants. RESEA is authorized by Section 306 of the Social Security Act, and it uses an evidence-based integrated approach that combines an assessment for continuing UI eligibility and the provision of reemployment services. The Department uses a RESEA program to satisfy the WPRS mandate in accordance with federal requirements, and its program design is documented in the RESEA State Plan approved by the U.S. Department of Labor. According to the Department’s RESEA State Plan, the agency profiles unemployment claimants using a scoring model that is built into its Unemployment Tax and Benefit (UTAB) system to identify claimants who are likely to exhaust benefits and are in need of job search assistance to obtain new employment. The profiling model must statistically combine information on the person’s work industry, occupation, education level, county of residence, and other personal characteristics, including veteran and union status, and labor market characteristics to generate a numerical score indicating their likelihood of exhausting regular unemployment benefits before finding work. The claimants are to be ranked in a queue based on their individual score from most likely to least likely to exhaust benefits. On a weekly basis, the Department selects people from this queue for available appointments for reemployment evaluations. In July 2019, the Department implemented an online appointment scheduling system called the Reemployment Appointment Scheduler (RAS) to facilitate the appointment scheduling process for the Department’s WorkSource offices. In June 2021, the Department deployed a pilot program proposed by the U.S. Department of Labor known as a randomized control trial (RCT), to randomly assign profile scores in lieu of using the risk profile model to profile all unemployment claimants. The objectives of the trial were to assess the impact of the RESEA program concerning duration of unemployment claims, earnings and employment probability of claimants following the provision of RESEA services, and to assess whether the program improved the identification of claimant eligibility issues and improper payment detection. Under the RCT, the WPRS score used to rank claimants was replaced with a randomly generated score, after excluding the top 5% of claimants with the highest WPRS scores. The Department’s UI staff oversee the RESEA program, which includes participating in the planning, administration and oversight of the program, providing appropriate training to staff conducting applicant eligibility reviews, completing individual reemployment plans, and providing information and access to career and reemployment services, including referrals to other services. All staff working within the RESEA program must, at a minimum, be trained in the programmatic requirements, state laws, rules and agency policies. Department policy requires staff to complete an intensive training course before providing reemployment services to claimants, as well as take an annual refresher training once a year. Training includes information regarding job search requirements, reporting requirements and UI eligibility assessments. In addition, all staff working with RESEA participants must be trained to detect and report potential eligibility issues to the UI claims center. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it profiled all claimants under the UI program to identify people likely to need reemployment services and ensure staff providing those services received required training. The prior finding number was 2023-010. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure the Department profiled all claimants under the UI program, to identify those likely to need reemployment services and ensure staff providing reemployment services received required training. Identification for People Eligible for Reemployment Services The Department did not adequately monitor its UTAB scoring model to ensure applicant risk profile scores were accurate to identify those claimants most likely to exhaust their unemployment benefits. The Department is required to use a scoring model to profile all claimants to identify those likely to need reemployment services. During the audit period, the score calculated by the model was only applied for 5% of claimants with the highest score. A random score was assigned to the remaining 95% of claimants. The random score assignment did not provide adequate assurance that those people most likely to exhaust benefits were prioritized to receive reemployment services. To determine a claimant’s profile score, the scoring model assigns 10 different coefficient rates associated with attributes that were determined by the Department to signify how likely a claimant will be to exhaust their unemployment benefits. The Department could not explain the methodology for determining an applicant’s profile score based on these 10 attributes, or how to independently recalculate the score. The Department has not tested the calculation of the profile score to ensure it is functioning as intended and producing accurate results. In addition, management could not provide historical records to demonstrate the calculation had ever been tested since its first implementation. Therefore, the Department has no assurance that the calculation provides an accurate measurement of the risk a claimant will exhaust their benefits. In addition, management did not monitor to determine whether the RAS system had received all eligible claimants. There is a daily process to send eligible claimants to the RAS selection queue, but there were no internal controls in place to ensure that all files sent to RAS were received and processed. In addition, RAS does not have a working test environment to test whether the system effectively schedules claimants based on defined rules and requirements. Employee Training The Department uses a tracking report to monitor the status of completed training for each RESEA employee. However, the Department did not adequately monitor to ensure staff who administered RESEA services to clients took required training. We used a statistical sampling method to randomly select and examine 25 out of a total population of 277 employees that administered RESEA services to claimants during fiscal year 2024. We examined records for all RESEA training courses completed by these 25 employees and found one employee (4%) did not complete annual RESEA training during the audit period. This employee administered RESEA appointments to claimants during the audit period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Identification for People Eligible for Reemployment Services During the implementation of the RCT, the Department did not monitor the profiling and prioritization of claimants for RESEA participation to determine whether claimants prioritized for receiving RESEA services were the most likely to exhaust their unemployment benefits. In the prior audit our Office tested the Department’s UTAB risk scoring model and identified system weaknesses and recommended the Department review the design of its UTAB calculation to determine whether it was accurately identifying claimants most likely to exhaust regular UI benefits. However, during this audit period, the Department did not implement any system changes to the scoring model. Employee Training The Department asserted that the employee who did not receive annual training had returned from extended leave after their annual training was past due. Management did not ensure the employee completed the annual training before resuming work. Effect of Condition Identification for People Eligible for Reemployment Services Without monitoring its automated scoring model for effectiveness, the Department cannot ensure that its systems select RESEA participants based on a valid risk profile and priority of need for reemployment services. By disabling the automated scoring model, the Department is not in compliance with provisions in the RESEA State Plan, and it cannot ensure that claimants selected for RESEA appointment services should have received consideration over higher-risk claimants who may be excluded in the RCT. Employee Training By not maintaining adequate training records for its employees, the Department cannot demonstrate that all RESEA staff have been properly trained on unemployment eligibility requirements in order to administer reemployment services to clients, as required in the RESEA State Plan. Recommendation We recommend the Department: • Review the design of its UTAB calculation to determine an applicant’s risk profile score and test the calculation of the score to determine whether the system is accurately identifying claimants most likely to exhaust benefits. This understanding and testing should ensure that coefficient values are correctly determined and assigned by the UTAB system. • Reconcile the interface between the UTAB system and the scheduling system to ensure the RAS scheduling system received all RESEA eligible claimants • Consider implementing additional internal controls to ensure claimants are profiled and prioritized for reemployment services based on their risk of exhausting unemployment benefits, in accordance with federal requirements • Establish adequate internal controls to ensure all employees receive required RESEA training before providing reemployment screening services to claimants • Ensure staff administering RESEA services on behalf of the Department have completed required training before providing services to claimants Department’s Response The Department thanks the State Auditor’s Office for its work to ensure compliance with federal requirements for the UI Program. The Department would like to clarify it does use two federally approved methods to profile and prioritize for reemployment services based on their risk of exhausting unemployment benefits, in accordance with federal requirements. The first is the profile score calculation, and the second is the federal pilot program which assigns priority differently than the profile score and is helping develop better outcomes. The Department concurs with the recommendation regarding review and design of the profile score calculation so that ESD can accurately determine the effectiveness of the profile scoring. The Department in response to this finding in the prior audit year implemented a corrective action plan with a timeline of April 2025. This involved Department review of processes to effectively validate profile scores based upon new coefficients. That work began in October 2024 and ESD continues to discuss processes, prioritization, and resources to complete this work. The Department continues to perform work and allocate resources to address reconciliation between the RAS scheduler and the UTAB system. The Department monitors local offices for staff who have taken training and provide RESEA services. In the specific case cited in the finding, it was one staff member of 279 who was out for approved extended leave and missed the required training period for the refresher training. The Department additionally completed intensive training during the same period for 75 staff, for a total of 354 during SFY24. The Department has implemented follow up communication with local offices to remind members to attend the required training. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 United States Code, Chapter 7 – Social Security, Subchapter III – Grants to States for Unemployment Compensation Administration, § 503 – State laws, states in part: (j) Worker profiling (1) The State agency charged with the administration of the State law shall establish and utilize a system of profiling all new claimants for regular compensation that – (A) Identifies which claimants will be likely to exhaust regular compensation and will need job search assistance services to make a successful transition to new employment; (B) Refers claimants identified pursuant to subparagraph (A) to reemployment services, such as job search assistance services; available under any State or Federal law; Revised Code of Washington (RCW), Title 50, Unemployment Compensation, Section 50.20.011, Profiling system to identify individuals likely to exhaust benefits – Confidentiality of information – Penalty, states in part: 1. The commissioner shall establish and use a profiling system for new claimants for regular compensation under this title that identifies permanently separated workers who are likely to exhaust regular compensation and will need job search assistance services to make a successful transition to new employment. The profiling system shall use a combination of individual characteristics and labor market information to assign each individual a unique probability of benefit exhaustion. Individuals identified as likely to exhaust benefits shall be referred to reemployment services, such as job search assistance services, to the extent such services are available at public expense. 2. The profiling system shall include collection and review of follow-up information relating to the services received by individuals under this section and the employment outcomes for the individuals following receipt of the services. The information shall be used in making profiling identifications. Washington State Employment Security Department, Wagner-Peyser Employment Service Policy 4050, Reemployment Services and Eligibility Assessments (RESEA) program, states in part: 3. Policy: A. Staff Training requirements for RESEA Services Staff working in the RESEA program must, at a minimum, be trained in the program’s requirements, including state laws, rules, and agency policies related to job search, reporting requirements and UI eligibility assessments, prior to providing direct services to claimants and then receive annual refresher training thereafter. All staff working with RESEA participants must be trained to detect and report potential issues to the unemployment insurance claims centers. B. Claimant selection for RESEA services RCW 50.20.11 states, in part, that a profiling system must be established to identify new permanently separated claimants most likely to exhaust regular UI benefits and that are in need of job search assistance services to make successful transitions to new employment. This system uses a combination of individual characteristics and labor market information to assign each individual a unique probability of benefit exhaustion known as the profile score. Claimants with a work search requirement will be given a profile score. Those still attached to an employer will not receive a profile score. Based on ranked scoring, claimants are selected and added to an electronic list as eligible to receive RESEA services. Claimants identified as most likely to exhaust, or as UCX receive top priority. Selection occurs between the second and fifth week of a valid claim. Claimants waiting on decisions or for their claims to become valid are not selected until they have valid claims and are eligible for benefits.

2024-010 The Employment Security Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act for the Workforce Innovation and Opportunity grant. Assistance Listing Number and Title: 17.258 Workforce Innovation and Opportunity Adult Program 17.259 Workforce Innovation and Opportunity Youth Activities 17.278 Workforce Innovation and Opportunity Dislocated Worker Formula Grants Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: AA-36352-21-55-A-53 AA-38562-22-55-A-53 23A55AT00043-01-00 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-011 Background The Employment Security Department administers the Workforce Innovation and Opportunity Act (WIOA) grant to help job seekers access employment, education, training and support services to succeed in the labor market. WIOA provides employment and training programs for adults, dislocated workers and youth. In fiscal year 2024, the Department spent about $70.3 million in WIOA federal funding, including about $66 million paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The Act is intended to empower the public with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. When a new subaward is executed, Department staff prepare the Fund Manager Spreadsheet that contains the required reporting information for the subawards. Staff then submit the report based on the Fund Manager Spreadsheet. There were 22 WIOA subawards and amendments that the Department was required to report in fiscal year 2024, totaling $48,772,426. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act for the WIOA grant. The prior finding number was 2023-011. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act for the WIOA grant. During the audit period, the Department was required to report 22 subawards, totaling about $48 million of program funds, that it awarded to 12 subrecipients. We used a nonstatistical sampling method to randomly select and examine seven out of the total population of 22 subawards. We found: • Three out of seven subawards (43%), totaling $417,919, that the Department did not report in FSRS • The other four subawards (57%), totaling $16,820,245, had the incorrect subaward obligation/action dates, and the Department did not submit them on time We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Department officials said management reviews the reports to ensure they are accurate and submitted on time. However, there was no documentation to demonstrate the reviews occurred. If the Department did conduct these reviews, they were not sufficient to ensure that it reported all executed subawards and subaward amendments on time and accurately in FSRS. Effect of Condition Failing to submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Department: • Establish effective internal controls to ensure it submits all required reports on time and accurately • Provide training for employees who prepare and review the reports Department’s Response The Department concurs with the finding and thanks SAO’s work to ensure federal requirements are met over the WIOA grant. The Department has developed a comprehensive SOP to ensure these reports are submitted timely, reviewed, and submission dates are documented. This includes review and approval of the FFATA input sheet and required elements prior to entry into the system. After the report is submitted, it is reviewed, and evidence is saved. Additionally, the Department has expanded FFATA requirements training to all personnel within the Grants Management Unit to ensure the accuracy of reporting. FSRS is currently being phased out and new system will go live in March 2025. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation  a. Reporting of first-tier subawards.  1. Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward.   2. Reporting Requirements.  i. The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at https://www.fsrs.gov.  ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the subaward was made on November 7, 2025, the subaward must be reported by no later than December 31, 2025).   The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-011 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with federal requirements for suspension and debarment and wage rate notification. Assistance Listing Number and Title: 20.205 Highway Planning and Construction 20.205 COVID-19 Highway Planning and Construction Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement Pass-through Entity Name: None Pass-through Award/Contract Number: Applicable Compliance Component: None Suspension and Debarment Special Tests and Provisions – Wage Rate Requirements Known Questioned Cost Amount: None Prior Year Audit Finding: No Background Federal requirements prohibit award recipients from contracting with parties suspended or debarred from doing business with the federal government. Whenever the Department of Transportation contracts for highway construction projects that it will pay in whole or in part with federal funds, it must verify the contractor is not suspended or debarred from doing business with the federal government. The Department can verify a contractor’s status by obtaining written certification from the contractor, inserting a clause into the contract stating the contractor is not suspended or debarred, or checking the U.S. General Services Administration’s Excluded Parties List System. The Department must meet one of these requirements before awarding the contract or making purchases, and it must keep documentation demonstrating compliance with this federal requirement. Federal requirements also require contractors to not knowingly enter into any lower-tier covered transaction with a person who is debarred, suspended, declared ineligible or voluntarily excluded from participation in this covered transaction, unless authorized by the department or agency entering into this transaction. In addition, all prime construction contracts more than $2,000 awarded by nonfederal entities must include a provision for compliance with the Davis-Bacon Act for payment of prevailing wages to laborers. Federal regulations stipulate that the Department must incorporate Form FHWA-1273, Required Contract Provisions Federal-Aid Construction Contracts in all construction contracts, including subcontracts and lower-tier subcontracts for all construction projects receiving federal aid. FHWA Form FHWA-1273 includes the required Davis-Bacon and related act provisions as well as a suspension and debarment certification. The Department’s Advertisement and Award Office is responsible for awarding and executing contracts for state highway projects. In fiscal year 2024, the Department awarded about $890 million to contractors participating in construction projects under the federal Highway Planning and Construction program. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements for suspension and debarment and wage rate notifications. We examined 12 out of 37 contracts totaling about $735 million awarded by the Department. We found one contract for about $479 million (65%) in which the Department did not include the required Form FHWA-1273 in the contract provisions. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition During the contract execution phase, management did not adequately review contract documents to ensure they included the Form FHWA-1273 before requesting the contractor’s signature. Management did not immediately recognize that the contract did not include the required certification on federal suspension and debarment, or the requirement to pay prevailing wages to laborers. The Department discovered the missing form after the contract was awarded and signed into effect, but did not approve a change order to amend the contract with the contractor until after the audit period. Effect of Condition By not complying with suspension and debarment requirements, the Department is at an increased risk of entering into a covered transaction with an excluded party. Any payments made to an excluded party would be unallowable, and the grantor could potentially recover the funds from the Department. Additionally, by not including language in the contract terms and conditions requiring the contractor to pay all laborers and lower-tier contractors and subcontractors prevailing wages, the Department is at an increased risk of obligating federal funding to contractors to perform work that does not meet federal prevailing wage laws. Recommendations We recommend the Department: • Establish effective internal controls to ensure it procures goods and services in accordance with state laws and regulations, FHWA regulations, and its own policies and procedures • Improve its internal controls to ensure it complies with federal suspension and debarment requirements • Ensure it complies with all federal regulations regarding contracting procedures, and follows its policies and procedures for awarding contracts Department’s Response We appreciate the State Auditor’s Office (SAO) audit of the Federal Highway Administration’s (FHWA) Program. The Department is committed to ensuring our programs comply with federal regulations related to procurement, suspension, and debarment. We also appreciate the importance of including all required contract provisions in our federal-aid construction contracts. We acknowledge the Department did not include a required federal form (form FHWA-1273) as part of one contract. We would also like to state that the Department has policies & procedures, approved by FHWA, in place to ensure all contracts awarded have all the necessary elements to meet both state and federal requirements. In thoroughly investigating the details around this occurrence, there are several components we believe are worth noting: • There is clear guidance provided to teams to ensure that Form 1273 is included in all contracts. • It was simply a mistake that Form 1273 was left out of this set of contract documents. In this case, the contract documents were some 1,200 pages and the inclusion of this form in an appendix was simply overlooked by the project team. • As a result of various checks and balances already in place, the Department discovered that Form 1273 was missing. This was ahead of the audit and also before any work started on the contract. Upon that discovery, we added Form 1273 by executing Change Order number 1 to the construction contract in question July 18, 2024. There were no negative repercussions or issues created. • As an additional protection, all contracts include language that requires the contractor to meet the various requirements associated with Form 1273, whether Form 1273 was included in the contract or not. We’ve had follow-up conversations with appropriate staff on lessons learned from this occurrence and believe the issue has been addressed moving forward. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 U.S. Code of Federal Regulations (CFR) Part 180, OMB Guidelines on Agencies on Government Wide Department and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations. Title 29 U.S Code of Federal Regulations (CFR) Part 5, Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction (also Labor Standards Provisions Applicable to Nonconstruction Contracts Subject to the Contract Work Hours and Safety Standards Act), Section 5, Contract provisions and related matters, describes the requirements for payment of prevailing wages to laborers and contractors.

2024-012 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction program. Assistance Listing Number and Title: 20.205 Highway Planning and Construction Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-012 Background The Washington State Department of Transportation’s Local Programs Office administers Highway Planning and Construction Program funding to local agencies throughout the state for highway construction projects. The Department spent about $818 million on highway projects during fiscal year 2024. Of that amount, it awarded about $425 million to local agencies through subawards for 355 new and existing projects across the state. Pass-through entities are required to monitor the activities of their subrecipients to ensure they are properly using federal funds. To determine the appropriate level of monitoring, federal regulations require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. For the subawards made during fiscal year 2024, Department management delegated the responsibility to complete risk assessments for individual projects to the Local Programs Engineers who were assigned to the regional office that oversees the project. When the Department prepares to monitor or review a subrecipient, it selects an open and active project and evaluates the subrecipient based on its performance under that project. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction program. The prior finding number was 2023-012. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction program. We randomly selected and examined 28 of the 355 projects awarded funding during the audit period to determine if the Department performed a risk assessment of each project to determine the appropriate level of monitoring required for the subrecipient. We found the Department did not complete risk assessments for six of the 28 projects (21 %). Three risk assessments were signed and dated by Department staff after the audit period had ended. The other three projects did not have a risk assessment performed. We consider this internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management did not ensure the Local Programs Engineers performed risk assessments for each subrecipient project awarded program funds. Effect of Condition Not performing risk assessments makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the grant’s terms and conditions. Without verifying the Local Programs Engineers completed risk assessments for each awarded project, the Department cannot ensure it is performing risk assessments consistently and using the proper criteria to determine the appropriate amount of monitoring required for each subrecipient project. Recommendation We recommend the Department: • Ensure it properly performs and documents the required risk assessments, which would allow management to evaluate the results and demonstrate compliance with federal requirements. • Improve its monitoring of regional Local Programs Engineers to ensure they complete risk assessments for each program-funded project. Department’s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor’s Office audit of the Highway Planning and Construction program. WSDOT is committed to ensuring our programs comply with federal regulations. Risks assessments for subrecipients in this FHWA grant program are the responsibility of WSDOT’s Regional Local Programs Engineers, located in the six WSDOT Regions. While every attempt is made to complete a risk assessment at each phase of a project, staff turnover contributed to the lack of consistency and timeliness in completing these assessments. To help ensure consistency, the Department has updated position descriptions for Local Programs Engineers to reflect this requirement. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, section 332, Requirements for pass-through entities, establishes requirements for pass-through entities to evaluate each subrecipients’ risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate level of subrecipient monitoring. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-013 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to collect certified payrolls from contractors on projects funded by the Highway Planning and Construction program. Assistance Listing Number and Title: 20.205 Highway Planning and Construction Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – Wage Rate Requirements Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-013 Background The Washington State Department of Transportation receives federal funding under the Highway Planning and Construction program for highway construction projects throughout the state. Some of these projects are awarded to contractors who perform the work on behalf of the Department. The Department spent about $818 million in federal Highway Planning and Construction program funds during fiscal year 2024. Of that amount, it spent more than $389 million on state-administered construction projects. All laborers and mechanics employed by contractors or subcontractors to work on construction contracts exceeding $2,000 financed by federal assistance funds must be paid wages that are no less than those established for the locality of the project (prevailing wage rates) by the Department of Labor. All contractors and subcontractors are required to submit a copy of their payroll and a statement of compliance (certified payrolls) on a weekly basis, for each week in which any applicable contract work is performed. The Department’s construction projects typically involve both a prime contractor and subcontractors to complete work on the project. The Department is required to authorize the prime contractor’s use of subcontractors on a project. The Department requires field inspectors to be onsite during construction work to ensure projects are completed in accordance with contract specifications. For every day of the week in which contract work is performed, Project Engineers, Project Managers, or Chief Inspectors overseeing construction review inspector’s reports to document which contractors are required to submit certified payrolls for the given week. The Department publishes the Standard Specifications for Road, Bridge and Municipal Construction (Standard Specifications), in addition to the Construction Manual (M.41-01.41), which applies to its construction contracts, and is approved by the U.S. Federal Highway Administration of the Department of Transportation. These specifications require contractors to submit certified payrolls to the Department on a weekly basis for each weekly payroll period. The Standard Specifications further stipulate that contractors must use the Washington State Department of Labor and Industry’s Prevailing Wage Intents and Affidavit System (PWIA) to submit weekly certified payrolls on federal and state projects. The Construction Manual further requires that Project Engineers verify that contractor certified payrolls are submitted on a weekly basis in PWIA. If the contractor’s certifications are not submitted in a timely manner, the Standard Specifications permit the Department to withhold payment from contractors and enact other sanctions as necessary. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to collect certified payrolls from contractors on projects funded by the Highway Planning and Construction program. The prior finding number was 2023-013. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to collect certified payrolls from contractors on projects funded by the program. We found that the Department’s internal controls were not adequate to ensure all contractors and subcontractors submitted certified payrolls on a weekly basis, as required by federal law and the Standard Specifications. We used a statistical sampling method to randomly select 85 out of a total 1,605 weeks in which contract work was performed on federally funded construction projects, to determine whether the Department received certified payrolls from the prime contractor and all subcontractors performing work on the project on a weekly basis, or within one week of the preceding payroll period end date, as required by federal law and Department policies. We identified the 85 weeks required a total of 576 certified payrolls to be submitted to the Department. Collecting certified payrolls The Department did not collect all certified payrolls from the prime contractor and subcontractors on a weekly basis for 79 of the 85 weeks we examined (93 %). We performed testing to determine whether the Department collected all certified payrolls due from contractors working on the project within seven days (or one week) of the payroll week ending date. We identified 29 payrolls that were not collected by the Department before the end of the audit period. Of the 547 payrolls submitted to the Department, 305 (56 %) were not submitted within seven days of the payroll week ending date, as required by federal law and the Construction Manual. On average, these payrolls were 21 days late and we found: • 145 payrolls were between one and seven days late; • 65 payrolls were between eight and 14 days late; • 47 payrolls were between 15 and 30 days late; and • 48 payrolls were more than 30 days late, with the oldest being 279 days late Review of certified payrolls We performed additional testing to determine whether the Department submitted a request to the contractor to supply overdue payrolls in the PWIA system, as required by the Construction Manual. We found 204 overdue payrolls (67 %) had no requests submitted to the prime contractor or subcontractor (if applicable). Additionally, 95 of these payrolls were submitted more than one week late, with the oldest being 279 days late. We inquired with the Department as to whether any sanctions were imposed upon contractors with late or missing certified payroll submissions. We determined two payments related to one contract from our sample had payment partially withheld due to delinquent payrolls. However, we received no additional records to demonstrate sanctions imposed on contractors for the weeks reviewed as part of the audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management did not adequately monitor Project Offices and the PWIA system to ensure compliance with federal requirements and the Construction Manual. While the Department’s Construction Manual and Standard Specifications have documented policies and procedures in place for Project Engineers to follow to track certified payrolls due from contractors, they do not include clear guidance on when and how Project Engineers follow up on late submissions and issue sanctions. Additionally, Project Engineers did not consistently follow these policies when monitoring contractors for compliance and documenting certified payrolls due on construction projects. Effect of Condition Without collecting all certified payrolls timely, the Department cannot ensure that laborers working on federally funded construction contracts are being paid the applicable prevailing wages, as required by law, which could make the Department and the contractor vulnerable to sanctions by the U.S. Department of Labor. In addition, by not collecting certified payrolls on a weekly basis, the Department is not in compliance with federal requirements and may be subject to actions by the federal grantor. Recommendations We recommend the Department: • Improve internal controls to ensure Project Engineers monitor the status of certified payrolls due from contractors on a weekly basis in accordance with its Construction Manual, ensure contractors are made aware of delinquent payrolls, and consideration is given to assessing sanctions on noncompliant contractors in accordance with its Standard Specifications, such as withholding any or all payments to the contractor, as necessary, when contractors do not submit required certified payrolls on a weekly basis • Monitor projects offices to ensure contractors are notified in PWIA when they have not provided certified payrolls for a given week of contract work, in accordance with the Construction Manual, and request all overdue or missing payrolls immediately • Ensure certified payrolls are collected from prime contractors and all subcontractors on a weekly basis, in accordance with federal law and the Construction Manual • Consider modifying the Construction Manual to define the circumstances in which sanctions must be imposed upon contractors with incomplete, overdue or missing certified payrolls Department’s Response The Washington State Department of Transportation appreciate the State Auditor’s Office (SAO) audit of the Federal Highway Administration’s (FHWA) Program. The Department is committed to ensuring our programs comply with federal regulations. As WSDOT indicated in previous years for similar findings, the draft audit finding does not consider the nature of the contractual relationship between the contractor and WSDOT as the owner. The owner's compliance with the Davis-Bacon Act and regulations cited in the finding is determined by collective actions specified by regulations and not merely by how many payrolls are collected from the contractor within an arbitrary 7-day window. WSDOT, in close consultation with the FHWA, has established contract administration processes with contingencies built in to address and correct for contractor noncompliance. In addition, WSDOT will not issue project Completion until all certified payrolls are collected (Standard Specifications 1-08.5.2, Time for Completion). FHWA guidance recommends actions to take if a contractor is habitually late in submitting payrolls but leaves it up to WSDOT to determine when sanctions should be imposed. WSDOT’s Standard Specifications (1-07.9(5)) on certified payrolls aligns with FHWA guidance. Sanctions are imposed as appropriate during the life of a contract. We also point out that SAO only reviewed the Department’s actions taken, such as sanctions, only as they applied to the original weeks tested, not for other weeks within the contract. Sanctions are taken when contractors meet certain criteria such as being habitually late. As a result, SAO did not review or consider all evidence we provided of sanctions taken on late payrolls during the contract period, when it was not within the weeks originally tested. We will continue to look for opportunities to improve our process as well as our documentation to demonstrate compliance with the Davis-Bacon Act requirements. In addition, we will continue consulting with FHWA for any further actions needed to resolve this finding. Changes to the Construction Manual just approved by FHWA in January 2025, will help to clarify timeliness in submission of certified payrolls and Department follow up actions, and should help clarify the rules we’re evaluated against regarding certified payrolls In FHWA’s management decision letter of November 14, 2024, in response to a similar finding for FY 2023, the grantor states “FHWA believes that WSDOT’s procedures, in their entirety, contain the necessary controls to ensure reasonable compliance with 29 CFR 5.5 and FHWA Davis-Bacon and Related Acts Questions and Answers. Ensuring all certified payrolls are collected, and considering sanctions or other appropriate actions for missing payrolls using the methods outlined in WSDOT’s procedures provide sufficient internal control and reasonable compliance, notwithstanding the collection of the payrolls within a seven-day period. FHWA considers this finding to be resolved.” In this year’s audit, the State Auditor sampled 85 weeks and the required 547 certified payrolls for contract work performed on federally funded construction projects during that period. WSDOT collected all the required 547 certified payrolls. SAO identified 29 payrolls that were “not collected by the Department before the end of the audit period”, however these payrolls were collected. Because these 29 payrolls were collected during a week that SAO had not tested, the auditor did not report the payrolls as collected. Of the 547 payrolls only 48 were 30-days or more late and only 25 (4.5%) were 60-days or more late. This result is below the exception threshold typically allowed by the State Auditor of 5%. At 60-days, the Department has its first opportunity to initiate sanctions against the contractor. Of the 25 payrolls that were at least 60-days late, WSDOT had imposed sanctions against a contractor, including withholding payment. WSDOT had also performed actions, such as notifying the contractors via email or during weekly meetings with the contractors. Sanctions prior to 60-days, are not feasible, as the contractors are paid monthly for the prior month’s work, and WSDOT has 30-days to process payments. As indicated last year, WSDOT is in the midst of delivering its largest and one of its most complex construction programs in our history and is doing so with lower and less experienced staffing levels than it had to deliver past construction programs. Auditor’s Remarks In determining our audit opinion on the Department’s compliance, we did not give consideration to payrolls collected after the one-week due date that were also collected after the audit period ended. Regarding the 29 missing certified payrolls, based on Department records and PWIA, as of our audit, 10 of these payrolls had not yet been collected by the Department. The 19 payrolls that were eventually collected were received by the Department from July 2, 2024 to January 9, 2025, which is between 10 and 426 days beyond the one-week due date, and between two and 193 days after the audit period end date. Our testing of contractor certified payrolls was designed to address the U.S. Department of Labor (USDOL) regulations outlined in the Davis-Bacon Act and related requirements concerning federally-funded construction projects (Title 29 CFR, Subpart A – Davis-Bacon and Related Acts Provisions and Procedures, Subsection 5.5). These requirements, in addition to the suggested audit procedures in Part 4 of the Uniform Guidance Compliance Supplement, were applied to our audit testing. Federal law requires for contractors and subcontractors participating in federal-aid construction projects to submit weekly and for each week certified payrolls to the Department. In addition, the Department’s Construction Manual requires contractors to submit certified payrolls on federal-aid projects weekly regardless of whether or not work was performed. Using these criteria expanded upon in the Applicable Laws and Regulations below, we do not believe our interpretation that payrolls should be collected in the week following the preceding payroll week’s ending date is arbitrary.  Furthermore, the USDOL Wage and Hour Division’s Final Rule (effective October 23, 2023) concerning the Davis-Bacon and Related Acts Regulations, stipulates that “contractors and subcontractors are required to provide certified payrolls to the contracting agency to demonstrate their compliance with Davis-Bacon Act requirements on a weekly basis,” and that “the Department cannot allow contractors to pay required prevailing wages or submit certified payrolls on a basis less frequent than weekly.”  We reviewed all documentation provided by the Department addressing late or missing contractor certified payrolls. The Department’s records show only two contract payments (only one of which corresponded to a week we examined as part of this audit) had partial payment withheld from the prime contractor. In addition, the Department only followed up on one-third of its overdue payrolls examined as part of this audit by submitting requests to the contractor to furnish the required payrolls as outlined in the Construction Manual. We believe these observations support our opinion that the Department’s internal controls were not sufficient to detect and correct material noncompliance with respect to the federal requirements. The Department also acknowledges in its response that approximately nine percent of its certified payrolls collected from contractors were more than 30 days late which we believe is significant, as the Department reviews pay estimates from prime contractors on a monthly basis, and this indicates that the Department is not following up on overdue contractor certified payrolls weekly as the Construction Manual requires.   The Department also states it is not feasible to impose sanctions upon contractors with habitually late payrolls before 60 days have passed from the week(s) of work ending due to its designed payment delivery method. Without ensuring its prime contractors have submitted certified payrolls for their employees and for all approved subcontractors performing work under the contract, the Department cannot ensure the contractor has paid prevailing wages to all laborers and mechanics, and that laborers have been paid on a weekly basis, as federal law requires.  We appreciate the Department’s willingness to re-define its contractor monitoring requirements in its Construction Manual with the federal grantor, and we expect that these revisions more narrowly define the expectations for what specific follow-up actions the Department must take against the contractor and define the timelines for performing necessary follow-up actions.  We reaffirm our audit finding and we will review the status of the Department’s corrective action during our next audit.  Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 29 CFR Part 5, Labor Standards Provisions Applicable to Contract Covering Federally Financed and Assisted Constructed (Also Labor Standards Provisions Applicable to Nonconstruction Contracts Subject to the Contract Work Hours and Safety Standard Act), section 5, Contract provisions and related matters, establishes the requirements for including prevailing wage clauses in federal-aid contracts, payment withholding, and required documents. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The Federal Highway Administration Davis-Bacon and Related Acts Questions and Answers, section 56, states that contracting agencies are responsible for properly applying and enforcing prevailing wage requirements in covered contracts including: a. Verifying that covered contracts have incorporated the required Davis-Bacon clauses and the applicable wage determination(s); b. Verifying that the Davis-Bacon notice and the applicable wage determination(s) are displayed at the site of the work in a conspicuous location in clear view of everyone; c. Reviewing certified payrolls in a timely manner; d. Conducting employee interviews e. Conducting reviews and investigations of covered contracts in conjunction with FHWA as appropriate; f. Forwarding refusal to pay and/or debarment consideration cases to the USDOL Wage and Hour Division for appropriate action; and g. Submitting enforcement reports and semi-annual enforcement reports to the USDOl Wage and Hour Division The Washington State Department of Transportation’s Construction Manual (M41-01.43), April 2024 edition, section 1-07.9, Wages, states in part: Federal Prevailing Wage Enforcement of Federal Prevailing Wage Provisions In addition to the requirements of Standard Specifications Section 1-07.9, all Contracts financed with Federal funding includes the Required Contract Provisions for Federal-Aid Construction Contracts (FHWA-1273). These provisions identify Federal wage requirements. The Federal prevailing wage requirements included in these provisions are also commonly referred to as Davis Bacon and Related Acts (DBRA). It is the Project Engineer’s responsibility to monitor and enforce these provisions to the degree necessary to ensure full compliance. In order to comply with these requirements, the Contractor must: Submit weekly certified payrolls to the Project Engineer through LNI’s Prevailing Wage Intents and Affidavits (PWIA) system. Ensure each Subcontractor, and each agent or lower-tier subcontractor submits weekly certified payrolls to the Project Engineer through PWIA. SS1-07.9(5) Required Documents Statement of Intent Every Contractor, Subcontractor, agent, or lower tier subcontractor performing work on a public works contract must submit a Statement of Intent to Pay Prevailing Wages to LNI for approval. Separate Intents are required for each Request to Sublet submitted on the project. Hiring Contractors are required to file an Intent if they hire a lower tier subcontractor subject to prevailing wages. Affidavit of Wages Paid Prior to Contract Completion, the Contractor, all Subcontractors, agents and lower-tier subcontractors must submit an Affidavit of Wages Paid to the Project Engineer using PWIA. The form may be submitted earlier by a Subcontractor or lower-tier subcontractor if that firm’s work is completed prior to Completion of the Contract. All Affidavits must be approved by LNI prior to Contract Completion. Certified Payroll Certified payroll must be submitted to the Project Engineer through PWIA for each Contractor, Subcontractor, and each lower tier subcontractor performing work on the project, regardless of funding source or delivery method. Certified payrolls are required from the time each Firm begins performing Contract work until the time the Affidavit is visible in PWIA, or until the Contractor has identified their last certified payroll has been Submitted. Once the Affidavit is visible in PWIA, the Affidavit has been approved by LNI. The last working day is included on the Affidavit, and the Project Office should compare this date to the last certified payroll submitted. A tracking sheet is required to document when Project Office staff verify that certified payrolls are received through PWIA. The frequency of verification depends on the funding source of the project. Weekly verification is required for federally funded projects, while monthly verification is required for state funded contracts. The tracking sheet needs to indicate that all active Contracts have been checked for late or missing certified payrolls. PWIA will be used to track requests made for missing certified payrolls. A separate tracking sheet may be used to track which certified payrolls have been verified for each Project. Federally funded projects require weekly submittals. Further review of the payroll will be required to ensure the Federal prevailed wage rate is met using the Wage Determination included in the Contract Special Provisions. Federally funded Contracts: • Weekly submittals • No leniency on late submittals • Required for every week, whether work was performed or not • Enforcement of all Federal requirements will remain WSDOT responsibility Federally funded projects require weekly submittal of certified payrolls. If the Contractor is unable to submit their payroll electronically using PWIA, they must submit the certified payrolls directly to the Project Office. Non-compliance or non-submittal could result in the Project Engineer withholding an appropriate portion of payment (see Section SS 1-09.9). The Washington State Department of Transportation’s Construction Manual (M41-01.43), April 2024 edition, section 1-09, Measurement and Payment, states in part: Withholding of Payments Withholding payments for the work the Contractor has performed and completed in accordance with the contract should not be done casually. There must be clear contract language supporting the action. The authority to withhold progress payments is subdelegated to the Regions. Further delegation to the Project Engineers is at the discretion of each Region. Delinquent Contractor Submittals Missing submittals is a principal source of delays in closing out the project and processing the final estimate. As the project proceeds toward completion, the Project Engineer and the Contractor should attempt to obtain all submittals as the need arises. These might include such things as materials certificates, certified payrolls, extension of time requests, or any other item or document that delay processing the final estimate.

2024-014 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with quality assurance program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed testing for projects funded by the Highway Planning and Construction program. Assistance Listing Number and Title: 20.205 Highway Planning and Construction Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – Quality Assurance Program Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-014 Background The Washington State Department of Transportation receives federal funding under the Highway Planning and Construction Program for highway construction projects throughout the state. Some of these projects are awarded to contractors who perform the work on behalf of the Department. The Department spent about $818 million in federal Highway Planning and Construction program funds during fiscal year 2024. Of that amount, it spent more than $389 million on state-administered construction projects. Federal regulations require that the Department have a quality assurance (QA) program, approved by the Federal Highway Administration (FHWA), for construction projects on the National Highway System to ensure that materials and workmanship conform to approved plans and specifications. Verification sampling must be performed by qualified testing personnel employed by the Department or its designated agent, excluding the contractor. The Department’s QA program requirements are outlined in the Construction Manual, which is approved by the FHWA. This manual documents how materials are tested for acceptance before being incorporated into construction projects. Materials can be accepted in various ways, such as sample testing, a visual inspection documented by the Field Note Record or Inspector’s Daily Report, or a certification of compliance from the manufacturer. If a materials test is required, the Department must ensure that only qualified people perform the testing, including independent testers, consultants or certified Department employees. To ensure that materials incorporated into a project meet approved plans and specifications, the Department prepares a list of prescribed materials to be used on the project. The Department uploads this list to a program called the Record of Materials (ROM). The ROM sets forth the materials and quantities that are expected to be used on the project, and it documents the proper acceptance criteria, including any test(s) personnel are required to perform on a material. To ensure that only qualified people perform the testing, testers must pass a certification exam, which consists of a written and performance exam. After passing both, the testers are entered into the Qualified Tester Database and are certified for five years, after which they must recertify by passing both exams again. There are two different types of tester qualifications: module and method. Module testers are proficient in multiple method tests that can encompass all method tests for a particular material, whereas method testers may only be proficient in particular tests for any given material. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls over and did not comply with QA program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed materials testing for projects funded by the Highway Planning and Construction program. The prior finding numbers were 2023-014, 2022-011, 2021-011, 2020-017 and 2019-019. Description of Condition The Department did not have adequate internal controls over and did not comply with QA program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed testing for projects funded by the Highway Planning and Construction program. Materials acceptance testing did not conform to Standard Specifications and the Construction Manual We used a statistical sampling method and randomly selected and examined 58 out of a total population of 1,687 materials that were used on federally funded projects during state fiscal year 2024. For the 58 randomly selected materials, we requested supporting documentation for acceptance and/or testing of the material. We found: • One material where the Department did not obtain the manufacturer’s certificate of compliance • One material where the project engineer did not perform testing in accordance with the Department’s Standard Specifications Testing personnel were not properly certified We obtained data from the Department to identify materials tested for acceptance during the audit period. Using this data, we identified 1,080 unique tester and acceptance test types corresponding to the materials tested. We used a statistical sampling method and randomly selected and examined 57 out of the 1,080 to verify whether the testers performing materials testing for the Department had all required documents to support the tester’s certification. We found: • One instance where the tester was missing a required exam for certification • Three instances where the Department was unable to provide documentation to support that the tester met certification requirements We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Materials acceptance testing did not conform to Standard Specifications and the Construction Manual Management did not adequately monitor project offices to ensure all required materials testing and acceptance occurred in accordance with the Construction Manual. Testing personnel were not properly certified Project Engineers did not ensure tester qualifications were current, and management did not ensure that only qualified testers performed materials testing and acceptance on behalf of the Department. Effect of Condition By not adequately monitoring project materials to ensure they conform to approved plans and specifications, the Department does not have reasonable assurance that materials incorporated into projects conform to standard specifications and the Construction Manual. By not properly verifying and documenting the testers’ qualifications, the Department risks improper material testing. This could result in the Department using materials that may not conform to approved plans and specifications. Recommendations We recommend the Department: • Improve internal controls, and monitor project offices, to ensure that required sampling activities occur, as required, and permanently incorporated materials conform to standard specifications for all federal aid construction projects • Strengthen internal controls to ensure testers have completed all required exams and that they have proper documentation of passing these exams before performing sampling activities • Continue to review all testers to ensure they meet the minimum requirements for certification before performing materials testing on projects receiving federal aid Department’s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor’s Office (SAO) audit of the Federal Highway Program and the federally required Quality Assurance (QA) program. The Department is committed to ensuring our programs continue to comply with federal regulations and recognizes that there are always opportunities for improvement to its QA program. The Department continues towards replacement of its ROM legacy system; therefore, it was not practical to modify this system to help correct issues reported in a similar finding in previous Single Audits. Instead, the Department eliminated its practice requiring updates to the ROM within 30 days of payment and instead relies on the required documentation, as evidence of proper material acceptance. In addition, WSDOT modified its practice related to how tester data is reviewed and entered into the tester certification tracking system, as a result of audit recommendations from a prior audit, however this change was not formally adopted into policy until the Construction Manual was approved in April 2024. All offices now funnel tester data to the Headquarters Quality Assurance Program for review and entry. These changes to practices were communicated to appropriate staff and are reflected in the Construction Manual, which was reviewed and approved by FHWA. Materials Acceptance The construction contracts awarded in FY24 utilizing federal funding contained more than 4,600 materials and SAO identified 1,687 that required testing. SAO examined documentation for 58 materials that required testing. Through our review of SAO’s exceptions the Department found only 2 materials (3.4%) where we could not provide documentation to support that testing occurred or was not required. Testing Personnel Certifications FY24 had over 7,000 materials tested. The State Auditor selected and reviewed documentation for 57 tests and whether the testers performing materials testing activities for the Department had all required documents to support their certification and took exception to documentation provided. The Department had 3 testers perform material acceptance tests before they passed their certification testing and could not locate the required exam for 1 tester. The Department has worked closely with the Federal Highway Administration (FHWA) on our QA program and continues to receive feedback from them on the strength of our program. The Department will continue to put improvements in place for the QA program based on the SAO audit recommendations. These issues will be discussed at the 2025 Material Assurance Training offered 3/19/2025, and we will continue to deliver other training to Project Engineering Offices to emphasize QA program requirements throughout the year. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 23 U.S. Code of Federal Regulations (CFR) Part 637, Construction Inspection and Approval establishes the following applicable requirements: Section 637.201 Purpose To prescribe policies, procedures, and guidelines to assure the quality of materials and construction in all Federal-aid highway projects on the National Highway System. Section 637.205 Policy a. Quality assurance program. Each STD shall develop a quality assurance program which will assure that the materials and workmanship incorporated into each Federal-aid highway construction project on the NHS are in conformity with the requirements of the approved plans and specifications, including approved changes. The program must meet criteria in (Section 637.207) and be approved by the FHWA. b. STD capabilities. The STD shall maintain an adequate, qualified staff to administer its quality assurance program. The State shall also maintain a central laboratory. The State’s central laboratory shall meet the requirements in (Section 637.209(a)(2)) c. Independent assurance program. Independent assurance samples and tests or other procedures shall be performed by qualified sampling and testing personnel employed by the STD or its designated agent. d. Verification sampling and testing. The verification sampling and testing are to be performed by qualified testing personnel employed by the STD or its designated agent, excluding the contractor and vendor. e. Random samples. All samples used for quality control and verification sampling and testing shall be random samples. Section 637.207 Quality assurance program a. Each STD’s quality assurance program shall provide for an acceptance program and an independent assurance (IA) program consisting of the following: 1. Acceptance program. i. Each STD’s acceptance program shall consist of the following: A. Frequency guide schedules for verification sampling and testing which will give general guidance to personnel responsible for the program and allow adaptation to specific project conditions and needs. B. Identification of the specific location in the construction or production operation at which verification sampling and testing is to be accomplished. C. Identification of the specific attributes to be inspected which reflect the quality of the finished product. ii. Quality control sampling and testing results may be used as part of the acceptance decision provided that: A. The sampling and testing has been performed by qualified laboratories and qualified sampling and testing personnel. B. The quality of the material has been validated by the verification sampling and testing. The verification testing shall be performed on samples that are taken independently of the quality control samples. C. The quality control sampling and testing is evaluated by an IA program. The Department of Transportation’s Construction Manual (M41-01), Chapter 9: Materials, states in part: 9-1 General The quality of materials used on the project will be evaluated and accepted in various ways, whether by testing of samples, visual inspection, or certification of compliance. This chapter details the manner in which these materials can be accepted. Requirements for materials are described in Standard Specifications for Road, Bridge, and Municipal Construction M 41-10 Section 1-06 and Division 9. It is the Project Engineer’s responsibility to accept materials in accordance with this chapter. For materials that do not meet specification requirements, the Project Engineer shall contact the State Construction Office which will coordinate with the State Materials Engineer or Assistant State Materials Engineer to determine the appropriate action. 9-1.2C Record of Materials The Project office is required to maintain documentation in the project records on quantities paid, quantities placed, quantities field verified for materials that have sampling frequencies, WSDOT Fabrication Inspection items, or where quantities are needed for Acceptance Criteria such as Manufacturer Certificate of Compliance. Any changes to the acceptance requirements, additional permanently incorporated materials used, or any additional materials added to the project by change order or force account need to be documented and tracked in the project records. 9-5.3 WSDOT Testing Technician Qualification Program (WTTQP) All testing Technicians that conduct QA/QV testing shall be certified through the WTTQP. For registration information contact the Region Independent Assurance Inspector. The purpose of this program is to provide uniform statewide testing by ensuring testing technicians meet the WTTQP module certification and method qualification process below. This program is based on AASHTO R 25.The State Quality Systems Manager performs oversite of WSDOT’s Testing Technician Qualification Program (WTTQP). The Quality Systems Section at the State Materials Laboratory is responsible for maintaining the Tester Qualification database information for all WTTQP Testing Technicians. A Testing Technician will not be certified or qualified until listed as “Available” by the Quality Systems Manager. The Region Independent Assurance Inspectors are responsible for entering their region data into the Tester Qualification database and submitting the WTTQP internal certification or qualification records to the Quality Systems Section.

2024-015 The Housing Finance Commission did not have adequate internal controls over eligibility requirements for the Homeowner Assistance Fund program. Assistance Listing Number and Title: 21.026 COVID-19 Homeowner Assistance Fund Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-022 Background The American Rescue Plan Act of 2021 provided $9.96 billion to the Homeowner Assistance Fund (HAF) program. The U.S. Department of the Treasury provides funds directly to states, U.S. territories and Indian tribes to assist eligible homeowners experiencing financial hardship due to the COVID-19 pandemic. Program funds can be used to prevent mortgage delinquencies and defaults, foreclosures, loss of utilities or home energy services, and homeowner displacement. The law prioritizes funds for homeowners who have experienced hardships, leveraging local and national income indicators to maximize the program’s impact. The Housing Finance Commission administers the HAF program in Washington. In fiscal year 2024, the Commission spent about $70.8 million in HAF funds. The Commission is required to ensure all homeowners who receive HAF funds are eligible for the program. The HAF Plan Term Sheet, approved by the federal grantor, outlines the general eligibility requirements for the program. The Commission entered into an agreement with a contractor to perform eligibility determinations for the program. As part of the agreement, the contractor reviews eligibility determinations for 10% of applications that were approved, denied and withdrawn each quarter. To ensure the contractor made the correct determinations, Commission staff reviews eligibility determinations that the contractor reviewed. For the first two quarters of the year, Commission staff reviewed 10% of the eligibility determinations reviewed by the contractor then increased this review to 20% for the last two quarters. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Commission did not have adequate internal controls over eligibility requirements. The prior finding number was 2023-022. Description of Condition The Commission did not have adequate internal controls over eligibility requirements for the HAF program. During the first two quarters of the audit period, the Commission only reviewed 1% of all approved, denied and withdrawn applications. During the third quarter, the Commission increased its review to 2% of all approved, denied and withdrawn applications. The determinations that staff reviewed were only taken from those that the contractor selected, so the Commission had no assurance that the application determinations the contractor did not select were made properly. During the last month of the year, the Commission began reviewing eligibility determinations of all applicants before issuing a payment. Because the Commission did not perform any additional independent reviews for 11 out of the 12 months, we determined the Commission did not perform an adequate level of review to ensure proper eligibility determinations were made for the program as a whole. We consider this internal control deficiency to be a material weakness. Cause of Condition Management believed the level of review Commission staff performed was adequate to ensure proper eligibility determination for all HAF applicants. Effect of Condition Without establishing adequate internal controls, the Commission is at a higher risk of paying ineligible homeowners. Additionally, by only reviewing cases that the contractor selected, there is a risk that the eligibility determinations that Commission staff reviewed were not representative of the program as a whole. Recommendations We recommend the Commission: • Improve internal controls to ensure it only provides HAF funds to eligible homeowners • Ensure that Commission staff perform and document an adequate review of approved, denied and withdrawn HAF applications that are independent of those the contractor reviewed Commission’s Response The Commission concurs with this finding. In response to the prior year’s finding, the Commission doubled its quality control review, participates in the selection of QC files and conducts an independent of those verified by the contractor to ensure a more representative population. In addition, the Commission immediately implemented an independent review of all payments for eligibility under the HAF Program guidelines prior to disbursing funds. The Commission implemented these changes in late FY 2024. Auditor’s Remarks We thank the Commission for its cooperation and assistance throughout the audit. We will review the status of the Commission's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The U.S. Department of the Treasury’s Homeowner Assistance Fund: Guidance on Participant Compliance and Reporting Responsibilities, states, in part: Eligibility. Under this program, HAF participants are responsible for ensuring funds are used for eligible purposes. Generally, HAF participants must develop and implement policies and procedures, and record retention, to determine and monitor implementation of criteria for determining the eligibility of beneficiaries and / or Subrecipients. HAF participants, and if applicable, the Subrecipient(s) administering a program on behalf of the HAF participant, will need to maintain procedures for obtaining information evidencing a given beneficiary, Subrecipient, or contractor’s eligibility, including a valid SAM.gov registration. Implementing risk-based due diligence for eligibility determinations is a best practice to augment your organization’s existing controls.

2024-016 The Housing Finance Commission did not have adequate internal controls over earmarking requirements for the Homeowner Assistance Fund program. Assistance Listing Number and Title: 21.026 COVID-19 Homeowner Assistance Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Earmarking Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-023 Background The American Rescue Plan Act of 2021 provided $9.96 billion to the Homeowner Assistance Fund (HAF) program. The U.S. Department of the Treasury provides funds directly to states, U.S. territories and Indian tribes to assist eligible homeowners experiencing financial hardship due to the COVID-19 pandemic. Program funds can be used to prevent mortgage delinquencies and defaults, foreclosures, loss of utilities or home energy services, and homeowner displacement. The law prioritizes funds for homeowners who have experienced hardships, leveraging local and national income indicators to maximize the program’s impact. The Housing Finance Commission administers the HAF program in Washington. In fiscal year 2024, the Commission spent about $70.8 million in HAF funds. The Commission must meet earmarking requirements for the following four categories: 1. Counseling or educational efforts by housing counseling agencies approved by the U.S. Department of Housing and Urban Development (HUD), tribal government (including such efforts by in-house housing counselors who are HUD certified or tribally approved), or legal services, targeted to households eligible to be served with funding from the HAF related to foreclosure prevention or displacement, in an aggregate amount up to 5% of the funding from the HAF received by the HAF participant. 2. Planning, community engagement, needs assessment and administrative expenses related to the HAF participant’s disbursement of HAF funds for qualified expenses, in an aggregate amount not to exceed 15% of the funding from the HAF received by the HAF participant. 3. Participants are providing not less than 60% of funds to homeowners with income less than 100% of area median income (AMI) or 100% of U.S. median income. 4. Participants target homeowners who are classified as socially disadvantaged individuals (SDIs) and 100% AMI or less. The Commission is required to meet the requirements of the first, second and third earmarks when the HAF funds are fully expended. When administering the program, the Commission is required to have processes in place to track these requirements to ensure it is compliant at the end of the award. The HAF Plan, approved by the federal grantor, outlines the program design and the budget allocation for the earmarking categories. These amounts are based on the award being fully expended. For the first two earmarking requirements, the Commission used these budgets to contract for necessary services. Commission staff then maintained a tracking spreadsheet to ensure payments did not exceed the contracted amount. For the third earmark requirement, the Commission allocated 77% of the HAF award to homeowners, and it required all homeowners to have an income less than 100% AMI. For the fourth earmark requirement, the Commission contracted with a contractor to perform outreach targeting SDIs and those that are less than 100% AMI. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Commission did not have adequate internal controls over earmarking requirements. The prior finding number was 2023-023. Description of Condition The Commission did not have adequate internal controls over earmarking requirements for the HAF program. During the audit period, the Commission tracked contractor payments applicable to the first and second earmarking requirements. However, expenditures were tracked in relation to the amounts budgeted in the HAF Plan. The Commission did not review these expenditures in relation to overall program expenditures to ensure they were on track to be compliant with the established earmarks. For the third earmarking requirement, the Commission relied on eligibility determinations made by a contractor to ensure all homeowners in the HAF program have income less than 100% AMI. We determined the Commission did not have an adequate process to ensure all applicants met eligibility requirements. This condition is reported as a material weakness in internal controls in audit finding 2024-015. We did not identify any internal control deficiencies over the fourth earmarking requirement. We consider this internal control deficiency described above to be a material weakness. Cause of Condition While Commission staff tracked payments made to contractors allocated in the HAF Plan, management did not implement procedures to track these amounts to the total program expenditures to be able to ensure compliance. Additionally, management believed the level of eligibility determination review Commission staff performed was adequate to ensure proper eligibility determination for all HAF applicants. Effect of Condition Without adequate internal controls, the Commission is at risk of not meeting the earmarking requirements when the award closes if budget allocations change or the award is not fully expended. Recommendations We recommend the Commission: • Establish effective internal controls to ensure that it tracks and meets the earmarking requirements • Improve internal controls to ensure eligibility determinations are made properly Commission’s Response The Commission concurs with this finding. In response to the prior year’s finding, the Commission is implementing a monthly review of drawdown rates to track and meet earmarking requirements relative to expenditure levels. Additionally, the Commission doubled its quality control review, participates in the selection of QC files and conducts an independent of those verified by the contractor to ensure a more representative population. In addition, the Commission immediately implemented an independent review of all payments for eligibility under the HAF Program guidelines. The auditor’s recommendations and the Commission’s implementation began in late FY 24 and was not wholly reflected in this current audit. Auditor’s Remarks We thank the Commission for its cooperation and assistance throughout the audit. We will review the status of the Commission's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The U.S. Department of the Treasury’s Homeowner Assistance Fund Guidance, states, in part: Qualified Expenses: Counseling or educational efforts by housing counseling agencies approved by HUD or a tribal government (including such efforts by in-house housing counselors who are HUD certified or Tribally approved), or legal services, targeted to households eligible to be served with funding from the HAF related to foreclosure prevention or displacement, in an aggregate amount up to 5% of the funding from the HAF received by the HAF participant. Planning, community engagement, needs assessment, and administrative expenses related to the HAF participant’s disbursement of HAF funds for qualified expenses, in an aggregate amount not to exceed 15% of the funding from the HAF received by the HAF participant.

2024-017 The Housing Finance Commission did not have adequate internal controls over reporting requirements for the Homeowner Assistance Fund program. Assistance Listing Number and Title: 21.026 COVID-19 Homeowner Assistance Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-025 Background The American Rescue Plan Act of 2021 provided $9.96 billion to the Homeowner Assistance Fund (HAF) program. The U.S. Department of the Treasury provides funds directly to states, U.S. territories and Indian tribes to assist eligible homeowners experiencing financial hardship due to the COVID-19 pandemic. Program funds can be used to prevent mortgage delinquencies and defaults, foreclosures, loss of utilities or home energy services, and homeowner displacement. The law prioritizes funds for homeowners who have experienced hardships, leveraging local and national income indicators to maximize the program’s impact. The Housing Finance Commission administers the HAF program in Washington. In fiscal year 2024, the Commission spent about $70.8 million in HAF funds. The Commission implemented a pilot program before launching the main HAF program. The Commission contracted with a contractor to help implement the main HAF program and maintain participant data. The Commission is required to submit an annual performance report that provides an overview of its intended and actual uses of funding to-date for the pilot and main HAF programs. The federal grantor identified two key lines items on the report that contained critical information: 1. Socially Disadvantaged Individuals (SDIs) – Quantifiable Objective Criteria: Participants are providing not less than 60% of funds to homeowners with income less than 100% area median income (AMI) or 100% of U.S. median income. 2. AMI – Quantifiable Objective Criteria: Participants target homeowners that are classified as SDI and 100% AMI or less. The HAF Plan, approved by the federal grantor, outlines the budget allocations, goals and types of assistance for the Washington HAF program. The HAF reporting portal automatically populates each section of the annual report template with information from this plan. The Commission is required to submit a narrative on the status of each section. Commission staff use participant data provided by the contractor to complete the report template. Once completed, the preparer submits the report in the HAF reporting portal without management review. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Commission did not have adequate internal controls over and did not comply with reporting requirements. The prior finding number was 2023-025. Description of Condition The Commission did not have adequate internal controls over reporting requirements for the HAF program. The contractor only provided summary-level data to the Commission at the time of reporting. As a result, Commission staff did not have detailed supporting documentation to review to verify that the total amounts in the contractor’s reports were complete and accurate. Additionally, the Commission did not have documented evidence to support that management reviewed the annual report before submission. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Commission did not require the contractor to submit detailed support for the total numbers provided for reporting to ensure all categories were included. Additionally, the Commission did not ensure adequate management review of the report before submission. Effect of Condition Without establishing adequate internal controls, which should include reviewing the reports and the detailed supporting documentation to ensure the correct data is reported, management cannot ensure that the reports are complete and accurate. Recommendations We recommend the Commission: • Establish effective internal controls to ensure the reports are accurate and complete • Ensure that management performs and documents an adequate review of the supporting documentation before submitting reports to the grantor Commission’s Response The Commission concurs with this finding. The Commission has implemented a system of controls and management review to ensure that data reported to the federal grantor is complete and accurate. The auditor’s recommendations came after the FY 23 Annual Report was filed and will be reflected in the upcoming FY24 Annual Report. The new process has been used in the quarterly reporting. Auditor’s Remarks We thank the Commission for its cooperation and assistance throughout the audit. We will review the status of the Commission's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 328, Financial reporting, states: (a) The Federal agency must require only OMB-approved government-wide data elements on recipient financial reports. At the time of publication, this consists of the Federal Financial Report (SF-425); however, this also applies to any future OMB-approved government-wide data elements available from the OMB-designated standards lead. (b) The Federal agency or pass-through entity must collect financial reports no less than annually. The Federal agency or pass-through entity may not collect financial reports more frequently than quarterly unless a specific condition has been implemented in accordance with § 200.208. To the extent practicable, the Federal agency or pass-through entity should collect financial reports in coordination with performance reports. (c) The recipient or subrecipient must submit financial reports as required by the Federal award. Reports submitted annually by the recipient or subrecipient must be due no later than 90 calendar days after the reporting period. Reports submitted quarterly or semiannually must be due no later than 30 calendar days after the reporting period. (d) The final financial report submitted by the recipient must be due no later than 120 calendar days after the conclusion of the period of performance. A subrecipient must submit a final financial report to a pass-through entity no later than 90 calendar days after the conclusion of the period of performance. See also § 200.344. The Federal agency or pass-through entity may extend the due date for any financial report with justification from the recipient or subrecipient. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The U.S. Department of the Treasury’s Homeowner Assistance Fund: Guidance on Participant Compliance and Reporting Responsibilities, states, in part: Programmatic Information Requirements HAF participants are required to submit an Annual Performance Report on an annual basis and demonstrate the impact of the HAF-financed programs. Reports should include data related to program outputs and outcomes against the stated objectives of the HAF participant’s HAF Grant Plan. Performance Goals HAF participants initially submitted performance goals on the use of HAF awarded funds in their approved Grantee Plan. Each one of the performance goals should have identified how the HAF participant will address homeowner needs and should have been disaggregated by key characteristics such as mortgage type, racial and ethnic demographics, and/or geographic areas, as appropriate. HAF participants will be required to provide a status update and quantitative measures, if applicable, on each of their initial performance goals set forth in their Grantee Plan. Please note, HAF participants will not have the ability to alter their original performance goals noted in their Grantee Plan nor add additional performance goals in the Annual Report. Methods for Targeting and HAF Funding HAF participants were asked in their original Grantee Plan to describe how the HAF participant will effectively target HAF award funds to (1) homeowners with incomes equal to or less than 100% of the area median income or equal to or less than 100% of the median income for the United States, whichever is greater; and (2) socially disadvantaged individuals. The description included the HAF participant’s targeting strategies. HAF participants will be required to provide an update on their targeting methods and if they have appropriately executed targeting methods according to their original Grantee Plan.

2024-018 The Housing Finance Commission did not have adequate internal controls over and did not comply with reporting requirements for the Homeowner Assistance Fund program. Assistance Listing Number and Title: 21.026 COVID-19 Homeowner Assistance Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-024 Background The American Rescue Plan Act of 2021 provided $9.96 billion to the Homeowner Assistance Fund (HAF) program. The U.S. Department of the Treasury provides funds directly to states, U.S. territories and Indian tribes to assist eligible homeowners experiencing financial hardship due to the COVID-19 pandemic. Program funds can be used to prevent mortgage delinquencies and defaults, foreclosures, loss of utilities or home energy services, and homeowner displacement. The law prioritizes funds for homeowners who have experienced hardships, leveraging local and national income indicators to maximize the program’s impact. The Housing Finance Commission administers the HAF program in Washington. In fiscal year 2024, the Commission spent about $70.8 million in HAF funds. The Commission is required to submit quarterly financial reports that have information on the cumulative obligations and expenditures to date. These reports are due 45 days after the end of each quarter. The federal grantor specified there were two key lines items on the report that contained critical information: 1. Administrative Expenses – Quantifiable Objective Criteria: Obligations and expenditures do not exceed 15% for admin expenses. 2. Services, Counseling & Education – Quantifiable Objective Criteria: Obligations and expenditures do not exceed 5% for legal services, counseling and education. The HAF Plan, approved by the federal grantor, outlines the budget allocation of administrative, services, counseling and education expenditures. Administrative expenses are subcategorized by 10 program design elements, and counseling and education expenses are subcategorized by two program design elements. The Commission is required to report expenditure and obligation data on each program design element. The Commission uses these allocations to contract required services. Commission staff maintain a tracking spreadsheet for HAF obligations and payments made to contractors. For the 2023 quarter three report, Commission staff use data from this spreadsheet to fill out the quarterly reporting template. For the 2023 quarter four report and subsequent reports, the Commission used this spreadsheet to report obligations and then used accounting data for expenditures. Once completed, the Commission submits the report in the HAF reporting portal. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit we reported the Department did not have adequate internal controls over and did not comply with reporting requirements for the Homeowner Assistance Fund program.  The prior finding number was 2023-024. Description of Condition The Commission did not have adequate internal controls over and did not comply with reporting requirements for the HAF program. The spreadsheets used to track obligation and expenditure data for the 2023 Q3 report was not accurate and complete. We determined staff were reporting expenditures that had not been paid in the expenditure category instead of as obligations. We also determined staff made errors when recording the obligation amounts. These errors included not properly realizing all the expenditures in the accounting system, not realizing all administrative obligations and including obligations that were not supported. Starting with the 2023 Q4 report and the subsequent reports, the Commission used accounting data when reporting on expenditures. We examined all four quarterly reports and all four reports that we examined had errors, as summarized below. In the 2023 Q3 report we noted: • For key line item one, nine out of 16 sections had errors. o The range of these discrepancies for obligations was between $393,154 underreported to $1,120,000 overreported. The variances of these discrepancies ranged from -100% to 127.27%. o The range of these discrepancies for expenditures was between $394,154 underreported to $246,382 overreported. The variances of these discrepancies ranged from -100% to 13.44%. • For key line item two, two out of four sections had errors. o The one discrepancy for obligations was $911,060 overreported. This is a variance of 20.25%. o The one discrepancy for expenditures was $272,800 underreported. This is a variance of -10.06%.  In the 2023 Q4 report we noted: • For key line item one, one out of 16 sections had errors. o The one discrepancy for obligations was $1,120,000 overreported. This is a variance of 127.27%. • For key line item two, one out of four sections had errors. o The one discrepancy for obligations was $1,239,000 underreported. This is a variance of -27.53%. In the 2024 Q1 report we noted: • For key line item one, two out of 16 sections had errors. o The one discrepancy for obligations was $72,675 overreported. This is a variance of 6.39%. o The one discrepancy for expenditures was $135,223 underreported. This is a variance of -12.09%. • For key line item two, one out of four sections had errors. o The one discrepancy for obligations was $807,986 overreported. This is a variance of 17.96%. In the 2024 Q2 report we noted: • For key line item one, one out of 16 sections had errors. o The one discrepancy for obligations was $322,758 overreported. This is a variance of 28.36%. • For key line item two, one out of four sections had errors. o The one discrepancy for obligations was $807,986 overreported. This is a variance of 17.96%. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance.  Cause of Condition The reports are mainly comprised of obligations recorded through contracts and financial information recorded in the Commissions accounting system. The 2023 Q3 report did not rely on this data when reporting on expenditures and obligations. Commission officials said there was a lack of coordination between program and finance staff in compiling this report to ensure the correct data was used. Furthermore, the Commission did not require management to review the reports and their supporting documentation before submitting them to the grantor. Beginning with the 2023 Q4 report, the Commission changed its process to rely on the correct data and implemented a second review. However, there was an error in the calculation for the obligation amounts that the Commission staff said they corrected starting with the 2024 Q3 report. Additionally, for the one expenditure discrepancy, staff did not update the amount from the prior quarterly report. While the Commission implemented a second review, it was not performed effectively to identify these errors. Effect of Condition Without establishing adequate internal controls, which should include reviewing the reports and the supporting documentation to ensure the correct source data is reported, management cannot ensure that the reports are complete and accurate. Recommendations We recommend the Commission: • Establish effective internal controls to ensure the reports are accurate and complete • Ensure that management performs and documents an adequate review of the supporting documentation before submitting reports to the grantor • Consult with the federal grantor to determine if revision and resubmission of the reports are necessary to correct amounts reported Commission’s Response The Commission concurs with this finding. The Commission will strengthen its system of controls and review processes to ensure that data reported to the federal grantor is complete and accurate. In addition, the Commission will confirm with the grantor to determine if revision is necessary. Auditor’s Remarks We thank the Commission for its cooperation and assistance throughout the audit. We will review the status of the Commission's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 328, Financial reporting, states: Unless otherwise approved by OMB, the Federal awarding agency must solicit only the OMB-approved governmentwide data elements for collection of financial information (at time of publication the Federal Financial Report or such future, OMB-approved, governmentwide data elements available from the OMB-designated standards lead. This information must be collected with the frequency required by the terms and conditions of the Federal award, but no less frequently than annually nor more frequently than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes, and preferably in coordination with performance reporting. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The U.S. Department of Treasury’s Homeowner Assistance Fund: Guidance on Participant Compliance and Reporting Responsibilities, states, in part: Programmatic Information Requirements The following programmatic information will be required in Quarterly Reports. f. Program(s) Information- HAF participants will provide information on all HAF programs. Programs are new or existing eligible government services or investments funded in whole or in part by HAF funding. For each program, the HAF participant will be required to enter the following information: • Total Obligations Cumulative to Calendar Quarter end date; • Total Expenditures Cumulative to Calendar Quarter end date; g. Expenditures- HAF participants are required to report the HAF assistance expended or spent by the HAF participant. HAF participants will be asked to report expenditures on a cumulative basis at the following levels: the participant-level, program-level, and program design element-level. At the participant-level, HAF participants will be asked to disaggregate expenditures or amounts expended by the categories noted under the Disaggregated Information requirement below. • The information provided in this section will relate to the HAF Grantee Plan Budget Expenditures broken out by Program Design Element. h. Obligations- HAF participants are required to report the HAF assistance obligated. HAF participants will be asked to report obligations on a cumulative basis at the participant level, program-level, and program design element-level. HAF participants will be asked to disaggregate participant-level obligations by the categories noted under the Disaggregated Information requirement below. • The information provided in this section will relate to the HAF Grantee Plan Budget Obligations broken out by Program Design Element. i. Program Design Elements Covered- HAF participants will report on each of their HAF term sheets identified programs and their respective program design elements. HAF participants that provide funding for housing counseling and legal services will also report in this section. HAF participants will create a new line item for each program design element and tie the program design element to a specific program. Please reference Appendix 3 for Program Design Element categories and descriptions. HAF participants will be expected to report the following for each specific program design element within a program: • Total Obligations Cumulative to Calendar Quarter end date; • Total Expenditures Cumulative to Calendar Quarter end date; • Number of Homeowners Assisted Cumulative to Calendar Quarter end date; and, • Number of SDIs Assisted Cumulative to Calendar Quarter end date.

2024-019 The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-027 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. The prior finding numbers were 2023-027, 2023-028 and 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for allowable activities and period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with activities allowed, cost principles and period of performance requirements. Therefore, we were unable to assess the adequacy of internal controls over expenditures reimbursed to subrecipients to determine the Department’s compliance with these compliance requirements. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it and its subrecipients are using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the allowable costs and cost principles and period of performance requirements. Department’s Response The Department received a significant amount of SLFRF funding which was issued largely by proviso to various programs. The programs who received funding operated on their own internal control structures based on the guidance in place at the time and provided to them as part of their proviso. The programs audited in the prior year were not audited again in the current audit so any deficiencies reported in the prior year are not tied to the programs reported in this finding. The Department does have significant controls in place for activities allowed or unallowed, allowable costs/cost principles and period of performance. The Washington State Auditor’s Office (SAO) starting the planning for this audit in late in the audit cycle in October 2024 and on November 1, 2024 the Internal Control Officer met with the Assistant Audit Manager to confirm two programs would be audited for the SLFRF audit. Internal Control Office (ICO) staff met with program staff to document their internal control processes. Less than a week later SAO changed their audit scope and added three more separate programs, two with different internal control structures. SAO required receipt of internal controls in writing which Commerce was able to fulfill for three of the programs, however, since the SAO was late in completing the planning, scoping and start of the audit, Commerce leadership made the decision to bypass the internal control work confirmation. It is important to note that the Code of Federal Regulation was updated in 2024 that starting on October 1, 2024 internal controls were required to be documented. That code did not apply to these programs as their award start was in 2023, yet SAO required key controls to be documented. The Department supports that the programs audited had established controls that were in place and working effectively and that three of the five program controls were documented prior to the request made by the auditor. The SAO is not able to meet the Federal Audit Clearinghouse deadline for this audit, however, the Department was given a very short window in which to complete an audit of five different internal programs. It is our hope that all future audits are started within in timeframe early enough to allow staff to appropriately fill all audit requests and provide documentation to support the mission of the audit. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-020 The Department of Commerce did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds  Federal Grantor Name: U.S. Department of the Treasury  Federal Award/Contract Number: SLFRFP0002  Pass-through Entity Name: None  Pass-through Award/Contract Number: None  Applicable Compliance Component:  Suspension and Debarment  Known Questioned Cost Amount: None  Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF, more than $102 million of which the Department of Commerce spent.    The Department primarily used SLFRF to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department.    Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls.   Description of Condition The Department did not have adequate internal controls to ensure compliance with suspension and debarment requirements for the SLFRF.    During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for suspension and debarment.    We consider these internal control deficiencies to be a material weakness.    This issue was not reported as a finding in the prior audit.  Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with suspension and debarment requirements. Therefore, we were unable to assess the adequacy of internal controls over suspension and debarment to determine the Department’s compliance with the compliance requirement.  Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are not suspended or debarred from receiving or participating in federal awards.   Recommendation We recommend the Department establish and document internal controls sufficient to prevent and detect noncompliance with the suspension and debarment requirements.  Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls over suspension and debarment requirements. All Department contract templates include a suspension and debarment clause that when signed, confirms the contractor is not suspended or debarred from receiving federal funds. This clause meets the standard required in the Code of Federal Regulations. The past several audits completed by the SAO and other entities have concluded this control to be in place and working effectively. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 180, OMB Guidelines on Agencies on Government Wide Debarment and Suspension (Nonprocurement) establishes non-procurement debarment and suspension regulations.

2024-021 The Washington State Department of Transportation did not have adequate controls over and did not comply with procurement and suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of Treasury Federal Award/Contract Number: CSLFRF are direct deposit funds from the Treasury Office and are not classified as grants. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Procurement and Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. Federal regulations require states to follow the same policies and procedures for procuring goods and services with federal grant funds as they do with non-federal funds. In Washington, state agencies are required to follow state law as well as policies and procedures established by the Department of Enterprise Services when procuring goods and services. The Department utilizes two types of construction contracts: Design-build and design-bid-build. Under a design-build contract, the contractor will engineer the project and build it. In a design-bid-build contract, the Department engineers the project’s design and the contractor builds it based on the Department’s plans and specifications. Federal requirements prohibit award recipients from contracting with parties suspended or debarred from doing business with the federal government. Whenever the Department of Transportation contracts for construction projects that it will pay in whole, or in part with federal funds, it must verify the contractor is not suspended or debarred from doing business with the federal government. The Department can verify a contractor’s status by obtaining written certification from the contractor, inserting a clause into the contract stating the contractor is not suspended or debarred, or checking the U.S. General Services Administration’s Excluded Parties List System. The Department must meet one of these requirements before awarding a contract, and it must keep documentation demonstrating compliance with this federal requirement. Federal requirements also require contractors to not knowingly enter into any lower tier covered transaction with a person who is debarred, suspended, declared ineligible or voluntarily excluded from participation in this covered transaction, unless authorized by the department or agency entering into this transaction. Federal regulations stipulate that the Department must incorporate Form FHWA-1273, Required Contract Provisions Federal-Aid Construction Contracts in all construction contracts, including subcontracts and lower-tier subcontracts for all construction projects receiving federal aid. The Department’s Advertisement and Award Office is responsible for awarding and executing contracts for state highway projects. Projects are advertised through the Department’s regional offices in accordance with state law and the Department’s Advertisement and Award Manual (M 27-02.06). The Department’s regional offices are required by the Advertisement and Award Manual to assess the risk level of each project and to obtain approval from the Headquarters Construction Office to proceed with advertising a project assessed at Risk Level 2 or 3. In addition, the Department administers design-build construction projects according to the provisions of its Design-Build Manual (M 3126.08). In fiscal year 2024, the Department awarded about $325 million to contractors participating in construction projects under the Coronavirus State and Local Fiscal Recovery Funds. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate controls over and did not comply with procurement and suspension and debarment requirements for the SLFRF. Specifically, we found the Department’s procedures were not effective to ensure it met procurement requirements and that it communicated the requirement to contractors to ensure any lower-tier subcontracts include requirements to certify suspension and debarment of lower-tier subcontractors. We examined all five contracts totaling about $325 million awarded by the Department during the audit period. We found: • Three design-build contracts totaling $287 million (60 percent) were not adequately reviewed by management to ensure they contained the requirement for the contractor to pass down the requirement to comply with federal suspension and debarment requirements to lower-tier subcontractors. • One design-build contract totaling $102.3 million (20 percent) did not include the required Form FHWA-1273 in the contract provisions, including requiring the contractor not to enter into contracts or sub-contracts with suspended or debarred parties at the next lower level. The Department did, however, verify the suspension and debarment status of the prime contractor prior to executing the contract. • Two design-build contracts totaling $184.7 million (40 percent) did not have documentation demonstrating that the Headquarters Construction Office approved the projects for advertisement, assessed at Risk Level 3, as required by the Advertisement and Award Manual. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not effectively monitor each contract awarded to ensure that it had proper documentation of Headquarters Construction Office approval to advertise projects for award, as required by Department policies. Management did not adequately monitor each solicitation to ensure it met the requirements for advertisement in accordance with the Advertisement and Award Manual and the Design-Build Manual. Additionally, management did not adequately review contracts executed to ensure they included suspension and debarment requirements and the required Form FHWA-1273 in the contract provisions. Effect of Condition By not establishing adequate internal controls over procurement, the Department is at an increased risk of improperly awarding contracts on construction projects. By not complying with Advertisement and Award Manual requirements, the Department is at an increased risk of awarding contracts to entities without promoting fair and open competition for bidding on Department projects. By not complying with suspension and debarment requirements, the Department is at an increased risk of entering into a covered transaction with an excluded party. As a result, any payments made to an excluded party would be unallowable, and the grantor could potentially recover the funds from the Department. Recommendation We recommend that the Department: • Establish effective internal controls to ensure it procures goods and services in accordance with federal regulations, and its own policies and procedures • Improve internal controls to ensure it complies with federal suspension and debarment requirements • Ensure it complies with all federal regulations regarding contracting procedures, and follows its own policies and procedures for advertising and awarding contracts • Improve internal controls to ensure all applicable state and federal requirements are met prior to advertisement of the contract • Thoroughly review its construction contracts to ensure all federal suspension and debarment requirements have been met prior to execution Department’s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor’s Office audit of the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) program. WSDOT is committed to ensuring our programs comply with federal regulations. These funds were received from the Office of Financial Management (OFM), who received the funding from the U.S. Department of the Treasury (U.S. Treasury). At the time the funds were received WSDOT attempted to obtain guidance from the Federal Highway Administration (FHWA) and the U.S. Treasury; however, neither party was able to clarify how these funds were to be administered. Considering this, WSDOT developed procedures for awarding contracts using these funds, including contract provisions requiring adherence to WSDOT Standard Specifications for Road, Bridge, and Municipal Construction. WSDOT believed these Standard Specifications addressed requirements for procurement, suspension, and debarment, in contracts using federal U.S. Treasury funds, however SAO staff indicated these projects should be treated as if they were administered by USDOT and follow FHWA contracting requirements. These funds were for a limited program, and should the Department make any awards moving forward we will utilize the procedures in place for FHWA. In addition, WSDOT will continue communications with OFM to ensure that contracts with SLFRF funds awarded are in compliance with federal regulations and communicate any changes to the appropriate WSDOT staff, as needed. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.180, What requirements must I pass down to persons at lower tiers with whom I intend to do business?, establishes requirements that must be passed to persons at lower tiers prior to contracting with them. Title 23 CFR Part 633, Required Contract Provisions. Section 102, Applicability, establishes the required contract provisions and proposal notices applicable to all Federal-aid construction contracts other than Appalachian construction contracts. Title 23 CFR Part 635, Construction and Maintenance, Section 112, Advertising for bids and proposals, outlines the requirements for advertising bids and proposals for construction contracts on Federal-aid projects. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The Washington State Department of Transportation’s Advertisement and Award Manual (M 27-02.06), March 2022 edition, states in part: Chapter 2, Rules Appendix 1 Approval of Projects to Advertise All projects must have formal approval action in order to be advertised. The form of this approval action will depend on the risks the Department will be assuming with the advertisement of the project. It is the goal of the Department to minimize risks associated with the project bid packages prior to advertisement. The advertisement risk levels detailed below quantify risk associated with all of the project development disciplines, including right of way certification. This assessment needs to be a collaborative effort between the Region and Headquarters. Level 2 Approval This approval level is for projects that are generally complete, but still have some non-critical issues to be resolved prior to proceeding to bid opening. Approval action for these projects shall consist of a letter from the Region to the Headquarters Contract Ad and Award Office, certifying the project meets the criteria for a Level 2 Approval, and identifying all outstanding issues along with a plan to resolve all deficiencies prior to the bid opening. Approval to advertise will require concurrence by Headquarters Construction. This concurrence will be based on the risk associated with outstanding issues and the likelihood of resolving them prior to the scheduled bid opening. Level 3 Approval This approval level is for projects that are lacking one or more critical elements to be a complete biddable project, but there is a clear and overwhelming need to begin the advertisement process. Approval action for these projects shall consist of a letter from the Region to the Headquarters Contract Ad and Award Office, certifying the project meets the criteria for a Level 3 Approval, identifying all outstanding issues along with a plan to resolve all deficiencies prior to the bid opening, and documenting the prior agreement between the Region and the Headquarters Construction Office to proceed into the advertisement phase of the project. Headquarters approval to proceed to advertisement will be based on the balance of risk associated with outstanding issues, the likelihood of resolving them prior to the scheduled bid opening, and the benefits of beginning the advertisement period prior to the issues being resolved. The Washington State Department of Transportation’s Design-Build Manual (M 3126-.08), February 2022 edition, states in part: Chapter 5 General Procurement Activities 5-4 Approval of Design-Build Projects to Advertise All DB projects must have formal approval action for the RFQ and RFP to be published. The form of this approval action will depend on the risks WSDOT will be assuming with the publishing of the RFQ and RFP. It is the goal of WSDOT to minimize risks associated with the RFQ and RFP prior to publishing. The risk levels detailed below quantify risk associated with all the project development disciplines, including right of way certification. The risk levels described below are associated with an assessment of the RFP status. The assessment is intended to determine that all components of the RFP are on track to be completed and incorporated into the RFP prior to Issue RFP Date. 5-4.2 Level 2 Approval This approval level is for projects that are generally on track to be complete by the Target Date, but still have some activities/issues to be resolved prior to the Ad Date. Approval action for these projects shall consist of a letter from the Region to the Contract Ad & Award Office, certifying the project meets the criteria for a Level 2 Approval, and identifying all outstanding issues along with a plan to resolve said issues prior to the Ad date. Approval to publish the RFQ will require concurrence by HQ Construction. 5-4.3 Level 3 Approval This approval level is for projects that are not on track for completion prior to the Ad Date, missing critical elements required for a complete biddable project, but there is a clear and compelling need to begin the advertisement process. Approval action for these projects shall consist of a letter from the Region to the Contract Ad & Award Office, certifying the project meets the criteria for a Level 3 Approval, identifying all outstanding issues along with a plan to resolve said issues two weeks prior to the proposal due date. HQ’s approval to proceed to RFQ publishing will be based on clearly defined risk associated with outstanding issues, and a plan for resolving said issue two weeks prior to the scheduled proposal due date. Any conditions incorporated into the RFP and extensions proposal due date will require concurrence by HQ Construction.

2024-022 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-031 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients for the SLFRF. The prior finding numbers were 2023-031 and 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SLFRF. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit period, the Department awarded more than $68 million in SLFRF funds to 25 subrecipients for the five SLFRF funded programs we examined. We randomly selected and examined eight subrecipients in addition to one individually significant subrecipient and determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for two of its subrecipients (22 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. Program management was not aware of the requirement to perform and document risk assessments of each of its subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity. Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendation We recommend the Department: • Establish and document internal controls sufficient to prevent and detect noncompliance with subrecipient monitoring requirements. • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results, determine the appropriate level of monitoring, and demonstrate compliance with federal requirements. Department’s Response The Department maintained effective internal controls over the SLFRF-funded programs audited, despite late audit planning and an expanded scope introduced by the Washington State Auditor’s Office (SAO). The Department operated within applicable federal regulations in place at the time of the awards and ensured that controls were functioning as required. Each program receiving SLFRF funding was subject to its own internal control structure, aligned with specific program requirements and proviso guidance. The programs audited this year were distinct from those audited in the prior year, and as such, any deficiencies previously reported are unrelated to the programs referenced in the current finding. The Department confirms that appropriate subrecipient monitoring controls were in place and operating effectively for all programs included in this year’s audit. Challenges arose due to SAO initiating audit planning late in the cycle, beginning in October 2023. At the outset, only two programs were identified for audit, and internal control documentation for these programs was prepared accordingly. However, within a week, SAO expanded the audit scope to include three additional programs, two of which followed different internal control frameworks. Commerce responded promptly, providing documentation for three of the five programs. Due to time constraints caused by the late scoping and planning of the audit, Commerce leadership prioritized core audit deliverables and elected not to pursue additional internal control confirmations at that time. It is important to note that a 2024 update to the Code of Federal Regulations requires documented internal controls for awards beginning on or after October 1, 2024. The programs audited, however, were awarded in 2023 and were therefore not subject to this requirement. Despite this, SAO reported the absence of certain documented key controls as a deficiency. The Department maintains that all audited programs had established and effective internal controls and that documentation was completed for a majority of programs prior to SAO’s request. While the SAO will not meet the Federal Audit Clearinghouse deadline due to delays in initiating and planning this audit, the Department worked within a compressed timeline to accommodate the widened audit scope. Looking ahead, the Department recommends that future audits be initiated earlier to provide sufficient time for staff to meet all audit requirements and fully support the audit’s objectives. Auditor’s Remarks Our Office began scoping the audit of the SLFRF program in October 2024 after receiving the Schedule of Expenditures of Federal Awards from the Office of Financial Management (OFM). Once we performed our analysis of program expenditures at the Department, we submitted requests for audit contacts from two of the divisions administering SLFRF funds on October 3, 2024. We finalized preliminary scoping for the audit on October 16th and followed up with the Department by requesting audit contacts for three additional projects funded by SLFRF. The Department ultimately provided enough information for us to scope and finalize the audit plan in January 2025. In our judgment, we provided the Department with ample time to provide documentation about its internal controls over the direct and material compliance requirements for the SLFRF that were in place during the audit period. We discussed the timing of the audit with Department management, and they decided to forego our Office testing the internal controls over all of the compliance requirements. We agree with the Department that Uniform Guidance (2 CFR) did not require non-Federal entities that receive federal funds to explicitly have documentation of their internal controls. However, the version of 2 CFR 200.303 Internal controls (effective November 12, 2020) in place during the audit period required non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State Administrative and Accounting Manual (SAAM), published by OFM, establishes the minimum requirements that state agencies must meet. Chapter 20 of the SAAM discusses policies related to internal controls. Section 20.15.60.d states: Documentation is a necessary part of a system of internal control. Management must determine the level and nature of documentation that is needed to assess the effectiveness of internal control. Documentation should be sufficient to allow the agency to: • Assess the overall soundness of the system of internal control. • Be aware of the existence of internal control weaknesses, if any. • Formulate the agency’s plan of action for addressing internal control weaknesses and improving the internal control where necessary. While we appreciate the Department’s Internal Control Office assisting its programs with documenting its internal controls and believe it will help strengthen the Department in future years, it was evident this documentation did not exist at its program levels during the audit period. Regarding the timing of our single audit opinion for the state, our engagement letter with OFM stipulates that the single audit report will be issued no later than April 30, 2025 and this letter was signed by both parties in June 2024. Our audit work was completed in accordance with the timelines outlined in this engagement letter. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.

2024-023 The Department of Commerce did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Coronavirus State and Local Fiscal Recovery Funds received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2024, state agencies spent about $564 million in SLFRF funds, more than $102 million of which was spent by the Department of Commerce. The Department primarily used SLFRF funds to administer and support affordable housing construction and infrastructure projects including broadband infrastructure, through its housing and local government divisions. SLFRF funds were also used for transportation, tourism and other pandemic-recovery projects. During fiscal year 2024, the Department expended about $100 million on reimbursements to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for carrying out housing and infrastructure projects under contracts with the Department. Federal regulations require the Department to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more on federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes to subrecipients, the Department must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a Department funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the Federal Audit Clearinghouse. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. To monitor its compliance with these requirements, the Internal Control Office uses an Excel workbook to track subrecipients’ single audits along with identifying any program-funded findings. The Internal Control Office obtains a list of subrecipients paid with federal funds in its Contract Management System (CMS) and also obtains program expenditures from the state’s accounting system (AFRS) to determine which subrecipients were paid by the Department. The Program staff also provide separate lists of subrecipients to the Internal Control Office for comparison. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the SLFRF received required single audits, and that it appropriately followed up on findings and issued management decisions. During the audit, we were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. As such, we determined internal controls were inadequate to prevent or detect material noncompliance with federal requirements for subrecipient monitoring. During the audit, we requested the spreadsheet used to monitor compliance with these requirements for SLFRF subrecipients, but the Department did not provide it. We compared the subrecipients identified by program management to the Federal Audit Clearinghouse to determine which received single audits. We found 59 SLFRF subrecipients received a single audit during the audit period. Additionally, we found nine subrecipients received a SLFRF finding requiring a management decision letter to be issued by the Department during the audit period. These subrecipients were not monitored by the Department during the audit period and no management decisions were issued. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This condition was not reported as a finding in the prior audit. Cause of Condition The Department did not identify its internal controls that are designed to ensure compliance with subrecipient monitoring requirements. Therefore, we were unable to assess the adequacy of internal controls over subrecipient monitoring to determine the Department’s compliance with these compliance requirements. The Department did not effectively monitor SLFRF subrecipients during the audit period to ensure single audits were performed, when required, due to not reviewing audit reports submitted in the Federal Audit Clearinghouse. The Department relied on the accuracy of program reports to determine which of its subrecipients required follow-up. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure it is adequately monitoring subrecipients for all requirements placed on the pass-through entity for this program, which the federal government has classified as a program of higher risk. Further, the Department cannot ensure it follows up on subrecipient single audit findings and communicates required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and that management monitors them for effectiveness when required, the Department cannot determine whether its subrecipients have sufficiently corrected issues identified in audit findings Recommendations We recommend the Department: • Establish effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required • Monitor subrecipients to ensure all required audit reports are submitted and reviewed to determine if any additional subrecipients are required to take corrective action to address audit recommendations • Ensure subrecipients develop and take acceptable corrective actions to adequately address all audit recommendations • Issue a written management decision for all applicable audit findings, if necessary Department’s Response The Department agrees with part of the finding issued. The Department does have a robust process in place to identify, verify, track and work with program partners to complete the required single audit submission verifications required by the Code of Federal Regulations. The Department acknowledges weaknesses exist in the issuance of management decision letters. While the Department was successful in monitoring subrecipients and issuing management decision letters to all Commerce subrecipients who were issued findings in the prior audit, the workload related to the monitoring and letter issuance exceeded staff capabilities. The amount of subrecipients the Department provides funding to is large and many have different submission dates and their funding thresholds vary widely making tracking of several hundred subrecipients a challenge. In October 2024 the Internal Controls Office (ICO) hired an experienced staff member who is responsible for the audit submission verification, tracking and management decision letter issuance and our staffing resource issues have been resolved. Additionally, the ICO is examining the complexity of the process for the Department to identify improvements which will allow for stronger internal controls and result in a higher compliance rate. The Department anticipates these process improvements will resolve all deficiencies and will be reflected in outcome of the next federal single audit report issued in 2026. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-024 The Office of Superintendent of Public Instruction improperly charged $5,139 to the Special Education program. Assistance Listing Number and Title: 84.027 Special Education Grants to Staes (IDEA, Part B) 84.027 COVID-19 Special Education Grants to Staes (IDEA, Part B) 84.173 Special Education Preschool Grants (IDEA Preschool) 84.173 COVID-19 Special Education Preschool Grants (IDEA Preschool) Federal Grantor Name: U.S. Department of Education  Federal Award/Contract Number: H027A210074-21A; H027A220074; H027A230074-23A; H027X210074; H173A210074; H173A220074; H173A230074; H173X210074 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Period of Performance Known Questioned Cost Amount: $5,139  Prior Year Audit Finding: None Background The Individuals with Disabilities Education Act’s (IDEA) Special Education Grants to States program (IDEA, Part B) provides grants to states, and through them to local education agencies (LEAs), to help provide special education and related services to eligible children with disabilities. IDEA’s Special Education Preschool Grants program (IDEA Preschool), also known as the “619 program,” provides grants to states, and through them to LEAs, to assist with providing special education and related services to children with disabilities ages 3 through 5 and, at a state’s discretion, to 2-year-old children with disabilities who will turn 3 during the school year. The Office of Superintendent of Public Instruction administers the Special Education program in Washington, which serves about 143,000 eligible students. The program provides specially designed instruction to address students’ unique needs. The Office offers the program at no cost to parents, and it includes the related services students need to access their educational program. The Office spent about $251 million in federal IDEA grant funds during fiscal year 2024 and passed about $243 million of that funding through to LEAs and educational service districts. The grantor identified that obligations charged to the fiscal year 2022 IDEA grant funds must be obligated or incurred prior to September 30, 2023. Description of Condition The Office improperly charged $5,139 to the program. We found the Office had adequate internal controls to ensure it materially complied with period of performance requirements. We used a nonstatistical sampling method to randomly select and examine 13 payments of a total of 68 that the Office made close to the end of the obligation period to ensure they were allowable and obligated within the proper period.  During our testing, we found three charges totaling $5,139 that were obligated after the obligation period ended. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a single audit exceed $25,000. We are issuing this finding because, as stated in the Effect of Condition and Questioned Costs section of this finding, the estimated questioned costs exceed that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition Office staff made accounting adjustments to the fiscal year 2023 IDEA part B grant. These payments were initially charged to an allowable grant, but staff made adjustments and moved them to the fiscal year 2022 IDEA part B grant. Therefore, the payments were then noncompliant with period of performance requirements. Effect of Condition and Questioned Costs We identified $5,139 in questioned costs that were obligated outside the obligation date. Projection to population Known Questioned Costs Likely Questioned Costs Federal expenditures $5,139 $26,883 We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Office consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Office’s Response The Office of Superintendent of Public Instruction (OSPI) concurs with this finding. To ensure that expenditures occurring outside of a grant’s period of performance are not shifted to the grant during its liquidation period, OSPI has established internal controls to address accounting adjustments made during liquidation periods. Journal vouchers (corrections) will be verified by budget staff prior to submission to ensure expenditures occurred within the grant period of performance. OSPI will communicate the corrective action plan with internal stakeholders to ensure compliance with updated process/procedures. Internal Control Details: • Monitor expenditures (through reconciliation of monthly reports) to ensure the agency stays within the allowable set-aside threshold and grant maximum. • Verify that all expenditures corrected with journal vouchers during the grant liquidation period have occurred during the grant period of performance. • Complete expenditure corrections within the grant liquidation period. • Liquidation is done on the last business day of January (or 120 days after the budget period ends). Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 U.S. Code of Federal Regulations (CFR) Part 200.1, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs. Fiscal Year 2022 Special Education Grant Award, Grant Award Notification, establishes the federal funding period for award numbers H137A210074 and H027A210074 as July 1, 2021 through September 30, 2023. Tile 20 United States Code 1225(b), General Education Provisions Act, establishes that any funds that are not obligated at the end of the federal funding period shall remain available for obligation for an additional period of 12 months.

2024-025 Office of Superintendent of Public Instruction did not have adequate internal controls to ensure it performed risk assessments for subrecipients of the Special Education program. Assistance Listing Number and Title: 84.027 Special Education Grants to Staes (IDEA, Part B) 84.027 COVID-19 Special Education Grants to Staes (IDEA, Part B) 84.173 Special Education Preschool Grants (IDEA Preschool) 84.173 COVID-19 Special Education Preschool Grants (IDEA Preschool) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: H027A210074-21A; H027A220074; H027A230074-23A; H027X210074; H173A210074; H173A220074; H173A230074; H173X210074 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-036 Background The Individuals with Disabilities Education Act’s (IDEA) Special Education Grant to States program (IDEA, Part B) provides grants to states, and through them to local educational agencies (LEAs), to help provide special education and related services to eligible children with disabilities. IDEA’s Special Education Preschool Grants program (IDEA Preschool), also known as the “619 program,” provides grants to states, and through them to LEAs, to assist with providing special education and related services to children with disabilities ages 3 through 5 and, at a state’s discretion, to 2-year-old children with disabilities who will turn 3 during the school year. The Office of Superintendent of Public Instruction administers the Special Education program in Washington, which serves about 143,000 eligible students. The program provides specifically designed instruction to address students’ unique needs. The Office offers the program at no cost to parents, and it includes the related services students need to access their educational program. The Office spent about $285 million in federal IDEA grant funds during fiscal year 2024 and passed about $276 million of that funding through to LEAs and all nine education service districts (ESDs) in the state. Federal law requires the Office to evaluate each subrecipient’s risk of noncompliance with federal statues, regulations, and the subaward’s terms and conditions to determine the appropriate amount and type of subrecipient monitoring. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Office did not have adequate internal controls over requirements to perform risk assessments for the program’s subrecipients. The prior finding numbers were 2023-036, 2022-026 and 2021-023. Description of Condition The Office did not have adequate internal controls to ensure it performed risk assessments for subrecipients of the Special Education program. As a result, the Office did not perform risk assessments for the nine ESDs that received program funding during the audit period. We consider this internal control deficiency to be a significant deficiency. Cause of Condition In response to the prior year audit finding, the Office’s Special Education division revised and expanded the form package that ESDs need to submit as part of year-end reporting. The corrective action was not fully implemented during the fiscal 2024 year, and therefore the Office did not perform risk assessments for the nine ESDs that received program funding during the audit period. Effect of Condition Without conducting risk assessments, management cannot ensure the Office performs the appropriate amount of monitoring to ensure subrecipients comply with program requirements. Further, without appropriate levels of subrecipient monitoring, the Office cannot have reasonable assurance that federal requirements are being met. Recommendation We recommend the Office establish and follow adequate internal controls to ensure it performs the required risk assessments, which would allow management to evaluate the results, monitor subrecipients appropriately, and demonstrate compliance with federal requirements. Office’s Response The Office of Superintendent of Public Instruction (OSPI) concurs with this finding. As of April 2024, OSPI Special Education division fully implemented the accepted corrective action plan and conducted fiscal monitoring of all nine (9) Educational Service Districts (ESDs) statewide. All nine (9) ESDs received a fiscal monitoring report no later than April 2024. Based on the results from monitoring activities over year-end reporting, ESDs will be selected for additional monitoring and may be subject to a future onsite visit if deemed necessary. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-026 The Workforce Training and Education Coordinating Board did not have adequate internal controls over matching requirements for the Career and Technical Education – Basic Grants to States program. Assistance Listing Number and Title: 84.048 Career and Technical Education – Basic Grants to States (Perkins V) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: V048A210047; V048A220047; V048A230047 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Matching Known Questioned Cost Amount: None Prior Year Audit Finding: None Background The Career and Technical Education - Basic Grants to States (Perkins V) program is administered by the Workforce Training and Education Coordinating Board (Workforce Board). Perkins V provides grants to states and outlying areas to develop the academic knowledge and technical and employability skills of secondary students and postsecondary students. This is accomplished by building on the efforts of states and localities to develop challenging academic and technical standards and to assist students in meeting such standards promoting the development of services and activities that integrate rigorous and challenging academic and career and technical instruction, and that link secondary education and postsecondary education. This is also done through increasing state and local flexibility in providing services and activities designed to develop, implement and improve career and technical education, conducting and disseminating national research and disseminating information on best practices that improve career and technical education programs and programs of study, services, and activities. The Office of the Superintendent of Public Instruction (OSPI) and the Washington State Board for Community and Technical Colleges (SBCTC) receive funds through interagency agreements with the Workforce Board. The federal funding provides technical assistance, supporting partnerships among secondary schools, postsecondary institutions, area career and technical education schools, local workforce investment boards, business and industry, and intermediaries. It helps provide individuals with opportunities to develop, in conjunction with other educational and training programs, the knowledge and skills needed to keep the United States competitive; and increase the employment opportunities for populations who are chronically unemployed or underemployed (including individuals with disabilities, individuals from economically disadvantaged families, out-of-workforce individuals, youth who are in, or have aged out of, the foster care system, and homeless individuals). Matching requirements for the grant require the state to match, from nonfederal sources and on a dollar-for-dollar basis, the funds reserved for the administration of the plan. The matching requirement may be applied overall, rather than line-by-line, to state administrative expenditures. During fiscal year 2024, the Workforce Board, OSPI, and SBCTC spent about $27 million in federal grant funds. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Workforce Board did not have adequate internal controls over matching requirements for the Perkins V program.  The Board obtains information as part of its annual report from OSPI and SBCTC along with a certification showing the amount of state funds that are being used to match the federal administrative expenditures required by the grant. The Board did not have documentation to show the certification was received from OSPI. We also identified a lack of sufficient detail on the individual reimbursement requests and the certification. Without reviewing any of the supporting documentation for the state matching funds from other entities, the Board cannot determine the amount of state funds being used to match is supported and was for allowable purposes. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition While the Workforce Board established internal controls, they were insufficiently designed and did not operate effectively to ensure compliance with matching requirements. Effect of Condition Without establishing adequate internal controls and obtaining a sufficient level of supporting accounting detail, the Board cannot reasonably ensure it and its partnered state agencies have met matching requirements. Recommendation We recommend the Workforce Board: • Establish and document internal controls sufficient to prevent and detect noncompliance with matching requirements. • Obtain support sufficient to adequately ensure matching requirements are met. Board’s Response We appreciate the State Auditor’s Office audit of the matching requirement for the Perkins V program. The Workforce Training and Education Coordinating Board (Workforce Board) is committed to ensuring that our programs comply with all federal regulations. While the Workforce Board partially concurs with the Auditor's findings, we want to highlight that we have established controls to ensure the state administration match requirement is met. During the period audited, there was turnover within both the Office of Superintendent of Public Instruction (OSPI) and the Workforce Board, which may have contributed to challenges in fulfilling certain requirements. However, the Workforce Board does have a contract with OSPI that specifies a Certification is required, and we did receive the Certification for the current year. Additionally, we have communicated with our subrecipients that certifications are required. We have since worked closely with the new fiscal staff at OSPI, and they are now providing additional support for each quarterly billing, as reflected in their accounting records. Furthermore, the Workforce Board has incorporated a monitoring section into the new contracts to enhance oversight and ensure compliance moving forward. Auditor’s Remarks We thank the Board for its cooperation and assistance throughout the audit. We will review the status of the Board's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 20 United Stated Code, section 2391, Fiscal requirements, states, in part: (b)Matching requirement Each eligible agency receiving funds made available under subsection (a)(3) shall match, from non-Federal sources and on a dollar-for-dollar basis, the funds received under subsection (a)(3).

2024-027 Workforce Training and Education Coordinating Board did not have adequate internal controls to ensure compliance with level of effort requirements for the Career and Technical Education – Basic Grants to States program. Assistance Listing Number and Title: 84.048 Career and Technical Education – Basic Grants to States (Perkins V) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: V048A210047; V048A220047; V048A230047 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Level of Effort Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Career and Technical Education - Basic Grants to States (Perkins V) program is administered by the Workforce Training and Education Coordinating Board (Workforce Board). Perkins V provides grants to states and outlying areas to develop the academic knowledge and technical and employability skills of secondary students and postsecondary students. This is accomplished by building on the efforts of states and localities to develop challenging academic and technical standards and to assist students in meeting such standards promoting the development of services and activities that integrate rigorous and challenging academic and career and technical instruction, and that link secondary education and postsecondary education. This is also done through increasing state and local flexibility in providing services and activities designed to develop, implement and improve career and technical education, conducting and disseminating national research and disseminating information on best practices that improve career and technical education programs and programs of study, services, and activities. The Office of the Superintendent of Public Instruction (OSPI) and the Washington State Board for Community and Technical Colleges (SBCTC) receive funds through interagency agreements with the Workforce Board. The federal funding provides technical assistance, supporting partnerships among secondary schools, postsecondary institutions, area career and technical education schools, local workforce investment boards, business and industry, and intermediaries. It helps provide individuals with opportunities to develop, in conjunction with other educational and training programs, the knowledge and skills needed to keep the United States competitive; and increase the employment opportunities for populations who are chronically unemployed or underemployed (including individuals with disabilities, individuals from economically disadvantaged families, out-of-workforce individuals, youth who are in, or have aged out of, the foster care system, and homeless individuals). Level of effort requirements for the grant require the state to maintain its fiscal efforts from state sources each year when compared with such efforts from the preceding year. Similarly, the state shall provide from state sources for administration of Perkins V, an amount that is not less than the state sourced amounts provided for administrative costs in the preceding fiscal year. Lastly, the state and its subrecipients may use funds for career and technical education activities that supplement, and not supplant, non-federal funds expended to carry out career and technical education activities. During fiscal year 2024, the Workforce Board, OSPI, and SBCTC spent about $27 million in federal grant funds. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Workforce Board did not have adequate internal controls to ensure compliance with level of effort requirements for the Perkins V program. The Workforce Board reviews state funding efforts for the program during its preparation of their annual report. However, the Workforce Board did not implement sufficient preventative controls to effectively monitor the level of effort requirements on a more continuous basis. During the audit, we were unable to identify controls that would prevent or detect non-compliance with the requirement that federal funds must be used to supplement, not supplant, non-federal funds specific to the level of effort requirement. As such, we determined internal controls were inadequate to prevent or detect non-compliance with federal requirements for level of effort. We consider this internal control deficiency to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Workforce Board did not establish sufficient internal controls that were designed to ensure compliance with the level of effort requirements. Effect of Condition Without establishing adequate internal controls, the Workforce Board cannot reasonably ensure it and its partnered state agencies have met level of effort requirements. Recommendation We recommend the Workforce Board establish and document internal controls sufficient to prevent and detect noncompliance with the level of effort requirements. Board’s Response Thank you for providing the Workforce Training and Education Coordinating Board (Workforce Board) with the opportunity to review and respond to the State Auditor’s Office (SAO) audit report on the level of effort. The Workforce Board fully acknowledges the significance and priority of maintaining strong internal controls over the analysis and certification of level of effort, ensuring that this process is completed in a timely manner and allowing sufficient time for any necessary corrective actions. In collaboration with the State Board for Community and Technical Colleges (SBCTC) and the Office of Superintendent of Public Instruction (OSPI), the Workforce Board is committed to identifying and analyzing options for incorporating semi-annual reviews of the level of effort / maintenance of effort (MOE) funds. These efforts will help enhance transparency and improve the accuracy of reporting. The SBCTC already provides level of effort documentation on a semi-annual basis. The Workforce Board will use this document as a template to establish agency guidelines related to MOE. The agency will require the collection of MOE data and certification from its subaward recipients on a semi-annual basis. This approach will help ensure consistent compliance with all applicable requirements and reinforce our commitment to continuous improvement in managing and overseeing MOE funds. We appreciate the recommendations from the SAO and look forward to working collaboratively with SBCTC and OSPI to enhance our internal processes and controls. Auditor’s Remarks We thank the Board for its cooperation and assistance throughout the audit. We will review the status of the Board's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 20 United Stated Code, section 2391, Fiscal requirements, states: (a) Supplement not supplant Funds made available under this chapter for career and technical education activities shall supplement, and shall not supplant, non-Federal funds expended to carry out career and technical education activities. (b) Maintenance of effort (1) Determination (A) In general Except as provided in subparagraph (B), (C), or (D), in order for a State to receive its full allotment of funds under this chapter for any fiscal year, the Secretary must find that the State's fiscal effort per student, or the aggregate expenditures of such State, with respect to career and technical education for the preceding fiscal year was not less than the fiscal effort per student, or the aggregate expenditures of such State, for the second preceding fiscal year. (B) Computation In computing the fiscal effort or aggregate expenditures pursuant to subparagraph (A), the Secretary shall, at the request of the State, exclude competitive or incentive-based programs established by the State, capital expenditures, special one-time project costs, and the cost of pilot programs. (C) Decrease in Federal support If the amount made available for career and technical education programs under this chapter for a fiscal year is less than the amount made available for career and technical education programs under this chapter for the preceding fiscal year, then the fiscal effort per student or the aggregate expenditures of a State required by subparagraph (A) for the preceding fiscal year shall be decreased by the same percentage as the percentage decrease in the amount so made available. (D) Establishing the state baseline For purposes of applying subparagraph (A) for years which require the calculation of the State's fiscal effort per student, or aggregate expenditures of such State, with respect to career and technical education for the first full fiscal year following July 31, 2018, the State may determine the State's fiscal effort per student, or aggregate expenditures of such State, with respect to career and technical education for such first full fiscal year by- (i) continuing to use the State's fiscal effort per student, or aggregate expenditures of such State, with respect to career and technical education, as was in effect on the day before July 31, 2018; or (ii) establishing a new level of fiscal effort per student, or aggregate expenditures of such State, with respect to career and technical education, which is not less than 95 percent of the State's fiscal effort per student, or the aggregate expenditures of such State, with respect to career and technical education for the preceding fiscal year. (2) Failure to meet (A) In general The Secretary shall reduce the amount of a State's allotment of funds under this chapter for any fiscal year in the exact proportion by which the State fails to meet the requirement of paragraph (1) by falling below the State's fiscal effort per student or the State's aggregate expenditures (using the measure most favorable to the State), if the State failed to meet such requirement (as determined using the measure most favorable to the State) for 1 or more of the 5 immediately preceding fiscal years. (B) Special rule No such lesser amount shall be used for computing the effort required under paragraph (1) for subsequent years. (3) Waiver The Secretary may waive paragraph (2) due to exceptional or uncontrollable circumstances affecting the ability of the State to meet the requirement of paragraph (1) such as a natural disaster or an unforeseen and precipitous decline in financial resources. No level of funding permitted under such a waiver may be used as the basis for computing the fiscal effort or aggregate expenditures required under this section for years subsequent to the year covered by such waiver. The fiscal effort or aggregate expenditures for the subsequent years shall be computed on the basis of the level of funding that would, but for such waiver, have been required.

2024-028 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with federal activities allowed and subrecipient monitoring requirements for the Education Stabilization Fund program. Assistance Listing Number and Title: 84.425R COVID-19 Coronavirus Response and Relief Supplemental Appropriations Act, Emergency Assistance to Non-Public Schools (CRRSA EANS) 84.425V COVID-19 American Rescue Plan – Emergency Assistance to Non-Public Schools (ARP EANS) program Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: S425D210015; S425R210012; S425U210015; S425V210012; S425W210049 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Components: Activities Allowed or Unallowed Allowable Costs/Cost Principles Subrecipient Monitoring Known Questioned Cost Amount: $47,322,280 Prior Year Audit Finding: No Background Beginning in March 2020, Congress set aside the Elementary and Secondary School Emergency Relief (ESSER) Fund to address the effect the COVID-19 pandemic has had, and continues to have, on elementary and secondary schools across the nation. Several rounds of funding were distributed to states under the Education Stabilization Fund (ESF) program with the intent to support public and nonpublic schools. The U.S. Department of Education awarded ESF grants to the Office of Financial Management, which then dispersed funds to the Office of Superintendent of Public Instruction, to pass through to Local Education Agencies (LEAs). The U.S. Department of Education awarded ESF program funds to grantees under multiple subprograms of the ESF. An alphabetic character at the end of the 84.425 Assistance Listing Number was used to delineate the specific subprogram. Each subprogram has its own funding requirements and compliance requirements. The objective of the CRRSA EANS (84.425R) and ARP EANS (84.425V) subprograms is to provide governors with a reservation of funds to provide services or assistance to eligible nonpublic schools to address the impact the COVID-19 pandemic has had, and continues to have, on nonpublic school students and teachers in the state. In fiscal year 2024, the state spent more than $600 million in ESFs federal funding. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and did not comply with federal activities allowed and subrecipient monitoring requirements for the ESF program. After the Office distributed EANS funds to nonpublic schools, there was $47,322,281 in ESF program funds remaining that went unobligated. Those funds reverted to the Governor’s office as CRRSA-GEER funds. After the reversion of these funds, the legislature specifically directed the Office to use the resources to fund Transition to Kindergarten programs. During this process, the Office distributed funds to 149 public LEAs but did not issue subawards as required. As a result, it failed to clearly communicate these awards’ terms and conditions to the subrecipients, including the allowable uses of the funds. We consider this internal control deficiency to be a material weakness which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Office believed the information that was sent out through other means would cover the required elements it needed to communicate to the LEAs. The Office did not know the amount each LEA would receive as amounts were not predetermined, and the Office used an apportionment process to allocate funds to meet the legislative intent. Effect of Condition and Questioned Costs Without issuing subawards to subrecipients to ensure proper accountability and compliance with federal requirements, the Office cannot ensure all funds were used for allowable activities and properly supported. In addition, without a subaward, the Office could not distribute funds to these subrecipients. Therefore, we are questioning the $47,322,280 that it distributed to these LEAs. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Office: • Establish effective internal controls to ensure that all federal funds it grants to subrecipients are awarded through a subaward that meets federal requirements • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Office’s Response We distributed these funds through the apportionment process instead of our grants system due to the nature of how the payments were calculated. Our grants system provides a grant award notification via e-mail when the grant is awarded that contains the federal elements required in CFR 200.332. While we did not provide a formal subaward that included all of these elements in one document, we provided most of them using other formal communication, such as through a Gov Delivery e-mail and the School District Accounting Manual. If we use the apportionment process to distribute funds in the future, we will include all of the required federal elements in a separate subaward. Additionally, our communication to school districts included the use of allowable activities for these funds. Therefore, we do not agree that the funds should be questioned as not being allowable or properly supported. Auditor’s Remarks The Office asserts the costs should not be questioned for not being allowable or properly supported. However, without a subaward the Office could not distribute federal funds to these subrecipients, therefore we are questioning the costs consistent with criteria established in 2 CFR 200 (Uniform Guidance). We reaffirm our finding and will review the status of the Office’s corrective action during the next audit.  Applicable Laws and Regulations Title 34 U.S. Code of Federal Regulations (CFR) Part 75, Direct grant programs, section 702, Fiscal control and fund accounting procedures, states that a grantee shall use fiscal control and fund accounting procedures that ensure proper disbursement of, and accounting for, Federal funds as required in 2 CFR part 200, subpart D—Post Federal Award Requirements. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 332, Requirements for pass-through entities, requires that every subaward is clearly identified to the subrecipient as a subaward and includes the federal identification elements. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 U.S. Code of Federal Regulations (CFR) Part 200.1, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs. Title 2 CFR Part 200.403, Uniform Guidance, establishes the factors affecting the allowability of costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-029 The Department of Social and Health Services did not have adequate internal controls to ensure it filed reports timely as required by the Federal Funding Accountability and Transparency Act. Assistance Listing Number and Title: 93.044 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.044 COVID-19 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.045 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.045 COVID-19 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.053 Nutrition Services Incentive Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: Various Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-039 Background The Aging Cluster programs, which include Supportive Services and Senior Centers, Nutrition Services, and the Nutrition Services Incentive Program, provide services and meals to older people. The Supportive Services program helps states and area agencies on aging (AAAs) facilitate the development and implementation of a comprehensive, coordinated system for providing long-term care in homes and community-based settings in a way that responds to the needs and preferences of older people and their family caregivers. Nutrition Services programs support nutrition services and provide resources incentives to encourage and reward effective and efficient performance delivery of nutritious meals to older people. The Department of Social and Health Services administers federal programs under the Older Americans Act, including the Aging Cluster programs. In fiscal year 2024, the Department spent about $37.9 million in Aging Cluster federal funding, including about $36.9 million paid to 13 AAAs. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The Act is intended to empower the public with the ability to hold the federal government accountable for spending decisions and therefore reduce wasteful government spending. The Department issues subawards to AAAs for multiple Older American Act grants in the same contract, including grants that are not a part of the Aging Cluster. When a new subaward is executed, Department staff enter the required reporting information for the subawards in a tracking spreadsheet. Staff use the tracking spreadsheet to submit the required reports in FSRS. The Department had 47 subawards and amendments totaling $25,092,377 that it was required to report in fiscal year 2024. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. The prior finding number was 2023-039. Description of Condition The Department did not have adequate internal controls to ensure it filed reports timely as required by the Act. The Department did not follow its written procedures over the reporting process. Specifically, staff did not submit the reports on time. We used a statistical sampling method and randomly selected and examined 10 subawards out of a total population of 47. We determined that four out of 10 subawards were not submitted on time. However, the reports were reported accurately, were not missing any of the key elements and the amounts reported were correct. We consider these internal control deficiencies to be a significant deficiency. Cause of Condition The Department had procedures in place to ensure it reported subawards and amendments in FSRS. However, due to management turnover during the previous fiscal year, staff was behind in submitting subawards and amendments in FSRS and is in the process of becoming current. Effect of Condition Failing to submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendation We recommend the Department strengthen internal controls to ensure it reports all first-tier subawards of $30,000 more in FSRS by the federal deadlines. Department’s Response The Department concurs with the finding. Due to management and fiscal staff turnover in fiscal year 2023, staff did not enter information required for Federal Funding Accountability and Transparency Act (FFATA) reporting into the Subawards and Amendments Tracking Spreadsheet when subawards and subaward amendments were executed and did not report any of the subawards in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) during fiscal year 2023. Effective January 17, 2024, the Subawards and Amendments Tracking Spreadsheet was created with the required fields to ensure contract information for all current contracts were entered. Effective January 17, 2024, two fiscal staff were assigned to submit FFATA reports in the FSRS system to ensure reporting activities are completed by federal deadline. By January 19, 2024, the Office Chief or designee started reviewing the Subawards and Amendments Tracking Spreadsheet with FFATA reporting dates monthly to ensure federal deadlines for FFATA reporting are met consistently. The Fiscal Year 2023 Corrective Action Plan was not completed until March 1, 2024, therefore there were still exceptions during the audit period of July 1, 2023, to June 30, 2024. The Finance and Contract Units will work in collaboration to streamline notification of contract execution dates by June 30, 2025, ensuring that fiscal staff are aware of executed contracts and submitting FFATA reports timely. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, statins in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2020. 3. What to report. You must report the information about each obligating action that the submission instructions posted at https://www.fsrs.gov specify. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-030 The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Aging Cluster Programs. Assistance Listing Number and Title: 93.044 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.044 COVID-19 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.045 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.045 COVID-19 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.053 Nutrition Services Incentive Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: Various Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-040 Background The Aging Cluster programs, which include the Supportive Services and Senior Centers, Nutrition Services, and the Nutrition Services Incentive Program, provide services and meals to older people. The Supportive Services program helps states and area agencies on aging (AAAs) facilitate the development and implementation of a comprehensive, coordinated system for providing long-term care in home and community-based settings in a way that responds to the needs and preferences of older people and their family caregivers. The Nutrition Services programs support nutrition services and provide resource incentives to encourage and reward effective and efficient performance in the delivery of nutritious meals to older people. The Department of Social and Health Services administers federal programs under the Older Americans Act, including the Aging Cluster programs. In fiscal year 2024, the Department spent about $37.9 million in Aging Cluster federal funding, including about $36.9 million it paid to 13 AAAs. Federal regulations require the Department to ensure that every subaward is clearly identified to the subrecipient as a subaward and includes 14 federal identification elements. These elements include the subrecipient’s unique entity identifier, the Federal Award Identification Number (FAIN), name of the federal awarding agency, the program’s Assistance Listing Number, title and more. The Department is required to communicate this information at the time of the subaward and, if any of these elements change, include the changes in a subsequent subaward modification. In addition, the Department is responsible for communicating all requirements it has imposed on its subrecipients so that they use the federal award in accordance with federal statutes, regulations, and the terms and conditions of the award. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit we reported the Department did not have adequate internal controls over and did not comply with federal award identification element requirements. The prior finding number was 2023-040. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Aging Cluster Programs. We used a nonstatistical sampling method to randomly select and examine five of 11 subawards to determine if every subaward was clearly identified to the subrecipient as a subaward and included all 14 federal identification elements. We found that all five subawards did not include the following four required federal identification elements: • FAIN • Federal award date • Name of federal award agency, pass-through entity and contact information for awarding official of the pass-through entity • Indirect cost rate for the federal award We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Department communicated the four excluded identification elements in the Notice of Award (NOA) that was posted on its intranet. The Department wanted to simplify the procedure of notifying AAAs about the NOAs but, while the process was being developed, it did not communicate the required information to the AAAs in the subawards. This required information and its location were not referenced in the subaward. Effect of Condition By not clearly identifying the required information in the subaward, the Department cannot ensure it adequately informed its subrecipients of the program requirements for each federal award. Recommendation We recommend the Department strengthen internal controls and ensure it communicates all required information in future subawards, as required by law. Department’s Response The Department concurs with the finding. This is a repeat finding because the corrective action plan for same issue in FY2023 was not completed until July 2024. Effective July 2024, Initial Notices of Award (NOA), with all 14 federal identification elements, were included for each funding source in the initial subaward as Exhibit D. Language was added to the subaward informing AAAs that future NOAs will be posted online. In addition, the Department’s fiscal staff notify inform all AAA fiscal staff via email when new NOAs are posted. Contracts staff will ensure Exhibit D is attached to the initial subaward before signing the contract. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes federal award identification requirements for subawards. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-031 The Department of Social and Health Services did not have adequate internal controls to ensure subrecipients of the Aging Cluster Programs obtained required single audits.  Assistance Listing Number and Title: 93.044 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.044 COVID-19 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.045 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.045 COVID-19 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.053 Nutrition Services Incentive Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: Various Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-041 Background The Aging Cluster programs, which include the Supportive Services and Senior Centers, Nutrition Services, and the Nutrition Services Incentive Program, provide services and meals to older people. The Supportive Services program helps states and area agencies on aging (AAAs) facilitate the development and implementation of a comprehensive, coordinated system for providing long-term care in home and community-based settings in a way that responds to the needs and preferences of older people and their family caregivers. The Nutrition Services programs support nutrition services and provide resource incentives to encourage and reward effective and efficient performance in the delivery of nutritious meals to older people. The Department of Social and Health Services administers federal programs under the Older Americans Act, including the Aging Cluster programs. In fiscal year 2024, the Department spent about $37.9 million in Aging Cluster federal funding, including about $36.9 million it paid to 13 AAAs. Federal regulations require the Department to monitor its subrecipients’ activities. This includes: • Verifying that subrecipients obtain a single audit if they spend $750,000 or more in federal awards during a fiscal year • Following up and ensuring that subrecipients take timely and appropriate action on all deficiencies pertaining to the federal award • Issuing a management decision to the subrecipient, within six months, for applicable audit findings pertaining to the federal award Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit we reported the Department did not have adequate internal controls over and did not comply with single audit tracking requirements. The prior finding number was 2023-041. Description of Condition The Department did not have adequate internal controls to ensure subrecipients of the Aging Cluster Programs obtained required single audits. The Department’s process to monitor compliance is to use Excel spreadsheets to track subrecipients’ single audits. However, during the audit period, the Department did not adequately perform this process. The Department did not regularly check to ensure every subrecipient obtained a single audit when it was due. We consider this internal control deficiency to be a material weakness. Cause of Condition Due to management turnover, staff were behind on monitoring whether the Department’s subrecipients obtained their required single audits. The Department developed procedures to ensure all subrecipients received a single audit, but did not implement the procedures until after the audit period. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure that all subrecipients requiring a single audit obtain one, that timely and appropriate action is taken for subrecipients that did not obtain a single audit, and that subrecipients with audit findings receive required management decisions timely. Recommendation We recommend the Department strengthen internal controls to ensure: • Subrecipients obtain a single audit if they spend $750,000 or more in federal awards during a fiscal year • Subrecipients take timely and appropriate action on all deficiencies pertaining to the federal award • It issues all required management decisions to subrecipients, within six months, for applicable audit findings pertaining to the federal award Department’s Response The Department concurs with the finding. This is a repeat finding because the corrective action plan for the same issue in FY2023, was not completed until October 2024. Effective September 2024, a reminder process was implemented for all AAAs to submit their audits six months after the subrecipient fiscal year-end close. Email reminders will be sent until single audits are received or once the AAA has communicated an estimated audit completion date. Communication will be documented in the Tracker system. Effective October 2024, the Single Monitor Tracking Sheet was updated to document the dates of audit requests, receipts, date of review, confirmation of FAC audit receipt, date of communication with AAA, when a management letter is sent, and the AAA responses. Effective October 2024 and ongoing, the AAA & Grants Unit Manager or Office Chief will review the Single Monitor Tracking Sheet nine months after the sub-recipient fiscal year-end close to ensure that all Single audits are received timely. Follow up will occur monthly on outstanding audits and timing of management letters. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes federal award identification requirements for subawards. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-032 The Department of Health did not have adequate internal controls to ensure payments to subrecipients were allowable, met cost principles, and were within the period of performance for the Immunization Cooperative Agreements program. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: 5 NH23IP922619-02-00; 6 NH23IP922619-02-03; 6 NH23IP922619-02-04; 6 NH23IP922619-02-06; 6 NH23IP922619-04-01; 5 NH23IP922619-05-00; 6 NH23IP922619-05-01; 6 NH23IP922619-05-02; 6 NH23IP922619-05-03; 6 NH23IP922619-05-04 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/ Cost Principles Period of Performance Known Questioned Cost Amount: $464,473 Prior Year Audit Finding: Yes, Finding 2023-044 Background The Department of Health administers the Immunization Cooperative Agreements program. The objective of the program is to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. The program places emphasis on populations at highest risk for under-immunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2024, the Department spent more than $41.7 million in federal program funds, about $11.3 million of which it disbursed to subrecipients. The Department also received more than $110.5 million in noncash assistance from the federal grantor in the form of vaccines. To help carry out the program’s objectives, the Department issues consolidated contracts to Local Health Jurisdictions that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. The Department awards federal funds to subrecipients on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate and high-risk subrecipients for each of the following expense categories: • Salaries and benefits • Equipment ($5,000 or more) • Materials and supplies • Meals • Outreach materials • Travel • Training • Contracts • Sub-subrecipients • Indirect costs During the audit period, subrecipients submitted invoices to the Department’s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The accounting unit emailed the requests to Department program staff requesting review to ensure the payment was allowable and within the period of performance. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over to ensure payments to providers were allowable, met cost principles and were within the period of performance for the program. The prior finding numbers were 2022-031 and 2023-044. Description of Condition The Department did not have adequate internal controls to ensure payments to subrecipients were allowable, met cost principles, and were within the period of performance for the program. Department program staff were required to use the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, were within the period of performance and included required supporting documentation. However, program staff did not communicate their approval to the accounting unit that issues payment. As a result, the Department paid the subrecipients without knowing whether program staff had reviewed and approved these expenditures. We used a statistical sampling method to randomly select and examine 64 out of 483 provider payments. Additionally, we judgmentally reviewed three individually significant payments that exceeded $550,065 each. In total, we examined more than $7.8 million in provider payments as part of the audit. Of the 64 payments examined, we identified seven payments (11%) and three individually significant payments that did not have the required supporting documentation for the subrecipients’ assigned risk level. In addition to not having adequate supporting documentation, of the seven payments randomly selected: • Two (3%) subrecipient payments utilized a higher indirect rate than the approved rate and the error was not identified at the time of approval • One (2%) incorrectly charged $25,954 in expenditures for another federal program We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department’s established procedures allowed for paying providers without ensuring program staff reviewed and determined the payment was allowable, within the period of performance, and adequately supported. Furthermore, program management did not ensure staff followed the existing review procedures and fiscal management did not ensure staff properly charged the program. The Department also did not ensure it maintained access to the documents reviewed during the audit period. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it uses federal funds for allowable purposes and within the period of performance. By not ensuring subrecipients submitted required supporting documentation, staff could not adequately verify the reimbursement claims, and the Department could not ensure its subrecipients complied with the subaward’s terms and conditions. The 10 payments for which the Department did not have adequate supporting documentation from subrecipients totaled $464,473 in known questioned costs. Based on these results, we estimate that the total amount of likely improper payments using federal funds to be $465,976. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95% confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our “best estimate of total questioned costs” as required by Title 45 CFR Part 75, section 516(3). To ensure a representative sample, we stratified the population by dollar amount. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Improve internal controls to ensure that it obtains adequate supporting documentation from subrecipients before reimbursing them • Ensure that it retains documentation reviewed and approved for payment for audit review • Improve internal controls to ensure program staff review, approve and communicate approval expenditures to those issuing payment to verify they are for allowable activities and within the period of performance prior to payment • Ensure fiscal staff charge the correct federal programs • Consult with the grantor to discuss whether it should repay the questioned costs identified in the audit Department’s Response We appreciate the State Auditor’s Office audit of the Immunization grant. DOH is committed to ensuring our programs comply with federal regulations. The Department partially concurs with the finding. While the Department has taken steps to ensure payments to providers contain proper support in line with our A19 matrix for risk assessed of our subrecipients, we continue to disagree with SAO’s assessment of a material weakness in internal controls over the consolidated contract provider payment process. As noted in the finding, program staff document their review and approval of consolidated contract reimbursement requests. If the payment has no issues or concerns, the total payment is logged in a spreadsheet with documented review and approval to denote no issues and that full payment can be made. If there is a question on allowable cost, period of performance, a need for additional backup or an error, program Immunization staff will update spreadsheet with the amounts in question and communicate with the Local Health Jurisdiction, document the correspondence, and contact the accounting consolidated contract payment desk to withhold the specific amount of payment until the issue is resolved. Once resolved staff update the spreadsheet to denote the issue has been resolved and email accounting to release the payment amount in question. The defined process of consolidated contract payments has been in place for well over a decade and was implemented in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions (LHJs) for state and federal programs in order to serve the residents of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the LHJs. We partially agree with the exceptions and questioned costs identified. The Department did approve payment with the use of an incorrect indirect rate that was applied to a payment. This was identified as an error through the department’s internal controls during the audit period and that overpayment was corrected. The department stands that this should not have been an exception. The department maintains that its internal policies are held to a higher standard than federal requirements, and the level of documentation received from the subrecipient accounting system gave us assurance that the transactions/costs questioned met federal cost principles for allowability and period of performance at the time of review. This, along with the following additional overall internal monitoring and policy processes support our overall assurance of the allowability of payments: • The Immunization program staff maintain detailed budget information for each subrecipient by project area, and as A-19s are submitted, program and accounting staff update budget spreadsheets. When reviewing the support provided by the subrecipient, they ensure amounts submitted by project are reasonable and are in alignment with expectations for the budget period submitted. • The Immunization program refer to the federal Immunization Program Operations Manual (IPOM) to determine allowable costs, purchase, and procurement procedures. • The Fiscal Monitoring Unit provides technical assistance and training, not only to program staff, but to the subrecipients while onsite and at the request of the entities receiving funding. • The Immunizations program provides technical assistance, policies, and training to Immunization subrecipients related to both allowability and compliance. • The Immunizations program has continued to strengthen processes to ensure that the backup documentation received is in alignment with the agency’s documentation matrix for sub-recipients per their risk level. Auditor’s Remarks While management has implemented a new procedure for program staff to document their review and approval of subrecipient reimbursement requests, this approval is not communicated to fiscal staff before payments are issued. As a result, approval is assumed and not verified by fiscal staff when no response is received from the program staff. The amount of supporting documentation submitted by a subrecipient utilizing consolidated contracts is extensive and often covers multiple reimbursement requests for more than one federally funded program. In our judgment, this increases the risk that a proper review is not performed before payments are issued. We reaffirm our finding and will follow up on the status of the Department’s corrective action during our next audit period. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 2, Definitions, includes the definition of improper payment. Title 45 CFR Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. 45 CFR Part 75, section 403, Factors Affecting Allowability of Costs 45 CFR Part 75, section 410, Collection of Unallowable Costs The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 7/1/22 This is the backup documentation required based on the determined risk level. More supporting documentation may be requested by programs at any time regardless of risk category. Please review your statement of work to determine if there are additional documentation requirements. Expenditure Category Low-Risk Moderate-Risk High-Risk Salaries and Benefits A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: • Employee name • Salaries & Wages A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: • Employee name • Salaries & Wages A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: • Employee name • Salaries & Wages • Hours worked Example: Salary Bob Smith $5,324.75 Ann Brown $1,245.52 Example: Salary Bob Smith $5,324.75 Ann Brown $1,245.52 Example: Salary Bob Smith $5,324.75 (168 hrs.) Ann Brown $1,245.52 (34 hrs.) Benefits $1,750.35 Benefits $1,750.35 Benefits $1,750.35 Note: Salaries and benefits must be broken out as separate line items. Note: Salaries and benefits must be broken out as separate line items. Note: Salaries and benefits must be broken out as separate line items. Equipment ($5,000 or more) A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report with DOH preapproval. A-19 and a detailed GL expenditure report with DOH preapproval and copy of the invoice. Materials and Supplies A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report. Copies of invoices for transactions over $2,500. Note: If the subrecipient has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and detailed GL expenditure report. Copies of invoices for transactions over $1,000. Note: If the subrecipient has a petty cash fund, they must supply 100% of the supporting documentation. Meals A-19 and a detailed GL expenditure report and receipt. A-19 and a detailed GL expenditure report with receipt and number of participants or meeting invite. A-19 and a detailed GL expenditure report with receipt, number of participants and sign in roster. Outreach Materials- All outreach materials must be allowable according to grant terms and conditions. A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report. Pre-approval required for all outreach materials in excess of $2,500. A-19 and a detailed GL expenditure report. Pre-approval required for all outreach materials in excess of $1,000: AND • Sample of Outreach materials Travel A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report and purpose of travel. A-19 and a detailed GL expenditure report and purpose of travel: AND • Pre-approval for out of state travel. Training A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report and receipt for training. A-19 and a detailed GL expenditure report and receipt for training: AND • Agenda Contracts (If the DOH subrecipient is contracting out with an agency to perform work charged to the grant) A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report that provides: AND • Invoices for individual transactions over $5,000. A-19 and a detailed GL expenditure report that provides: AND • Invoices for individual transactions over $1,000. Sub-Sub recipients (If the DOH subrecipient is passing funds through to another agency as a subrecipient) A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report. • A copy of all invoices over $5,000 with a detailed GL report. • A copy of all invoices over $1,000 with a detailed GL report. NOTE: Indirect costs included on A19s must include verification of the following: • Indirect plan is current and on file with DOH • Indirect rate is being applied accurately to allowable expenditures • If the indirect cost rate plan has expired, no indirect costs can be charged • If the subrecipient is using 10% de minimis they must complete DOH de minimis certification.

2024-033 The Department of Health did not have adequate internal controls over cash management and reporting requirements for the Immunization Cooperative Agreements program. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: 5 NH23IP922619-02-00; 6 NH23IP922619-02-03 6 NH23IP922619-02-04; 6 NH23IP922619-02-06 6 NH23IP922619-04-01; 5 NH23IP922619-05-00 6 NH23IP922619-05-01; 6 NH23IP922619-05-02 6 NH23IP922619-05-03; 6 NH23IP922619-05-04 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Cash Management Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Department of Health administers the Immunization Cooperative Agreements (Immunization) program. The objective of the program is to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. The program places emphasis on populations at highest risk for under-immunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2024, the Department spent more than $41.7 million in federal program funds, about $11.3 million of which it disbursed to subrecipients. The Department also received more than $110.5 million in noncash assistance from the federal grantor in the form of vaccines. Immunization is not subject to the Cash Management Improvement Act and is not included in the Treasury-State Agreement for Washington. Programs not covered by a Treasury-State Agreement are subject to the provisions of Title 31 of the U.S. Code of Federal Regulations, Part 205, Subpart B, which specifies how funds transfers from the federal government must be processed. The Department has federal revenue bimonthly draw procedures to request reimbursements in line with the Department’s payroll pay dates. In addition, the Department is required to submit an annual SF-425 financial report for each open grant. This report contains information on revenue as well as direct and indirect expenditures for each open award. The Department maintains the Grant Management System (GMS) that is used agency-wide to calculate cash draw amounts and pull financial data needed to complete the SF-425. The Department uses this system as one of its tools to manage all its federal grants. Daily, federal grant revenue and expenditures are automatically uploaded from the Department’s accounting system into its AFRS Data Distribution Services (ADDS) database. Department staff can pull data from ADDS by running queries in GMS. To ensure that the data is properly uploaded, Department staff perform a manual reconciliation between ADDS and the accounting system every workday. Also, indirect expenditures are calculated through the Cost Allocation System (CAS) that the Department maintains. The Department also maintains a chart of accounts (COA) system that feeds coding information into GMS and CAS to instruct these systems how to allocate grant expenditures. Department staff generate a Grant Draw Report from GMS that provides the necessary information to complete a cash draw and SF-425 report. This report includes calculations for the cash draw amount performed by GMS using expenditure and revenue data received from the ADDS system. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over cash management and reporting requirements for the Immunization program. Since the Department’s internal controls reviewed are a centralized process, our testing included all its federal programs we reviewed for this audit. Daily Manual Reconciliation We used a statistical sampling method to randomly select and examine 24 out of a total population of 250 workdays during the fiscal year. We found that the Department did not complete a reconciliation of the accounting system and ADDS data for three of the 24 days (13%). We also determined that the daily reconciliation included reconciling expenditure data, but not revenue data. Apart from the three instances, our testing discovered that incorrect reporting criteria was used for ADDS reporting, resulting in blank ADDS reports being generated from the system for the first 20 days of fiscal year 2024. GMS Automated Draw Calculation We judgmentally selected three cash draws and found the following issues: • One instance in which the GMS incorrectly calculated the draw amount, resulting in an overdraw of $145,103 • Expenditures charged to valid program project codes did not show on the GMS draw report, resulting in funds being underdrawn by $700,819 • Indirect expenditures were incorrect in the GMS resulting in an overdraw of $153,312 We also examined the Department’s controls over updating the COA to determine if the coding associated with each award entered in GMS and CAS was accurate. Our review found: • Users could update the COA without review or approval directly in the COA system • There was no formal process to track the identification and resolution of COA coding errors • The Department did not correct COA coding errors in a timely manner • The COA system did not produce and retain audit logs of changes made These issues are also noted in finding 2024-036. Due to the issues noted above, we determined that the GMS Grant Draw Report used to complete the SF-425 is not adequately supported. Therefore, we reviewed the data directly from the accounting system and the cost allocation system as support for amounts reported on the SF-425. We examined five of the 10 reports submitted during the fiscal year and did not identify any discrepancies. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not have adequate internal controls to ensure the data used to complete cash draws and SF-425 reporting is accurate and complete. The Department also does not have adequate controls in place to detect coding errors that would result in incorrect data being input and pulled from the GMS and CAS. The Department was not able to provide an explanation for why GMS incorrectly calculated the cash draw amount. Effect of Condition By not implementing adequate internal controls, the Department risks reporting inaccurate information on its SF-425 reports, overdrawing federal revenue and having to repay the grantor. Recommendations We recommend the Department ensure it: • Performs daily reconciliations between ADDS and AFRS • Has adequate internal controls in place over the accuracy of the chart of accounts • Has adequate controls in place to properly calculate cash draw amounts in GMS Department’s Response We appreciate the State Auditor’s Office audit of the Immunization grant. DOH is committed to ensuring our programs comply with federal regulations. The Department partially concurs with the finding. While the Department has taken steps to ensure adequate internal controls over cash management and reporting requirements for the Immunization program, we partially agree with SAO’s assessment of a material weakness in internal controls over the cash management and reporting process. Daily Manual Reconciliation The Department disagrees with this assessment. Our internal controls identified a concern with the ADDs reporting criteria. The Department partnered with our IT department and identified the cause of the report errors. This was corrected within the audit period which allowed us to go back to using this internal control to verify totals. GMS Automated Draw Calculation The Department agrees with this assessment and the Department is working diligently to correct the issue. Chart of Account Updates The Department disagrees with this assessment. The Chart of Accounts (COA) errors were due to OFM giving the Department the incorrect EA schedule. The 23-25 Biennium EA schedule released from OFM on 06/21/2023 showed the appropriation as 984, which was incorrect.  The Departments’ coding structure was set up based on the initial EA schedule provided by OFM. The EA schedule that was released on 10/18/2023 had the correct appropriation of 985.  The Department had already set up the COA with incorrect appropriation.  After receiving the new EA schedule in October, the Department had to set up all new master index codes with the correct appropriation and JV all expenditures from the old master index codes to the new ones.   Therefore, in order to change the existing COA to the correct COA structure with the new EA schedule, the Department had to update the COA structure outside of normal procedures. The Department tracked changes via excel spreadsheets and developed additional internal control processes due to the nature of changes made outside of normal procedures. The Department addressed the COA errors as timely as possible. Auditor’s Remarks Daily Manual Reconciliation We appreciate the Department acknowledging that the system was not generating a report with the correct criteria for 20 days. In addition to this issue, we found three (13%) of the 24 days tested outside of this period were also not reconciled. Chart of Account Updates While changes to the COA that resulted in some of the errors were made at the direction of OFM, it was not the cause for all issues identified in the audit. We reaffirm the lack of internal controls within the Department over COA updates resulted in incorrect draw amounts. We reaffirm our finding and will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 31 CFR Part 205.33, How are funds transfers processed?, states in part: A state must minimize the time between the Drawdown of Federal Funds from the Federal government and their disbursement for Federal Program Purposes. A federal Program Agency must limit a fund transfer to a State to the minimum amount needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a federal assistance program or project. The timing and amount of funds transfers must be close as is administratively feasible to a State’s actual cash outlay for direct program costs and proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102 (For availability, see 5 CFR 1310.3) CDC General Terms and Conditions for Research Grant and Cooperative Agreements, states in part: Annual Federal Financial Report (FFR, SF-425): The Annual Federal Financial Report (FFR) SF- 425 is required and must be submitted no later than 90 days after the end of the budget period in the Payment Management System. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-034 The Department of Health did not have adequate internal controls to ensure it filed on-time reports required by the Federal Funding Accountability and Transparency Act for the Immunization Cooperative Agreements program. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 5 NH23IP922619-02-00; 6 NH23IP922619-02-03 6 NH23IP922619-02-04; 6 NH23IP922619-02-06 6 NH23IP922619-04-01; 5 NH23IP922619-05-00 6 NH23IP922619-05-01; 6 NH23IP922619-05-02 6 NH23IP922619-05-03; 6 NH23IP922619-05-04 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-045 Background The Department of Health administers the Immunization Cooperative Agreements (Immunization) program. The objective of the program is to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. The program places emphasis on populations at highest risk for under-immunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2024, the Department spent more than $41.7 million in federal program funds, about $11.3 million of which it disbursed to subrecipients. The Department also received more than $110.5 million of vaccines as noncash assistance from the federal grantor. The Federal Funding Accountability and Transparency Act (Act) requires the Department to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The Act is intended to empower those with the ability to hold the federal government accountable for spending decisions and therefore reduce wasteful government spending. When the Department makes a new subaward or amendment, staff update a spreadsheet throughout the month with the subaward information required for reporting. Staff then send the spreadsheet to management for approval before submitting the report. The Department was required to report 16 subawards and amendments in fiscal year 2024, totaling $1,316,302. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act for the Immunization program. The prior finding numbers were 2023-045 and 2022-032. Description of Condition The Department did not have adequate internal controls to ensure it filed on-time reports required by the Act for the Immunization program. During the audit period, the Department’s process for filing FFATA reports started with a Fiscal Analyst maintaining a spreadsheet throughout the month with the subaward information required for reporting. Management reviewed the spreadsheet and asked the Fiscal Analyst to approve the submission of the report. We used a nonstatistical sampling method to randomly select and examine management approvals for five of the 12 spreadsheets that corresponded with each month in the state fiscal year. We found that two of the five months (40%) did not have management approval. We used a nonstatistical sampling method to randomly select and examine nine out of the 16 total subawards and amendments the Department was required to report during the state fiscal year. We found that the Department reported four of the six subawards and amendments (67%) late. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department did not retain documentation to support management review and approval of the monthly FFATA worksheets. Additionally, Department management asserted the late submission of the report for the four subawards was because the contract account coding for the Department’s accounting system was not created at the time of the contract execution. The Department’s process requires this coding to identify reportable information such as the grant Federal Award Identification Number. As soon as the coding information is updated, staff can then submit the items to FSRS. Effect of Condition Without performing an adequate review, management cannot ensure the Department submits accurate, complete and on-time reports. Further, failing to submit reports on time diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Lastly, the federal award’s terms and conditions allow the grantor to penalize the Department for noncompliance by suspending or terminating the federal award or withholding future awards. Recommendations We recommend the Department: • Ensure it documents management reviews in writing and retains them for audit review • Review its FFATA reporting procedure to ensure it submits reports on time Department’s Response We appreciate the State Auditor’s Office audit of the immunization grant. DOH is committed to ensuring our programs comply with federal regulations. The Department will evaluate current process to ensure timely review and submission of the FFATA reports. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a) Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) 3. What to report. You must report the information about each obligating action that the submission instructions posted at https://www.fsrs.gov specify. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-035 The Department of Health did not have adequate internal controls to ensure providers maintained immunization records, control, accountability and safeguarding of vaccines for the Immunization Cooperative Agreements Program. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 5 NH23IP922619-02-00; 6 NH23IP922619-02-03 6 NH23IP922619-02-04; 6 NH23IP922619-02-06 6 NH23IP922619-04-01; 5 NH23IP922619-05-00 6 NH23IP922619-05-01; 6 NH23IP922619-05-02 6 NH23IP922619-05-03; 6 NH23IP922619-05-04 Pass-through Entity Name: None Pass-through Award/Contract Number: None Known Questioned Cost Amount: Special Tests and Provisions – Control, Accountability, and Safeguarding of Vaccines   Special Tests and Provisions – Record of Immunization Known Questioned Cost Amount: None Prior Year Audit Finding: N/A Background The Department of Health administers the Immunization Cooperative Agreements (Immunization) program. The objective of the program is to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. The program places emphasis on populations at highest risk for under-immunization and disease, including children eligible under the Vaccines for Children (VFC) program. In fiscal year 2024, the Department spent more than $41.7 million in federal program funds, about $11.3 million of which it disbursed to subrecipients. The Department also received more than $110.5 million of vaccines as noncash assistance from the federal grantor. The Department works with providers that administer vaccines to eligible children. The Department is required to ensure providers comply with the requirements of the VFC program. This includes ensuring vaccines are adequately safeguarded, used solely for authorized purposes and are only administered to VFC program-eligible children. The U.S. Centers for Disease Control and Prevention requires the Department to conduct site visits of each provider once every 24 months. Additionally, the Department reviews monthly reports for vaccine doses administered outside the age range (DOAR), vaccine storage temperature logs and inventory reconciliation reports before approving vaccine orders to ensure providers are compliant with these VFC requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure providers maintained immunization records, control, accountability and safeguarding of vaccines for the Immunization Program. On-site Visits We used a nonstatistical sampling method to randomly select 56 providers that received a site visit out of the total 502 provider visits completed during the state fiscal year. We found that the Department conducted two (3.6%) provider site visits about two months after the 24-month period. Ongoing Monitoring The Department uses a tracking spreadsheet to document the review of the DOAR report, temperature logs and inventory reconciliation report along with any necessary follow-up with providers before approving vaccine orders. We used a statistical sampling method and randomly selected 57 providers out of a total of 570 and examined the review of the submitted reports. We found the Department did not review the DOAR report for two providers (3.5%) and did not track subsequent follow-up on corrective measures in the spreadsheet. Further, we found four providers (7%) had issues on its DOAR report, but the Department approved vaccine orders without receiving the provider’s questionnaire to address the deficiency noted in the report. We did not identify any issues for the temperature logs or the inventory reconciliation reports. We consider these internal control deficiencies to be a significant deficiency, which did not lead to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Department management said excessive staff workload and providers’ requests to delay visits resulted in the Department not completing on-site visits within the required 24 months. Department management said that inadequate ongoing monitoring of the reports was due to staff oversight. Effect of Condition Without conducting on-site visits every 24 months and without adequate review of the DOAR report and the questionnaire response, the Department risks approving vaccine orders for providers that may not be compliant with VFC program requirements. By not ensuring it completes on-site visits every 24 months and properly performs reviews of reports, the Department could be subject to sanctions by the grantor. Recommendations We recommend the Department ensure: • That it conducts compliance visits every 24 months • That it adequately reviews the DOAR report and completes follow-up procedures according to internal policies and procedures Authority’s Response We appreciate the State Auditor’s Office audit of the immunization grant. DOH is committed to ensuring our programs comply with federal regulations. The Department has already taken steps to evaluate current processes to ensure providers maintain immunization records, control, accountability and safeguarding of vaccines for the Immunization Program. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Center for Disease Control and Prevention Vaccines for Children Operations Guide, Page 57 states in part: Requirement: Awardees must conduct and record VFC compliance site visits, covering areas of provider details, eligibility, documentation, storage and handling (per unit and sitewide), and inventory management with each VFC provider every 24 months. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-036 The Department of Health did not have adequate internal controls over cash management and allowable cost requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: Too numerous to list Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Cash Management Activities Allowed or Unallowed Allowable Costs / Cost Principles Known Questioned Cost Amount: $298,415 Prior Year Audit Finding: N/A Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports many specific infectious disease programs and projects, and it provides special appropriations in response to infectious disease emergencies. The Department spent more than $126.6 million in federal grant funds during fiscal year 2024. The ELC program is subject to the Cash Management Improvement Act (CMIA) and is included in the Treasury-State Agreement for Washington. The primary purpose of the CMIA agreement is to ensure states request federal funds when they are needed so that no interest is gained or lost by either the federal or state governments. The agreement specifies the funding technique the Department should use when requesting federal funds. The Department shall draw funds semi-monthly, according to the state payroll schedule. The Department maintains the Grant Management System (GMS) that is used to calculate cash draw amounts. The Department also utilizes the Cost Allocation System (CAS) to calculate indirect costs associated with expenditures. The Department uses these systems as agency-wide tools to manage all its federal grants. Daily, federal grant revenue and expenditures are automatically uploaded from the Department’s accounting system into its AFRS Data Distribution Services (ADDS) database. Department staff can pull data from ADDS by running queries in GMS and CAS. To ensure that the data is properly uploaded, Department staff perform a manual reconciliation between ADDS and the accounting system every workday. The Department also maintains a chart of accounts (COA) system that feeds coding information into GMS and CAS to instruct these systems how to allocate grant expenditures. Department staff generate a Grant Draw Report from GMS that provides the necessary information to complete a cash draw. This report includes calculations for the cash draw amount performed by GMS, as well as indirect costs calculated by CAS, using expenditure and revenue data received from the ADDS system. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over cash management and allowable cost requirements for the ELC program. Since the Department’s internal controls reviewed are a centralized process, our testing included all its federal programs we reviewed for this audit. Daily Manual Reconciliation We used a statistical sampling method to randomly select and examine 24 out of a total population of 250 workdays during the fiscal year. We found that the Department did not complete a reconciliation of the accounting system and ADDS data for three of the 24 days (13%). We also determined that the daily reconciliation included reconciling expenditure data, but not revenue data. Apart from the three instances, our testing discovered that incorrect reporting criteria was used for ADDS reporting, resulting in blank ADDS reports being generated from the system for the first 20 days of fiscal year 2024. GMS Automated Draw Calculation We judgmentally selected three cash draws and found the following issues: • One instance in which the GMS incorrectly calculated the draw amount, resulting in an overdraw of $145,103 • Expenditures charged to valid program project codes did not show on the GMS draw report, resulting in funds being underdrawn by $700,819 • Indirect expenditures were incorrect in the GMS resulting in an overdraw of $153,312   We also examined the Department’s controls over updating the COA to determine if the coding associated with each award entered in GMS and CAS was accurate. Our review found: • Users could update the COA without review or approval directly in the COA system • There was no formal process to track the identification and resolution of COA coding errors • The Department did not correct COA coding errors in a timely manner • The COA system did not produce and retain audit logs of changes made   These issues are also noted in finding 2024-033. Cash Management Improvement Act Testing The CMIA for the ELC program states that cash draws are to be made one day before scheduled pay days throughout the year. We reviewed the timing of ELC cash draws made during the fiscal year to ensure they were in keeping with CMIA timing requirements. We determined that for expenditures incurred in fiscal year 2024, no cash draws were made during the first five payroll periods of the year. We also identified nine cash draws that correspond to a payroll period, but were not made one day before the scheduled pay day as the CMIA requires. Additionally, there was one cash draw that we determined to be noncompliant as it was in the middle of a payroll period.   We consider these internal control deficiencies to be a material weakness which led to material noncompliance. These issues were not reported as a finding in the prior audit. Cause of Condition The Department did not have adequate internal controls to ensure the data used to complete cash draws was accurate and complete and that the timing of draws was in compliance with the CMIA requirements. The Department also does not have adequate controls in place to detect coding errors that would result in incorrect data being input and pulled from the GMS and CAS. Coding errors in the chart of accounts resulted in indirect expenditures being overcharged to the grant. The Department was unable to provide an explanation as to the cause of the chart of account errors. The Department was not able to provide an explanation for why GMS incorrectly calculated the cash draw amount. Effect of Condition and Questioned Costs By not implementing adequate internal controls, the Department overdrew indirect expenditures by $298,415, which we are reporting as questioned costs. Overdraws can result in the Department having to repay the grantor. Violations of the CMIA can result in the grantor denying the state payment or credit for the resulting federal interest liability or other sanctions. Delaying federal draw-down requests also results in state funds being advanced longer than necessary and potentially losing interest revenue for the state. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Department ensure it: • Performs daily reconciliations between ADDS and AFRS • Has adequate internal controls in place over the updating of the chart of accounts • Has adequate controls in place to properly calculate cash draw amounts in GMS • Performs cash draws on the schedule specified in the CMIA agreement Department’s Response We appreciate the State Auditor’s Office audit of the ELC grant. DOH is committed to ensuring our programs comply with federal regulations. The Department partially concurs with the finding. While the Department has taken steps to ensure adequate internal controls over cash management and allowable cost requirements for the ELC program, we partially disagree with SAO’s assessment of a material weakness in internal controls over the cash management and allowable cost requirements for the ELC program. Daily Manual Reconciliation The Department disagrees with this assessment. Our internal controls identified a concern with the ADDs reporting criteria. The Department partnered with our IT department and identified the cause of the report errors. This was corrected within the audit period which allowed us to go back to using this internal control to verify totals. GMS Automated Draw Calculation The Department agrees with this assessment and the Department is working diligently to correct the issue. Chart of Account Updates The Department disagrees with this assessment. The Chart of Accounts (COA) errors were due to OFM giving the Department the incorrect EA schedule. The 23-25 Biennium EA schedule released from OFM on 06/21/2023 showed the appropriation as 984, which was incorrect.  The Departments’ coding structure was set up based on the initial EA schedule provided by OFM. The EA schedule that was released on 10/18/2023 had the correct appropriation of 985.  The Department had already set up the COA with incorrect appropriation.  After receiving the new EA schedule in October, the Department had to set up all new master index codes with the correct appropriation and JV all expenditures from the old master index codes to the new ones.   Therefore, in order to change the existing COA to the correct COA structure with the new EA schedule, the Department had to update the COA structure outside of normal procedures. The Department tracked changes via excel spreadsheets and developed additional internal control processes due to the nature of changes made outside of normal procedures. The Department addressed the COA errors as timely as possible. CMIA The Department disagrees with this assessment. The Department performed draws for ELC using the prior periods MI codes. The Department spends on a first in, first out method.  The Department uses the previous year’s code for all expenditures that occurred in the allowable period and the funding has a 90-day period to process all previous year’s expenditures. There will always be expenditures and draws for a previous budget year in the first couple months of the new year due to the timing of invoices and processing. The department also ensures we are drawing in line with CMIA funding techniques and the payroll cycle. The states payroll cycle results in money leaving the treasury account prior to the 10th and the 25th. DOH ensures we draw funds after the cycle has ended and by state pay dates. This ensures the state is made whole in a timely manner. Auditor’s Remarks Daily Manual Reconciliation We appreciate the Department acknowledging that the system was not generating a report with the correct criteria for 20 days. In addition to this issue, we found three (13%) of the 24 days tested outside of this period were also not reconciled. Chart of Account Updates While changes to the COA that resulted in some of the errors were made at the direction of OFM, it was not the cause for all issues identified in the audit. We reaffirm the lack of internal controls within the Department over COA updates resulted in incorrect draw amounts. CMIA We agree that funding for expenditures occurring at the close of a fiscal year can be drawn during the next fiscal year due to the timing of invoices and processing. However, the Department did not complete cash draws for expenditures incurred during July and August of fiscal year 2024, as required by the CMIA. Additionally, nine cash draws completed by the Department during the fiscal year were completed earlier than allowed by the approved terms of the CMIA. We reaffirm our finding and will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75 section 2 establishes definitions for questioned costs. Title 45 CFR Part 75 section 403 establishes the factors affecting the allowability of costs. Title 45 CFR Part 75 section 410 establishes requirements for the collection of unallowable costs. Title 31 CFR Part 205, Rules and Procedures for Efficient Federal-State Funds Transfers, section 11, What requirements apply to funding techniques?, states in part: (a) A State and a Federal Program Agency must minimize the time elapsing between the transfer of funds from the United States Treasury and the State's payout of funds for Federal assistance program purposes, whether the transfer occurs before or after the payout of funds. (b) A State and a Federal Program Agency must limit the amount of funds transferred to the minimum required to meet a State's actual and immediate cash needs. Title 31 CFR Part 205.29, What are the State oversight and compliance responsibilities? states in part: (d) If a State repeatedly or deliberately fails to request funds in accordance with the procedures established for its funding techniques, as set forth in § 205.11, § 205.12, or a Treasury-State agreement, we may deny the State payment or credit for the resulting Federal interest liability, notwithstanding any other provision of this part. (e) If a State materially fails to comply with this subpart A, we may, in addition to the action described in paragraph (d) of this section, take one or more of the following actions, as appropriate under the circumstances: (1) Deny the reimbursement of all or a part of the State's interest calculation cost claim; (2) Send notification of the non-compliance to the affected Federal Program Agency for appropriate action, including, where appropriate, a determination regarding the impact of non-compliance on program funding; (3) Request a Federal Program Agency or the General Accounting Office to conduct an audit of the State to determine interest owed to the Federal government, and to implement procedures to recover such interest; (4) Initiate a debt collection process to recover claims owed to the United States; or (5) Take other remedies legally available. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The Cash Management Improvement Act (CMIA) of 2024, states in part: 6.2.4 The following are terms under which State unique funding techniques shall be implemented for all transfers of funds to which the funding technique is applied in section 6.3.2 of this Agreement. Modified Direct Program Costs - Admin, Payroll, Payments to Providers: The State shall request funds for all direct administrative costs and/or payroll costs, and/or payments made to providers and to support providers. The request shall be made in accordance with the appropriate Federal agency cut-off time specified in Exhibit I. The amount of the funds requested shall be based on the amount of expenditures recorded for direct administrative costs and/or payroll costs and/or payments made to providers or to support providers since the last request for funds. The State payroll cycle is payday twice a month. Draws made the day before payday are for deposit on payday. The draw request will be made in accordance with the cutoff time in Exhibit 1. The amount of the funds requested shall be based on the amount of expenditures recorded for direct administrative costs and/or payroll costs and/or payments made to providers or to support providers since the last request for funds. This funding technique is interest neutral. 6.3.2 Programs 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Recipient: Department of Health % of Funds Agency Receives: 100 Component: Admin, Payroll, Payments to Providers Technique: Modified Direct Program Costs - Admin, Payroll, Payments to Providers Average Day of Clearance: 0 Days

2024-037 Department of Health did not have adequate internal controls to ensure payments to subrecipients were allowable and met cost principles for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: Too numerous to list Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Subrecipient Monitoring Known Questioned Cost Amount: $2,037 Prior Year Audit Finding: Yes, Finding 2023-046 Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports several specific infectious disease programs and projects, and provides special appropriations in response to infectious disease emergencies. The Department spent more than $126.6 million in federal grant funds during fiscal year 2024, more than $20 million of which it disbursed to subrecipients. To help carry out the program’s objectives, the Department issues consolidated contracts to Local Health Jurisdictions (LHJs) that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate and high-risk subrecipients for each of the following expense categories: • Salaries and benefits • Equipment ($5,000 or more) • Materials and supplies • Meals • Outreach materials • Travel • Training • Contracts and sub-subrecipients • Administrative/indirect costs During the audit period, LHJs submitted invoices to the Department’s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The emails were sent to Department program staff requesting review to ensure the payment was allowable. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Beginning in February 2023, program staff documented their review and approval of the reimbursement request on a spreadsheet. The spreadsheet was only used at the program level, so it was not shared with the fiscal staff to communicate approval prior to issuing payment. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior year audits, we reported the Department did not have adequate internal controls over and did not comply with fiscal monitoring requirements to ensure subrecipients of the ELC program only used funds for allowable activities and met cost principles. The prior finding numbers were 2023-046 and 2022-033. Description of Condition The Department did not have adequate internal controls to ensure payments to subrecipients were allowable and met cost principles for the ELC program. Department program staff were required to use the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, and included required supporting documentation. However, program staff did not communicate their approval to the accounting unit that issues payments. As a result, the Department paid the LHJs without knowing whether these expenditures had been reviewed and approved by the program staff. We used a nonstatistical sampling method to randomly select and examine 25 out of a total population of 280 payments to LHJs. In total, we examined $548,396 in LHJ subrecipient payments as part of the audit. Of the 25 randomly selected payments examined, we identified two payments (8%) that did not have the required supporting documentation for the subrecipients’ assigned risk level. We consider this internal control deficiency to be a material weakness. Cause of Condition The Department’s established procedures allowed for paying LHJs without ensuring program staff reviewed and determined the payment was allowable and adequately supported. Furthermore, program management did not ensure staff followed the existing review procedures. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes. By not ensuring LHJs submitted required supporting documentation, staff could not adequately verify the reimbursement claims, and the Department could not ensure its subrecipients complied with the subaward’s terms and conditions. The two payments for which the Department did not have required supporting documentation from LHJs totaled $2,037 in known questioned costs. Based on these results, we estimate the total amount of likely improper payments using federal funds to be $22,815. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Department: • Improve internal controls to ensure it obtains adequate supporting documentation from LHJs before reimbursing them • Improve internal controls to ensure program staff review and approve expenditures to verify they are for allowable activities prior to payment • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response We appreciate the State Auditor’s Office audit of the ELC grant. DOH is committed to ensuring our programs comply with federal regulations. The Department partially concurs with the finding. While the Department has taken steps to ensure payments to providers contain proper support in line with our A19 matrix for risk assessed of our subrecipients, we continue to disagree with SAO’s assessment of a material weakness in internal controls over the consolidated contract provider payment process. As noted in the finding, program staff document their review and approval of consolidated contract reimbursement requests. If the payment has no issues or concerns, the total payment is logged in a spreadsheet with documented review and approval to denote no issues and that full payment can be made. If there is a question on allowable cost, period of performance, a need for additional backup or an error, program ELC staff will update spreadsheet with the amounts in question and communicate with the Local Health Jurisdiction, document the correspondence, and contact the accounting consolidated contract payment desk to withhold the specific amount of payment until the issue is resolved. Once resolved staff update the spreadsheet to denote the issue has been resolved and email accounting to release the payment amount in question. The defined process of consolidated contract payments has been in place for well over a decade and was implemented in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions (LHJs) for state and federal programs in order to serve the residents of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the LHJs. We partially agree with the exceptions and questioned costs identified. The Department did approve two payments that did not have the required supporting documentation for the subrecipients’ assigned risk level per agency policies. We disagree that these costs were unallowable as staff reviewed them to ensure they met federal cost principles for allowability. This, along with the following additional overall internal monitoring and policy processes support our overall assurance of the allowability of payments: • The ELC program staff maintain detailed budget information for each subrecipient by project area, and as A-19s are submitted, program and accounting staff update budget spreadsheets. When reviewing the support provided by the subrecipient, they ensure amounts submitted by project are reasonable and are in alignment with expectations for the budget period submitted. • The ELC program refers to the Notice of Funding Opportunity (NOFO), posted guidance, notice of award (NOA), as well as 2 CFR 200, to determine allowable costs, purchase, and procurement procedures. • The Fiscal Monitoring Unit provides technical assistance and training, not only to program staff, but to the subrecipients while onsite and at the request of the entities receiving funding. • The ELC program provides technical assistance, policies, and training to ELC subrecipients related to both allowability and compliance. • The ELC program has continued to strengthen processes to ensure that the backup documentation received is in alignment with the agency’s documentation matrix for sub-recipients per their risk level. Auditor’s Remarks While management has implemented a procedure for program staff to document their review and approval of subrecipient reimbursement requests, this approval is not communicated to fiscal staff before payments are issued. As a result, approval is assumed and not verified by fiscal staff when no response is received from the program staff. The amount of supporting documentation submitted by a subrecipient utilizing consolidated contracts is extensive and often covers multiple reimbursement requests for more than one federally funded program. In our judgment, this increases the risk that a proper review is not performed before payments are issued. Additionally, the agency utilizes a risk-based approach to ensuring payment requests are adequately supported. Without adhering to the support requirements for high risk subrecipients, the Department cannot reasonably ensure that payments made to that subrecipient are allowable. We reaffirm our finding and will follow-up on the Department’s corrective action during the next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 2, Definitions, includes the definition of improper payment. 45 CFR Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. 45 CFR Part 75, section 403, Factors Affecting Allowability of Costs. 45 CFR Part 75, section 410, Collection of Unallowable Costs. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 7/1/2022 This is the backup documentation required based on the determined risk level. Please ensure the detailed GL expenditure report clearly aligns with the A19 form. More supporting documentation may be requested by programs at any time due to programmatic requirements regardless of risk category. Expenditure Category Low-Risk Moderate-Risk High-Risk Salaries and Benefits A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: • Employee name • Salaries & Wages A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: • Employee name • Salaries & Wages A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: • Employee name • Salaries & Wages • Hours worked Example: Salary Bob Smith $5,324.75 Ann Brown $1,245.52 Example: Salary Bob Smith $5,324.75 Ann Brown $1,245.52 Example: Salary Bob Smith $5,324.75 (168 hrs.) Ann Brown $1,245.52 (34 hrs.) Benefits $1,750.35 Note: Salaries and benefits must be broken out as separate line items. Benefits $1,750.35 Note: Salaries and benefits must be broken out as separate line items. Benefits $1,750.35 Note: Salaries and benefits must be broken out as separate line items. Equipment ($5,000 or more) A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report with DOH preapproval. A-19 and a detailed GL expenditure report with DOH preapproval and copy of the invoice. Materials and Supplies A-19 and a detailed GL expenditure report A-19 and a detailed GL expenditure report. Copies of invoices for transactions over $2,500. Note: If the subrecipient has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and a detailed GL expenditure report. Copies of invoices for transactions over $1,000. Note: If the subrecipient has a petty cash fund, they must supply 100% of the supporting documentation. Outreach Materials All outreach materials must be allowable according to grant terms and conditions. A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report. Pre-approval required for all outreach materials in excess of $2,500. A-19 and a detailed GL expenditure report. Pre-approval required for all outreach materials in excess of $1,000: AND • Sample of Outreach materials Meals A-19 and a detailed GL expenditure report and receipt. A-19 and a detailed GL expenditure report with receipt and number of participants or meeting invite. A-19 and a detailed GL expenditure report with receipt, number of participants and sign in roster. Travel A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report and purpose of travel. A-19 and a detailed GL expenditure report and purpose of travel: AND • Pre-approval for out of state travel. Training A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report and receipt for training. A-19 and a detailed GL expenditure report and receipt for training: AND • Agenda Contracts (If the DOH subrecipient is contracting out with an agency to perform work charged to the grant) A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report that provides: AND • Invoices for individual transactions over $5,000. A-19 and a detailed GL expenditure report that provides: AND • Invoices for individual transactions over $1,000. Sub-Sub recipients (If the DOH subrecipient is passing funds through to another agency as a subrecipient) A-19 and a detailed GL expenditure report. A-19 and a detailed GL expenditure report. • A copy of all invoices over $5,000 with a detailed GL report. A-19 and a detailed GL expenditure report. • A copy of all invoices over $1,000 with a detailed GL report. NOTE: Indirect costs included on A19s must include verification of the following: • Indirect plan is current and on file with DOH • Indirect rate is being applied accurately to allowable expenditures • If the indirect cost rate plan has expired, no indirect costs can be charged • If the subrecipient is using 10% de minimis they must complete DOH de minimis certification

2024-038 The Department of Health did not have adequate internal controls over and did not comply with suspension and debarment requirements for Epidemiology and Laboratory Capacity for Infectious Diseases program. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU50CK000515-05-04; NU50CK000515-02-07; NU50CK000515-05-00; NU50CK000515-05-05; NU50CK000515-01-08; NU50CK000515-02-04; Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-047 Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports many specific infectious disease programs and projects, and it provides special appropriations in response to infectious disease emergencies. The Department spent more than $126.6 million in federal grant funds during fiscal year 2024. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. They may verify this by obtaining a written certification from the contractor or subrecipient or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit we reported the Department did not have adequate internal controls over and did not comply with suspension and debarment requirements for the ELC program. The prior finding number was 2023-047. Description of Condition The Department did not have adequate internal controls over and did not comply with suspension and debarment requirements for the ELC program. During the fiscal year, the ELC program had 27 newly executed contracts that required a suspension and debarment check. We used a non-statistical sampling method to randomly select and examine eight out of a population of 27 contracts. We found the Department did not include suspension and debarment language and did not perform a suspension and debarment check for two contracts with Educational Service Districts (ESDs) and one vendor contract (38%). We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Department used contracts that did not include suspension and debarment language and did not document a suspension and debarment check in the System for Award Management. The Department did not have adequate management oversight to ensure the ESD contracts received the required suspension and debarment checks or that corrective actions were completed timely. During the audit, the Department informed us that system changes to ensure that ESDs are correctly identified as subrecipients were not complete by July 2023, as stated in the Department’s corrective action plan for the prior finding. Effect of Condition By not performing suspension and debarment checks, the Department cannot ensure all its contractors and subrecipients are allowed to receive federal funds. Without proper checks, the Department could be required to repay the grantor for any payments made to a contractor or subrecipient that is suspended or disbarred. We verified that none of the eight sampled entities were suspended or debarred and therefore will not question costs. Recommendation We recommend the Department establish adequate internal controls to ensure it completes the required suspension and debarment checks before entering into contracts with subrecipients and contractors that will receive $25,000 or more in federal funds. Department’s Response We appreciate the State Auditor’s Office audit of the ELC grant. DOH is committed to ensuring our programs comply with federal regulations. During the COVID pandemic DOH operated under a competitive procurement waiver in order to expedite funding to critical partners throughout the state.  Efforts to accelerate contracts combined with the misperception that Educational Service Districts (ESDs) are an extension of the Office of Superintendent of Public Instruction (OSPI was named in the IAA as a collaborator for the Learn to Return Playbook), prompted the decision to use an Interagency Agreement and no suspension & debarment check was performed at the time. DOH implemented and corrected this error moving forward with ESD and Vendor contracts as of January 2024, the middle of the next audit cycle. Therefore, the corrections will not be reflected in contracts executed prior to that time frame. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 213, Suspension and debarment, states: Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR parts 180 and 376. These regulations restrict awards, subawards and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-039 The Department of Health did not have adequate internal controls over and did not comply with reporting requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases Program. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU50CK000515-05-04; NU50CK000515-02-07; NU50CK000515-05-00; NU50CK000515-05-05; NU50CK000515-01-08; NU50CK000515-02-04; Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-048 Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports many specific infectious disease programs and projects, and it provides special appropriations in response to infectious disease emergencies. The Department spent more than $126.6 million in federal grant funds during fiscal year 2024. During the audit period, the Department was required to submit various reports to the Centers for Disease Control and Prevention (CDC) for two ELC projects: Enhancing Detection and Enhancing Detection Expansion. The Department submits quarterly fiscal reports in REDCap, a web-based system used by the CDC to collect data. Reports summarize total quarterly expenses, including salaries, fringe benefits, equipment, travel, supplies and contractual payments. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with reporting requirements for the ELC program. The prior finding numbers were 2023-048 and 2022-034. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements for the ELC program. Quarterly financial reporting of expenditures and unpaid obligations is required for the Enhancing Detection and Enhancing Detection Expansion projects. The Department submits these reports quarterly in REDCap. Before submission, management reviews the reports and supporting documentation to ensure they are accurate and complete. We examined all 16 reports required during the audit period. Three (18.75%) of the reports were not accurate and complete. Specifically, we found: • The Department did not submit one report, with almost $27 million in expenditures, in REDCap • One report underreported $263,827 (1.5%) in expenditures in REDCap • One report had the correct expenditure total in aggregate; however, amounts in specific categories did not match the category totals in the accounting records We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition While the Department implemented a review process to correct the prior year finding, management did not ensure the Department submitted all reports to REDCap, and the reviews were inadequate for detecting the errors our audit identified. Effect of Condition By not ensuring management adequately reviewed quarterly reports, the Department did not ensure it submitted reports and that they were accurate and complete. Recommendation We recommend the Department establish and follow effective internal controls to ensure it submits reports and that they are accurate and complete. Department’s Response We appreciate the State Auditor’s Office audit of the ELC grant. DOH is committed to ensuring our programs comply with federal regulations. The Department will evaluate current process to ensure submitted reports are accurate and complete. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 341, Financial reporting, describes the requirements for auditees to submit financial reports. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-040 The Department of Health did not have adequate internal controls over and did not comply with fiscal monitoring requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: Too numerous to list Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-050 Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports many specific infectious disease programs and projects, and provides special appropriations in response to infectious disease emergencies. The Department spent more than $126.6 million in federal grant funds during fiscal year 2024, more than $20 million of which it disbursed to subrecipients. Federal regulations require the Department to monitor the activities of subrecipients to ensure they use subawards for authorized purposes and in compliance with federal statutes, regulations, and the terms and conditions of the subaward. This monitoring must include reviewing financial reports and taking timely and appropriate action on all deficiencies pertaining to the federal award. The Department assigns each subrecipient a compliance risk level based on standardized criteria. The Department’s Fiscal Monitoring Unit (FMU) conducts on-site fiscal reviews of each subrecipient every two years. This review includes all federal awards the subrecipient received from the Department for the period under review. Reviewers complete a standardized template to document their work. Using the subrecipient’s reimbursement requests, reviewers judgmentally determine how many samples of payroll expenditures and contractor payments to review to ensure there is adequate source documentation. Reviewers also look at internal controls over processes and examine specific award and contract requirements to ensure the subrecipient was in compliance with these requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with fiscal monitoring requirements to ensure subrecipients of the ELC program only used funds for allowable activities and met cost principles. The prior finding numbers were 2023-050 and 2022-033. Description of Condition The Department did not have adequate internal controls over and did not comply with fiscal monitoring requirements for the ELC program. The Department did not accurately identify all of their subrecipients. We requested a list of all contracted subrecipients for the state fiscal year 2024 period. This list did not include nine Educational Service Districts (ESDs) that the Department contracted with as subrecipients. The contracts for these educational service districts did not contain required subaward information in accordance with 45 CFR 75.352. Additionally, the Department did not complete fiscal reviews for its subrecipients. We identified 35 subrecipients with consolidated contracts, and 20 subrecipients with non-consolidated contracts for a total of 55. Of these, we determined there was no fiscal monitoring performed for the 20 subrecipients with non-consolidated contracts. We also found that fiscal monitoring did not occur for two of the subrecipients with consolidated contracts. This resulted in 40% of subrecipients not receiving fiscal monitoring. We consider these internal control deficiencies to be material weaknesses, which led to material noncompliance. Cause of Condition The Department believed that ESDs are an extension of the Office of Superintendent of Public Instruction and therefore entered into interagency agreements instead of subawards. This resulted in them being omitted from subrecipient fiscal monitoring tracking. These interagency agreements also do not have the DOH Contract Subrecipient Statement of Work included in them, which is used to communicate required federal subaward information to subrecipients. Additionally, we were informed by the Department that there were significant staff shortages in the Fiscal Monitoring Unit in state fiscal year 2024, and that the timing of reviews had to be modified based on capacity. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are spending federal funds in accordance with grant requirements. Without adequately monitoring each subrecipient’s use of federal funds expended during the period of performance of the subaward, the Department does not have reasonable assurance that the subrecipient has complied with the terms and conditions of the subaward. Recommendation We recommend that the Department: • Ensure all subrecipient contracts are identified correctly and include the appropriate templated language • Identify and track all subrecipients • Strengthen internal controls to ensure that fiscal monitoring is completed timely for all subrecipients Department’s Response We appreciate the State Auditor’s Office audit of the ELC grant. DOH is committed to ensuring our programs comply with federal regulations. The Department will evaluate current processes to ensure compliance with fiscal monitoring requirements for the ELC program. DOH had significant staff shortages in the Fiscal Monitoring Unit in SFY2024. Due to the shortage, we had to modify our reviews to ensure programs with a federal requirement for timing of monitoring visits were met (WIC and HIV). We then completed additional reviews based on capacity. In addition, during the COVID pandemic DOH operated under a competitive procurement waiver in order to expedite funding to critical partners throughout the state.  Efforts to accelerate contracts combined with the misperception that Educational Service Districts (ESDs) are an extension of the Office of Superintendent of Public Instruction (OSPI was named in the IAA as a collaborator for the Learn to Return Playbook), prompted the decision to use an Interagency Agreement and therefore some fiscal monitoring reviews were not performed. DOH implemented and corrected this error moving forward with ESD and Vendor contracts as of January 2024, the middle of the next audit cycle. Therefore, the corrections will not be reflected in contracts executed prior to that time frame. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes requirements for pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-041 The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure subrecipients of the Epidemiology and Laboratory Capacity for Infectious Diseases program received required single audits, and that it appropriately followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU50CK000515-05-04; NU50CK000515-02-07; NU50CK000515-05-00; NU50CK000515-05-05; NU50CK000515-01-08; NU50CK000515-02-04 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-049 Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports many specific infectious disease programs and projects, and it provides special appropriations in response to infectious disease emergencies. The Department spent more than $126.6 million in federal grant funds during fiscal year 2024, about $20 million of which it disbursed to subrecipients. Federal regulations require the Department to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes to subrecipients, the Department must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a Department-funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the Federal Audit Clearinghouse. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. To monitor its compliance with these requirements, the Department uses an Excel workbook to track subrecipients’ single audits. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure subrecipients of the ELC program received required single audits and appropriately followed up on findings and issued management decisions. The prior finding number was 2023-049. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure its subrecipients of the ELC program received required single audits, and that it appropriately followed up on findings and issued management decisions. The Department did not have written policies or procedures over its process for tracking subrecipients’ single audits. To monitor compliance with these requirements, the Department used an Excel spreadsheet to track subrecipients’ single audits and the agency’s follow-up actions, if necessary. However, after examining the workbook, we found 13 subrecipients that required audit tracking were missing. Additionally, we found that the Department did not check for single audit requirements for one subrecipient, and that no single audit exists for that subrecipient in the federal audit clearinghouse. During fiscal year 2024, four subrecipients received an ELC finding, which the Department documented in the tracking workbook. However, the workbook did not document any follow-up with the subrecipient or review of a corrective action plan. In addition, the Department did not issue a management decision letter for any of the findings, and the tracking spreadsheet did not document any management decisions. We consider these internal control deficiencies to be material weaknesses, which led to material noncompliance. Cause of Condition There were no written procedures for the single audit tracking process. Management said there was confusion around the subrecipient single audit process, and that they were working to define the process around the monitoring requirements. In addition, management did not exercise sufficient oversight to ensure staff completed the monitoring. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure that all subrecipients requiring a single audit obtain one, and that subrecipients with audit findings receive required management decisions timely. Recommendation We recommend the Department strengthen internal controls to ensure: • All subrecipients receive a single audit, if required • It issues all required management decisions to subrecipients, within six months, for applicable audit findings pertaining to the federal award • Subrecipients take timely and appropriate action on all deficiencies pertaining to the federal award Department’s Response We appreciate the State Auditor’s Office audit of the ELC grant. DOH is committed to ensuring our programs comply with federal regulations. The Department will evaluate current processes and provide additional training to staff to monitor if DOH subrecipients of the ELC program received required single audits and take appropriate action based on those single audits. This will include DOH following up on findings and issued management decisions. In addition, during the COVID pandemic DOH operated under a competitive procurement waiver in order to expedite funding to critical partners throughout the state.  Efforts to accelerate contracts combined with the misperception that Educational Service Districts (ESDs) are an extension of the Office of Superintendent of Public Instruction (OSPI was named in the IAA as a collaborator for the Learn to Return Playbook), prompted the decision to use an Interagency Agreement and therefore some single audits were not tracked. DOH implemented and corrected this error moving forward with ESD’s and Subrecipient contracts as of January 2024, the middle of the next audit cycle. Therefore, the corrections will not be reflected in contracts executed prior to that time frame. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, states, in part: All pass-through entities must: d. Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by section 75.521. f. Verify that every subrecipient is audited as required by subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in section 75.501. h. Consider taking enforcement action against noncompliant subrecipients as described in section 75.371and in program regulations. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-042 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with Temporary Assistance for Needy Families funds were allowable and property supported. Assistance Listing Number and Title: 93.558 Temporary Assistance for Needy Families Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2301WATANF; 2401WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $67,698,747 Prior Year Audit Finding: Yes, Finding 2023-051 Background The Department of Social and Health Service (DSHS), Community Services Office, administers the Temporary Assistance for Needy Families (TANF) grant that provides temporary cash assistance for families in need. To receive TANF benefits, participants must be engaged in activities listed in the Individual Responsibility Plan through the WorkFirst program, unless the TANF benefits are received only on behalf of a child. TANF grant funds are also used to pay clients’ child care costs to meet one of the program’s primary purposes of helping clients obtain employment. Washington has established the Working Connections Child Care (WCCC) program to help eligible working families pay for child care. Both the Department of Children, Youth, and Families (the Department) and DSHS administer the program. The Department is responsible for establishing policies and procedures for licensing child care providers and paying them for allowable child care services. DSHS determines TANF client eligibility and reimburses the Department for child care payments under an agreement between the two agencies. In fiscal year 2024, DSHS paid $67,698,747 related to child care services. The Department uses its Social Service Payment System (SSPS) to process the payments it makes to child care providers. The system allocates payments to various funding sources based on the eligibility of the client. These funding sources include multiple federal programs, multiple Child Care Development Fund (CCDF) federal grant awards and state funding. The Department uploads the payment data into the state’s accounting system at a summary level based on the various funding sources. DSHS worked with the Department to set up coding in the Payment Allocating Model system that looks at the client-level information and then assigns the correct TANF source of funds. Once the source of funds is identified, that information is sent to SSPS for allocation assignment. The Department prepares electronic reports for funds allocated to TANF funding sources and sends DSHS a monthly bill. There is always a need to transfer the funding sources for some payments throughout the year to manage federal and state funds properly. In prior audit periods up until fiscal year 2021, the Department prepared supporting documentation for transfers that included details of what payments it was transferring. The purpose of documenting this detail was to maintain proper support for federal expenditures. Some payments the Department makes for child care are funded by both the CCDF and TANF grants. While the two federal programs are separate, the requirements and policies in Washington for child care payments are consolidated under the WCCC program. Federal regulations require grant fund expenditures to be adequately supported to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls that ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with TANF funds were allowable and properly supported. The prior finding numbers were 2023-051, 2022-035 and 2021-028. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with TANF funds were allowable and properly supported. To identify TANF-funded payments the Department made to child care providers, we requested a population of payments charged to TANF sources from SSPS. However, in fiscal year 2021, management informed us that the Department changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditure coding in SSPS inaccurate and unreliable for testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent TANF funds in accordance with federal and state regulations. Further, this meant we could not test the Department’s payments to child care providers for compliance with activities allowed and cost principles. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. The Department’s accounting practices prevent it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions from SSPS that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. Officials from the U.S. Department of Health and Human Services informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition and Questioned Costs By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit the federal dollars it used for payments to child care providers. Because we could not test transaction-level detail, we also could not determine whether the issues we identified in prior audits had improved or worsened, including the Department’s lack of adequate internal controls and significant rate of noncompliance for payments to child care providers. Because the Department did not comply with federal requirements to allow for the tracing of grant expenditures to a payment level, we are questioning all $67,698,747 in federal program costs for child care payments that DSHS paid during the audit period. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules • Update service level agreements with DSHS to ensure payments are sufficient and properly supported • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Working Connections Child Care (WCCC) program was previously managed by the Department of Social and Health Services (DSHS) and the Department of Early Learning. Since the program transitioned in 2019, the Department has been making efforts to strengthen internal controls over payments to child care providers and other grant requirements. The Department implemented grant-level management of all federal funds, including the Temporary Assistance for Needy Families grant. This consisted of making significant grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements were met. The Department’s grant adjustments were processed based on eligible clients and allowable activities. The State Auditor’s Office (SAO) has taken issues in the past several audits and maintained that the program is not auditable without child-level data. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit for accurately testing compliance. During the audit period, the Department did not have the staff and resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance recommended by the SAO. In response to the auditor’s recommendations, the Department submitted a budget request for the 2024 supplemental budget. The enacted budget included funding to implement the Department’s budget request beginning in state fiscal year 2025, specifically: “Funding in this subsection must be expended with internal controls that provide child-level detail for all transactions, beginning July 1, 2024.” The Department is working with a developer to assist with building out the required databases between the Social Service Payment System and the Agency Financial Reporting System to allow transfers between funding sources to include child-level data related to the expenditures. The Department looks forward to working with SAO to resolve the child-level data concerns in the audit of the child care grant programs. Auditor’s Remarks The level of documentation needed to support grant expenditures is not established by our Office but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. Without adequate transactional level payment data, our Office is unable to perform tests to verify the grant adjustments were processed for eligible and allowable expenditures for the TANF grant. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings Title 45 CFR, Section 98.67 – Fiscal requirements, states: (a)  Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c)  Fiscal control and accounting procedures shall be sufficient to permit: (1)  Preparation of reports required by the Secretary under this subpart and under subpart H; and (2)  The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-043 The Department of Children, Youth, and Families did not have adequate internal controls over eligibility requirements for child care services paid with the Child Care and Development Fund and Temporary Assistance for Needy Families funds. Assistance Listing Number and Title: 93.558 Temporary Assistance for Needy Families 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2303WACCDF; 2303WACCDD; 2403WACCDM; 2403WACCDD; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2301WATANF; 2401WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-059 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2024, the Department spent about $483.5 million in CCDF federal funding. The Department of Social and Health Services (DSHS) administers the Temporary Assistance for Needy Families (TANF) grant. To meet one of the program’s primary purposes of helping clients obtain employment, TANF grant funds may be used to pay clients’ child care costs. If a client obtains employment and is no longer eligible for the program, TANF funds may still be used to pay child care costs to help the client maintain employment. In fiscal year 2024, the Department spent more than $306 million in CCDF and $109 million in TANF federal grant funds on child care subsidy payments to providers. Some payments made for child care are paid for by both the CCDF and TANF grants. While the two federal programs are separate, the requirements and policies in Washington for child care payments are consolidated under the Working Connections Child Care program. As of July 1, 2019, the responsibility for making and documenting child care eligibility determinations under the CCDF and TANF grants was transferred from DSHS to the Department. For a family to be eligible for child care assistance, state and federal rules require that at the time of application or reapplication, children must: • Reside in Washington and be a citizen or legal resident of the United States; • Be younger than 13 years, or if for verified special needs, be younger than 19 years; • Reside with a parent(s) or guardian whose countable income does not exceed 60% of the state median income at application or 65% of the state median income at reapplication; • Reside with a parent(s) or guardian who works or attends a job-training or education program, or needs to be receiving protective services. State rules describe the information clients must provide to the Department to verify their eligibility. The information must be accurate, complete, consistent and from a reliable source. This information includes, but is not limited to, employer and wage information, proof of an approved activity under TANF, and family household size and composition. Once determined to be eligible for the program, a child is eligible for one year unless a change in income causes the household to exceed 85% of the state’s median income. The Department requires that clients self-report such income changes. A written notice communicates the recipients’ reporting requirement and the specific dollar threshold applicable to the household’s annual income. Once the client’s income exceeds this cutoff level, the Department terminates services. The Department has access to systems that contain wage and household benefit and composition data for some, but not all, child care recipients. The Department uses this information in part to determine program eligibility, benefit level, including client copayment, and the amount of child care the family is eligible to receive. If an ineligible client receives assistance, the payment made to the child care provider is not allowable and the client must repay the ineligible amount. Federal regulations require the Department to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the past 12 audits, we reported findings related to eligibility for the Working Connections Child Care program. In these prior audits, we reported the Department did not have adequate internal controls over the eligibility process for child care subsidy recipients. These were reported as finding numbers 2023-059, 2022-036, 2021-035, 2020-039, 2019-032, 2018-030, 2017-026, 2016-023, 2015-026, 2014-026, 2013–017 and 2012-30. Description of Condition The Department did not have adequate internal controls over eligibility requirements for child care services paid with the CCDF and TANF funds. In response to the prior audit findings, the Department developed the following corrective action plan to address the internal control deficiencies: • Conduct root cause analysis of internal audit findings, particularly for cases with errors due to household composition and approved activities, and develop appropriate corrective actions as needed • Develop and deliver updated household composition training for all staff • Improve and publish the desk aid outlining simplified eligibility determination process that includes procedures for those families who do not have an approved activity The Department updated some policies and procedures for eligibility in February 2024 and management said they made more policies and procedures after the audit period. Department management also said they updated their child care household composition training after the audit period. Lastly, in April and May 2024, the Department made clarifying changes to its desk aid and updated its eligibility process flow. While the Department partially implemented corrective actions, they did not encompass the entire audit period and some occurred after the audit period. We consider these internal control deficiencies to be a significant deficiency. Cause of Condition In response to the prior audit findings, the Department developed a corrective action plan to address the internal control deficiencies. However, the Department did not fully implement the corrective action plan during the audit period. Effect of Condition By not implementing adequate internal controls, the Department is at higher risk of paying providers for child care services when clients are ineligible. Recommendation We recommend the Department improve its internal controls over determining client eligibility to ensure only eligible people receive benefits. Department’s Response During the fiscal year 2024 (FY24) audit period, the Department determined 36,413 families were eligible for child care. The State Auditor’s Office (SAO) selected samples and examined 61 of these determinations. In all instances, they found the Department properly made eligibility determinations before authorizing services. The Department partners with the SAO to complete the annual Statewide Single Audit process. The Department has completed a corrective action plan each year. Due to the timelines of the Statewide Single Audit, the agency’s corrective action plan is filed with the Office of Financial Management in the following fiscal year which prohibits the completion of the corrective action plan prior to the start of the following fiscal year. The Department agrees with the auditor’s finding that the fiscal year 2023 (FY23) corrective action plan was not completed prior to the start of FY24. The Department completed the FY23 corrective action plan as scheduled and recognizes this partnership with the SAO has led to our second year in a row with $0 questioned costs and for FY24 no case exceptions. The Department will continue to partner with the Administration for Children and Families (ACF) and follow our program integrity plan. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-044 The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements to ensure the statewide court hearing rate assessment was performed for subrecipients of the Child Support Services program. Assistance Listing Number and Title: 93.563 Child Support Services Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2301WACSES; 2201WACSES; 2401WACSES Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Department of Social and Health Services (DSHS) administers the Child Support Services program (CSS), which aims to locate absent parents, establish paternity, obtain child and spousal support, and enforce support obligations owed by noncustodial parents. During fiscal year 2024, the Department spent more than $129 million in federal program funds, about $23 million of which it paid to subrecipients. The Department administers and awards CSS funding to all counties through various court offices, including county clerks, county commissioners and county prosecutors. Federal regulations require the Department to monitor the activities of subrecipients to ensure the subaward is used for authorized purposes, in compliance with federal statues, regulations, and terms and conditions of the subaward, and that subaward performance goals are achieved. This includes reviewing financial and performance reports required by the passthrough entity. Department procedures require the Department to implement a statewide court hearing rate every calendar year. This rate is used by the subrecipient courts to determine the total allowable CSS share of direct costs. The process of implementing this rate begins by reviewing court hearing data from the current year from five sample counties. The counties submit two months of Commission hearing data from the current calendar year. The Department requires each sample county to provide the case number, party names, hearing date, and the start and end times of each hearing. The County Fiscal Liaison selects a sample from the total number of hearings and the counties review the hearings to determine if they were child support related and identifies the total number of minutes in the hearing. After it has been determined that a case is CSS related, a review is completed to determine if the parties in the hearing have a Title IV-D case. The review is documented on the Department’s sampling worksheet, which calculates the rate based on the actual minutes related to the program divided by the total minutes of the hearings. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure the statewide court hearing rate assessment was performed for subrecipients of the CSS program. According to the Division of Child Support Court Commissioner sample process document, program staff are required to review court hearing data from five sample counties in the state to determine the statewide hearing rate for the year. We found the Department did not perform the rate assessment to ensure that the statewide rate established during the fiscal year was based on current case load data of the subrecipient courts. As a result, the Department continued using the previously determined hearing rate, which the courts then used to determine their reimbursement claim amounts for the fiscal year. The Department was unable to provide documentation to demonstrate this action was discussed, what rationale was used to determine this course of action or that management approved it. We consider this internal control deficiency to be a material weakness that led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not establish sufficient internal controls to ensure the annual rate assessment was completed and accurate. The Department asserted it did not have sufficient court hearing data from participating counties at the time of the annual rate assessment. In addition, management asserted that it could not replace counties selected for analysis that experienced data errors in reporting child support caseloads to the state. Therefore, management opted not to complete the rate assessment. However, the Department did not document the rationale for its decision, nor management’s approval to continue using the previously established court hearing rate. Effect of Condition Without conducting the rate assessment, the Department cannot ensure the CSS hearing rate is an accurate representation of court caseloads for the program. This increases the risk of the Department reimbursing the courts at an excessive rate based on the child support cases heard. Recommendation We recommend the Department: • Improve internal controls to ensure it performs required county hearing rate assessments based on its policies and procedures • Establish internal controls sufficient to ensure it performs annual rate assessments to ensure hearing rates the courts use are based on accurate and complete data Department’s Response The Department partially concurs with the auditor’s finding. The Department has an established written process for conducting a sample of five counties to determine the statewide hearing rate for the fiscal year. Two of the five counties contacted us two weeks after the due date with technical issues and concerns that their data may not be accurate and requested that we use other counties’ data as part of the sampling process. Since the Department was already into State Fiscal Year (SFY) 24 and the courts needed the rate for their reimbursement requests, it was not realistic with such short notice to find two other counties that could pull two months of court hearings data from the prior year. DCS management made the decision to carry over the certified rate from the prior fiscal year’s sampling process rather than use potentially inaccurate data to update the court hearing rate. The difference in the sampling rates between SFY 22 (6.35%) and SFY 23 (6.58%) was so small we determined that a carryover of the SFY 23 rate given the circumstances would provide the most accurate representation of court caseloads and would mitigate the risk of the Department reimbursing the courts at an excessive rate. The Department provided the auditor documentation from the two counties that communicated their inability to participate in the SFY 24 sampling process as well as the Department’s communication to all the court administrators. This communication explained that due to unforeseen circumstances, the Department was not able to complete the state sampling process for SFY 24 and that it used the certified rate from SFY 23 to set a SFY 24 hearing rate. In addition, the Department provided the approved SFY 23 rate and sampling data. The auditor stated that since the SFY 23 rate was signed in April 2023, it was outside the scope of the audit period. The Department disagreed with the auditor because the SFY 23 rate was carried over for SFY 24, which made the sampling process and data within scope of the audit period. For the SFY 25 rate, the Department has found a new county to participate in the sampling process and the other county has resolved their system issues. The Department will update procedures to ensure decisions and approvals are documented when alternate methodologies are required. Auditor’s Remarks The Department asserts it communicated to participating counties that it would not re-assess the hearing rate for the year 2024 child support cases and instead carry forward the rate approved from 2023. This communication was provided to our Office in the form of an email, sent by the County Fiscal Liaison, which did not have any recipients listed. In addition, the Department did not provide documentation to demonstrate that management reviewed and approved the decision to carry forward the previously certified child support hearing rate, including what factors were considered that would allow the previous rate to be used and still be compliant with child support services monitoring requirements. We reaffirm our audit finding and we will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR part 75, section 352, Requirements for pass-through entities, establishes the requirements for pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Division of Child Support Court Commissioner Sample Process Instructions, states in part: “….Notify sample counties in July or August that it’s time to pull their samples. Current sample counties are: Chelan, Lewis, Pend Oreille, Spokane, and Grays Harbor. Email each sample county and request they provider their sample data” “ To pull the sample – 9. Using the Access Sample Program – pull a sample of 275-350 hearings. This number was determined by E-Maps statisticians to be an acceptable number of hearings based on having less than 5,000 hearings total. (*There is also a program that will provide you with a statistically sound sample number based on the total number of hearings you enter. You can use this or choose a number somewhere between 275-350.) 10. Set up your sample worksheets to include a column titled ‘Child Support?’ and one titled ‘IV-D?’, and one titled ‘Qualified Number of Minutes’. 11. Print this out so you have a hard copy to work from. These you will fill in as you review each hearing. If the hearing gets both a YES under the Child Support and the IV-D, then you’ll enter the number of minutes of that hearing in the last column.” 12. Review each and every hearing to determine if it is child support related.” “Calculating the sample IV-D percentage rate – Using your ‘Final Data Totals’ worksheet: 20. Cell F6 - Enter number of minutes for all “Other” than 3 & 5 case types. 21. Cell F7 - Enter number of minutes for all Type 3 + Type 5 case types. 22. Total of all hearings minutes will be automatically calculated and entered in Cell F8. 23. Cell F11 - Enter the total number of minutes in the sample. 24. Cell F13 - Enter the total of IV-D qualified minutes in the sample. 25. The system will calculate the IV-D sample percentage from those two figures and enter it in Cell F15. 26. Cell G6 - Enter the percentage of all “other” case types that are IV-D (this will always be 0). 27. Cell G7 – The system will enter the percentage of all Type 3 + Type 5 cases that are IV-D. (This is simply copied from Cell F15.) 28. Cell H7 – The system will enter the Total IV-D Minutes for Type 3 and Type 5 cases using the total Type 3 + Type 5 minutes (Cell F7) multiplied by the percentage of IV-D minutes per the sample (Cell G7). 29. That number (Cell H8) is then divided by the total of minutes of ALL hearings submitted (Cell F8) and the resulting percentage is your Hearings Sample IV-D Percentage Rate to be used by all counties statewide for their Court Commissioner reimbursements.” The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-045 The Department of Social and Health Services did not have adequate internal controls to ensure risk assessments performed for subrecipients of the Child Support Services program were accurate and complete. Assistance Listing Number and Title: 93.563 Child Support Services Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2301WACSES; 2201WACSES; 2401WACSES Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Department of Social and Health Services (DSHS) administers the Child Support Services program (CSS), which aims to locate absent parents, establish paternity, obtain child and spousal support, and enforce support obligations owed by noncustodial parents. During fiscal year 2024, the Department spent more than $129.7 million in federal program funds, about $23 million of which it paid to subrecipients. The Department administers and awards program funding to all counties through various court offices, including county clerks, county commissioners and county prosecutors. Federal regulations require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward to determine the appropriate amount and type of subrecipient monitoring required to ensure they use the subaward for authorized purposes, comply with the terms and conditions of their subawards, and achieve performance goals. The Department’s County Fiscal Liaison completes the annual risk assessment of all counties for the program. The Department’s risk assessment contains different risk factors that are answerable by a “yes” or a “no” value and are each assigned a numerical value. The scores are then totaled to determine the overall risk of the subrecipient. This risk score determines the adequate level of monitoring necessary for the subrecipient. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure risk assessments performed for subrecipients of the program were accurate and complete. The Department’s policies and procedures instruct program staff to conduct annual risk assessments and determine the level of monitoring required for each county subrecipient. Although the County Fiscal Liaison completed risk assessments for county subrecipients during the audit period, Department management did not perform a secondary review of the risk assessments the County Fiscal Liaison completed for completeness and appropriateness. In addition, we determined that only the County Fiscal Liaison participates in the subrecipient risk assessment process. Therefore, we determined the Department does not have adequate internal controls to ensure program staff perform risk assessments, as required by Department policies, and that the results of completed risk assessments are accurate and support the recommended level of monitoring over the subrecipients. We consider this internal control deficiency to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not consider performing a secondary review of the County Fiscal Liaison’s assessment of each County’s risk of noncompliance, and did not monitor the results of risk assessment as it relied on the liaison’s judgment. Effect of Condition Without monitoring to ensure risk assessments are completed and conducting a secondary review of risk assessments that program staff perform, management cannot ensure that the Department is meeting federal requirements by performing the appropriate level of monitoring to ensure subrecipients comply with program requirements. Recommendation We recommend the Department: • Improve internal controls to ensure it performs required risk assessments • Establish internal controls to ensure management reviews and approves risk assessments to ensure they are complete, accurate and performed timely to ensure an appropriate level of subrecipient monitoring is performed • Department’s Response The Department partially concurs with the auditor’s findings. The Department has a control in place to discuss risks in real time with management during weekly meetings. Management is appraised of concerns and workloads, including completion of risk assessments. The risk assessment worksheets capture, in writing, the risks and actions taken as discussed with management in the weekly meetings. For ongoing compliance, the Department’s Division of Child Support will update procedures for risk assessments to include documenting management’s review and approval. Auditor’s Remarks We requested and received risk assessment worksheets as part of the audit and found no information indicating the results were provided to or approved by management. In addition, program staff informed our Office that it did not have documentation to demonstrate that risk assessments completed by the County Fiscal Liaison were reviewed by management for appropriateness. We reaffirm our audit finding and we will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes the requirements for pass-through entities. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-046 The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act for the Refugee and Entrant Assistance program. Assistance Listing Number and Title: 93.566 Refugee and Entrant Assistance – State Administered Programs Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2301WARCMA-03, 2301WARCMA-04, 2301WARSSS-06, 2301WARSSS-07, 2301WARSSS-08, 2301WARSSS-09, 2401WARCMA-00, 2401WARCMA-01, 2401WARCMA-02, 2401WARSSS-00, 2401WARSSS-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-052 Background The Refugee and Entrant Assistance – State Administered programs provide states and replacement designees with funds to help refugees, asylees, trafficking victims, special immigrants, and certain humanitarian parolees during the first 12 months after their date of arrival, or date of eligibility, in the U.S to attain economic self-sufficiency as soon as possible after their initial placement. The U.S. Department of Health and Human Services administers this program by providing assistance through Cash and Medical Assistance (CMA) Grants, as well as Refugee Support Services (RSS). Specifically, CMA covers Refugee Cash Assistance, Refugee Medical Assistance, Unaccompanied Refugee Minor assistance, medical screenings and administrative costs. RSS provides formula funding to assist with facilitating employment and other social services for refugees for up to five years after their date of arrival to the U.S., or date of initial eligibility. In 2022, Congress appropriated additional funding under the Additional Afghanistan Supplemental Appropriations Act, and Additional Ukraine Supplemental Appropriations Act. In Washington, the Department of Social and Health Services administers the state’s Refugee and Entrant Assistance programs. In fiscal year 2024, the Department spent about $77.9 million in federal program funding. Of that amount, the Department passed through more than $55.9 million to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower the public with the ability to hold the federal government accountable for spending decisions and, as result, reduce wasteful government spending. During fiscal year 2024, the Department issued 125 subawards and 122 subaward amendments totaling more than $111 million to subrecipients that it was required to report in FSRS. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. The prior finding number was 2023-052. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. We used a statistical sampling method and randomly selected and examined 24 subawards out of a total population of 247. We also tested two individually significant subawards. We determined that 12 out of 26 subawards (46%) were not submitted in FSRS during the audit period. The Department reported three of the 12 subawards in FSRS after the audit period ended, however the reports were submitted late. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not have written policies and procedures in place to determine which subawards and amendments were required to be reported in FSRS until April 2024. Management said the Department filed overdue reports from prior fiscal years before it could report subawards issued during the audit period. Additionally, management did not ensure that reports were originally submitted, as required. Effect of Condition Failing to submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. The terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance, including suspending or terminating the federal award or withholding future awards. Recommendations We recommend the Department: • Establish effective internal controls to ensure it reports all first-tier subawards of $30,000 or more, as required • Verify all subawards and subaward amendments are reported in FSRS, as required Department’s Response The Department concurs with the auditor’s findings. The Department’s Office of Refugee and Immigrant Assistance (ORIA) will immediately report the contracts and amendments in question to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). For ongoing compliance, ORIA will develop and subsequently implement a process to verify all subawards and subaward amendments were reported as required. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010. 3. What to report. You must report the information about each obligating action that the submission instructions posted at https://www.fsrs.gov specify. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-047 The Department of Social and Health Services did not have adequate internal controls over and did not comply with federal requirements to perform fiscal and program monitoring of subrecipients for the Refugee and Entrant Assistance programs. Assistance Listing Number and Title: 93.566 Refugee and Entrant Assistance – State Administered Programs Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2301WARCMA-03, 2301WARCMA-04, 2301WARSSS-06, 2301WARSSS-07, 2301WARSSS-08, 2301WARSSS-09, 2401WARCMA-00, 2401WARCMA-01, 2401WARCMA-02, 2401WARSSS-00, 2401WARSSS-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-054 Background The Refugee and Entrant Assistance – State Administered programs provide states and replacement designees with funds to help refugees, asylees, trafficking victims, special immigrants, and certain humanitarian parolees during the first 12 months after their date of arrival, or date of eligibility, in the U.S to attain economic self-sufficiency as soon as possible after their initial placement. The U.S. Department of Health and Human Services administers this program by providing assistance through Cash and Medical Assistance (CMA) Grants, as well as Refugee Support Services (RSS). Specifically, CMA covers Refugee Cash Assistance, Refugee Medical Assistance, Unaccompanied Refugee Minor assistance, medical screenings and administrative costs. RSS provides formula funding to assist with facilitating employment and other social services for refugees for up to five years after their date of arrival to the U.S., or date of initial eligibility. In 2022, Congress appropriated additional funding under the Additional Afghanistan Supplemental Appropriations Act, and Additional Ukraine Supplemental Appropriations Act. In Washington, the Department of Social and Health Services’ Office of Refugee and Immigrant Assistance (ORIA) administers the State’s Refugee and Entrant Assistance programs. During fiscal year 2024, the Department spent about $77.9 million in federal program funding, more than $55.9 million of which it passed through to subrecipients. Federal regulations require the Department to monitor the activities of subrecipients to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. This includes reviewing financial and performance reports required by the pass-through entity. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with federal requirements to perform fiscal and program monitoring of subrecipients for the Refugee and Entrant Assistance programs. The prior finding number was 2023-054. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to perform fiscal and program monitoring of subrecipients for the Refugee and Entrant Assistance programs. The Department’s administrative policy 19.50.30 - Subrecipient Monitoring requires Department staff to conduct programmatic and fiscal monitoring of subrecipients. We found the Department did not monitor any of its 56 program subrecipients to ensure compliance with federal statutes, regulations, or that subaward performance goals are achieved. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition In response to the prior audit finding, ORIA program management implemented procedures for determining program subrecipients, however these changes did not take effect until the end of this audit period. The Department did not accurately identify all program subrecipients to develop a comprehensive monitoring plan and did not ensure subrecipients were correctly identified and monitored for compliance, as required by the Uniform Guidance. In addition, management did not effectively communicate the responsibility for conducting fiscal monitoring of program subrecipients to ORIA staff. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are spending federal funds in accordance with grant requirements. Without adequately monitoring each subrecipient’s use of federal funds expended during the period of performance of the subaward, the Department cannot reasonably ensure that the subrecipient has complied with the terms and conditions of the subaward. Recommendation We recommend the Department: • Establish effective internal controls to ensure all subrecipients are subject to fiscal and program monitoring, as required • Establish effective internal controls to ensure subrecipients are accurately identified by Department program staff • Establish internal controls to ensure Department staff review financial and performance-based reports for every subrecipient • Monitor each subrecipient to obtain reasonable assurance that each subrecipients’ use of federal funds complies with federal laws and regulations, and the subaward terms and conditions • Communicate to subrecipients any deficiencies noted during its review and ensure appropriate corrective action is taken to address the deficiencies Department’s Response The Department concurs with the auditor’s findings. The Department’s Office of Refugee and Immigrant Assistance (ORIA) monitored some of their subrecipients, however, they did not have monitoring reports to provide as evidence. Since the program determined the subrecipients to be low risk, monitoring consisted of a desk review which was documented only on the monitoring screen of the Agency Contracts Database (ACD). In response to the prior audit 2023-054, ORIA is working with the Division of Finance and Financial Resources (DFFR) to develop and implement effective internal controls and clear written procedures covering program and fiscal subrecipient monitoring requirements. ORIA will train all staff responsible for subrecipient monitoring on the newly established internal controls and written procedures. To address the significant workload associated with onsite monitoring and the development of monitoring reports, ORIA and DFFR will explore the department’s ability to increase staff resources. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes the requirements for all pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Department of Social and Health Services, Administrative Policy 19.50.30, Subrecipient Monitoring, states in part: Policy E. Fiscal and programmatic monitoring must be completed. (See Attachment C – Sample DSHS Subrecipient Fiscal Monitoring Site Visit Tool) Based on the result of the risk assessment, a desk or on-site review must be completed. Each Program has control over the form and content of its risk assessment tools. 1. If the risk assessment shows the entity is of low to medium risk, the entity may not require an on-site review. The following items, if available, must be documented in a desk review: a. Entity’s invoices and documentation (A-19s). b. Entity’s program or service and financial reports. c. Surveys or feedback cards from clients. d. Client complaints. e. Entity’s audit or financial report follow up and ensuring all appropriate action has been taken on all items detected through audits, on-site reviews and any other means. f. Entity’s indirect rate certification (Certificate of Indirect Costs, form 02-568 or plan), if applicable. g. If any of the above are not reviewed within the desk review, supervisor approval and an explanation for the reason the items were unable or immaterial to be reviewed must be included within the desk review assessment tool. 2. If the risk assessment shows the entity is a high risk, an on-site visit is required. The program/division will assign the appropriate staff to conduct the on-site review. On-site reviews must include all items in a desk review. In addition, on-site reviews may include, as appropriate, the following items: a. A review of the delivery of program services. b. Discussions about the subrecipient’s problems and challenges. c. Follow-up on identified problems from previous visits. d. Review of faculty/personnel licensing. e. Review of surveys and inspections performed by outside parties. f. Interview of staff to determine whether they are familiar with the program. g. Inspection of the entity’s facilities and operations. h. Review of and compliance with the entity’s policies and procedures governing service delivery and financial processes. i. Review of the entity’s monitoring/production reports. j. Review of any independent limited scope program audits. k. Verification of performance from outside source (e.g. sub-contractors). l. Review of the entity’s self-risk assessment survey. m. Review of internal controls. n. Review of billing practices. o. Review of allocation of costs. p. Review of timesheets or activity reports. q. Review of financial records. F. Monitoring must be documented. 1. The ACD must be used to document all subrecipient-related monitoring activities. 2. Assigned staff must document all desk or on-site reviews performed. The program manager overseeing the contract is responsible for making sure that items included in the review are documented in the ACD by the end of the contract period. 3. Each program must maintain contract monitoring documentation per General Administration’s retention schedule (Administrative Policy 5.04, Records Retention).

2024-048 The Department of Social and Health Services did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Refugee and Entrant Assistance programs received required single audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.566 Refugee and Entrant Assistance – State Administered Programs Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2301WARCMA-03, 2301WARCMA-04, 2301WARSSS-06, 2301WARSSS-07, 2301WARSSS-08, 2301WARSSS-09, 2401WARCMA-00, 2401WARCMA-01, 2401WARCMA-02, 2401WARSSS-00, 2401WARSSS-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-053 Background The Refugee and Entrant Assistance – State Administered programs provide states and replacement designees with funds to help refugees, asylees, trafficking victims, special immigrants, and certain humanitarian parolees during the first 12 months after their date of arrival, or date of eligibility, in the U.S to attain economic self-sufficiency as soon as possible after their initial placement. The U.S. Department of Health and Human Services administers this program by providing assistance through Cash and Medical Assistance (CMA) Grants, as well as Refugee Support Services (RSS). Specifically, CMA covers Refugee Cash Assistance, Refugee Medical Assistance, Unaccompanied Refugee Minor assistance, medical screenings and administrative costs. RSS provides formula funding to assist with facilitating employment and other social services for refugees for up to five years after their date of arrival to the U.S., or date of initial eligibility. In 2022, Congress appropriated additional funding under the Additional Afghanistan Supplemental Appropriations Act, and Additional Ukraine Supplemental Appropriations Act. In Washington, the Department of Social and Health Services administers the state’s Refugee and Entrant Assistance programs. In fiscal year 2024, the Department spent about $77.9 million in federal program funding. Of that amount, the Department passed through more than $55.9 million to subrecipients. Federal regulations require the Department to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single audit or program-specific audit. Furthermore, federal regulations require subrecipients to submit their audits in the Federal Audit Clearinghouse and to the pass-through entity within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes on to its subrecipients, the Department must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a Department-funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Refugee and Entrant Assistance programs received required single audits, and that it followed up on findings and issued management decisions. The prior finding number was 2023-053. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Refugee and Entrant Assistance programs received required single audits, and that it followed up on findings and issued management decisions. We found the Department did not have adequate internal controls in place to verify whether: • Subrecipients met the audit threshold for federal assistance expended for their fiscal year • Subrecipients received required audits, if necessary, and appropriate actions were taken if audits were not filed • Management decisions were required to be issued for subrecipients who received a single audit or program-specific audit We found the Department did not monitor each of its 56 subrecipients to ensure they received a single audit, if required. Six of these subrecipients received single audits during the audit period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department used accounting system reports to determine how much it reimbursed subrecipients with Refugee and Entrant Assistance funds. However, management did not monitor subrecipients to ensure they received single audits, as required. Additionally, management did not assign any specific employees the responsibility for reviewing subrecipient audit reports and findings until after the audit period. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the Department cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions, and management monitors them for effectiveness where required, the Department cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings.   Recommendations We recommend the Department: • Monitor subrecipients to ensure all required audit reports are submitted and reviewed to determine if any additional subrecipients are required to take corrective action to address audit recommendations • Establish effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required • Ensure subrecipients develop and take acceptable corrective actions to adequately address all audit recommendations • Issue a written management decision for all applicable audit findings, if necessary Department’s Response The Department partially concurs with the auditor’s findings. The Department’s Office of Refugee and Immigrant Assistance (ORIA) monitored their subrecipients for single audit reports by verifying each subrecipient’s total federal financial assistance through online tax forms. For subrecipients that met the single audit threshold, ORIA either received the single audit report from the subrecipient or pulled a copy from the single audit online database. However, the Department did not issue management decisions. As part of our corrective action plan for the prior audit finding (2023-053), ORIA is working with the Department’s Division of Finance and Financial Resources (DFFR) to establish and implement effective internal controls and written procedures to ensure ORIA reviews audit reports for their subrecipients and issue written management decisions, as required. ORIA and DFFR will review all SFY24 completed single audit reports, and for any findings that pertain only to the federal award provided to the subrecipient, ORIA will issue a management decision outlining their determination of the effectiveness of the subrecipients’ proposed corrective actions to address the findings and monitor the subrecipient’s corrective actions through completion. Auditor’s Remarks In response to our audit request for internal controls, the Department asserted in writing that its monitoring of single audits of subrecipients during the audit period were not completed during state fiscal year 2024 and that it had no records for us to test to demonstrate monitoring occurred. It further stated that management hopes to demonstrate compliance beginning in state fiscal year 2025. We reaffirm our audit finding and we will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes requirements for pass through entities including monitoring of subrecipients. Title 45 CFR Part 75, section 501, Audit requirements, establishes the single audit requirements for recipients of federal assistance. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-049 The Department of Commerce improperly charged $492,317 to earmarking requirements for the Low-Income Home Energy Assistance Program. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Energy Assistance Program Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 2101WAE5C6; 2101WALIEA Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Earmarking Known Questioned Cost Amount: $492,317 Prior Year Audit Finding: No Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia, and territories. In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. The Department makes subawards to community-based organizations to provide this assistance. In fiscal year 2024, the Department spent more than $96 million in federal funds, about $89.5 million of which it paid to subrecipients. Federal regulations require the Department to meet the following earmark requirements: • No more than 10% of a state’s LIHEAP funds may be used for planning and administrative costs • No more than 15% of LIHEAP funds may be used for low-cost residential weatherization or other energy-related home repairs • No more than 5% of LIHEAP funds may be used to provide services that encourage and enable households to reduce their home energy needs and therefore their need for energy assistance To ensure the Department meets the earmark requirements, when a new award is received, staff create an allocation model to calculate the maximum allowable earmarking amounts. Each award is given unique project codes in the accounting system to track expenditures against the earmark amounts. Description of Condition The Department of Commerce improperly charged $492,317 to earmarking requirements for LIHEAP. We found the Department had procedures to track earmarking requirements and had adequate internal controls to ensure material compliance. During fiscal year 2024, there were two awards that were required to meet the earmark limits. We found both awards overspent the 15% weatherization earmark as follows: • For award 2101WAE5C6, the Department overspent the amount by $287,998. • For award 2101WALIEA, the Department overspent the amount by $204,319. The total questioned cost amount is $492,317. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a single audit exceed $25,000. We are issuing this finding because, as stated in the Effect of Condition and Questioned Costs section of this finding, the questioned costs exceeded that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition When completing the allocation model to determine earmarking amounts, the Department initially allocated 15% of the total award funds to weatherization. However, staff allocated additional subrecipient administrative funds to the initial allocated amount, bringing the weatherization total beyond the allowed earmark. Staff identified this error, but the Department had already obligated funds to subrecipients from this allocation and chose not to correct the subaward amounts. Effect of Condition and Questioned Costs We identified $492,317 in questioned costs on activities that exceeded the weatherization earmark amount. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Department consult with the federal grantor to discuss whether it should repay the questioned costs identified in the audit. Department’s Response The Department appreciates the detailed audit of the earmarking process in use by the Low Income Home Energy Assistance Program (LIHEAP). Following receipt of the audit recommendations, budget and Internal Controls Office staff reviewed the total expenditures used to calculate the questioned costs and determined the amounts reported were accurate. Program staff will seek guidance from the Department of Health and Human Services (HHS) Office of Community Services (OCS) regarding the questioned costs. To ensure accuracy and compliance of current and future awards, LIHEAP program staff are currently collaborating with budget staff to work towards alignment between divisions with federal requirements. This includes a thorough review of financial records, detailed reconciliations, and adjustments to budgeting procedures to prevent future occurrences. Moving forward, the Department will implement enhanced internal controls and monitoring processes to ensure accurate budgeting and reporting of earmarked funds. We are committed to maintaining compliance with federal requirements and demonstrating our accountability in managing public funds. The Department will provide the results of the consultation of HHS during the next scheduled LIHEAP audit or audit follow-up. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 CFR Part 75.1, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards establishes definitions for questioned costs. Part 75.410 establishes requirements for the collection of unallowable costs. Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 42 United States Code, Section 8624(k), Limitations on use of funds; waiver, establishes that no more than 15% may be used by the State for low-cost residential weatherization or other energy-related home repair for low-income households.

2024-050 The Department of Commerce did not have adequate internal controls over and did not comply with period of performance requirements for the Low-Income Home Energy Assistance program. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 2101WALIEA, 2101WAE5C6, 2101WALWC6, 2101WALWC5, 2201WALIEI, 2201WALIEA, 2201WALIE4 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Period of Performance Known Questioned Cost Amount: $4,409,760 Prior Year Audit Finding: N/A Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families (ACF), administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia and U.S. territories. In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. The Department administers and awards LIHEAP funds under two programs: the energy assistance program and the weatherization program. Subawards are issued to community-based organizations to provide this assistance. In fiscal year 2024, the Department spent more than $96 million in federal funds, about $89.5 million of which it paid to subrecipients. Federal regulations require the Department to obligate at least 90% of the LIHEAP block grant funds in the first federal fiscal year in which they are awarded. If funds are left over after the end of the first federal fiscal year, the Department must either return those funds or report to the grantor the amount it intends to carry over and reallot. The Department may carry over up to 10% of the funds payable for obligation no later than the end of the following federal fiscal year. Funds not obligated by the end of the second fiscal year of the award must be returned to ACF. The limits on the period for the expenditure of funds are communicated to award recipients. LIHEAP awards typically have a two-year project period when the Department may obligate funds to subrecipients through subawards and incur administrative costs to execute the award. The subawards define the period of performance for subrecipients to spend these funds. Departmental administrative costs are considered obligated when the expenditure activity occurs. As such, the period of performance for administrative costs aligns with the project period start and end date. If the Department requires more than one year from the project period end date to liquidate allowable costs, it is required to notify the Grantor. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with period of performance requirements for LIHEAP. Obligations During state fiscal year 2024, the Department was required to obligate 90% of funds for the federal fiscal year 2023 award. This amount is reported on the Carryover and Reallotment Report. The Department was unable to provide documentation to support the amount of funds it obligated in the first year of the award. This issue is referenced in finding 2024-051. Expenditures During state fiscal year 2024, there were five awards with project end dates. We judgmentally selected and examined 21 expenditures charged to these awards. We found: • Four (19%) expenditures for which the Department did not provide any documentation to support that the cost occurred during the period of performance • Three (14%) expenditures for which the documentation the Department provided did not support that the costs occurred during the period of performance The total costs associated with these seven expenditures are $1,010,249. In addition, we analyzed expenditures charged to the awards in the accounting system and identified $1,346,137 of administrative activities that occurred after the period of performance. Liquidations There were two awards with liquidation periods ending during state fiscal year 2024. We judgmentally selected and examined eight expenditures the Department charged to grants that were liquidating funds during the audit period. We found: • Three (38%) expenditures for which the Department did not provide any documentation to support that the cost occurred during the period of performance • Two (25%) expenditures for which the documentation the Department provided did not support that the costs occurred during the period of performance The total costs associated with these five expenditures are $1,916,227 In addition, we analyzed expenditures charged to the awards and identified $137,148 of administrative activities that occurred after the period of performance. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department misinterpreted the federal regulations, which led management to believe it was compliant with period of performance requirements. Further, the Department did not provide us with all the documentation to demonstrate that the Department incurred the charges we examined during the period of performance. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it uses federal funds within the period of performance. We identified $1,483,285 in known questioned costs for expenditures that occurred outside of the period of performance. We also identified $2,926,476 in known questioned costs for expenditures that did not have adequate support to determine if they were within the period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Design and implement internal controls to ensure it complies with period of performance requirements • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Department agrees with the internal control weaknesses identified in the report. However, for the contract periods included in this audit we were operating off of guidance received by the United State Department of Health and Human Services (HHS) in 2022. Directly following notification of this deficiency for this audit, we reached out to HHS to clarify the closeout year requirements. In December 2024 we received updated guidance on how to apply the closeout year to current awards. Beginning with the 2024 program year (October 1, 2023), all subrecipient contracts were issued with a two-year period of performance, which will eliminate new expenses being added to the closeout year. This ensures that all LIHEAP awards will be managed within a consistent two-year period of performance, which aligns with the updated HHS guidance. All future LIHEAP awards will follow the same period of performance principle. The Department will engage with the HHS to determine the appropriate next steps on how to handle the questioned costs. The Department is committed to addressing the internal control weaknesses identified in the audit and will continue to strengthen its processes to ensure ongoing compliance with period of performance requirements. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs. Title 45 CFR Part 96, section 81, Carryover and reallotment, establishes the procedures relating to carryover and reallotment of regular LIHEAP block grant funds ACF Supplemental Terms and Conditions, LIHEAP, effective October 1, 2021, states in part: 9. Obligation Deadline: a. The two-year funding (project) period for this award is concurrent with the obligation period: from the first day of the FFY for which these funds were awarded through the last day of the following FFY. (i.e., October 1, FFY 1 through September 30, FFY 2.) A maximum of 10 percent of the federal funds awarded under this grant may be held available for obligation in the FFY 2 of the project period. If more than 10 percent of a recipient's federal funds remains unobligated at the end of the FFY in which they were allotted, those excess funds must be returned to HHS and are subject to reallotment among all recipients in the next fiscal year. Any federal funds not obligated by the end of the two-year obligation period will be recouped by the Department. b. Federal funds awarded under this grant must be expended for the purposes for which they were awarded and in payment for obligations made within the time period allotted. 10. Liquidation: All properly obligated federal funds awarded under this grant must be liquidated in accordance with the recipient’s own fiscal control and funds control procedures. If the recipient requires more than 1 year from the project period end date to liquidate allowable costs, it shall notify the Grants Management Officer identified on its latest Notice of Award. The notification shall include the reason for the delay and the anticipated timeframe for liquidation. Any federal funds from this award not liquidated by the date required under the recipient’s own fiscal control procedures, which may not exceed five years following the fiscal year of award, will be recouped by this Department. ACF-OCS-LIHEAP-IM-2024-04 LIHEAP Obligations, Expenditures, and Refunds, states in part: Federal appropriations accounting law at 31 U.S.C. § 1502(a) states that the balance of an appropriation or fund limited for obligation to a definite period is available only for payment of expenses properly incurred during the period of availability or to complete contracts properly made within that period of availability. Grant recipients may not incur new expenditures beyond the period of performance unless necessary to liquidate obligations made during the period of performance under active agreements or subawards with partnering agencies. Grant recipients must liquidate obligations according to the same rules, including the timeframe, required of its own non-federal funding.  The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-051 The Department of Commerce did not have adequate internal controls over and did not comply with reporting requirements for the Low-Income Home Energy Assistance Program. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 2301WALIEA; 2301WALIEE; 2301WALIEI Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia and U.S. territories. In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. The Department makes subawards to community-based organizations to provide this assistance. In fiscal year 2024, the Department spent more than $96 million in federal funds, about $89.5 million of which it paid to subrecipients. The LIHEAP Carryover and Reallotment Report is used to indicate the amount expected to be carried forward for obligation in the following fiscal year and the planned use of those funds. The federal grantor specified there were two key lines items on the report that contained critical information: the carryover amount and the reallotment amount In the first federal fiscal year after a grant is awarded, the Department must obligate at least 90% of the LIHEAP block grant funds. If funds are left over after the end of the first federal fiscal year, the Department must either return those funds or report the amount it intends to carry over and reallot. The Department must submit this report by August 1, indicating the amount it expects to carry forward for obligation in the following fiscal year and its planned use of those funds. To complete this report, the Department’s budget unit staff is responsible for reviewing the support and compiling the reported amounts. They are also responsible for completing, reviewing, and approving the report. Program staff are responsible for submitting the report. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements for LIHEAP. The Department reported that there were no funds for reallotment and there was $6,033,389 for carryover from the fiscal year 2023 award. The Department created a spreadsheet with manual inputs to calculate the carryover amount. However, the Department was unable to provide the source documentation to support the amounts on the spreadsheet. As a result, the Department was unable to demonstrate that this reported amount was accurate. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department stated they experienced turnover with key staff responsible for preparing the report. Specifically, the budget staff who had prepared the report in past years left the Department. Instead of budget staff preparing and submitting the report, the program manager, who is not normally involved in this process, was tasked with completing and submitting this report without adequate guidance or oversight by management.  The Department stated the staffing changes, combined with duties not being assigned, led to process changes from previous years which resulted in the deficiencies identified. The Department also did not have written policies or procedures on how to prepare, review and submit this report. Effect of Condition Since the Department did not retain supporting documentation and source data for the reports, we were unable to verify whether the amounts the Department reported to the federal grantor were accurate. Additionally, the terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance with reporting requirements by suspending or terminating the award, or withholding future awards, should it choose to do so. Recommendations We recommend the Department: • Establish effective internal controls to ensure the report is accurate • Ensure management reviews reports before submission • Establish written policies and procedures on how to complete the report • Retain adequate supporting documentation for the report • Consult with the federal grantor to determine if it should revise and resubmit the report Department’s Response The Department agrees with this finding, and is taking the following actions in response: • Developing procedural documents that articulate roles and responsibilities, and documentation retention requirements. • Escalation processes that support resolution of any discrepancies in data. • Implementing a recurring reconciliation processes to find and adjust errors as necessary. • Updating agency policy to reflect uniform standards that are consistent with a singular interpretation of federal guidance. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Office of Management and Budget, 2024 Compliance Supplement, Assistance Listing 93.568 Low-Income Home Energy Assistance Program, describes the compliance requirements for special and performance reporting. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-052 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 2101WALIEA,2101WAE5C6,2101WALWC6, 2101WALWC5, 2201WALIEI,2201WALIEA, 2201WALIE4, 2301WALIEA, 2301WALIEE, 2301WALIEI, 2401WALIEA, 2401WALIEI Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia and U.S. territories. In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. Subawards are issued to community-based organizations to provide this assistance. In fiscal year 2024, the Department spent more than $96 million in federal funds, about $89.5 million of which it paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it executed the subaward (or subaward amendment). The Act is intended to empower the public with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. The Department has two units – energy assistance and weatherization – that administer two different program activities. Each unit is responsible for complying with this reporting requirement and have similar processes for completing the reports. When a new or amended subaward is executed, program staff enter its information into the Department’s Contract Management System (CMS). Program staff use the information in the CMS to complete the report. There were a total of 115 awards and amendments that the Department was required to report in fiscal year 2024, totaling $102,300,556. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. During the audit period, the Department was required to report 115 new and amended subawards totaling about $102 million in program funds. We used a nonstatistical sampling method to randomly select and examine 17 out of the total population of 115 subawards. We found that: • The Department did not report three out of 17 (18%) subawards in FSRS. The Department asserted it submitted the subawards included in one Federal Funding Accountability and Transparency Act report, but did not retain a copy of the report and was unable to retrieve it from FSRS. We attempted to locate these three subawards at USAspending.gov to verify submission but were unable to do so. • One out of 17 (6%) subawards reported an incorrect subaward amount • Two out of 17 (12%) subawards reported the incorrect subrecipient name and unique entity identifier We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not have adequate processes in place to ensure it reported the correct information and retained documentation for audit purposes. For the three subawards not retained, Department management said another staff member submitted this report instead of the program manager. This person no longer works at the Department and the program manager does not have access to their FSRS account. For the three subawards with incorrect information, internal controls were insufficient to ensure the Department correctly entered the information into the CMS. Effect of Condition Failing to properly submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Department: • Establish effective internal controls to ensure it accurately reports all first-tier subawards of $30,000 or more in FSRS by the federal deadlines • Ensure it retains copies of completed reports after submitting • Ensure it correctly enters subaward details into the CMS Department’s Response Commerce concurs with the finding and will work with budget staff to ensure that Notice of Funding Available (NOFA) information is entered into CMS accurately when it is received. Program staff enter dollar amounts for contracts and amendments into CMS and budget staff enter the Federal Awards information from the NOFA into CMS. Department staff will look into this process and evaluate updating the data entry process to eliminate the possibility of errors in the entry process. The FFATA Sub Reporting System (FSRS) does not allow users to review reports that were submitted by other users without the request of account migration. The reports could not be provided due to this restriction of the system. The FSRS system is currently being removed and updated to a different site. In the meantime, Department staff will request account migration of previous users to gain access to previously submitted reports. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010. 3. What to report. You must report the information about each obligatory action that the submission instructions posted at https://www.fsrs.gov specify. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-053 The Department of Commerce did not have adequate internal controls over and did not comply with reporting requirements for the Low-Income Home Energy Assistance Program. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 2101WALIEA,2101WAE5C6,2101WALWC6, 2101WALWC5, 2201WALIEI,2201WALIEA, 2201WALIE4, 2301WALIEA, 2301WALIEE, 2301WALIEI, 2401WALIEA, 2401WALIEI Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Finding 2023-055 Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia and U.S. territories. In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. The Department administers and awards LIHEAP funds under two programs: the energy assistance program and the weatherization program. Subawards are issued to community-based organizations to provide this assistance. In fiscal year 2024, the Department spent more than $96 million in federal funds, about $89.5 million of which it paid to subrecipients. The Department is required to collect and report program information through various reports. LIHEAP Performance Data Form The LIHEAP Performance Data Form has two modules. Module 1 is the Grant Recipient Survey that collects and reports data on sources and uses of LIHEAP funds. Module 2 is the performance measures used to report data on energy burden targeting and reduction, as well as the continuity of home energy services. The Grant Recipient Survey obligation amounts should be compared with the Carryover and Reallotment and SF-425 reports. This reconciliation is needed to ensure the obligated balances for the program year being tested are accurate. The key line items include: • “Uses of Funds” represent a state’s obligation of federal LIHEAP funds, not expenditure of federal LIHEAP funds. In some cases, obligated funds are not actually expended until after the end of the federal fiscal year. • The total “Uses of Funds” (shown in Item 45 of Section IV) should equal the total “Sources of Funds” (shown in Item 16 of Section III). • “Other LIHEAP assistance” would include federal LIHEAP funds used to provide “other crisis assistance,” such as furnace or air conditioner repairs or replacements. Annual Report on Households Assisted by LIHEAP The Annual Report on Households is used to report data on the number, income levels and demographic information on both households assisted and households applying for assistance. Both reports are required to separate the data by regular LIHEAP funding and additional LIHEAP funding under the Coronavirus Aid, Relief, and Economic Security (CARES) Act, and the American Rescue Plan Act of 2021 (ARPA). Quarterly Performance and Management Report The Quarterly Performance and Management Report requires the Department to report aggregated data on total households assisted, performance management metrics and estimated uses of LIHEAP funds, along with some narrative information about program implementation and support. The Department maintains a LIHEAP database that stores recipient information used to complete many sections of these reports. Department staff rely on reports with preset criteria from this database to pull necessary information. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls over and did not comply with reporting requirements for LIHEAP. The prior finding numbers were 2023-055, 2022-039 and 2021-032. Description of Condition The Department did not have adequate internal controls over and did not comply with the reporting requirements for LIHEAP. To ensure the data pulled from the LIHEAP database is accurate and complete, we reviewed the stored procedures for generating the reports. We found that there were errors in the logic that caused these reports to not capture the correct program data that should have been reported to the federal grantor. We reviewed the LIHEAP Performance Data Form and Annual Report on Households Assisted for the federal fiscal year ending September 30, 2023. In addition, we reviewed the four Quarterly Performance and Management Reports that the Department submitted during the audit period. We examined each report and attempted to recalculate the information reported using the supporting documentation used to prepare the reports and data from the LIHEAP database. We identified the following discrepancies: LIHEAP Performance Data Form In Module 1 Estimated Uses of LIHEAP Funds, 15 of the 21 fields had discrepancies: • Eight of 21 (38%) fields were inaccurate. The range of variance on what was reported and what was supported was between -$5,699,151 and $96,661. • The Department was unable to provide support for seven of 21 (33%) fields Furthermore, we found a discrepancy of $1,945,675 between the total source of funds in section III and the total use of funds in section IV where these amounts should match. Lastly, the amount reported for obligations on the Performance Data Form did not reconcile to the amounts reported on both the Carryover and Reallotment and the SF-425 reports. The Department reported $99,468,214 in total obligations on the Performance Data Form and $101,962,464 on the Carryover and Reallotment and SF-425 reports for a difference of $2,494,250. Annual Report on Households Assisted by LIHEAP • Ten of 14 (71%) fields we examined were inaccurate. • The differences in the amounts reported and data from the LIHEAP database were between 6322 households underreported to 35 households overreported. Quarterly Performance and Management Report • Sections 1, Total Households Assisted and 2, Performance Management: o For 2023 Q3 we determined that three out of three (100%) fields were inaccurate.  The difference between values reported and data provided were between 103 to 3924 households underreported. o For 2023 Q4 we determined that three out of three (100%) fields were inaccurate.  The difference between values reported and data provided were between one to 451 households underreported. • Section 3, Estimated Uses of Funds: o For the 2023 Q3 & Q4 reports there was a difference of -$7,286,259 in the reported amount of funds obligated with the amount in documentation provided. o For the 2024 Q1 & Q2 reports there was a difference of -$8,528,492 in the reported amount of funds obligated with the amount in documentation provided. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition For all three reports, there were errors in the logic used to pull data from the LIHEAP Database that caused sections of these reports to contain inaccurate data. The Department did not detect these errors before the audit. In addition, management did not ensure they properly reviewed and approved these reports before the Department submitted them. In response to the prior year finding, the Department began to retain source documentation used at the time of completing these reports. However, for the Quarterly Performance Management Report, the Department had already completed two of the quarterly reports before implementing this new process. Therefore, current data from the LIHEAP database was used to test these two quarters and since this is real-time data that can change over time without the ability to track changes, the data used to verify the reported amounts has changed since the time of report submission. Department officials also said the agency is understaffed and experienced turnover among key personnel, including management, who are involved in preparing and submitting the reports. Effect of Condition By not establishing proper logic to pull data from the LIHEAP database, the Department cannot ensure the amounts reported to the federal grantor were complete and accurate. Additionally, by not retaining supporting documentation and source data for the Quarterly Performance Management Report, management was unable to demonstrate the amounts the Department reported to the federal grantor were complete and accurate. Finally, the terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance with reporting requirements by suspending or terminating the award, or withholding future awards, should it choose to do so. Recommendations We recommend the Department: • Establish effective internal controls to ensure the reports are accurate and complete • Establish effective internal controls to ensure that the LIHEAP Database reports are accurate and complete • Ensure management reviews reports before submission • Ensure it retains supporting documentation and real-time data used to prepare the reports • Ensure all amounts reported align with reporting requirements and methodologies • Consult with the federal grantor to determine if revision and resubmission of the reports are necessary to correct amounts reported Department’s Response We concur with the audit finding and are committed to implementing corrective actions to address the identified discrepancies. Program staff will work with the Financial Services Division (FSD) staff to enhance internal controls and ensure accurate reporting by requiring that all sections completed by budget staff be reviewed and approved by the Budget Manager for completeness and accuracy prior to submission to the program for entry into the Federal Reporting System. Additionally, budget and accounting staff and managers will ensure Module 1 of the LIHEAP Performance Data Form reconciles to the amounts reported on both the Carryover and Reallotment, and the SF-425 reports to prevent reporting inconsistencies. As a result of the deficiencies identified, information technology (IT) staff conducted a thorough review of the LIHEAP Admin Report 706 – LIHEAP AT 2024 HHR Long Form FY 24 and identified errors affecting data accuracy. System updates were implemented to correct these issues and ensure alignment with the federal reporting guidelines. IT staff will continue to monitor and refine data processes to improve accuracy and consistency. These efforts will ensure that LIHEAP reports remain complete, accurate, and compliant with federal reporting requirements. It is important to note that quarterly reports are point-in-time counts and can change throughout the program year. The inaccuracies in the quarterly reports were due to the omission of LIHEAP Weatherization obligations. Following guidance from the U.S. Department of Health and Human Services program staff will include LIHEAP-Weatherization obligations for all future reporting. To better explain some of the deficiencies reported, the period of performance audited is the state fiscal year which presents challenges in immediately implementing corrective actions. Each SAO audit covers two overlapping federal award periods which restricts our ability to make required changes until the next program cycle, as contracts and NOFA information are already executed when findings are issued. Despite this, the program is committed to integrating necessary corrections at the start of each new program year to improve the accuracy and completeness of LIHEAP reporting. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, Subpart 342, Monitoring and reporting program performance, states in part: b. Non-construction performance reports. The HHS awarding agency must use standard, OMB-approved data elements for collection of performance information (including performance progress reports, Research Performance Progress Report, or such future collections as may be approved by OMB and listed on the OMB Web site). 1. The non-Federal entity must submit performance reports at the interval required by the HHS awarding agency or pass-through entity to best inform improvements in program outcomes and productivity. Intervals must be no less frequent than annually nor more frequent than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes. Annual reports must be due 90 calendar days after the reporting period; quarterly or semiannual reports must be due 30 calendar days after the reporting period. Alternatively, the HHS awarding agency or pass-through entity may require annual reports before the anniversary dates of multiple year Federal awards. The final performance report will be due 90 calendar days after the period of performance end date. If a justified request is submitted by a non-Federal entity, the HHS awarding agency may extend the due date for any performance report. Title 45 CFR Part 96, Subpart 82, Required report on households assisted, states in part: a. Each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1 – September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Office of Management and Budget, 2024 Compliance Supplement, Assistance Listing 93.568 Low-Income Home Energy Assistance Program, describes the compliance requirements for special and performance reporting. The U.S. Department of Health and Human Services, Division of Energy Assistance, Office of Community Services, Administration of Children and Families, provides the following reporting instructions: • Instructions for the LIHEAP Performance Data Form for FFY 2023 • Instructions for the LIHEAP Household Report for FFY 2023 – Long Form • Instructions for Completion of the Quarterly Performance and Management Report for the Low-Income Home Energy Assistance Program The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-054 The Department of Commerce did not have adequate internal controls over and did not comply with federal requirements to ensure subawards for the Low-Income Home Energy Assistance Program are clearly identified as subawards. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 2101WALIEA,2101WAE5C6, 2101WALWC6, 2101WALWC5, 2201WALIEI, 2201WALIEA, 2201WALIE4, 2301WALIEA, 2301WALIEE, 2301WALIEI, 2401WALIEA, 2401WALIEI Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, 2023-056 Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia and U.S. territories. In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. The Department makes subawards to community-based organizations to provide this assistance. In fiscal year 2024, the Department spent more than $96 million in federal funds, about $89.5 million of which it paid to subrecipients. The Department administers and awards LIHEAP funds under two programs: the energy assistance program and the weatherization program. During the audit period, the energy assistance program allocated funds to 26 subrecipients to assist low-income households with their energy costs, and the weatherization program allocated funds to 24 subrecipients for construction projects to increase the energy efficiency of homes and apartments. About 85% of LIHEAP funds go to the energy assistance program, with no more than 15% allocated for weatherization activities. Each program makes separate subawards to subrecipients. Federal regulations require pass-through entities to ensure that every subaward is clearly identified to a subrecipient as a subaward, and that it includes 14 federal award identification elements. These elements include the subrecipient’s unique entity identifier, the Federal Award Identification Number, name of the federal awarding agency, the program’s Assistance Listing Number and title, and more. The contract unit creates and maintains contract and subaward templates that programs use to draft contracts and subawards but is not involved in reviewing these subawards for compliance prior to execution. LIHEAP program management prepare and review subawards prior to execution to ensure all elements are included in the subaward. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls over and did not comply with federal requirements to ensure subawards for LIHEAP contained the federal award identification elements. The prior finding number was 2023-056. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure subawards for LIHEAP are clearly identified as subawards. During the audit period, the Department executed 63 LIHEAP subawards for the energy assistance and weatherization programs. The Department uses the same process for these two programs to ensure the 14 federal award identification elements are included in the subawards. We used a nonstatistical sampling method to randomly select and examine 12 out of a total population of 63. We found that seven subawards (58%) for energy assistance did not clearly identify the subaward as such to the subrecipient. On the face sheet of these subawards there are boxes to identify if the agreement is for a subrecipient or contract. For these seven awards, the Department identified it was for a contractor instead of a subrecipient even though the fields on the face sheet use the term “grantee.” In addition, for these seven agreements, the page following the face sheet in the agreement is a sheet titled "Contract Information Sheet." This sheet refers to the subrecipient as a contractor and continues to use the terms contract and contractor throughout the remainder of the agreement. All seven of the agreements are also titled as “Federal Client Service Contract.” Washington state law has specific guidance and requirements related to client service contracts that are not consistent with requirements for subawards. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The program manager for energy assistance believed these award recipients to be contractors instead of subrecipients. In addition, the contract and subaward templates created by the contract unit at the Department use consistent language throughout, but the program manager edited the templates, resulting in inconsistent language. Effect of Condition By not correctly identifying the award as a subaward, the Department cannot ensure the subrecipient will comply with federal subrecipient requirements. Recommendation We recommend the Department establish policies and procedures and provide training for staff to ensure subawards are clearly identified as such to subrecipients. In addition, we recommend the Department consider incorporating the contracts unit when reviewing draft contracts and subawards. Department’s Response The Department acknowledges the SAO finding but clarifies that the terminology used in subawards was not the result of a program manager’s independent modifications, the term “contractor” is included in Department contracts to refer to the entity the Department is contracting with, it was not used to designate the federal recipient type.  Department templates used for subrecipient awards have been updated to include a designation of contractor or subrecipient. For all future contracts, the LIHEAP program will ensure the applicable contract templates are used to include the federal recipient type and all of the requirements for pass through entities. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, states, in part: All pass-through entities must: a. Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. … Title 45 CFR Part 75, section 2, Definitions, state, in part: These are the definitions for terms used in this part. Different definitions may be found in Federal statutes or regulations that apply more specifically to particular program or activities. These definitions could be supplemented by additional instructional information provided in in governmentwide standard information collections. Contract means a legal instrument by which a non-Federal entity purchases property or services needed to carry out the project or program under a Federal award. The term as used in this part does not include a legal instrument, even if the non-Federal entity considers it a contract, when the substance of the transaction meets the definition of a Federal award or subaward (see Subaward). Contractor means an entity that receives a contract as defined in Contract. Subaward means an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a Federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a Federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Subrecipient means a non-Federal entity that receives a subaward from a pass-through entity to carry out part of a Federal program; but does not include an individual that is a beneficiary of such program. A subrecipient may also be a recipient of other Federal awards directly from a Federal awarding agency. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 39 Revised Code of Washington, Chapter 39.26, Procurement of Goods and Services, contains guidance on the procurement of goods and services, including for client service contracts.

2024-055 The Department of Commerce did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Low Income Home Energy Assistance program received required single audits, and that it appropriately followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 2101WALIEA,2101WAE5C6, 2101WALWC6, 2101WALWC5, 2201WALIEI, 2201WALIEA, 2201WALIE4, 2301WALIEA, 2301WALIEE, 2301WALIEI, 2401WALIEA, 2401WALIEI Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia and U.S. territories. In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. The Department administers and awards LIHEAP funds under two programs: the energy assistance program and the weatherization program. Subawards are issued to community-based organizations to provide this assistance. In fiscal year 2024, the Department spent more than $96 million in federal funds, about $89.5 million of which it paid to subrecipients. Federal regulations require the Department to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more on federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes to subrecipients, the Department must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a Department-funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the Federal Audit Clearinghouse. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. To monitor its compliance with these requirements, the Internal Control Office uses an Excel workbook to track subrecipients’ single audits along with identifying any program-funded findings. The subrecipients included on this list are provided to the Internal Control Office by program staff. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the LIHEAP received required single audits, and that it appropriately followed up on findings and issued management decisions. During the audit period, the spreadsheet used to monitor compliance with these requirements included seven LIHEAP subrecipients. By reviewing prior year LIHEAP expenditures, we determined there were 33 LIHEAP subrecipients that may have been required to receive a single audit. We requested the Department verify this number, but did not receive a confirmation. As a result, we concluded the Department did not properly track 26 out of these 33 subrecipients to review the subrecipients’ audits for program-funded findings and completion of required management decisions, if applicable. In addition, we found one subrecipient received a LIHEAP finding requiring a management decision letter. This subrecipient was not tracked on the spreadsheet and no letter was issued by the end of the audit period, 14 months after the report was accepted into the Federal Audit Clearinghouse. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Internal Control Office staff responsible for ensuring compliance received a list of subrecipients from program staff, but did not verify that the list was complete. Therefore, the list provided by program staff was tracked, but not the remaining subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure that all subrecipients received single audits when they were required. Further, the Department cannot ensure it follows up on subrecipient single audit findings and communicates required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and that management monitors them for effectiveness when required, the Department cannot determine whether its subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the Department: • Monitor subrecipients to ensure all required audit reports are submitted and reviewed to determine if any additional subrecipients are required to take corrective action to address audit recommendations • Establish effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required • Ensure subrecipients develop and take acceptable corrective actions to adequately address all audit recommendations • Issue a written management decision for all applicable audit findings, if necessary Department’s Response The Department appreciates the review of the single audit verification process but respectfully disagrees with information reported in the finding. The Internal Controls Office (ICO) implemented strong internal controls in 2022 to monitor and verify single audit reporting. This is supported by fiscal year 2023 opinions issued which found no deficiencies. During the current audit the auditor in charge changed three times leading to issues in understanding of the monitoring process. Additionally, a total of eight subrecipients were selected for testing of management decisions, however, seven of those selected were drawn inaccurately and not applicable for testing at Commerce. The process to identify, review, verify and document subrecipients who meet the federal single audit reporting requirements in comprehensive but relies on information provided from internal programs. ICO staff generate a Contracts Management System (CMS) report, an Agency Financial Reporting System (AFRS) report to identify federally funded subrecipients then confirm then with program staff. The process largely relies on our program partners to confirm their list of subrecipients. As referenced in the current year LIHEAP finding for subrecipient monitoring subaward language, most of the subrecipients were identified as contractors who are exempt from federal reporting resulting in the ICO receiving an incomplete list of subrecipients to verify. A total of eight LIHEAP recipients were verified as they received funding and were confirmed as subrecipients of other programs. After receiving the updated list of subrecipients in October 2024, ICO staff verified all but three, of those, two did not meet the reporting threshold and one report we are requesting to obtain from the entity. The Department acknowledges internal controls need to be strengthened in the determination of recipient type. As a result of staffing shortages, the management decision letter tested was not issued within the six month requirement. We have worked on addressing the staffing shortages and will continue to strengthen controls and compliance when deficiencies are identified. Auditor’s Remarks The original testing selections sent to the Department did include seven Department subrecipients that did not have findings related to the LIHEAP program, but these were removed from the testing population once this was identified during the normal audit process and they were not included in our reported results. We appreciate the Department acknowledges that it did not monitor the single audit requirement for all LIHEAP subrecipients during the audit period and that the only subrecipient with a LIHEAP finding did not receive a management decision letter. We also appreciate the Department’s commitment to strengthening its control processes to ensure it has a full population of subrecipients that are required to be monitored for compliance. We reaffirm our finding and will review the status of the Office’s corrective action during the next audit.  Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, states, in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 75.521. (f) Verify that every subrecipient is audited as required by subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 75.501. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 75.371 and in program regulations. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-056 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers for the Child Care and Development Fund Cluster programs were allowable and properly supported. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2303WACCDF; 2303WACCDD; 2403WACCDM; 2403WACCDD; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2024WACCDD Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $415,579,473 Prior Year Audit Finding: Yes, Finding 2023-058 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2024, the Department spent about $483.5 million in federal funding. The Department is responsible for establishing policies to ensure payments to providers for child care services are allowable. In fiscal year 2024, the Department spent more than $415 million on monthly child care subsidy payments to child care providers. There are three child care provider types: licensed centers, licensed family homes and licensed exempt providers referred to as Family, Friends and Neighbor providers. The Department uses the Social Service Payment System (SSPS) to process the payments it makes to child care providers. The system allocates payments to various funding sources based on the client’s eligibility. These funding sources include multiple federal programs, multiple CCDF federal grant awards and state funding. The Department uploads the SSPS payment data into the state’s accounting system at a summary level based on the various funding sources. There is always a need to transfer the funding sources for some payments throughout the year to manage federal and state funds properly. In prior audit periods up until fiscal year 2021, the Department prepared supporting documentation for transfers that included details of what payments it was transferring. The purpose of documenting this detail was to maintain proper support for federal expenditures. The Department of Health and Human Services (HHS), which oversees the CCDF program at the federal level, requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have used them in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to childcare providers were allowable and properly supported. We have reported this condition since 2005. The most recent audit finding numbers were 2023-058, 2022-041, 2021-033, 2020-038, 2019-035, 2018-034, 2017-024, 2016-021, 2015-023, 2014-023, 2013-016, 12-28, 11-23, 10-31, 9-12 and 8-13. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers for the CCDF programs were allowable and properly supported. In fiscal year 2021, management informed us that the Department changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditure coding in SSPS inaccurate and unreliable for testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent CCDF funds in accordance with federal and state regulations. Further, this meant we could not test the Department’s payments to child care providers for compliance with activities allowed and cost principles. By processing these adjustments at the fund level, the Department invalidated the transaction-level documentation of the original child care expenditure in SSPS and did not identify the new allocation at the payment level. Additionally, the Department transferred some of these child care expenditures at the fund level more than once, making the underlying data increasingly unreliable with each transfer. We consider these internal control deficiencies to be a material weakness that led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. The Department’s accounting practices prevent it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions in the payment system that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition and Questioned Costs By not complying with federal law requirements to maintain adequate supporting documentation for expenditures, the Department made it impossible for our Office to audit the federal dollars it used for payments to child care providers. Because we could not test transaction-level detail, we also could not determine whether the issues we identified in prior audits had improved or worsened, including the Department’s lack of adequate internal controls and significant rate of noncompliance for payments to child care providers. The total amount of known child care payments the Department made with federal CCDF funds in the audit period was $415,579,473. The Department also partially funded these payments with an additional $208,098,727 in state dollars. Because the Department did not comply with HHS requirements to allow for the tracing of grant expenditures to a payment level, we are questioning all $415,579,473 in federal program costs it incurred during the audit period. The payments the Department partially paid with state funds are not included in the federal questioned costs. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department:  • Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules • Consult with the grantor to discuss whether it should repay the questioned costs identified in the audit Department’s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department’s grant adjustments were processed based on eligible clients and allowable activities and did not include child-level data as required by SAO. The Department received a management decision letter dated October 3, 2023, from HHS for finding 2021-033 (2020-038) which states: “the ACF noted that the auditor raised concern about the Department’s accounting procedures and efforts made to trace expenditures at the transaction-level. As the basis for the finding, the auditor used CFRs (200.53, 200.303, 200.403, 200.410) that do not apply to CCDF. Federal regulations allow Lead Agencies to expend and account for CCDF funds in accordance with their own procedures.” In addition, ACF did not sustain the disallowance of questioned costs and stated: “Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” The ACF recommended, “that the Department work with the auditors to determine an appropriate methodology that can be tested to ensure child care payments comply with Federal regulations.” The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. The SAO maintained that the program is not auditable without child-level data. During the audit period, the Department did not have the staff and resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the auditor’s recommendations, the Department submitted a budget request for the 2024 supplemental budget. The enacted 2024 supplemental budget included funding to implement the Department’s budget request for funding beginning in state fiscal year 2025 and specified: “Funding in this subsection must be expended with internal controls that provide child-level detail for all transactions, beginning July 1, 2024” Upon receiving funding, the Department is working with a developer to assist with building out the required databases between the Social Service Payment System (SSPS) and the Agency Financial Reporting System (AFRS) to allow transfers between fundings sources to include the child-level data related to the expenditures. The Department looks forward to working with SAO to resolve the child-level data concerns and move forward with auditing the CCDF grant programs. Auditor’s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. During the February 2022 meeting with HHS that the Department referenced in its response, the grantor stated the specific federal law the Department’s accounting procedures were noncompliant with was 45 CFR 98.67. We agree with the HHS management decision that our references to 2 CFR 200.53, 200.303, 200.403 and 200.410 in the 2021 finding were not correct. However, HHS adopted these same requirements in 45 CFR 75.2, 75.303, 75.403 and 75.410, respectfully. These requirements were all in place during the audit period. The proper references were included in the prior year finding and are included in this finding as well. Without adequate transactional level payment data, our Office is unable to perform tests to verify the Department met these requirements. In addition, we also are unable to verify whether the Department complied with matching, level of effort and earmarking requirements, or that required financial information reported to the federal government was accurate. These matters are referenced in separate findings in our report. In its response, the Department references a management decision letter issued October 3, 2023. The finding was partially sustained because the questioned costs identified in the audit would not be disallowed. The management decision states: “The ACF partially sustains the finding and recommendation. The ACF agrees with the auditor that the Department should strengthen internal controls to ensure payments to child care providers are allowable and properly supported.” “The ACF does not sustain a disallowance for the questioned costs in the amount of $271,353,409 representing the entire amount of the CCDF grant award. Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” We are not aware of what procedures ACF performed to conclude expenditures reported by the Department for fiscal year 2024 were spent only for allowable activities, were for allowable costs and met federal cost principles. We questioned all expenditures because, in our judgment, they were unauditable. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 2, Definitions, includes the definition of improper payment. 45 CFR Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. 45 CFR Part 75, section 403, Factors Affecting Allowability of Costs. 45 CFR Part 75, section 410, Collection of Unallowable Costs 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 98.67 – Fiscal requirements, states: (a)  Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c)  Fiscal control and accounting procedures shall be sufficient to permit: (1)  Preparation of reports required by the Secretary under this subpart and under subpart H; and (2)  The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-057 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with matching, level of effort and earmarking requirements for the Child Care and Development Fund Cluster. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2303WACCDF; 2303WACCDD; 2403WACCDM; 2403WACCDD; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2024WACCDD Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Matching, Level of Effort, Earmarking Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-060 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2024, the Department spent about $483.5 million in federal funding. The CCDF consists of three distinct funding sources: Discretionary Fund, Mandatory Fund, and Matching Fund. Additionally, under the Temporary Assistance for Needy Families (TANF) program, the Department may transfer TANF funds to the CCDF, which are then treated as Discretionary Funds. The Department is instructed how to spend this federal money. For the Department to receive its allotted share of the Matching Fund, it must meet the Maintenance of Effort (MOE) requirement and match the federal Matching Fund claimed with state expenditures at the Federal Medical Assistance Percentage rate for the applicable fiscal year. The Department must also meet earmarking requirements for expenditures for administrative and quality activities. The U.S. Department of Health and Human Services (HHS), which oversees the CCDF program at the federal level, requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have used them in accordance with program requirements. Department staff run monthly and quarterly expenditure reports from the accounting system to track requirements over matching, level of effort and earmarking for each open grant award. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over matching, level of effort and earmarking requirements for the CCDF Cluster programs. The prior audit finding numbers were 2023-060, 2022-042, 2021-036, 2020-040 and 2019-037. Description of Condition The Department did not have adequate internal controls over and did not comply with matching, level of effort and earmarking requirements for the CCDF programs. The Department’s accounting records should be used to verify it has met matching, level of effort and earmarking requirements. In fiscal year 2021, management informed us that the Department changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditure coding in the payment system inaccurate and unreliable for testing. Without identifying which expenditures it transferred, the Department’s monitoring is insufficient for properly managing matching, level of effort and earmarking requirements. Our Office could not rely on the data supporting the Department’s expenditures or verify that the accounting records were accurate. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent CCDF funds in accordance with federal and state regulations. Further, this meant we could not test the Department’s payments for compliance with matching, level of effort and earmarking requirements. By processing these adjustments at the fund level, the Department invalidated the transaction-level documentation of the original child care expenditure in the payment system and did not identify the new allocation at the payment level. Additionally, the Department transferred some of these child care expenditures more than once at the fund level, making the underlying data increasingly unreliable with each transfer. This condition is also referenced in audit finding 2024-056. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. The Department’s accounting practices prevent it from meeting this requirement. In fiscal year 2021, the Department informed our Office that it had implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions in the payment system that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition By not complying with federal law requirements to maintain adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to determine if it had met matching, level of effort and earmarking requirements. Recommendations We recommend the Department: • Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules • Develop effective ongoing monitoring procedures Department’s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department’s grant adjustments were processed based on eligible clients and allowable activities and did not include child-level data as required by SAO. The Department received a management decision letter dated October 3, 2023, from HHS for finding 2021-033 (2020-038) which states: “the ACF noted that the auditor raised concern about the Department’s accounting procedures and efforts made to trace expenditures at the transaction-level. As the basis for the finding, the auditor used CFRs (200.53, 200.303, 200.403, 200.410) that do not apply to CCDF. Federal regulations allow Lead Agencies to expend and account for CCDF funds in accordance with their own procedures.” In addition, ACF did not sustain the disallowance of questioned costs and stated: “Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” The ACF recommended, “that the Department work with the auditors to determine an appropriate methodology that can be tested to ensure child care payments comply with Federal regulations.” The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. The SAO maintained that the program is not auditable without child-level data. During the audit period, the Department did not have the staff and resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the auditor’s recommendations, the Department submitted a budget request for the 2024 supplemental budget. The enacted 2024 supplemental budget included funding to implement the Department’s budget request for funding beginning in state fiscal year 2025 and specified: “Funding in this subsection must be expended with internal controls that provide child-level detail for all transactions, beginning July 1, 2024” Upon receiving funding, the Department is working with a developer to assist with building out the required databases between the Social Service Payment System (SSPS) and the Agency Financial Reporting System (AFRS) to allow transfers between fundings sources to include the child-level data related to the expenditures. The Department looks forward to working with SAO to resolve the child-level data concerns and move forward with auditing the CCDF grant programs. Auditor’s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. During the February 2022 meeting with HHS that the Department referenced in its response, the grantor stated the specific federal law the Department’s accounting procedures were noncompliant with was 45 CFR 98.67. We agree with the HHS management decision that our references to 2 CFR 200.53, 200.303, 200.403 and 200.410 in the 2021 finding were not correct. However, HHS adopted these same requirements in 45 CFR 75.2, 75.303, 75.403 and 75.410, respectfully. These requirements were all in place during the audit period. The proper references were included in the prior year finding and are included in this finding as well. Without adequate transactional level payment data, our Office is unable to perform tests to verify the Department met these requirements. In addition, we also are unable to verify whether the Department complied with matching, level of effort and earmarking requirements, or that required financial information reported to the federal government was accurate. These matters are referenced in separate findings in our report. In its response, the Department references a management decision letter issued October 3, 2023. The finding was partially sustained because the questioned costs identified in the audit would not be disallowed. The management decision states: “The ACF partially sustains the finding and recommendation. The ACF agrees with the auditor that the Department should strengthen internal controls to ensure payments to child care providers are allowable and properly supported.” “The ACF does not sustain a disallowance for the questioned costs in the amount of $271,353,409 representing the entire amount of the CCDF grant award. Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” We are not aware of what procedures ACF performed to conclude expenditures reported by the Department for fiscal year 2024 were spent only for allowable activities, were for allowable costs and met federal cost principles. We questioned all expenditures because, in our judgment, they were unauditable. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 98.67 – Fiscal requirements, states: (a)  Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c)  Fiscal control and accounting procedures shall be sufficient to permit: (1)  Preparation of reports required by the Secretary under this subpart and under subpart H; and (2)  The tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-058 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with period of performance requirements for the Child Care and Development Fund Cluster. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2303WACCDF; 2303WACCDD; 2403WACCDM; 2403WACCDD; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2024WACCDD Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-061 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2024, the Department spent about $483.5 million in federal funding. Each federal grant specifies a performance period during which recipients must obligate and liquidate program costs. These periods typically align with the federal fiscal year of October 1 through September 30. Payments for costs charged before a grant’s beginning date or after the ending date are not allowed without the grantor’s prior approval. The CCDF consists of three distinct funding sources: Discretionary Fund, Mandatory Fund, and Matching Fund. Each of these funds has specific period of performance requirements established in federal regulation (45 CFR § 98.60(d)). Recipients must obligate: • Discretionary funds by the end of the succeeding fiscal year after award and must expend them by the end of the third fiscal year after award • Mandatory funds by the end of the fiscal year in which they are awarded if the state also requests matching funds. If the state does not request matching funds for the fiscal year, then the Mandatory Funds are available until liquidated. • Matching funds by the end of the fiscal year in which they are awarded and must liquidate them by the end of the succeeding fiscal year after award During the audit period, the Department also received supplemental funds under the Coronavirus Aid, Relief, and Economic Security and the Coronavirus Response and Relief Supplemental Appropriations Acts. These funds are treated as Discretionary Funds, however, they have their own specific obligation and liquidation timeframes. The U.S. Department of Health and Human Services (HHS), which oversees the CCDF at the federal level, requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have used them in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over period of performance requirements for the CCDF program. The prior finding numbers were 2023-061, 2022-043, 2021-037 and 2020-041. Description of Condition The Department did not have adequate internal controls over and did not comply with period of performance requirements for the CCDF program. Our Office uses the Department’s accounting records to verify it has met the period of performance requirements. In fiscal year 2021, management informed us that the Department changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditures coded in the payment system inaccurate and unreliable for audit testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent CCDF funds in accordance with federal and state regulations. Further, this meant we could not test the Department’s payments for compliance with period of performance requirements. We also referenced this condition in audit finding 2024 -056. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. The Department’s accounting practices prevent it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions in the payment system that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition By not complying with federal law requirements to maintain adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to determine if it materially met the period of performance requirements. Furthermore, without adequate internal controls in place, the Department is at a higher risk of making improper payments with grant funds. Recommendations We recommend the Department: • Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules • Develop written policies and procedures over federal period of performance requirements Department’s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department’s grant adjustments were processed based on eligible clients and allowable activities and did not include child-level data as required by SAO. The Department received a management decision letter dated October 3, 2023, from HHS for finding 2021-033 (2020-038) which states: “the ACF noted that the auditor raised concern about the Department’s accounting procedures and efforts made to trace expenditures at the transaction-level. As the basis for the finding, the auditor used CFRs (200.53, 200.303, 200.403, 200.410) that do not apply to CCDF. Federal regulations allow Lead Agencies to expend and account for CCDF funds in accordance with their own procedures.” In addition, ACF did not sustain the disallowance of questioned costs and stated: “Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” The ACF recommended, “that the Department work with the auditors to determine an appropriate methodology that can be tested to ensure child care payments comply with Federal regulations.” The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. The SAO maintained that the program is not auditable without child-level data. During the audit period, the Department did not have the staff and resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the auditor’s recommendations, the Department submitted a budget request for the 2024 supplemental budget. The enacted 2024 supplemental budget included funding to implement the Department’s budget request for funding beginning in state fiscal year 2025 and specified: “Funding in this subsection must be expended with internal controls that provide child-level detail for all transactions, beginning July 1, 2024” Upon receiving funding, the Department is working with a developer to assist with building out the required databases between the Social Service Payment System (SSPS) and the Agency Financial Reporting System (AFRS) to allow transfers between fundings sources to include the child-level data related to the expenditures. The Department looks forward to working with SAO to resolve the child-level data concerns and move forward with auditing the CCDF grant programs. Auditor’s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. During the February 2022 meeting with HHS that the Department referenced in its response, the grantor stated the specific federal law the Department’s accounting procedures were noncompliant with was 45 CFR 98.67. We agree with the HHS management decision that our references to 2 CFR 200.53, 200.303, 200.403 and 200.410 in the 2021 finding were not correct. However, HHS adopted these same requirements in 45 CFR 75.2, 75.303, 75.403 and 75.410, respectfully. These requirements were all in place during the audit period. The proper references were included in the prior year finding and are included in this finding as well. Without adequate transactional level payment data, our Office is unable to perform tests to verify the Department met these requirements. In addition, we also are unable to verify whether the Department complied with matching, level of effort and earmarking requirements, or that required financial information reported to the federal government was accurate. These matters are referenced in separate findings in our report. In its response, the Department references a management decision letter issued October 3, 2023. The finding was partially sustained because the questioned costs identified in the audit would not be disallowed. The management decision states: “The ACF partially sustains the finding and recommendation. The ACF agrees with the auditor that the Department should strengthen internal controls to ensure payments to child care providers are allowable and properly supported.” “The ACF does not sustain a disallowance for the questioned costs in the amount of $271,353,409 representing the entire amount of the CCDF grant award. Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” We are not aware of what procedures ACF performed to conclude expenditures reported by the Department for fiscal year 2024 were spent only for allowable activities, were for allowable costs and met federal cost principles. We questioned all expenditures because, in our judgment, they were unauditable. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 98.60 – Availability of funds, states in part: (d) The following obligation and liquidation provisions apply to States and Territories: (1) Discretionary Fund allotments shall be obligated in the fiscal year in which funds are awarded or in the succeeding fiscal year. Unliquidated obligations as of the end of the succeeding fiscal year shall be liquidated within one year. (2)   (i) Mandatory Funds for States requesting Matching Funds per § 98.55 shall be obligated in the fiscal year in which the funds are granted and are available until expended. (ii)Mandatory Funds for States that do not request Matching Funds are available until expended. (4) Both the Federal and non-Federal share of the Matching Fund shall be obligated in the fiscal year in which the funds are granted and liquidated no later than the end of the succeeding fiscal year. Title 45 CFR, Section 98.67 – Fiscal requirements, states: (a)  Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c)  Fiscal control and accounting procedures shall be sufficient to permit: (1)  Preparation of reports required by the Secretary under this subpart and under subpart H; and (2)  The tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-059 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with financial reporting requirements for the Child Care and Development Fund Cluster. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2303WACCDF; 2303WACCDD; 2403WACCDM; 2403WACCDD; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2024WACCDD Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-062 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2024, the Department spent about $483.5 million in federal funding. The Department is required to submit a quarterly ACF-696 financial report for each open grant. These reports contain information on expenditures for three CCDF funding sources: the Mandatory Fund, the Matching Fund, and the Discretionary Fund. The Department uses CCDF expenditures recorded in the state’s accounting system to compile and support the ACF-696 report. The U.S. Department of Health and Human Services (HHS), which oversees the CCF program at the federal level, requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have used them in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over financial reporting requirements for the CCDF program. The prior finding numbers were 2023-062, 2022-044 and 2021-038. Description of Condition The Department did not have adequate internal controls over and did not comply with financial reporting requirements for the CCDF program. The Department’s accounting records must provide and support the financial information reported on ACF-696 reports. During the audit period, the Department’s grant management practice was to process expenditure transfers at the fund level without identifying which expenditures it transferred. Therefore, we could not rely on the data supporting the Department’s reported ACF-696 expenditures, and could not test whether the reports were accurate and complete. We also referenced this condition in audit finding 2024-056. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes using federal dollars. The Department’s accounting practices prevent it from meeting this requirement. In fiscal year 2021, the Department informed our Office that it had implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions in the payment system that supported them. This affected all populations of child care expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition By not complying with federal law requirements to maintain adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit the CCDF program expenditures reported on the ACF-696 financial report. Recommendation We recommend the Department design and implement internal controls to ensure the ACF-696 report is supported with transaction-level data that is sufficient to comply with federal law and state rules. Department’s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department’s grant adjustments were processed based on eligible clients and allowable activities and did not include child-level data as required by SAO. The Department received a management decision letter dated October 3, 2023, from HHS for finding 2021-033 (2020-038) which states: “the ACF noted that the auditor raised concern about the Department’s accounting procedures and efforts made to trace expenditures at the transaction-level. As the basis for the finding, the auditor used CFRs (200.53, 200.303, 200.403, 200.410) that do not apply to CCDF. Federal regulations allow Lead Agencies to expend and account for CCDF funds in accordance with their own procedures.” In addition, ACF did not sustain the disallowance of questioned costs and stated: “Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” The ACF recommended, “that the Department work with the auditors to determine an appropriate methodology that can be tested to ensure child care payments comply with Federal regulations.” The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. The SAO maintained that the program is not auditable without child-level data. During the audit period, the Department did not have the staff and resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the auditor’s recommendations, the Department submitted a budget request for the 2024 supplemental budget. The enacted 2024 supplemental budget included funding to implement the Department’s budget request for funding beginning in state fiscal year 2025 and specified: “Funding in this subsection must be expended with internal controls that provide child-level detail for all transactions, beginning July 1, 2024” Upon receiving funding, the Department is working with a developer to assist with building out the required databases between the Social Service Payment System (SSPS) and the Agency Financial Reporting System (AFRS) to allow transfers between fundings sources to include the child-level data related to the expenditures. The Department looks forward to working with SAO to resolve the child-level data concerns and move forward with auditing the CCDF grant programs. Auditor’s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. During the February 2022 meeting with HHS that the Department referenced in its response, the grantor stated the specific federal law the Department’s accounting procedures were noncompliant with was 45 CFR 98.67. We agree with the HHS management decision that our references to 2 CFR 200.53, 200.303, 200.403 and 200.410 in the 2021 finding were not correct. However, HHS adopted these same requirements in 45 CFR 75.2, 75.303, 75.403 and 75.410, respectfully. These requirements were all in place during the audit period. The proper references were included in the prior year finding and are included in this finding as well. Without adequate transactional level payment data, our Office is unable to perform tests to verify the Department met these requirements. In addition, we also are unable to verify whether the Department complied with matching, level of effort and earmarking requirements, or that required financial information reported to the federal government was accurate. These matters are referenced in separate findings in our report. In its response, the Department references a management decision letter issued October 3, 2023. The finding was partially sustained because the questioned costs identified in the audit would not be disallowed. The management decision states: “The ACF partially sustains the finding and recommendation. The ACF agrees with the auditor that the Department should strengthen internal controls to ensure payments to child care providers are allowable and properly supported.” “The ACF does not sustain a disallowance for the questioned costs in the amount of $271,353,409 representing the entire amount of the CCDF grant award. Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” We are not aware of what procedures ACF performed to conclude expenditures reported by the Department for fiscal year 2024 were spent only for allowable activities, were for allowable costs and met federal cost principles. We questioned all expenditures because, in our judgment, they were unauditable. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 98.67 – Fiscal requirements, states: (a)  Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c)  Fiscal control and accounting procedures shall be sufficient to permit: (1)  Preparation of reports required by the Secretary under this subpart and under subpart H; and (2)  The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-060 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with health and safety requirements for the Child Care and Development Fund program. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2303WACCDF; 2303WACCDD; 2403WACCDM; 2403WACCDD; 2103WACDC6; 2103WACSC6; 2103WACCC5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Health and Safety Requirements Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-064 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2024, the Department spent about $483.5 million in CCDF federal funding. The Department oversees two types of providers: licensed providers and license-exempt Family, Friend, and Neighbor (FFN) providers. The Department is responsible for ensuring all these providers meet health and safety standards. The monitoring activity varies for licensed and FFN providers. The Department has an approved CCDF State Plan for federal fiscal year 2022–2024 that outlines how it will meet the health and safety requirements for licensed and FFN providers. Licensed providers Department licensors conduct annual monitoring visits of licensed providers. During visits, they use a monitoring checklist to verify whether providers have met required health and safety standards. The licensors use the WA Compass system to document their activities. The system allows licensing staff to monitor the completion of visits, make timely updates and streamline their processes. When licensors identify health and safety violations during a monitoring visit, they document them on an inspection report. The inspection report contains the areas of provider noncompliance and establishes deadlines for correcting them. The Department is required to conduct timely follow-up visits on noncompliance issues to ensure providers correct them. Depending on the severity of the noncompliance, the Department has five, 10 or 15 business days to verify the noncompliance has been corrected. FFN providers Washington’s CCDF State Plan and a state rule (WAC 110-16-0025) require nonrelative FFN providers to complete health and safety training within 90 days of their subsidy payment begin date. They also must complete ongoing health and safety training. The Department conducts an annual health and safety visit to ensure providers are following health and safety rules. The Department adopted a rule (WAC 110-16-0030) that states it must conduct annual technical assistance visits for nonrelative FFN providers within a year of subsidy approval. During these visits, an FFN specialist reviews health and safety requirements and reminds the provider of the ongoing training requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the nine prior audits, we reported that the Department did not have adequate internal controls over and did not comply with health and safety requirements. The previous finding numbers were 2023-064, 2022-045, 2021-039, 2020-042, 2019-039, 2018-035, 2017-025, 2016-022, and 2015-024. Description of Condition The Department did not have adequate internal controls over and did not comply with health and safety requirements for the CCDF program. Licensed provider annual monitoring and noncompliance follow-ups We used a statistical sampling method to randomly select 59 out of a total population of 6,416 licensed providers. We examined this sample of licensed providers to determine if they received an annual monitoring visit and that the Department performed timely, appropriate follow-ups when they found noncompliance issues. We identified 16 instances (27%) in which the licensor did not conduct the appropriate follow-up visit on noncompliance issues within the required time frame. Nonrelative FFN provider ongoing training and annual technical visits The Department asserted that it uses the FFN Household CCDF Monitoring Report in WA Compass to determine if the FFN meets all training requirements. After reviewing this report, we determined that while the report contains information on current training requirements, it does not contain information for training that has already occurred during the audit period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Licensed provider annual monitoring and noncompliance follow-ups Department officials said the agency did not conduct 16 of the 59 monitoring follow-up visits within the required timeframe that we reviewed because it was unable to maintain the necessary level of staffing. Additionally, management did not ensure monitoring follow-up visits on identified noncompliance occurred, as the CCDF program requires. Nonrelative FFN provider ongoing training and technical visits Department staff remove FFNs from the personal tracking spreadsheets once training is completed, and the information is not maintained in the WA Compass system, which prevented our Office from fully auditing the Department’s monitoring activities during the audit period for ensuring that training requirements for FFNs were completed timely. Effect of Condition Licensed provider annual monitoring and noncompliance follow-ups By not following up on noncompliance in a timely manner, the Department did not have assurance that providers met health and safety requirements, which can put children in jeopardy of harm, neglect and unhealthy environments. Nonrelative FFN provider ongoing training and technical visits By not retaining documentation of monitoring activities, the Department could not demonstrate that it was performing monitoring. Recommendation We recommend the Department: • Strengthen internal controls to ensure it sufficiently monitors all health and safety requirements • Ensure management follows established policies and procedures to ensure licensors complete all monitoring visits and conduct thorough, timely follow-ups on any identified noncompliance issues • Improve documentation of internal controls to support that it performed monitoring activities during the audit period Department’s Response The Department is strongly committed to ensuring the health, safety, and well-being of all children in care. As to the State Auditor’s Office (SAO) specific findings, the Department partially concurs and offers the following detail: Licensed provider annual monitoring and noncompliance follow-ups The Department concurs that follow up visits were not completed timely for the cases identified by SAO. Given the Department’s limited staffing resources and high volume of providers, the Department was unable to complete all follow up visits within the timelines required. During state fiscal year 2024 the Department took the following actions to strengthen internal controls and increase recruitment of licensing staff: • Developed and implemented a monitoring recheck tool in the WA Compass system assist with tracking and monitoring requirements are completed prior to cases being marked complete within the system. • Created the option to document on the monitoring checklist when a non-compliance item is Corrected On-site during the monitoring visit. • Created a new unit of licensing staff in King County to assist with caseload increases in the fastest growing provider area in Washington. • Established new licensing staff positions to create a pathway for advancement to assist with staff recruitment efforts. • Implemented new recruitment and training plans for child care licensors. Recruited and trained licensors were able to complete monitoring visits at the same rate as experienced licensing staff. During state fiscal year 2024 the Department completed 100% of on-site monitoring visits. Of the cases identified by SAO, the average follow up visit is delayed by 11 business days. Although the follow up visits were not completed within the timelines required, 100% of the follow up visits occurred. The Department is focused on strengthening internal controls around all health and safety requirements and is confident that corrective actions taken will improve this area moving forward.. As part of its quality improvement initiative, the Department has implemented data-driven decisions to assist providers and their staff to meet health and safety requirements and prioritized monitoring visits to come back into compliance. Nonrelative FFN provider ongoing training and technical visits The Department partially concurs with the audit finding. The State Auditor’s Office (SAO) selected samples and examined 44 nonrelative providers that received child care payments during the audit period. In all instances, SAO found no issues of noncompliance or exceptions, all providers had their required trainings and technical visits as outlined in the Departments applicable health and safety WACs. The MERIT system and the WA Compass system are monitored by staff to ensure providers comply with health and safety requirements. The current WA Compass reports are real-time dashboards to assist staff with determining requirements that are due within 30, 60, 90 days. MERIT is the system of record for individual providers training requirements. Staff perform monitoring activities outlined in the reports to verify compliance, to include checking training completion dates in MERIT and updating WA Compass with the information. Once requirements are met in WA Compass the completed tasks are no longer reflected on the dashboard. The SAO maintained that the program is not auditable without the historical data showing compliance due dates to document monitoring activities including training requirements. The Department is committed to collaborating with SAO to determine an appropriate methodology that identify a sampling unit that can be used to accurately test internal controls around monitoring activities. Staff will continue to track and monitor FFN health and safety requirements with available tools and determine how to retain documentation to demonstrate this compliance for SAO. Auditor’s Remarks Regarding Nonrelative FFN provider ongoing training and technical visits, we selected and tested ongoing training and technical visits for 13 nonrelative FFN providers. Because the Department's FFN Household CCDF Monitoring Report only contains information on current training requirements, and the Department could not provide other support for its monitoring control activities, we could not determine if monitoring occurred during the audit period. We appreciate the Department’s commitment to improve its monitoring and compliance with health and safety requirements. We reaffirm our finding and will follow up on the status of the Department's corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 98.41, Health and safety requirements, states: a. Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements, which are subject to monitoring pursuant to § 98.42, shall: 1. Include health and safety topics consisting of, at a minimum: i. The prevention and control of infectious diseases (including immunizations); with respect to immunizations, the following provisions apply: A. As part of their health and safety provisions in this area, Lead Agencies shall assure that children receiving services under the CCDF are age-appropriately immunized. Those health and safety provisions shall incorporate (by reference or otherwise) the latest recommendation for childhood immunizations of the respective State, territorial, or tribal public health agency. B. Notwithstanding this paragraph (a)(1)(i), Lead Agencies may exempt: 1. Children who are cared for by relatives (defined as grandparents, great grandparents, siblings (if living in a separate residence), aunts, and uncles), provided there are no other unrelated children who are cared for in the same setting. 2. Children who receive care in their own homes, provided there are no other unrelated children who are cared for in the home. 3. Children whose parents object to immunization on religious grounds. 4. Children whose medical condition contraindicates immunization. C. Lead Agencies shall establish a grace period that allows children experiencing homelessness and children in foster care to receive services under this part while providing their families (including foster families) a reasonable time to take any necessary action to comply with immunization and other health and safety requirements. 1. The length of such grace period shall be established in consultation with the State, Territorial or Tribal health agency. 2. Any payment for such child during the grace period shall not be considered an error or improper payment under subpart K of this part. 3. The Lead Agency may also, at its option, establish grace periods for other children who are not experiencing homelessness or in foster care. 4. Lead Agencies must coordinate with licensing agencies and other relevant State, Territorial, Tribal, and local agencies to provide referrals and support to help families of children receiving services during a grace period comply with immunization and other health and safety requirements; ii. Prevention of sudden infant death syndrome and use of safe sleeping practices; iii. Administration of medication, consistent with standards for parental consent; iv. Prevention and response to emergencies due to food and allergic reactions; v. and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; vi. Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; vii. Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man- caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; viii. Handling and storage of hazardous materials and the appropriate disposal of biocontaminants; ix. Appropriate precautions in transporting children, if applicable; x. Pediatric first aid and cardiopulmonary resuscitation; xi. Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph(e) of this section; and xii. May include requirements relating to: A. Nutrition (including age-appropriate feeding); B. Access to physical activity; C. Caring for children with special needs; or D. Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children’s health and safety. 2. Include minimum health and safety training on the topics above, as described in § 98.44. b. Lead Agencies may not set health and safety standards and requirements other than those required in paragraph (a) of this section that are inconsistent with the parental choice safeguards in § 98.30(f). c. The requirements in paragraph (a) of this section shall apply to all providers of child care services for which assistance is provided under this part, within the area served by the Lead Agency, except the relatives specified at §98.42(c). d. Lead Agencies shall describe in the Plan standards for child care services for which assistance is provided under this part, appropriate to strengthening the adult and child relationship in the type of child care setting involved, to provide for the safety and developmental needs of the children served, that address: 1. Group size limits for specific age populations; 2. The appropriate ratio between the number of children and the number of caregivers, in terms of age of children in child care; and 3. Required qualifications for caregivers in child care settings as described at §98.44(a)(4). e. Lead Agencies shall certify that caregivers, teachers, and directors of child care providers within the State or service area will comply with the State’s, Territory’s, or Tribe’s child abuse reporting requirements as required by section 106(b)(2)(B)(i) of the Child Abuse and Prevention and Treatment Act (42 U.S.C. 5106a(b)(2)(B)(i)) or other child abuse reporting procedures and laws in the service area. Washington Administrative Code (WAC) 110-16-0025 Health and safety training: 1. A provider described in WAC 110-16-0015 (4)(b) or (c) must complete the following training within ninety calendar days of the subsidy payment begin date: a. Infant, child, and adult first aid and cardiopulmonary resuscitation (CPR): i. This training must be taken in person and the provider must demonstrate learned skills to the instructor. ii. The instructor must be certified by the American Red Cross, American Heart Association, American Safety and Health Institute, or other nationally recognized certification program. b. Prevention of sudden infant death syndrome and safe sleep practices when caring for infants; and c. Department approved health and safety training which includes the following topic areas: i. Prevention and control of infectious diseases; ii. Administration of medication; iii. Prevention of, and response to, emergencies due to food and allergic reactions; iv. Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; v. Prevention of shaken baby syndrome, abuse head trauma, and child maltreatment; vi. Emergency preparedness and response planning for natural disasters and human-caused events; vii. Handling and storage of hazardous materials and the appropriate disposal of bio contaminants; viii. Appropriate precautions in transporting children; ix. Recognition and reporting of child abuse and neglect, including the prevention of child abuse and neglect as defined in RCW 26.44.020 and mandatory reporting requirements under RCW 26.44.030; and x. Other topic areas as determined by the department. 2. A provider described in WAC 110-16-0015 (4)(b) or (c) can meet the health and safety training in subsection (1)(c) of this section if the department verifies that the provider has completed any of the following either prior to or within ninety calendar days of the subsidy payment begin date: a. Child care basics, a department approved thirty-hour health and safety training. b. Washington state early childhood education initial certificate (twelve credits) that includes early childhood education and development 105 health, safety, and nutrition. 3. A provider described in WAC 110-16-0015 (4)(b) or (c) must complete a minimum of two hours of health and safety training annually, using the subsidy payment begin date. The training must include, but is not limited to, one or more of the following: a. Prevention and control of infectious diseases; b. Emergency preparedness and response planning for natural disasters and human-caused events; c. Recognizing and prevention of shaken baby syndrome, head trauma abuse, neglect, and child maltreatment; and d. Prevention of sudden infant death syndrome and safe sleep practices, if caring for an infant or toddler. WAC 110-16-0030 Health and safety activities: 1. A provider described in WAC 110-16-0015 (4)(b) or (c), must participate in an annual, scheduled visit conducted by department staff in the home where care is provided. 2. The purpose of the visit is to: a. Provide technical assistance to the provider regarding the health and safety requirements described in this chapter; b. Observe the provider’s interactions with the child, and discuss health and safety practices; c. Provide written information and local resources about child development to include the major domains of cognitive, social, emotional, physical development, and approaches to learning; and d. Provide regional contact information for FFN child care services and resources. 3. A provider will be considered out of compliance with the requirements of this chapter if, after three attempts, the department is not able to complete an annual, scheduled visit in the home where care is provided. 4. At the annual, scheduled visit, the provider must show, unless previously provided to the department: a. Proof of identity; b. Proof of current certification for first aid and cardiopulmonary resuscitation (CPR) in the form of a card, certificate, or instructor letter; c. Proof of vaccination against or acquired immunity for vaccine-preventable diseases for all children in care, if the provider’s children are on-site at any time with the eligible children. Proof can include: i. A current and complete department of health (DOH) certificate of immunization status (CIS) or certificate of exemption (COE) or other DOH approved form; or  ii. A current immunization record from the Washington state immunization information system (WA IIS). d. Written permission from the parent to: i. Allow children to use a swimming pool; ii. Administer medication for treatment of illnesses and allergies of the children in care; iii. Provide for and accommodate developmental and special needs; and iv. Provide transportation for care, activities, and school when applicable. e. The written emergency preparedness and response plan required in WAC 110-16-0035(8)(c).

2024-061 Edmonds College did not have adequate controls over reporting for its Head Start Program. Assistance Listing Number and Title: 93.600 Head Start Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 10HE000919-01-03; 10CH012034-03-01 10CH012034-03-02;10CH012034-03-03 10CH012034-03-00 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: N/A Background The U.S. Department of Health and Human Services, through the Office of Head Start at the Administration for Children and Families, administers the Head Start and Early Head Start Programs. Head Start offers free, federally funded programs designed to promote school readiness for low-income children by enhancing children’s cognitive, social and emotional development. In Washington, Head Start funding is provided directly to various community colleges, including Edmonds College, which administers this program in Snohomish County. Its programs provide center-based programs for three- and four-year olds as well as home-based programs for infants and toddlers. In fiscal year 2024, the College spent $7,241,517 in Head Start funds. The College is required to submit a SF-425 federal financial report to the federal grantor every six months for an open grant award and also at the closing of a grant award. This report includes information like the federal grant number, the recipient organization, grant period, reporting period end date, basis of accounting, a summary of revenue and expenditures and recipient share of expenditures related to the grant during the award period. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The College did not have adequate controls over reporting for its Head Start Program. During the fiscal year, the College submitted six SF-425 reports. The Executive Director for the College’s Head Start program compiled and submitted the SF-425 reports without additional review by other College staff. We used a nonstatistical sampling method to randomly select and examine four out of a total population of six reports. We found that for two of the reports, the recipient share was underreported by $1,981 (less than 1% of the recipient share of expenditures) and $28,187 (3% of the recipient share of expenditures). We consider this internal control deficiency to be a significant deficiency. This issue was not reported as a finding in the prior audit. Cause of Condition The Executive Director for the program believed that a secondary review of the report was unnecessary. Additionally, the College did not retain the documentation to support the recipient share of expenditures reported at the time of the report submission. This amount is comprised of data received from each childcare site and some data was not received timely, causing the amounts to not match the reported amount on the SF-425 report. Effect of Condition Without adequate internal controls, the College risks not submitting accurate and complete SF-425 reports. Inaccurate reports could affect future funding from the federal grantor. Recommendations We recommend the College: • Establish internal controls over the preparation and submission of the SF-425 report to ensure compliance • Retain documentation it used at the time to complete the SF-425 report College’s Response Edmonds College thanks the State Auditor’s Office (SAO) and acknowledges the finding of inadequate controls over the Head Start Program’s Federal Financial Reporting (FFR) submissions, and commits to documenting and strengthening internal controls and the retaining of the back-up documentation for submitted SF-425 reports. Prior to the government’s requirement for 2FA and biometric authentications in order to access Payment Management Services (PMS) SF-425 reports were compiled and submitted by college business office personnel who did not pursue these additional authentications and subsequently lost access to PMS. In the absence of college business office personnel to compile and submit these reports and in an effort to submit timely reports, the Executive Director sought and acquired access to PMS and compiled and submitted the reporting in the same manner as had previously been done. While the College acknowledges that a final review was not completed prior to the electronic certification and submission of these reports, there were a series of reviews of the data provided to, and used by, the Executive Director in populating the SF-425 reporting. Due to the constraints of the database that is used to report the non-federal share, the reports used are dynamic and cumulative and the College did not have a process in place to maintain a point in time copy. This led to a mismatch between what the College could provide at the time of the audit and what was reported in the SF-425. The College acknowledges the need to retain the point in time reports that support what is reported in the SF-425 and commits to doing so moving forward. Auditor’s Remarks We thank the College for its cooperation and assistance throughout the audit. We will review the status of the College's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 341, Financial reporting, states: Unless otherwise approved by OMB, the HHS awarding agency may solicit only the standard, OMB-approved government-wide data elements for collection of financial information (at time of publication the Federal Financial Report or such future collections as may be approved by OMB and listed on the OMB Web site). This information must be collected with the frequency required by the terms and conditions of the Federal award, but no less frequently than annually nor more frequently than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes, and preferably in coordination with performance reporting. Federal Reporting of Standard Forms 425 and 428, ACF-PI-OHS-24-01, states in part: Submission of Federal Financial Report SF-425 All Head Start recipients are required to submit financial reports detailing the expenditures incurred for their awards. Filing requirements for most recipients are satisfied using the Federal Financial Report SF-425. Recipients currently submit three SF-425 reports for a 12-month budget period. Generally, awards are for a 12-month budget period. Semi-annual and annual reports are cumulative, covering either 6 or 12 months of expenditures, respectively. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-062 Edmonds College did not have adequate internal controls over and did not comply with protection of federal interest requirements for its Head Start program. Assistance Listing Number and Title: 93.600 Head Start  Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 10HE000919-01-03  Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Test and Provisions: Protection of Federal Interest in Real Property and Facilities Known Questioned Cost Amount: None Prior Year Audit Finding: N/A Background The U.S. Department of Health and Human Services, through the Office of Head Start at the Administration for Children and Families, administers the Head Start and Early Head Start Programs. Head Start offers free, federally funded programs designed to promote school readiness for low-income children by enhancing children’s cognitive, social and emotional development. In Washington, Head Start funding is provided directly to various community colleges, including Edmonds College, which administers this program in Snohomish County. Its programs provide center-based programs for three- and four-year olds as well as home-based programs for infants and toddlers. To protect federal interest in real property and facilities, federal regulations require a notice of federal interest to be included in property lease agreements and for it to be recorded in the official real property records for the county where the facility is located. The College works with the Department of Enterprise Services (DES) to draft and execute these lease agreements. Furthermore, DES typically files these agreements to be recorded in the official real property records for the proper county. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition Edmonds College did not have adequate internal controls over and did not comply with protection of federal interest requirements for its Head Start program. During the fiscal year, the College executed one new lease with major renovations utilizing Head Start funds. We determined the lease agreement contained the proper information for the notice of federal interest. However, the College fully executed the lease agreement on January 3, 2024, but did not file it with the official real property records by the end of the fiscal year, almost six months later. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The College did not have a process in place to ensure it filed the notice of federal interest in the official real property records. College management said DES files these quarterly; however, due to staff shortages, DES is behind in filing them. Effect of Condition The purpose of filing the lease agreement with the notice of federal interest with the official real property records is to help protect the grantee’s interest as well as the federal government’s interest in a real property. The College put this at risk when it did not ensure the lease agreement was properly filed. Recommendation We recommend the College establish adequate internal controls to ensure the notice of federal interest is filed in the official real property records. College’s Response Due to staff turnover at both the Department of Enterprise-DES (WA State Real Estate Services) and Edmonds College, the lease was not submitted to the proper jurisdiction for recording of federal interest. On December 28, 2023, the Head Start Executive Director received an unsigned copy of the final lease for a major renovation project with the Office of Head Start Lease Rider attached as exhibit C in the lease package from DES. She was asked to do a final review. The lease was signed by Edmonds College President and sent to DES for signing and submission to the recording jurisdiction. Through this audit it was discovered that the lease was never recorded due to a DES backlog. Edmonds College has put a procedure in place, in conjunction with DES, to ensure this does not happen again. Auditor’s Remarks We thank the College for its cooperation and assistance throughout the audit. We will review the status of the College's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 1303, section 47, Contents of notices of federal interest, states in part: (b) Facility leased by a grant recipient. (1) A notice of federal interest for a leased facility, excluding a modular unit, on land the grant recipient does not own, must be recorded in the official real property records for the jurisdiction where the facility is located and must include: (i) The grant recipient's correct legal name and current mailing address; (ii) A legal description of affected real property; (iii) The grant award number, amount and date of initial funding award or initial use of base grant funds for major renovation; (iv) Acknowledgement that the notice of federal interest includes any Head Start funds subsequently used to make major renovations on the affected real property; (v) A statement the facility and real property will only be used for purposes consistent with the Act and applicable Head Start regulations; and, (vi) A lease or occupancy agreement that includes the required information from paragraphs (b)(1)(i) through (v) to serve as a notice of federal interest.

2024-063 Edmonds College did not have adequate internal controls over and did not comply with program governance requirements for its Head Start program. Assistance Listing Number and Title: 93.600 Head Start Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 10HE000919-01 10CH012034-03  Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Test and Provisions: Program Governance Known Questioned Cost Amount: None Prior Year Audit Finding: N/A Background The U.S. Department of Health and Human Services, through the Office of Head Start at the Administration for Children and Families, administers the Head Start and Early Head Start Programs. Head Start offers free, federally funded programs designed to promote school readiness for low-income children by enhancing children’s cognitive, social and emotional development. In Washington, Head Start funding is provided directly to various community colleges, including Edmonds College, which administers this program in Snohomish County. Its programs provide center-based programs for three- and four-year olds as well as home-based programs for infants and toddlers. The College must establish and maintain a formal structure for program governance that includes a governing body and a policy council. The governing body is legally and fiscally responsible for administering and overseeing the College’s Head Start program. The governing body for the College is the Board of Trustees. The Board of Trustees has empowered the College’s President’s Leadership Team (PLT) to fulfill the responsibilities defined in the Head Start Act. As such, the PLT acts as the governing body for the College’s Head Start program. The policy council is comprised of parents of children enrolled in the College’s Head Start program and is responsible for the direction of the program, including program design and operation, and short-term planning goals and objectives. To assist in these responsibilities, the College is required to share monthly financial statements, including credit card expenditures, with the governing body and policy council. Also, all funding applications, the Head Start annual report, and major expenditures are required to be approved by the governing body. Finally, to effectively oversee program policy, members of both bodies are required to receive training covering, at a minimum, the items in 45 CFR 1302.12(m)(1)(i) through (iii) within 180 days of beginning a term. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition Edmonds College did not have adequate internal controls over and did not comply with program governance requirements for its Head Start program. While the College asserted the PLT was the governing body over the College’s Head Start program, we determined the PLT does not meet the definition or conflict of interest requirements of the governing body as outlined in the Head Start Act. Instead, the College’s Board of Trustees meet this requirement and we performed testing to ensure compliance with the Board of Trustees as the governing body. We reviewed five out of 12 months of the fiscal year to confirm the College shared the monthly financials and credit card statements as required. We found: • The Board of Trustees did not receive this information for all five (100%) months. • The Policy Council did not receive monthly financial statements for three (60%) months and did not receive a credit card statement for one (20%) month. The College also had written procedures that identify major financial expenditures, but it identified that they are approvable by the PLT, not the Board of Trustees. We identified $438,594 in major expenditures that the Board of Trustees did not approve. In addition, there was one funding application and one annual report during the audit period approved by the PLT, but not the Board of Trustees. Also, during the fiscal year, the College did not provide training to the Board of Trustees. For the Policy Council, we determined the population the College provided may not be a complete and accurate list for active members during the fiscal year. It was decided that we would test the eight members provided and identified five (63%) did not receive the training. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The College believes the PLT fulfills the requirements as the governing body for Head Start. As such, procedures the College develop require the PLT to receive the monthly financial statements and credit card expenditures, approve major expenditures, funding application, and the annual report. In addition, the College did not have adequate controls in place to track the new policy council members and ensure all members received the necessary training. Effect of Condition The approval of monthly financial information, major expenditures, funding applications, and the annual report with the Board of Trustees and policy council is to ensure proper governance over the College’s Head Start program. The lack of compliance over these requirements puts the College and the program at risk of having insufficient fiscal and programmatic oversight. In addition, the Board of Trustees and Policy Council cannot adequately govern this program without receiving the proper, required training to ensure they are knowledgeable in Head Start policies and procedures and federal regulations to make educated decisions for the program. Recommendations We recommend the College establish internal controls to ensure: • The Board of Trustees fulfills all requirements of the governing body, including receiving and approving: o The required monthly financial and credit card statements every month o The required major financial expenditures when approval is needed o Any funding applications • The Policy Council receives and approves the required monthly financial and credit card statements every month • All new members of the Board of Trustees and policy council receive training within the required 180 days College’s Response Edmonds College thanks the State Auditor’s Office (SAO) for their time and acknowledges the finding of inadequate controls over and noncompliance with program governance requirements for its Head Start program. Since at least 2011 Edmonds College’s Head Start’s “Leadership Council Bylaws and Governance Manual” has been in place and has described the relationship by and between the College’s Board of Trustees (BOT) and the PLT (which was previously known as President’s Cabinet in that manual) as it relates to the delegation of the responsibilities of the Governing Body. As a result of the SAO’s recent audit, SAO's concerns about the delegation of the responsibilities of the Governing Body to the PLT and the resulting conflict of interest (COI) was brought to light. The College now wishes to take the opportunity to explore their options as to the Governing Body and the resulting COI. After exploring options the College will take all necessary steps to fully comply with program governance requirements for its Head Start program. Auditor’s Remarks We thank the College for its cooperation and assistance throughout the audit. We will review the status of the College's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 1302, section 12, Determining, verifying, and documenting eligibility, establishes requirements for training on eligibility for the governing body and policy council. Title 42 U.S Code 9837, Powers and Functions of Head Start Agencies, state in part: (c) Program Governance - Upon receiving designation as a Head Start agency, the agency shall establish and maintain a formal structure for program governance, for the oversight of quality services for Head Start children and families and for making decisions related to program design and implementation. Such structure shall include the following: (1) GOVERNING BODY (C) Conflict of interest Members of the governing body shall— (i) not have a financial conflict of interest with the Head Start agency (including any delegate agency); (ii) not receive compensation for serving on the governing body or for providing services to the Head Start agency; (iii) not be employed, nor shall members of their immediate family be employed, by the Head Start agency (including any delegate agency) ; and (iv) operate as an entity independent of staff employed by the Head Start agency. (E) RESPONSIBILITIES- The governing body shall— (iv) be responsible for other activities, including-- (II) establishing procedures and criteria for recruitment, selection, and enrollment of children; (III) reviewing all applications for funding and amendments to applications for funding for programs under this subchapter; (VII) approving financial management, accounting, and reporting policies, and compliance with laws and regulations related to financial statements, including the-- (aa) approval of all major financial expenditures of the agency; (d) Program Governance Administration- (2) CONDUCT OF RESPONSIBILITIES- Each Head Start agency shall ensure the sharing of accurate and regular information for use by the governing body and the policy council, about program planning, policies, and Head Start agency operations, including- A. monthly financial statements, including credit card expenditures; The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-064 Skagit Valley College did not have adequate internal controls over and did not comply with program governance requirements for its Head Start program. Assistance Listing Number and Title: 93.600 Head Start Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 10CH011185-04; 10CH011185-05; 10WH000017-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Program Governance Known Questioned Cost Amount: None Prior Year Audit Finding: N/A Background The U.S. Department of Health and Human Services, through the Office of Head Start at the Administration for Children and Families, administers the Head Start and Early Head Start Programs. Head Start offers free, federally funded programs designed to promote school readiness for low-income children by enhancing children’s cognitive, social and emotional development. In Washington, Head Start funding is provided directly to various community colleges, including Skagit Valley College, which administers this program in Skagit County. Its programs provide center-based programs for three- and four-year olds as well as home-based programs for infants and toddlers. The College is required to establish and maintain a formal structure for program governance that includes a governing body and a policy council. The governing body is legally and fiscally responsible for administering and overseeing the College’s Head Start program. The governing body for the College is the Board of Trustees. The policy council is comprised of parents of children enrolled in the College’s Head Start program and is responsible for the direction of the program, including program design and operation, and short-term planning goals and objectives. To assist in these responsibilities, the College is required to share monthly financial statements, including credit card expenditures, with the governing body and policy council. Also, to effectively oversee program policy, members of both bodies are required to receive training covering, at a minimum, the items in 45 CFR 1302.12(m)(1)(i) through (iii) within 180 days of beginning a term. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The College did not have adequate internal controls over and did not comply with program governance requirements for its Head Start program. We reviewed all 12 months of the fiscal year to confirm if the College shared the monthly financial and credit card statements as required. We found the Board of Trustees did not receive this information for five (42%) months. The College communicated the monthly financial statements for the prior month during the seven monthly Board meetings held during this year. However, it did not provide the required monthly financial and credit card statements to the Board of Trustees for the five months in which the Board did not meet. We confirmed the College provided the information to the policy council for all 12 months. During the fiscal year, one member was added to the Board of Trustees. College management confirmed this member did not attend a training but said they received the training material covering the required topics within the 180-day requirement. However, the College was not able to provide documentation to support this. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition College management incorrectly believed providing the monthly financial statements to one Board member, who is a liaison to the policy council, each month fulfilled its requirement to share the financial information to the entire Board. In addition, the College did not maintain documentation to support that the new Board member received the necessary training. Effect of Condition The purpose of sharing monthly financial information and training with the Board of Trustees is to ensure that these members are knowledgeable in Head Start policies and procedures and federal regulations to make educated decisions for the program. This puts the College and the Head Start program at risk of having insufficient fiscal oversight. Recommendations We recommend the College establish adequate internal controls to ensure: • The Board receives the required monthly financial and credit card statements every month • All new Board members receive training within the required 180 days College’s Response We acknowledge and accept the auditor’s findings regarding program governance for the Head Start program. SVC has reviewed and strengthen current internal controls to ensure the Board receives the required monthly financial and credit card statements every month and all new Board Members receive training within the required 180 days. The delayed financial reporting was a result of aligning submission timelines with the Board’s bi-monthly meeting schedule, rather than a failure to provide the necessary documentation. All required financial reports and credit card statements were prepared and available during the period in question but were formally transmitted according to the Board’s meeting schedule. Recognizing the need for more frequent updates, we have already implemented a revised reporting procedure to ensure that monthly reports are provided to the Board, regardless of scheduled meetings. Additionally, adjustments have been made to strengthen the Board member training process, ensuring compliance with governance requirements. These corrective actions, as detailed in the attached document, have been fully implemented as of February 2025. Auditor’s Remarks We thank the College for its cooperation and assistance throughout the audit. We will review the status of the College's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 1302, section 12, Determining, verifying, and documenting eligibility, establishes requirements for training on eligibility for the governing body and policy council. 42 U.S. Code 9837(d), Program governance administration, states in part: (2) CONDUCT OF RESPONSIBILITIES- Each Head Start agency shall ensure the sharing of accurate and regular information for use by the governing body and the policy council, about program planning, policies, and Head Start agency operations, including – A. monthly financial statements, including credit card expenditures; The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-065 The Community Colleges of Spokane did not have adequate controls over and did not comply with program governance requirements for its Head Start program. Assistance Listing Number and Title: 93.600 Head Start Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 10CH012101-02, 10CH012101-03 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Program Governance Known Questioned Cost Amount: None Prior Year Audit Finding: N/A Background The U.S. Department of Health and Human Services, through the Office of Head Start at the Administration for Children and Families, administers the Head Start and Early Head Start Programs. Head Start offers free, federally funded programs designed to promote school readiness for low-income children by enhancing children’s cognitive, social and emotional development. In Washington, Head Start funding is provided directly to various community colleges, including the Community Colleges of Spokane (CCS), which administers this program in Spokane County. Its programs provide center-based programs for children 6-weeks through 5-years old, as well as limited home-based services for infants and toddlers. CCS must establish and maintain a formal structure for program governance that includes a governing body and a Policy Council. The governing body is legally and fiscally responsible for administering and overseeing the CCS’s Head Start program. The governing body for CCS is the Board of Trustees. The Policy Council is comprised of parents of children enrolled in the CCS’s Head Start program and is responsible for the direction of the program, including program design and operation, and short-term planning goals and objectives. The Policy Council elects alternates that may act on behalf of absent Policy Council members at its monthly meetings. In the absence of a voting member, an alternate will be included when determining if quorum is met and will vote on Head Start matters. A Trustee is appointed to serve as liaison to the Policy Council during their meetings and reports back to the Board at its next meeting. To assist in these responsibilities, CCS is required to share monthly financial statements, including credit card expenditures, with the governing body and Policy Council. Also, to effectively oversee program policy, members of both bodies are required to receive training covering, at a minimum, the items in 45 CFR 1302.12(m)(1)(i) through (iii) within 180 days of beginning a term. This training was offered to the Policy Council in October and May during the fiscal year. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition CCS did not have adequate internal controls over and did not comply with program governance requirements for its Head Start program. Sharing monthly financial statements, including credit card expenditures We used a nonstatistical sampling method to randomly select and examine five months of the fiscal year to confirm if CCS shared the monthly financial statement and credit card expenditures. Also, since the Policy Council does not meet in the summer months, we judgmentally selected and reviewed these three months. We found for all eight (100%) months for the Policy Council and five (100%) months for the Board of Trustees, that the financial information provided did not include a monthly financial statement and did not include credit card expenditures. Instead, a year-to-date financial statement was provided with a detailed expenditure report from the CCS’s accounting system that did not clearly define new monthly expenditures. Training During the fiscal year, one new member was appointed to the Board of Trustees and 25 members were voted into the Policy Council, including 8 alternates. We reviewed these 26 members and found: • Seven (28%) members of the Policy Council did not receive any training during the period o Of these, two were regular Policy Council members, and five were alternates • One (100%) member of the Board of Trustees did not receive any training during the period • Two (8%) members of the Policy Council did not receive the training within 180 of the start of their term We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Head Start program Management did not have adequate controls in place to monitor the training requirement for the Policy Council members, including alternates. CCS did not believe alternates required this training. In addition, CCS believes that providing training to the Policy Council liaison, who is a Board of Trustees member, fulfilled this requirement for the entire Board. CCS also believes the year-to-date financial information provided to the Board of Trustees and the Policy Council is sufficient to meet this requirement. Effect of Condition The purpose of sharing monthly financial information and training with the Board of Trustees is to ensure that these members are knowledgeable in Head Start policies and procedures and federal regulations to make educated decisions for the program. This puts CCS and the Head Start program at risk of not having sufficient fiscal oversight. Recommendations We recommend CCS establish adequate internal controls to ensure: • The Board and Policy Council receive the required monthly financial and credit card statements every month • All new Board of Trustees members and Policy Council members receive training within the required 180 days Community Colleges of Spokane’s Response We disagree with the auditor’s finding that Community Colleges of Spokane (CCS) has not established a formal structure for program governance to oversee the legal and fiscal responsibilities of the Head Start program. CCS specifically engages their Policy Council and governing board through regular meetings and trainings. The governance model provides for adequate internal controls to meet program requirements. The model of governance includes an appointed Board of Trustees (BOT) member who regularly attends Policy Council meetings and trainings that address program oversight and fiscal requirements. Additionally, detailed financial, enrollment, and program updates are included as a formal agenda item at the regularly scheduled meetings of the CCS Board of Trustees. The board agenda item provides the board an opportunity review, ask questions and consider approval of the information supplied by program administration. The model of governance employed by CCS provides adequate internal controls to ensure program requirements are met. The auditors identified exception to our training model and documentation of required trainings. While we agree with the general observation of the auditors regarding missed attendance by some Policy Council members, the more detailed evidence provided to the auditors illustrates our commitment to and evidence of comprehensive trainings that comply with program standards. Specific evidence is provided below. Compliance with Head Start Program Performance Standards (HSPPS) Training Requirements: Policy Council Training 1. Training Was Provided in Accordance with 45 CFR §1305.2 1. The Head Start Program Performance Standards (HSPPS) require that training be made available to the governing body and Policy Council members, ensuring they understand eligibility requirements, including verification and certification procedures. 1. The regulations do not explicitly require that every individual member be present at a single training session, but rather that the program ensures members have the opportunity to receive and understand the training content. 2. Training was offered and is accessible 1. Our program provided training during scheduled Policy Council meetings, ensuring that members in attendance received the required information. 1. Meeting minutes and handouts were provided to all elected representatives and alternates following the meetings, ensuring that any member unable to attend still had access to the information. 3. Policy Council minutes are shared with parents. 1. To maintain transparency and engagement, Policy Council meeting minutes are made available to all parents after each meeting. This practice ensures that information, including training topics, is widely disseminated to both representatives and the broader parent community. 4. No specific mandate for universal attendance in a single training session 1. 45 CFR §1301.3(e) requires that the program ensure Policy Council members understand their roles and responsibilities, including eligibility. However, it does not mandate that every individual receives the necessary training in a single training session. 1. Our program followed best practice by making the training accessible through multiple means, ensuring that all members had access to eligibility training information. 5. Commitment to continuous improvement 1. In our opinion, we met the regulatory requirements and have adequate controls over program governance. Moreover, we acknowledge the importance of clear documentation and tracking of Policy Council member participation in training sessions and meetings. Therefore, we intend to enhance our internal processes to further document training completion for all members, including those who receive materials after meetings. Compliance with HSPPS Training Requirements: Board of Trustees Liaison Model We disagree with the finding that our Board of Trustees (BOT) “Liaison Model” does not meet program requirements. Based on their assertion, we sought clarification from the Office of Head Start (OHS), who clarified that: “This policy should be interpreted to mean that if all governing body members who have a role in determining eligibility are properly trained, OHS would consider the program to be in compliance with this regulatory requirement.” 1. Consistent with OHS guidance, our program has ensured that all BOT members involved in eligibility decisions have received the required training. 1. BOT Liaison Model and Training Implementation o Our program uses a liaison model, where a designated BOT member receives Head Start-specific training and serves as a communication bridge between the full Board and the Policy Council. o This model ensures that a fully trained representative engages with eligibility topics while the broader BOT remains informed through regular updates and formal Board of Trustees meeting agendas. 2. Program Governance Responsibilities and Compliance o 45 CFR §1301.2 outlines the governance structure, requiring that governing body members understand their oversight role, including eligibility training. The liaison model is consistent with OHS guidance, ensuring that eligibility responsibilities are understood and met by trained decision-makers. 3. Commitment to Continuous Training and Documentation o As confirmed by OHS, our model is compliant. However, in response to the auditor’s recommendations, we plan to enhance the availability and documentation of training. To that end, additional access to eligibility training materials and multiple means of training will be available to all BOT members. We maintain that our program has fulfilled the training requirements established in CFR 1302.12. Given the OHS clarification, and the comprehensive nature of our program trainings to the Policy Council and Board of Trustees, CCS maintains a formal structure for program governance that includes a governing body and Policy Council. As such, the recommendations by the auditors are useful suggestions for management; however, they do not accurately represent a material weakness in our program governance models and practice. We also disagree with the auditor’s finding that CCS did not have adequate internal controls over and did not comply with the program governance requirement relating to “Sharing monthly financial statements, including credit card expenditures.” The auditors represent that the “financial information provided did not include a monthly financial statement and did not include credit card expenditures. Instead, a year-to-date financial statement was provided with a detailed expenditure report from the College’s accounting system that did not clearly define new monthly expenditures.” The auditor’s recommendations are that “The Board and Policy Council receive the required monthly financial and credit card statements every month.” The auditor’s finding is misleading and incorrect. The Head Start program standards do not prescribe a specific form or format for reporting financial information. Rather, the standards prescribe what should be included in the reports of financial information. The regular financial reports provided by CCS to the Policy Council and Board of Trustees are comprehensive of all transactions and clearly illustrate all funding available to the program, including all program related expenditures. The financial report is comprehensive and easy to understand. Specifically, the monthly report reconciles to the Head Start financial award (budget), the grant award period, actual expenditures year-to-date for each category of expenditures, and percent of budget spent for the award period. The report is updated monthly to reflect current month spending. Due to the complete nature of the report, all expenditures, including items purchased by credit card, are included in the expenditure line-item totals. Additionally, a note is included on the face of the report that states, “Both a report listing credit card expenditures and a report with greater budget detail are regularly provided to the HS/EHS Board of Trustees liaison and the Policy Council Treasurer. These reports are also available upon request.” The availability and access to this additional information provides additional oversight to CCS’ monthly financial reporting. In addition to the financial reports the auditors received for their test of controls, CCS provided the detailed list of credit card transactions for the audit period. It is our understanding that no exceptions were found in the support of credit card transactions provided to the auditors. All transactions were properly authorized and substantiated with supporting receipts. CCS has extensive internal controls over the authorization, use, reconciliation of credit card expenditures, and incorporates all such expenditures in their regular monthly financial reports. We contend that the auditor’s finding of material weakness in internal controls is unfounded and incorrect. It appears the auditor’s approach was to identify exception to a specific form of report rather than to consider the substantial compliance with the standards, including the substance of the financial report contents and completeness. We acknowledge and respect the auditor’s responsibilities to test controls over the program governance requirements of the Head Start program. However, we believe their internal control finding and recommendations illustrate reasonable direction for management to improve and enhance existing practices of the program. The items identified by the auditors do not reflect material weaknesses in internal controls that lead to material noncompliance with program requirements. Based on our review of the auditor’s recommendations, our commitment to continuous improvement and strong program governance, CCS will enhance documentation of training provided to all BOT members, and additional opportunities will be available for all members to access eligibility training materials. Additionally, CCS will add a current month expenditure column to their existing financial report so both current-month and year-to-date information is presented in the monthly reports. The financial report will also include a supplemental report of credit card expenditures to highlight how credit card expenditures are part of total expenditures presented on the face of the financial report. CCS does not believe it is appropriate to attach program credit card statements to the financial report as recommended by the auditors. CCS appreciates the thorough review of our Head Start program and adherence to program compliance. In summary, we do not believe that a material weakness in program governance exists; however, management has reviewed the auditor’s recommendations for improvement. CCS is committed to strong program governance. We will maintain adequate controls over the program to ensure CCS continues to meet all Head Start compliance standards. Auditor’s Remarks We appreciate CCS’s commitment to comply with federal regulations. CCS stated we found it had not established a formal structure for program governance to oversee the legal and fiscal responsibilities of the Head Start program. This is not an assertion made in the finding. However, we do disagree on CCS’s interpretation of the regulations and its conclusion that CCS is compliant. Training Requirements In its response, CCS references training requirements in 45 CFR 1301 and 1305. However, our finding references 45 CFR 1302.12(m), which is clear in stating “a program must train all governing body, policy council, management, and staff who determine eligibility on applicable federal regulations and program policies and procedures.” The BOT and policy council are integral in determining eligibility requirements and developing program policies and procedures for the Head Start program at CCS. We disagree that the CCS’s BOT liaison model fulfills these requirements. Our testing found that the appointed BOT member did not attend the required training and not all policy council members received the required training during the audit period, as required in 45 CFR 1302.12(m). In determining compliance, we considered all training sessions that included the original and make up session. Also, during the audit, CCS did not assert that sending training material to those not in attendance fulfilled this compliance requirement, therefore, this was not reviewed. Sharing monthly financial statements, including credit card expenditures While CCS asserts that each month it provided a year-to-date financial statement and associated expenditures, the financial statement does not include a current month expenditure column. Additionally, the detailed expenditures do not easily identify the current month expenditures or credit card expenditures. CCS also asserts that we reviewed credit card transactions as part of our testing. We did not review CCS’s use of credit cards as part of our audit. We reaffirm our finding and will review the status of CCS's corrective action during our next audit. Since CCS interprets certain governance requirements different than our Office, we encourage the College to engage with the Department of Health and Human Services (HHS) during the audit finding resolution process. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 1302, section 12, Determining, verifying, and documenting eligibility, establishes requirements for training on eligibility for the governing body and Policy Council. 42 U.S. Code 9837(d), Program governance administration, states in part: (2) CONDUCT OF RESPONSIBILITIES- Each Head Start agency shall ensure the sharing of accurate and regular information for use by the governing body and the Policy Council, about program planning, policies, and Head Start agency operations, including – (A) monthly financial statements, including credit card expenditures; The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-066 The Department of Children, Youth, and Families did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 – Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2302WAFOST 2402WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $6,000 Prior Year Audit Finding: Yes, Finding 2023-066 Background The federal Foster Care Title IV-E program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state’s child welfare agency until they are returned home, placed with adoptive families, or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for adults who are involved in the program, including state agency staff, foster parents and certain private agency staff. In Washington, the Department of Children, Youth, and Families administers the Foster Care program. During fiscal year 2024, the Department spent about $164 million in federal grant funds, including about $12.8 million for travel and family visits. Parent-child visits are a key strategy for minimizing a child’s time in out-of-home care and working toward family reunification. The Department creates a visit plan based on dependency court order visit requirements and other information to ensure the child’s safety. This visit plan is created and saved in a system called FamLink. When the Department needs contracted family time services, it sends a visit plan/referral through a FamLink-Sprout interface. Visit coordinators send this referral to the most appropriate contracted service provider through the Sprout system. These referrals authorize the contracted provider to provide the needed services. After the visit, contracted service providers complete visit reports, which include travel mileage and travel time. Based on these reports and information the contractor enters into the Sprout system, the system creates an invoice containing billable services and rates. To catch errors and ensure quality assurance, Sprout reports and invoices are reviewed and approved by the contracted service provider administrator or manager. The Department pays the provider solely based on the summary-level information entered into Sprout. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls to ensure payments to providers for family visits were allowable and adequately supported for the Foster Care program. The prior finding numbers were 2023-066, 2022-048 and 2021-040. Description of Condition The Department did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. We used a statistical sampling method to randomly select and examine 58 out of 1,084 foster care payments for travel and family time visits. Of the payments examined, we identified four payments costing $6,000 that lacked adequate documentation to support the amount of travel and family time visits being reimbursed. We also found the Department did not follow its procedures for performing fiscal monitoring of contracted service providers to ensure federally funded payments for travel and family visits were adequately supported and only for allowable activities. We consider this internal control deficiency to be a significant deficiency. Cause of Condition In response to the prior audit findings, the Department developed a corrective action plan to address the internal control deficiencies. However, the Department did not fully implement the corrective action plan during the audit period. Effect of Condition and Questioned Costs By not performing adequate fiscal monitoring, the Department cannot ensure payments for travel and family visits are allowable and adequately supported. We are questioning the $6,000 in unsupported payments and estimate likely questioned costs to be $20,277. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95% confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our “best estimate of total questioned costs” as required by 45 CFR 75.516(a)(3). To ensure a representative sample, we stratified the population by dollar amount. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Follow its fiscal monitoring procedures to ensure payments to providers for travel and family visits are allowable and adequately supported • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Department is committed to strengthening internal controls and complying with grant requirements. As stated in the Cause of Condition, the Department did not fully implement the corrective action plan during the audit period. Due to the timing and frequency of the statewide single audits, the Department is not made aware of a finding until months after the state fiscal year (SFY) concludes. It is not always feasible to correct audit issues before a new audit cycle begins. Thereby, the previous year’s audit issues will remain outstanding up to nine months of the current audit period. For this reason, the Department anticipates receiving repeat findings for consecutive years. In response to the prior year’s audit, the Contracts Compliance Team, hired two new staff in the last half of calendar year 2023 dedicated to reviewing all regional child welfare client service contracts including family time visit payments.  The Contracts Compliance Team developed compliance audit plans for child welfare contracts and began reviews of family time visit payments in November 2023. Due to staff resources and the number of contracts, the on-site compliance visits were completed for 44 of the 52 family time contracts in the past two fiscal years.    On-site compliance visits are performed on a four year cycle and the Department strives to have all contracts reviewed in state fiscal year 2025. The Department implemented a new process for creating Sprout invoices from family time activity data during the prior audit period. This process included utilizing algorithms to identify reimbursement outside of reasonable amounts, requiring providers to submit additional documentation or explanation for flagged invoices, and implementing a re-run process to identify duplicate billings. The Department also implemented additional review and approvals by program staff for the Network Administrator in Eastern Washington for invoices prior to release of payment. Between January and March 2024, the Department identified and implemented regional program approvals for Western Washington providers and implement fiscal monitoring controls to ensure payments to providers for travel and family visits are allowable and adequately supported. The Department experienced errors from new staff during the roll-out phases and as part of the Plan, Do, Check, Act (continuous quality improvement process) additional steps were added to the process to ensure payments were accurate. The Department will continue to strengthen internal controls around the review and payment for family time activities and invoices. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-067 The Department of Children, Youth, and Families did not have adequate internal controls to ensure monthly foster care maintenance payments to children’s caregivers were adequate and accurate for the Foster Care program. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 – Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2302WAFOST 2402WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-067 Background The federal Foster Care Title IV-E program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state’s child welfare agency until they are returned home, placed with adoptive families or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for adults who are involved in the Foster Care program, including state agency staff, foster parents and certain private agency staff. In Washington, the Department of Children, Youth, and Families administers the Foster Care program. During fiscal year 2024, the Department spent about $164 million in federal grant funds, including about $12.9 million for foster care maintenance payments to family foster homes. These monthly maintenance payments help licensed caregivers (foster parents and licensed kinship caregivers) meet the needs of children and youth experiencing foster care. The Department’s Federal Funding Unit manages each of its Title IV-E foster care cases. Title IV-E Specialists are stationed throughout the state and screen all new foster care cases for Title IV-E Eligibility. When children or youth are placed in foster care homes, specialists gather information from a variety of sources to determine the support level of the child or youth. To ensure maintenance payments are accurate and allowable, the specialists enter the data gathered into the Foster Care Rate Assessment tool, which calculates the appropriate reimbursement rate to meet a child’s needs. Prior to payment, a supervisor reviews the rate in a system called FamLink. These reimbursement rates must be reassessed every six months. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls to ensure monthly foster care maintenance payments to children’s caregivers were adequate and accurate for the Foster Care program. The prior finding number was 2023-067. Description of Condition The Department did not have adequate internal controls to ensure monthly foster care maintenance payments to children’s caregivers were adequate and accurate for the Foster Care program. We used a statistical sampling method to randomly select and examine 59 foster care maintenance payments out of a total population of 29,392 made during the audit period to ensure that the payments are allowable and accurate. We found that the Department did not perform six-month reviews of the reimbursement rates for two payments. This prevented the Department from ensuring it can provide accurate monthly maintenance payments to help caregivers meet the needs of every child or youth in foster care. We consider this internal control deficiency to be a significant deficiency. Cause of Condition In response to the prior audit finding, the Department developed a corrective action plan to address the internal control deficiencies. However, the Department did not implement some internal control improvements until June 2024. Effect of Condition By not performing six-month reviews of all reimbursement rates, the Department cannot ensure it provided accurate monthly maintenance payments to help caregivers meet the needs of every child or youth in foster care. Recommendation We recommend the Department establish adequate internal controls to ensure it performs all six-month reviews of caregivers’ reimbursement rates for the Foster Care program. Department’s Response As stated in the Cause of Condition, the Department did not fully implement the corrective action plan during the audit period. Due to the timing and frequency of the statewide single audits, the Department is not made aware of a finding until months after the state fiscal year (SFY) concludes. It is not always feasible to correct audit issues before a new audit cycle begins. Thereby, the previous year’s audit issues will remain outstanding up to nine months of the current audit period. For this reason, the Department anticipates receiving repeat findings for consecutive years. To strengthen internal controls and documentation, effective June 2024 and as part of the implementation of the new rate assessment process, the Department took the following actions: • Published a new report in FamLink to assist rate assessors in identifying: o Six-month reviews that have not been performed timely. o Cases with upcoming rate assessments and due dates for reviews. • Implemented monthly tracking by supervisors to assist with internal controls and compliance. The new tracking report has been helpful in identifying when cases are coming due, when they are overdue, and when they are missing. However, there were errors in the functionality of the report that were identified during the first sixth months the report was used. These errors led to placement resources specialists and their supervisors not having an accurate tool to appropriately identify all cases in need of a resource level determination. Placement resources specialists struggled to properly utilize the new report and as part of the Plan, Do, Check, Act (CQI process) additional steps were added to the process to assist with ensuring the reports were accurate and additional training was provided to staff to ensure they were supported. During the audit period, the Department expanded level determinations to include unlicensed kinship caregivers for the purpose of providing support which increased the number of resource level determinations and substantially increased workload for the placement resources specialists. In addition, when reviewing the number of cases that are missing rate assessments, many of the cases are for Tribal Dependent Youth for Tribes that have made the decision to do their own level determinations. Tribes are sovereign nations, and we partner with them in this space. We continue to work with Tribes to help determine the best way to support them in completing timely rate assessments. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington Administrative Code 110-50-0490, How often do the foster parent and caseworker meet to complete the rate assessment?, establishes rate assessment requirements for the program. Washington Administrative Code 110-50-0440, Foster care maintenance payment and standardized assessment tool, establishes rate assessment requirements for the program.

2024-068 The Department of Children, Youth, and Families did not have adequate controls over and did not comply with certain requirements of its Public Assistance Cost Allocation Plan. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 – Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2302 WAFOST 2402WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-065 Background As a condition of receiving federal grant funds, the Department of Children, Youth, and Families must submit a Public Assistance Cost Allocation Plan (PACAP) to the U.S. Department of Health and Human Services each state fiscal year. The PACAP describes how the Department is authorized to allocate indirect costs like overhead and general administrative expenses to all funding sources, including federal grants. The Department uses the Cost Allocation System (CAS), a subsystem of the Agency Financial Reporting System (AFRS), to execute its PACAP. The Department develops appropriate methodologies and updates cost allocation base input tables that contain cost objectives, which automatically distribute the cost of payments to either state, local or federal funding sources. The tables in CAS can be added, deleted, changed or inactivated each calendar month. As part of its cost allocation process, the Department establishes bases that are used to distribute costs to multiple funding sources. Each base consists of elements that are assigned a percentage that dictates how much of the original payment is allocated to it. For example, a base could be made up of three elements that allocate 35%, 25% and 40%, respectively, that will total 100%. Records of these bases are kept in workbooks that management reviews and approves before they are uploaded or keyed into AFRS for use. In fiscal year 2024, the Department allocated about $21 million in indirect costs to the Foster Care grant. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls over and did not comply with certain requirements of its PACAP. The prior finding numbers were 2023-065 and 2022-047. Description of Condition The Department did not have adequate controls over and did not comply with certain requirements of its PACAP. According to the Department’s PACAP, Base 100, which are charges for administrative costs, should be updated monthly with full-time equivalents disbursed to reflect the work that agency staff have performed. This method allows the Department to allocate administrative charges proportionately to the staffing level required to meet the program’s needs. We examined five monthly workbooks completed during the audit period. We found the Department did not complete a workbook for one month of the audit period (August 2023). We consider this internal control deficiency to be a material weakness which led to material noncompliance. Cause of Condition Management did not assign sufficient staffing resources to ensure all monthly workbooks were completed in accordance with the Department’s approved PACAP. Effect of Condition The Department’s inadequate internal controls affected the accuracy of the indirect costs charged to the Foster Care grant. When workbooks are not updated, the Department increases its risk of undercharging or improperly allocating indirect costs to the Foster Care program. Recommendation We recommend the Department strengthen internal controls to ensure that monthly workbooks are properly updated in accordance with the approved PACAP. Department’s Response The Department concurs with the finding. The Department did not have adequate staffing levels to maintain the business processes for one workbook for the Public Assistance Cost Allocation Plan (PACAP) cost base 100 for the administrative charges during the state and federal fiscal year close deadlines. Available staff were focused on grant reconciliations and closing out the prior fiscal year financial transactions. The Department is committed to improving our internal controls and has reviewed the base edit form written procedures with staff and added monthly reminders for the Cost Allocation and Grants Management Unit. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 95, Subpart E – Cost Allocation Plans, section 95.501, Purpose, states: (a) Preparation, submission, and approval of State agency cost allocation plans for public assistance programs; and (b) Adherence to approved cost allocation plans in computing claims for Federal financial participation. Public Assistance Cost Allocation Plan – Appendix 3 Administrative Costs, Base 100, states in part: FTEs are based on actual months and are reported by funding source. This information is obtained on a monthly basis from the Enterprise Reporting system at DCYF and is used on a rolling period with a one-month lag. For example, the FTEs for July would be used in the September plan. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-069 The Department of Children, Youth, and Families did not have adequate internal controls to ensure a child is eligible and group care facility employees and adults residing in prospective caregivers’ households had cleared background checks before having unsupervised access to children. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 – Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2302 WAFOST; 2402 WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: $3,493 Prior Year Audit Finding: Yes, Finding 2023-068 Background The federal Foster Care Title IV-E program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state’s child welfare agency until they are returned to home, placed with adoptive families, or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for the adults in the Foster Care program, including state agency staff, foster parents and certain private agency staff. Individuals To be eligible to receive foster care benefits a child must meet specific eligibility requirements including the former Aid to Families with Dependent Children (AFDC) criteria. To meet the AFDC criteria, the child must be in need and deprived of parental support or have a principal wage earner parent who is unemployed. The Department performs reviews of Title IV-E specialists’ cases to verify that all IV-E cases that are worked, are determined properly. During the audit period the Department had two processes. For the first quarter the Department had supervisors review 2 cases for each Title IV-E specialist they supervised. For the remaining three quarters of our audit period the Department had reimplemented their old process of quarterly peer reviews, where the Title IV-E specialist's review other regions Title IV-E Specialists’ cases to verify that specialists are determining eligibility properly. Background Checks Prospective foster parents and other out-of-home caregivers, as well as any adults residing in the prospective caregivers’ households must pass the background check. During an emergency situation when a child must be placed in out-of-home care due to the absence of appropriate parents or custodians, the Department shall request a federal name-based criminal history record check of each adult residing in the home of the potential placement resource. Upon receipt of the results the name-based check, the Department shall provide a complete set of each adult resident’s fingerprints to the Washington state patrol for submission to the federal bureau of investigation within 15 calendar days from the date the name search was conducted. The child shall be removed from the home immediately if any adult resident fails to provide fingerprints and written permission to perform a federal criminal history record check when requested. To ensure group care facility employees and adults residing in prospective caregivers’ households had cleared background checks before having unsupervised access to children the Department verifies that the facility is compliant and that background checks were completed before providing them with a license number. In Washington, the Department of Children, Youth, and Families administers the Foster Care program. During fiscal year 2024, the Department spent about $163.9 million in federal grant funds. This included about $39.1 million for payments to providers for direct client services, with $1.1 million paid to licensed group care facilities and $16.9 million paid to foster family homes. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls to ensure group care facility employees and adults residing in prospective caregivers’ households had cleared background checks before having unsupervised access to children. The prior finding numbers were 2023-068 and 2022-050. Description of Condition The Department did not have adequate internal controls to ensure a child is eligible and group care facility employees and adults residing in prospective caregivers’ households had cleared background checks before having unsupervised access to children. Individuals The supervisor and peer reviews were not in place throughout the audit period and were not working as intended. We found the Department did not retain monthly supervisor reviews for the first quarter for two of its six regions. We also found the Department did not perform peer reviews in the second quarter. We used a statistical sampling method to randomly select and examine 59 out of a total population of 465 children to determine whether they were eligible for the Foster Care program. We found one child who was not eligible, but for whom the Department paid $3,493 in benefits on behalf of using Foster Care program funds. Background Checks We used a statistical sampling method to randomly select and examine 57 out of a total population of 1,174 foster home new licenses and relicenses. We found that one foster home operated without a valid license for two months. In addition, we used a statistical sampling method to randomly select and examine 58 out of a total population of 2,064 employees and household members who required background checks and found: • Two individuals had background checks that were late with one being nine days after placement and the other being six months late • Four of the individuals were missing fingerprint background checks We consider these internal control deficiencies to be a material weakness, which led to material noncompliance Cause of Condition Individuals The Department did not include all assets of the family’s resources when calculating the child’s AFDC eligibility resulting in an ineligible client being paid with federal grant funds. Background Checks The Department processes over 50,000 background checks annually, with more than 60% processed in an information technology (IT) system that lacks the capability to track an individual’s status. The inefficient IT system necessitates staff manually documenting information across multiple, non-standardized systems, which can create challenges, particularly given the high turnover among field staff. Additionally, Department management did not monitor to ensure internal controls were sufficient to ensure compliance and that they were being followed. Effect of Condition and Questioned Costs Individuals The Department improperly determined eligibility for one individual leading to known questioned costs of $3,493. We used a nonstatistical sampling method and estimate likely questioned costs to be $33,335. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Background Checks By not ensuring everyone had cleared background checks before having unsupervised access to children, children may be in unsafe environments that affect their health and safety. Because this finding reports non-compliance with state law, the Office of Financial Management is required by RCW 43.09.312 (1) to submit the agency’s response and plan for remediation to the Governor, the Joint Legislative Audit and Review Committee, and the relevant fiscal and policy committees of the Senate and House of Representatives. Recommendations We recommend the Department: • Strengthen its internal controls and ensure everyone has cleared background checks before having unsupervised access to children • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department’s Response The Department is committed to strengthening internal controls and complying with grant requirements. As to the State Auditor’s Office (SAO) specific findings, the Department concurs and offers the following detail: Individuals The Department concurs that eligibility was improperly determined for one individual during the audit period. Upon notification, the Department processed a correction and returned the federal funds to the grantor. In addition, the Department has made updates to the peer review process to ensure that a sample of cases are reviewed quarterly and all documentation for the reviews are properly retained. Background Checks The Department concurs that six background checks were not conducted as required. As stated in the Cause of Condition, the current information technology (IT) system lacks the capability to track an individual’s background check status. The inefficient IT system necessitates staff manually documenting information across multiple, non-standardized systems, which can create challenges, particularly given the high turnover among field staff. To improve compliance, in January 2024, the Department started shifting its practice to conduct National Crime Information Center (NCIC) background checks for more placements, which will help ensure background checks are completed prior to placement. The Department will continue communication and training for staff on this new process and clarify when this process is applicable. The Department appreciates the SAO’s insights and remains committed to strengthening our processes to ensure compliance with all background check requirements. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. RCW 43.43.837, Fingerprint-based checks – Requirements for applicants and service providers – Shared background checks-Fees-Rules to establish financial responsibility RCW 74.15.110, Renewal of licenses. Department of Children, Youth, and Families, Policies and Procedures 6800 – Background Checks.

2024-070 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with reporting requirements for the Foster Care program. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 – Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2302WAFOST 2402WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-069 Background The purpose of the Foster Care program is to provide safe and stable out-of-home care for children under placement and care authority of state welfare agencies. To accomplish this, the Administration for Children and Families (ACF) in the U.S. Department of Health and Human Services (HHS) offers financial support to states to offset the cost of foster care maintenance for eligible children, administrative costs to manage the program, and training for state agency staff, foster parents and qualified private agency staff. As of June 2024, about 8,000 children were in Washington’s foster care system. In fiscal year 2024, the Department spent about $164 million in federal program funds. Within 30 days after each fiscal quarter, the Department of Children, Youth, and Families is required to file the CB-496: Title IV-E Programs Quarterly Financial Report with HHS. This report identifies the Department’s Foster Care program expenditures, and the number of children it has served. The ACF relies on the information reported to award funds, determine the allowability of the reported expenditures, and provide reports to Congress.  To complete the CB-496, Department management creates a crosswalk by examining the Department’s chart of accounts and expenditure-codes in relation to HHS’s published CB-496 instructions. This ensures that the reports ran will produce the required information for each line of the CB-496. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with reporting requirements for the Foster Care program. The prior finding numbers were 2023-069 and 2022-051. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements for the Foster Care program. During our review of all four quarterly crosswalks, we found the Department did not have the correct account coding to report fields correctly. Out of the four quarterly crosswalks, the Department had 126 lines in aggregate, and ten (8%) of the lines were incorrect. During our review of the four quarterly reports, we found that all of them contained inaccuracies. Of the 161 reported line items we examined, 141 were related to expenditure amounts and the other 20 were related to child counts. • The Department misreported 16 expenditure line items o Eight of these lines were misreported, ranging between ($4,389) and $373. Of the eight identified, two lines had incorrect expenditures that reported to the other six lines through subtotals. o For the remaining eight expenditure line items, we were unable to determine the accuracy of the reported expenditures. • The Department also misreported eight line items related to child counts o Six of these were input incorrectly ranging between (28) and ten children. o For the remaining two line items, we were unable to determine the accuracy of the child count reported. We consider these internal control deficiencies to be a material weakness which resulted in material noncompliance. Cause of Condition When completing the quarterly reports, the Department did not follow HHS’s published instructions. The Department did not create accurate crosswalks to ensure reports were run properly and, although there was an established review process, the reviews performed were insufficient to detect errors in the reports. Management said that due to competing priorities and staffing shortages, the Department had limited capacity to thoroughly review the reports before submitting them to HHS. Effect of Condition Because HHS uses these reports to determine award amounts and whether reported expenditures are allowable, it may have relied on inaccurate data to make these determinations for the Department. The grant agreement also allows HHS to take action for the Department’s noncompliance, which can include temporarily withholding funds, wholly or partly suspending or terminating the award, and withholding further program awards. Recommendation We recommend the Department: • Follow HHS’s published instructions when completing the quarterly CB-496 reports • Strengthen its review processes to ensure the reports are accurate and supported before submitting them to HHS Department’s Response During the audit period, the Department acknowledges errors were made in the quarterly reports and crosswalks. The Department concurs with the SAO findings. As to the Auditor’s specific findings, the Department offers the following detail: Quarterly Crosswalks The Department concurs that crosswalks were not reflective of the CB-496 instructions by line during the audit period. The crosswalks properly reflected the financial coding to run accurate reports, except for the splitting of administrative costs into separate lines on the report as outlined in the HHS published instructions. Inaccurate Reports SAO stated the Department misreported its program expenditures during the audit period. The Department concurs and offers the following: • The FFY23 Quarter 4 report was overstated by $373. • The FFY24 Quarter 1 report was understated by $4,389. • The FFY24 Quarter 2 and FFY24 Quarter 3 report expenditures were accurate, but the data was not split between the correct administrative reporting lines. This error does not have an effect on the overall administrative expenditures reported to HHS. The Department manages reporting for the Title IV-E program of $164 million per fiscal year. In proportion to the total expenditures reported, the reporting error identified by SAO is .0025%. The Department will submit a correction to the federal partner during the next reporting period and is committed to strengthening our internal review processes to ensure quarterly reports are completed accurately. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 201, Grants to States for Public Assistance Programs, establishes applicable requirements for form and manner of submittal of the estimates for public assistance grants. Section 201.5 Grants, states in part: a. Form and manner of submittal. 1. Time and place: The estimates for public assistance grants for each quarterly period must be forwarded to the regional office 45 days prior to the period of the estimate. They include a certification of State funds available and a justification statement in support of the estimates. A statement of quarterly expenditures and any necessary supporting schedules must be forwarded to the Department of Health and Human Services, Family Support Administration, not later than 30 days after the end of the quarter. 2. Description of forms: “State Agency Expenditure Projection – Quarterly Projection by Program” represents the State agency’s estimate of the total amount and the Federal share of expenditures for assistance, services, training, and administration to be made during the quarter for each of the public assistance programs under the Act. From these estimates the State and Federal shares of the total expenditures are computed. The State’s computed share of total estimated expenditures is the amount of State and local funds necessary for the quarter. The federal share is the basis for the funds to be advanced for the quarter. The State agency must also certify, on this form or otherwise, the amount of State funds (exclusive of any balance of advances received from the Federal Government) actually on hand and available for expenditure; this certification must be signed by the executive officer of the State agency submitting the estimate or a person officially designated by him, or by a fiscal officer of the State if required by State law or regulation. (A form “Certificate of Availability of State Funds for Assistance and Administration during Quarter” is available for submitting this information, but its use is optional.) If the amount of State funds (or State and local funds if localities participate in the program), shown as available for expenditures is not sufficient to cover the State’s proportionate share of the amount estimated to be expended, the certification must contain a statement showing the source from which the amount of the deficiency is expected to be derived and the time when this amount is expected to be made available. 3. The State agency must also submit a quarterly statement of expenditures for each of the public assistance programs under the Act. This is an accounting statement of the disposition of the Federal funds granted for past periods and provides the basis for making the adjustments necessary when the State’s estimate for any prior quarter was greater or less than the amount the State actually expended in that quarter. The statement of expenditures also shows the share of the Federal Government in any recoupment, from whatever source, including for title IV-A the appropriate share of child support collections made by the State, of expenditures claimed in a prior period, and also in expenditures not properly subject to Federal financial participation which are acknowledged by the State agency, including the share of the Federal Government for uncashed and cancelled checks as described at 45 CFR 201.67 and replacement checks as described at 45 CFR 201.70 in this part, or which have been revealed in the course of an audit. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-071 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure Foster Care Maintenance payment rates were properly calculated. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 – Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2302WAFOST 2402WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – Payment Rate Setting and Application Known Questioned Cost Amount: None Prior Year Audit Finding: N/A Background The federal Foster Care Title IV-E program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state’s child welfare agency until they are returned home, placed with adoptive families or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for adults who are involved in the Foster Care program, including state agency staff, foster parents and certain private agency staff. In Washington, the Department of Children, Youth, and Families administers the Foster Care program. During fiscal year 2024, the Department spent about $164 million in federal grant funds, including about $15.4 million for foster care maintenance payments. The Department must establish payment rates for maintenance payments (for example, payments to foster parents, childcare institutions or directly to youth). The Department’s state plan approved by the Administration for Children and Families must provide for periodic review of payment rates for foster care maintenance payments at reasonable, specific, time-limited periods established by the Department to ensure the rate’s continuing appropriateness for the administration of the Title IV-E program. One of seven levels of maintenance payment amounts are assigned to each child based on a variety of factors such as medical needs. Each of the levels includes an overall increase of $342.50 from the previous level. In fiscal year 2024, the Department recalculated its Foster Care maintenance payment rates. The different rate level increases were between $50 and $1,302 per month. The Department has established rate structures for regular foster care maintenance payments, Behavioral Rehabilitation Service, and administrative service and management fees. The Department performs an economic analysis every four years to determine rates. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure Foster Care Maintenance payment rates were properly calculated. The Department did not have written policies and procedures to ensure it established maintenance payment rates exclusively for allowable, reasonable and necessary activities. During the audit, we reviewed the rate elements the Department used to determine the final maintenance rates. We identified several elements that, in our judgment, appeared to be unnecessary or unreasonable, including: • Apps/games/ringtones for handheld devices • Multiple entertainment and recreation costs such as: o TV/video/audio o Satellite dishes o Exercise equipment and gear/game tables o Video game software o Streaming/downloaded audio o Stamp and coin collecting o Online gaming services • Food that did not appear to be suitable for children’s activities such as coffee, soda and other carbonated drinks, and sweets • Baby food included in the calculation for older children We consider these internal control deficiencies to be a material weakness, which led to material noncompliance This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not have written policies and procedures and had no documentation to demonstrate how each rate element above was reasonable and allowable. In addition, the state plan did not reference any policies, laws or regulations regarding how rates should be calculated; it only referenced a policy stating that rates must be recalculated every four years. In addition, the Department had a two-year moratorium on policies and procedures for the agency. The Department began working on a policy related to Rates, but this work has been delayed due to staff turnover and available resources. Effect of Condition After removing the elements described above, rates for level one payments were roughly $50 less than what the Department determined. The Basic Rate difference was $49.79 for children up to five years old, $50.27 for children aged six to 11 years, and $52.29 for children aged 12 years and older. Additionally, the Department could not support the overall increase of $342.50 for each level. For levels higher than the basic rate, the Department was unable to support the increases, leading to the Department potentially paying more than allowable. Recommendation We recommend the Department develop and implement written policies and procedures for setting payment rates to ensure established foster care maintenance payment rates only include allowable costs. Department’s Response The Department concurs that policies and procedures related to rate setting for Foster Care maintenance payment are not currently established. Due to limited staffing resources, in September 2024, the Department submitted a budget request for the 2025 supplemental budget. The request included funding for a contractor to establish a formal governance process, policies and procedures, and create a public rate setting calendar and feedback structure for Department rate setting activities. This budget request was not funded by the Legislature. In February 2025, the Department met with the SAO to gather an understanding of concerns and how reasonable and allowable rates could be documented to assist with compliance. The Department is committed to strengthening internal controls and complying with federal requirements and will prioritize establishing policies and procedures for rate setting. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, Subpart E-Cost Principles Title 45 CFR Part 75, Subpart F-Audit Requirements, establishes standards for obtaining consistency and uniformity among HHS agencies for the audit of non-Federal entities expending Federal awards. Title 42 U.S. Code Chapter 7, Social Security Subchapter IV –Grants to States for Aid and Services to Needy Families with Children and for Child-Welfare Services. Section 675 Definitions Part 4 states in part: 4. The term “foster care maintenance payments” means payments to cover the cost of (and the cost of providing) food, clothing, shelter, daily supervision, school supplies, a child’s personal incidentals, liability insurance with respect to a child, reasonable travel to the child’s home for visitation, and reasonable travel for the child to remain in the school in which the child is enrolled at the time of placement. In the case of institutional care, such term shall include the reasonable costs of administration and operation of such institution as are necessarily required to provide the items described in the preceding sentence. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-072 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable and properly supported for the Social Services Block Grant. Assistance Listing Number and Title: 93.667 Social Services Block Grant Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2302WASOSR; 2402WASOSR Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: $9,098,747 Prior Year Audit Finding: Yes, Finding 2023-070 Background The Department of Children, Youth, and Families administers the Social Services Block Grant (SSBG) program to provide services to children, youth and young adults for case management, foster care, protective services, transportation, childcare and other services such as child welfare services, intake and assessment, crisis counseling, family reconciliation and licensing staff. In fiscal year 2024, the Department spent about $46.7 million in federal funding. Of this amount, the Department paid about $20.2 million to providers for direct client services. SSBG gave the Department broad flexibility to design and administer the program based on its approved plan. The Department used the SSBG Pre-Expenditure Report and Intended Use Plan approved by the federal partner to identify activities eligible for the SSBG program. Payments to the providers were initially incurred for other programs then transferred to the SSBG program to align with the amounts allocated in the Pre-Expenditure Report. The Department periodically processed journal vouchers to make these transfers. Federal law requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable and properly supported for the SSBG. The prior finding number was 2023-070. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable and properly supported for the SSBG. Department management said it used the approved SSBG Pre-Expenditure Report and Intended Use Plan to identify eligible activities initially charged to the Foster Care program, then periodically transferred them to the SSBG grant to align with the Pre-Expenditure Report. The Department also said management performed monthly reconciliation to verify the expenditures were for allowable activities and within the period of performance. During our testing, we found the Department used the Pre-Expenditure Report to identify eligible activities for the SSBG program and transferred funds accordingly. However, we found the Department did not perform month reconciliations to verify these expenditures were for allowable activities and within the period of performance. We examined the Department’s accounting records to determine if payments the Department transferred to the SSBG program were for activities that were allowable, authorized, accurate and supported. We identified total provider payments of $20,211,047 that were transferred to the SSBG program during fiscal year 2024. We analyzed provider payments and requested the Department verify whether it could provide adequate level of expenditure so we could determine whether payments were allowable and supported. Based on our analysis and confirmation from the Department, we categorized the total expenditures into two categories, which we identified in the following table. Category Amount Provider payments for which the Department provided an adequate level of support $11,112,849 Provider payments for which the Department could not provide an adequate level of support $9,098,198 Total payments to providers $20,211,047 Provider payments for which the Department provided an adequate level of support We used a statistical sampling method to randomly select and examine 119 out of a total population of 12,867 payments. We reviewed the supporting documentation, description of activities and payment approvals. We found the payments were for activities that were supported, allowable, authorized and accurate. Provider payments for which the Department could not provide an adequate level of support We were unable to perform testing on payments totaling $9,098,198 because the Department was only able to provide summary level information. The Department was unable to provide an adequate level of support for us to determine whether the costs were for activities that were allowable, authorized and within the period of performance. Period of performance We analyzed costs recorded to determine if any costs were incurred for the 2024 SSBG grant award prior to the start of the grant period of performance. We found the Department charged $549 to the 2024 SSBG grant for costs prior to the grant award’s performance period began. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Due to staffing vacancies during the fiscal year, the Department did not perform monthly reconciliations to verify the expenditures were for allowable activities and within the period of performance. In addition, the Department processed expenditure transfers at the grant level. As a result, the Department could not provide an adequate level of support for 42 % of payments to providers charged to the SSBG program. Therefore, we could not determine whether the payments transferred to SSBG were accurate, for allowable activities, and incurred during the period of performance. Effect of Condition and Questioned Costs By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit some of the federal dollars it transferred to SSBG. We are questioning $9,098,747 in federal program costs the Department charged to the SSBG program during the audit period. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Design and implement internal controls to ensure the funds it transfers to SSBG are supported by transaction-level support sufficient to comply with federal law • Consult with the grantor to discuss whether it should repay the questioned costs identified in the audit Department’s Response The Department maintains that funds were not improperly charged to the SSBG grant. This is a two-year grant that the Department spends down in one fiscal year. The Department provided the State Auditor’s Office (SAO) with detailed expenditure data reports and email documentation of management reviews of the expenditures being charged to the SSBG grant. As to the SAO’s specific findings: Period of performance The charges identified by the SAO of $549 were related to accrued expenditures recorded at year end closing that were not transferred to the proper grant year. No federal funds were drawn on these accruals per Department guidelines and automated internal controls that are built into the Grants Management System that is used for federal draws. Provider payments for which the Department could not provide an adequate level of support The Department utilizes grant-level management for all federal funds, including the SSBG grant. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements are met. The Department allocated the SSBG grants to eligible clients and allowable activities in compliance with 45 CFR 98.67 but did not include the level of data recommended by the SAO for some transfers. The SAO maintained that the program is not auditable without transaction level data. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. In response to the auditor’s recommendations related to fiscal year 2023 Child Care and Development Fund findings, the Department submitted a budget request for the 2024 supplemental budget. Funding was provided effective July 2024 to develop and maintain the business process that would allow adjustments to include transaction level data. Upon receiving funding, the Department is working with a developer to assist with building out the required databases between the Social Service Payment System and the Agency Financial Reporting System to allow transfers between funding sources to include transaction level data related to the expenditures. The Department looks forward to working with SAO to resolve the transaction level data concerns and move forward with fully auditing the SSBG grant program. Auditor’s Remarks Period of Performance We performed testing to ensure federal awards were charged only for allowable costs within their performance periods. We found the Department improperly charged $549 to the 2024 SSBG grant for costs incurred before the grant’s start date. Provider payments for which the Department could not provide an adequate level of support The level of documentation needed to support grant expenditures is not established by our Office but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. Without adequate transactional level payment data, our Office is unable to perform tests to verify the remaining payments were transferred from eligible and allowable expenditures for the SSBG grant. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 96.30 – Fiscal and administrative requirements, states in part: a. Fiscal Control and accounting procedures. Except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures applicable to the obligation and expenditure of its own funds. Fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibition of the statute authorizing the block grant. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-073 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with reporting requirements to ensure reports were complete and accurate for the Social Services Block Grant program. Assistance Listing Number and Title: 93.667 Social Services Block Grant Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2302WASOSR; 2402WASOSR Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-072 Background The Department of Children, Youth, and Families administers the Social Services Block Grant (SSBG) program to provide services to children, youth and young adults for case management, foster care, protective services, transportation, childcare and other services, such as child welfare services, intake and assessment, crisis counseling, family reconciliation and licensing staff. In fiscal year 2024, the Department spent about $46.7 million in federal funding. The Department is required to submit annual SF-425 financial reports for each open SSBG grant. These reports contain information such as the federal grant number, the recipient organization, grant period, reporting period end date, and a summary of expenditures and revenues related to the grant during the reporting period. The Department is also required to submit annual SSBG Post-Expenditure reports that describe how the Department expended its SSBG grant for each fiscal year. These reports include information such as: 1. The number of eligible people who received services that were fully or partially paid for with SSBG funds 2. The amount of SSBG funds spent on providing each service 3. The method(s) by which each service was provided, showing separately for each service provided by public agencies, private agencies or both 4. The criteria applied in determining eligibility for each service, such as income eligibility guidelines, sliding fee scales, the effect of public assistance benefits, and any requirements for enrollment in school or training programs 5. The state’s definition of “child,” “adult” and “family” 6. Temporary Assistance for Needy Families funds transferred into SSBG In its approved state plan, the Department has broad flexibility to design and administer the SSBG program. The Department used the SSBG Pre-Expenditure Report and Intended Use Plan approved by the federal partner to identify activities eligible for the SSBG program. Most of the expenditures charged to the SSBG program were initially incurred for the other programs and transferred to the SSBG program. The Department periodically processed accounting adjustments to make these transfers. Federal law requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with reporting requirements to ensure reports were complete and accurate for the SSBG program. The prior finding number was 2023-072. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements to ensure reports were complete and accurate for the SSBG program. Financial Reporting – SF-425 We selected and examined the two SF-425 reports that the Department was required to submit in state fiscal year 2024. During the audit period, the Department processed expenditure transfers at the grant level. As a result, the Department did not identify the specific transactions, or provide the required level of supporting documentation, for 45% of payments to providers that were charged to the SSBG program. These transactions represented about 20% of total SSBG expenditures. Therefore, we could not rely on the data supporting the Department’s reported SF-425 expenditures and could not determine if the reports were accurate and complete. This condition is also reference in audit finding 2024-072. Performance Reporting – Post-Expenditure Report Department personnel said they reviewed and approved the Post-Expenditure Report workbook before the information was uploaded into the SSBG portal to ensure the data was complete and accurate. Department personnel then reviewed and approved the Post-Expenditure Report in the SSBG portal to ensure it was complete and accurate before management performed a final review, certified the report and submitted it. We selected the only SSBG Post-Expenditure Report that the Department was required to submit during the audit period. We found no documented evidence that the appropriate Department personnel reviewed the Post-Expenditure Report Workbook and the SSBG Post-Expenditure Report for accuracy and completeness before management completed the final review and certification of the report. The unsupported SF-425 expenditures identified above were also included in this report. Therefore, we could not rely on the data supporting the expenditures reported in the Department’s SSBG Post-Expenditure Report and could not determine if it was accurate and complete. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department processed expenditure transfers at the grant level and made accounting adjustments without identifying the actual payments that were used to support those adjustments. Additionally, while management asserted the Post-Expenditure Report Workbook and SSBG Post-Expenditure Report were reviewed before the report was uploaded into the SSBG portal, there was no evidence that this review occurred. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure that expenditure amounts reported to the grantor are complete and accurate. By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible to audit some of the federal dollars it transferred to SSBG and reported on the SF-425 financial report and the SSBG Post-Expenditure report. Recommendations We recommend the Department: • Improve internal controls to ensure management reviews reports along with supporting expenditure and revenue data to ensure completeness and accuracy • Design and implement internal controls to ensure financial and program reports are supported with an adequate level of detail Department’s Response The Department utilizes grant-level management for all federal funds, including the SSBG grant. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements are met. The Department allocated the SSBG grants to eligible clients and allowable activities in compliance with 45 CFR 98.67 but did not include the level of data recommended by the State Auditor’s Office (SAO) for some transfers. The SAO maintained that the program is not auditable without transaction level data. The Department maintains that funds were not improperly charged to the SSBG grant. This is a two-year grant that the Department spends down in one fiscal year. The Department provided the SAO with detailed expenditure data reports and email documentation of management reviews of the expenditures being charged to the SSBG grant and changes being requested prior to submission. Management reviewed the expenditure data prior to certifying and submitting the reports in the federal reporting system verifying the requested changes were made. The federal reporting system creates an email after certification which the Department shared with the SAO. The Department was unable to provide email communication between staff and management related to the approval of the changes requested as documentation of the final approval prior to management certifying the report in the federal system as requested by SAO. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. In response to the auditor’s recommendations related to fiscal year 2023 Child Care and Development Fund findings, the Department submitted a budget request for the 2024 supplemental budget. Funding was provided effective July 2024 to develop and maintain the business process that would allow adjustments to include transaction level data. Upon receiving funding, the Department is working with a developer to assist with building out the required databases between the Social Service Payment System and the Agency Financial Reporting System to allow transfers between funding sources to include transaction level data related to the expenditures. The Department looks forward to working with SAO to resolve the transaction level data concerns and move forward with fully auditing the SSBG grant program. Auditor’s Remarks The level of documentation needed to support grant expenditures is not established by our office but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. Without adequate transactional level payment data, our Office is unable to perform tests to verify the remaining payments were transferred from eligible and allowable expenditures for the SSBG grant. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 96.30 – Fiscal and administrative requirements, states in part: a. Fiscal Control and accounting procedures. Except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures applicable to the obligation and expenditure of its own funds. Fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibition of the statute authorizing the block grant. Title 45 CFR Part 96.74, Annual Reporting Requirements, establishes the reporting requirements for the Pre-Expenditure and Post-Expenditure program reports. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-074 The Health Care Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. Assistance Listing Number and Title: 93.767 Children’s Health Insurance Program 93.767 COVID-19 Children’s Health Insurance Program 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2305WA5MAP; 2305WA5ADM; 2305WAIMPL; 2405WA5MAP; 2405WA5ADM; 2205WA5021; 2305WA3002; 2305WA5021; 2405WA5021 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Managed Care Financial Audit Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-073 Background The Health Care Authority administers both Medicaid and the Children’s Health Insurance Program (CHIP). Medicaid is a jointly funded state and federal partnership providing coverage for about 2.5 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. CHIP provides health coverage for about 112,000 children and pregnant people whose families’ incomes are too high to qualify for Medicaid. During fiscal year 2024, the Medicaid program spent over $20.6 billion in federal and state funds and CHIP spent nearly $179.7 million in federal and state funds. Managed Care Organizations (MCOs) contract with the Authority under a comprehensive risk contract to provide prepaid health care services to eligible enrollees under their managed care programs. In fiscal year 2024, the Authority contracted with five MCOs and paid them more than $9.2 billion for Medicaid and CHIP services. Under federal regulations, contracts between states and MCOs must include a requirement that MCOs annually submit an audited financial report to the state. MCOs must have these audits conducted in accordance with generally accepted accounting principles (GAAP) and generally accepted auditing standards (GAAS). At least once every three years, the Authority must conduct or contract for an independent audit of the accuracy, truthfulness and completeness of the encounter and financial data each MCO submits. The Authority must also post these audit results on its website. These requirements are effective for contract years starting after July 1, 2017. The Authority’s contracts with the MCOs began in January 2018, making the first audits required to be completed by December 2020. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. The prior finding numbers were 2023-073, 2022-054 and 2021-048. Description of Condition The Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. Audited financial reports During the audit period, the Authority’s MCO contract language included the option for MCOs to submit audited financial reports in accordance with statutory accounting principles (SAP), which is not an acceptable accounting method under federal regulations. As a result, the Authority accepted audited financial reports in accordance with SAP from all five MCOs. Periodic audits The Authority did not establish consistent internal controls to ensure it complied with the periodic audit requirements of MCO encounter and financial data. The Authority confirmed that its internal control included holding weekly meetings designed to keep the required audits on track for on-time completion. We used a nonstatistical sampling method to randomly select and examine 11 of 52 weekly meeting agendas during the audit period and found three instances in which the meetings did not occur, resulting in a 27.3% control failure rate. While the Authority was in material compliance with this requirement during the audit period, it was required to complete the first financial data audits by December 2020. Therefore, the audits were 41 months late. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Audited financial reports Authority officials said the Authority allowed MCOs to submit audited financial reports in accordance with SAP so the reports would be consistent with the Washington State Office of the Insurance Commissioner. The Office of the Insurance Commissioner considers SAP an acceptable accounting method for determining and reporting the financial condition and the results of operations of an insurance company and determining its solvency under Washington insurance law. However, this accounting method does not comply with the federal requirements. Periodic audits Authority officials initially confirmed that they had adequate controls in place throughout the audit period. However, after we selected our sample for control testing, Authority officials said they did not establish the control until October 2023. All exceptions we found in our testing were within the months where the control had not yet been in place. We did not note any exceptions in our sample for months within the period following its implementation. Effect of Condition Audited financial reports When it does not collect proper, audited financial reports, the Authority increases its risk of relying on inaccurate or incomplete information. Periodic audits When it does not establish consistent internal controls, the Authority increases its risk of material noncompliance by not completing the required audits of encounter data and financial data. These risks could lead to an increased risk of making improper payments and reduced public transparency. The Authority could also be subject to sanction by the federal grantor for not meeting Medicaid and CHIP requirements. Recommendation We recommend the Authority: • Implement policies and procedures over obtaining properly audited financial reports • Update MCO contracts to require audits of financial statements that are conducted in accordance with GAAP and GAAS • Establish consistent processes to conduct and fully complete audits of encounter data and financial data at least once every three years Authority’s Response Audited financial reports The Authority partially concurs. The Authority accepted financial statements prepared in accordance with SAP during the fiscal year but also implemented contract changes as described in the corrective action plan from the SFY23 finding. As previously communicated to the auditor, the contract amendment process takes several months to complete. Contract language reflects the requirement for MCOs to provide the required financial audits in accordance with generally accepted accounting principles (GAAP) and generally accepted auditing standards (GAAS) was initiated and will be reflected in the MCO contracts effective January 1, 2025. Periodic audits The Authority partially concurs. The Authority was in material compliance during the period under review but concurs that the initial Financial Audit was completed after December 2020. Moving forward, the Authority has controls in place to ensure periodic audits are completed within the required timelines. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 42 CFR Part 438, Managed Care, establishes the following applicable requirements: Section 438.3 Standard Contract Requirements states in part: (m) Audited financial reports. The contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section 438.600 Statutory basis, basic rule, and applicability states in part: (c) Applicability. States will not be held out of compliance with the following requirements of this subpart prior to the dates noted below so long as they comply with the corresponding standard(s) in 42 CFR part 438 contained in the CFR, parts 430 to 481, edition revised as of October 1, 2015: (1) States must comply with §438.602(a), 438.602(c) through (h), 438.604, 438.606, 438.608(a), and 438.608(c) and (d), no later than the rating period for contracts starting on or after July 1, 2017. (2) States must comply with §438.602(b) and § 438.608(b) no later than the rating period for contracts beginning on or after July 1, 2018. Section 438.602 State responsibilities states in part: (e) Periodic audits. The State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP. (g) Transparency. The State must post on its Web site, as required in §438.10(c)(3), the following documents and reports: (1) The MCO, PIHP, PAHP, or PCCM entity contract. (2) The data at §438.604(a)(5). (3) The name and title of individuals included in §438.604(a)(6). (4) The results of any audits under paragraph (e) of this section. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-075 The Health Care Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and Children’s Health Insurance Program. Assistance Listing Number and Title: 93.767 Children’s Health Insurance Program 93.767 COVID-19 Children’s Health Insurance Program 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2305WA5MAP; 2305WA5ADM; 2305WAIMPL; 2405WA5MAP; 2405WA5ADM; 2205WA5021; 2305WA3002; 2305WA5021; 2405WA5021 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – Provider Eligibility (Screening and Enrollment) Known Questioned Cost Amount: $3,844,961 Prior Year Audit Finding: Yes, Finding 2023-074 Background The Health Care Authority administers both Medicaid and the Children’s Health Insurance Program (CHIP). Medicaid is a jointly funded state and federal partnership providing coverage for about 2.5 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. CHIP provides health coverage for about 112,000 children and pregnant people whose families’ incomes are too high to qualify for Medicaid. During fiscal year 2024, the Medicaid program spent over $20.6 billion in federal and state funds and CHIP spent nearly $179.7 million in federal and state funds. The Authority ensures medical providers for both programs are eligible to provide services for clients. Providers must continue to meet eligibility requirements to receive payments under the programs. Washington had more than 140,000 participating providers in fiscal year 2024. During that time, the Authority paid more than $12.7 billion to providers for direct client services under the programs. The Authority is responsible for performing screening measures appropriate for the provider type at application and initial enrollment. Federal Regulations require that the state Medicaid agency determine the exclusion status of providers through the Social Security Administration’s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities, the System for Award Management, and any other databases as the State or Secretary may prescribe. All providers in a Medicaid program must have a valid National Provider Indicator (NPI) provided through the NPPES system before enrollment. Without passing these database checks, providers cannot be enrolled in Medicaid. The state Medicaid agency must also revalidate the enrollment of all Medicaid and CHIP providers at least every five years. To meet this requirement, the Authority has implemented an automated revalidation notification process that sends a letter to providers in time for them to be revalidated before the end of the five-year period. Federal law also requires state Medicaid agencies to check federal databases at least monthly to confirm the identity and exclusion status of providers, as well as any person with ownership, controlling interest, or acting as an agent or managing employee of the provider. During the fiscal year 2021 audit, our Office reported in finding 2021-047 that there was a problem with the automated revalidation notifications. Specifically, the notices were being sent to providers after the five-year deadline had passed. In December of 2023, the Authority reported that the issue was resolved, and that revalidation notices were going out 150 days before the revalidation due date. If the provider revalidation is not completed, the Authority’s Medicaid system (Provider One) is set to automatically deactivate the provider so that payments cannot be processed. The provider enrollment and revalidation processes are similar. The first step in both processes is to determine the providers’ screening risk level. A provider can be designated as one of three risk levels: limited, moderate, or high. Each risk level requires progressively greater scrutiny of the provider before it can be enrolled or revalidated. For providers enrolled with both Medicare and Medicaid, state Medicaid agencies must assign them to the same or higher risk category applicable under Medicare. Additionally, certain provider behaviors require them to be moved to a higher screening level. The following are the required screening procedures for all risk types: • Verify that the provider meets applicable federal regulations or state requirements for the provider type before making an enrollment determination • Conduct license verifications, including for licenses in states other than where the provider is enrolling • Conduct database checks to ensure providers continue to meet the enrollment criteria for their provider type. Such database checks include the NPPES, List of Excluded Individuals/Entities, Excluded Parties List System, and Death Master File Index If state Medicaid agencies assess providers at a moderate or high risk, they are required to conduct onsite visits for those that did not have one as part of their Medicare enrollment. Federal regulations require a high-risk provider, or a person with a 5 percent or more direct or indirect ownership in the provider, to receive a fingerprint-based criminal background check. The deadline to fully implement a fingerprint-based criminal background check was July 1, 2018. The Authority is also responsible for ensuring that providers obtain the proper signed attestations and disclosures. For servicing only providers, a direct link must be made to a billing provider that has an active Core Provider Agreement (CPA) on file. A CPA contains the required attestation and disclosures of the billing provider to allow for the payment of medical claims To ensure the Authority has completed all applicable screening and enrollment or revalidation steps before enrolling or revalidating providers, staff members use checklists for each enrollment and revalidation. The staff member signs and dates the checklist to indicate the provider is eligible to render services and receive payments. In response to the COVID-19 pandemic, the Authority obtained flexibility under blanket waivers approved by the Centers for Medicare and Medicaid Services (CMS), which were effective March 1, 2020, through the end of the emergency declaration period. These included the waiving of provider application fees and fingerprint-based criminal background checks. The CMS waivers also allowed for expedited processing of any new or pending provider application, as well as the postponement of all revalidation actions until the end of the emergency declaration which ended in March 2023 for the Medicaid and CHIP programs. Also, in response to the COVID-19 pandemic, the Authority’s Chief Medical Officer approved a blanket waiver for the backdating of all provider’s effective dates, which was allowed by CMS and Washington Administrative Code. This waiver allows all providers to submit claims for services provided before their enrollment and revalidation applications are approved. This waiver is still in effect. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it revalidated providers every five years and met screening requirements. The prior finding numbers were 2023-074, 2022-055, 2021-047, 2020-046, 2019-048, 2018-042, 2017-033, and 2016-035. Description of Condition The Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and CHIP programs. During the audit period, the Authority processed 12,073 new provider enrollments and was required to perform ongoing eligibility determinations for 125,615 active providers. We used a statistical sampling method to randomly select and examine 59 newly enrolled providers and 59 active providers to determine if the Authority properly screened them based on their enrollment status and correctly determined their eligibility status. Of the 118 providers examined, we found eight instances (7%) when the Authority did not take the appropriate actions to ensure providers met eligibility requirements. Specifically, we found: • Staff enrolled two new providers and did not terminate three active providers without either having a valid CPA on file or being affiliated with a billing provider who has a valid CPA on file. Because the providers were not covered by a valid CPA, they were improperly enrolled and not eligible to provide services. • Staff did not complete a full enrollment screening prior to approval for two new providers. • Staff did not close the ProviderOne domain for a provider who was listed as deceased on June 4th, 2017, in the automated provider screening system. The procedures for sending revalidation notifications to providers changed on December 8, 2023. After this date, the Authority sent revalidation notifications 150 days prior to the deadline. During the audit period, we identified 816 providers who received a revalidation notification prior to 12/8/2023 and 1,836 providers who received a revalidation notification after this date. We used a statistical sampling method to randomly select and examine 57 pre-12/8/2023 revalidations and 58 post-12/8/2023 revalidations to determine if the Authority appropriately screened the providers prior to approval or if providers were deactivated by the deadline. Of the 115 providers examined, we found 95 instances (83%) when the Authority did not take sufficient action to ensure providers were either appropriately revalidated or deactivated by the revalidation deadline. Specifically, we found: Pre-12/8/2023 Notifications • Staff revalidated 48 providers; however, revalidation occurred after the deadline • Seven providers were not revalidated or deactivated by the revalidation deadline Post-12/8/2023 Notifications • 10 providers were revalidated after the revalidation deadline • 30 providers were not revalidated or deactivated by the revalidation deadline Federal regulations and a state rule require providers identified as high risk receive fingerprint based criminal background checks upon enrollment or revalidation. The Authority stated that they are not currently performing background checks for high-risk providers and are developing resources and procedures to fulfil this requirement in the future. We consider these internal control deficiencies to be a material weakness which led to material noncompliance. Cause of Condition Although the Authority has established processes to screen and enroll providers, they were ineffective to prevent or detect noncompliance. Management also did not ensure staff consistently followed the procedures in place. Additionally, the automated revalidation notification was inadequate for ensuring the Authority complied with the five-year revalidation requirement. To comply with this requirement, the Authority should notify providers about their revalidations and ensure they are started and completed before the due date. Our audit found that prior to December 8, 2023, the Authority’s automated system was designed to notify providers of their revalidations one day after the due date. We formally notified the Authority of this weakness in the automated system during the fiscal year 2021, 2022, and 2023 audits. Our audit also found that after the automated revalidation system was corrected by the Authority, it did not automatically deactivate providers to prevent claims from being processed. Management did not ensure adequate internal controls were established to comply with requirements that high-risk providers receive fingerprint-based background checks. Effect of Condition and Questioned Costs By not complying with federal fingerprint-based background checks for high-risk providers, the Authority risks the health and safety of Medicaid clients and is at a higher risk of not detecting when medical providers are ineligible to provide services or be paid with Medicaid funds. By not conducting required licensing, screening, and enrollment processes in a timely manner, the Authority is at risk of not detecting or preventing ineligible providers from providing services to clients and receiving federal Medicaid and CHIP funds. Payments to providers who are ineligible are unallowable, and the Authority could be required to repay the grantor for these payments. Provider Category Known Questioned Costs (state and federal) Known Questioned Costs (federal portion only) Likely Questioned Costs (state and federal) Likely Questioned Costs (federal portion only) Revalidated Providers Pre 12/8/2023 (Old Process) $568,101 $277,570 $8,132,819 $3,973,630 Revalidated Providers Post 12/8/2023 (New Process) $342,094 $247,045 $10,829,055 $7,820,246 Total $910,195 $524,615 $18,961,874 $11,793,876 During revalidation testing for nursing facilities that submitted social service claims, we found that medical claims had also been submitted during fiscal year 2024. We checked the licensing of these facilities to ensure that they were eligible to bill Medicaid for medical services. We determined that three nursing facilities were not revalidated as required and were not prevented from submitting unallowable medical claims to Medicaid. We identified $6,463,577 in questioned costs, with the federal portion being $3,320,346. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with 95% confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our “best estimate of total questioned costs” as required by 45 CFR 75.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Authority: • Strengthen internal controls to ensure providers are adequately screened, licensed, enrolled, and eligible to provide and bill for services • Implement internal controls designed to bring it into material compliance with the provider revalidation process • Implement procedures to ensure high risk providers receive required fingerprint-based background checks Authority’s Response The Authority partially concurs with the finding. For the period of July 1, 2023 through December 8, 2023, the Authority concurs that 48 providers were revalidated after the deadline, and that seven providers were not revalidated or deactivated by the revalidation deadline. On December 8, 2023, the Authority implemented a system change to send revalidation notices 150 days ahead of the deadline. For the period of December 9, 2023, through June 30, 2024, the Authority concurs with the auditor’s testing. The Authority concurs that one provider was not terminated after the provider was deceased, and that one active provider was not correctly terminated due to an incomplete revalidation, described by the auditors as not having a valid CPA on file. The Authority does not concur with the auditor’s assertion that two providers did not have a valid CPA on file. The two providers had valid CPAs on file, which do not expire under state or federal law. Washington Administrative Code (WAC) requires only that providers have a CPA on file. There is no violation of federal regulations or WAC to revalidate without collecting a new signed CPA. The Authority does not concur that two new providers were enrolled without completion of a full enrollment screening. The providers were screened by staff as documented on the enrollment checklist on the same day the enrollment was approved. Finally, regarding the nursing facility revalidation issue, as Washington’s Medicaid agency, we operate cooperatively under a written agreement with the Department of Social and Health Services (Department) who carry out nursing facility licensing and revalidations. The Department responded with the following regarding the revalidations: “The Department partially agrees with the finding. We agree five providers did not have Medicaid Provider Disclosure Statement (MPDS) forms. We do not concur with the known questioned cost amount.  While the MPDS forms are a requirement for the Centers for Medicare and Medicaid Services, services were provided to clients and the nursing facilities had valid contracts and active licenses. Effective May 2024, the Nursing Facility Revalidation Process was updated to state that the Facilities Contract Specialist would review the NF revalidation monitoring spreadsheet monthly and revalidation paperwork sent one year in advance of the due date to ensure revalidation is done ahead of the 5-year period.  In addition, the Department will be consulting with the Authority to determine if it is possible to automate revalidation notices.  Department contracts staff will be verifying the MPDS forms are in MODIS for all nursing facilities and that each form has been completed within the 5-year period by 12/31/25.” Auditor’s Remarks Federal regulations state that providers must be revalidated at least every five years. The Authority’s written policies and procedures state that a signed CPA must be provided by providers as part of the revalidation. For the two providers enrolled without completion of a full enrollment screening, there was no record of a screening being performed at the time of enrollment in ProviderOne, the system of record. The enrollment checklist is an internal tool utilized by the Authority and does not provide sufficient evidence that screening requirements for providers were met. We appreciate the steps the Authority and Department have taken to ensure revalidation requirements are met for nursing facilities. However, federal regulations specify that federal payments may not be made to entities that do not provide required disclosures. Federal law 42 CFR Part 455.104 (f) states that federal financial participation is not available in payments made to a disclosing entity that fails to disclose required ownership or control information. We reaffirm our finding and questioned costs and will follow up on the status of the Authority’s corrective actions during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 U.S. Code of Federal Regulations (CFR) Part 433, State Fiscal Administration, Subpart F – Refunding of Federal Share of Medicaid Overpayments to Providers, describes the requirements for identifying, reporting, collecting, and remitting Medicaid overpayments. Title 42 CFR section 438 subpart H - Additional Program Integrity Safeguards, states in part: Section 438.602 State responsibilities b. Screening and enrollment and revalidation of providers. 1. The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PHIPs, and PAHPs, in accordance with the requirement of part 455 subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. 2. MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section of up to 120 days, but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120 day period without enrollment of the provider, and notify affected enrollees. c. Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM, or PCCM entity, and any subcontractors as required in § 438.608(c). d. Federal database checks. Consistent with the requirements at § 455.436 of this chapter, the State must confirm the identity and determine the exclusion status of MCO, PIHP, PAHP, PCCM, or PCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM, or PCCM entity through routine checks of Federal databases. This includes the Social Security Administration’s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with § 438.610(c). Title 42 CFR section 455 subpart B – Disclosure of Information by Providers and Fiscal Agents, states in part: Section 455.104 Disclosure by Medicaid providers and fiscal agents: Information on ownership and control. a. Who must provide disclosures. The Medicaid agency must obtain disclosures from disclosing entities, fiscal agents, and managed care entities. b. When disclosures must be provided. The Medicaid agency must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: 1. i. The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agency, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location and P.O. Box address. ii. Date of birth and Social Security Number (in the case of an individual). iii. Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. 2. Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in an subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. 3. The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. 4. The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). c. When the disclosures must be provided – 1. Disclosures from providers or disclosing entities. Disclosures from any provider or disclosing entity is due at any of the following times: i. Upon the provider or disclosing entity submitting the provider application. ii. Upon the provider or disclosing entity executing the provider agreement. iii. Upon request of the Medicaid agency during the re-validation of enrollment process under § 455.414. iv. Within 35 days after any change in ownership of the disclosing entity. 2. Disclosures from fiscal agents. Disclosures from fiscal agents are due at any of the following times: i. Upon the fiscal agent submitting the proposal in accordance with the State’s procurement process. ii. Upon the fiscal agent executing the contract with the State. iii. Upon the renewal or extension of the contract. iv. Within 35 days after any change in ownership of the fiscal agent. 3. Disclosures from managed care entities. Disclosures from managed care entities (MCOs, PIHPs, PAHPs, and HIOs), except PCCMs are due at any of the following times: i. Upon the managed care entity submitting the proposal in accordance with the State’s procurement process. ii. Upon the managed care entity executing the contract with the State. iii. Upon renewal of the contract. iv. Within 35 days after any change in ownership of the managed care entity. 4. Disclosures from PCCMs. PCCMs will comply with disclosure requirements under paragraph (c)(1) of this section. d. To whom must the disclosures be provided. All disclosures must be provided to the Medicaid agency. f. Consequences for failure to provide required disclosures. Federal financial participation (FFP) is not available in payments made to a disclosing entity that fails to disclose ownership or control information as required by this section. Title 42 CFR section 455 Subpart E – Provider Screening and Enrollment, states in part: Section 455.410 Enrollment and screening of providers a. The State Medicaid agency must require all enrolled providers to be screened under to this subpart. b. The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. c. The State Medicaid may rely on the results of the provider screening performed by any of the following: 1. Medicare contractors 2. Medicaid agencies or Children’s Health Insurance Programs of other States. Section 455.412 Verification of provider licenses The State Medicaid agency must – a. Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. b. Confirm that the provider’s license has not expired and that there are no current limitations on the provider’s license. Section 455.414 Revalidation of enrollment The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years. Section 455.436 Federal database checks The State Medicaid agency must do all of the following a. Confirm the identity and determine the exclusion status of any providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. b. Check the Social Security Administration’s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. c. 1. Consult appropriate databases to confirm identity upon enrollment and reenrollment; and 2. Check the LEIE and EPLS no less frequently than monthly. Section 455.450 Screening levels for Medicaid providers. A State Medicaid agency must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation or enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. a. Screening for providers designated as limited categorical risk. When the State Medicaid agency designated a provider as a limited categorical risk, the State Medicaid agency must do all of the following: 1. Verify that a provider meets any applicable Federal regulations, or State requirements for the provider type prior to making an enrollment determination. 2. Conduct license verifications, including State licensure verifications in States other than where the provider is enrolling, in accordance with § 455.412. 3. Conduct database checks on a pre- and post-enrollment basis to ensure that providers continue to meet the enrollment criteria for their provider type, in accordance with § 455.436. b. Screening for providers designated as moderate categorical risk. When the State Medicaid agency designates a provider as a “moderate” categorical risk, a State Medicaid Agency must do both of the following: 1. Perform the “limited” screening requirements described in paragraph (a) of this section. 2. Conduct on-site visits in accordance with § 455.432. c. Screening for providers designated as high categorical risk. When the State Medicaid agency designated a provider as a “high” categorical risk, a State Medicaid agency must do both of the following: 1. Perform the “limited” and “moderate” screening requirements described in paragraphs (a) and (b) of this section. 2. i. Conduct a criminal background check; and ii. Require the submission of a set of fingerprints in accordance with § 455.434. d. Denial or termination of enrollment. A provider, or any person with 5 percent or greater direct or indirect ownership in the providers, who is required by the State Medicaid agency or CMS to submit a set of fingerprints and fails to do so may have its – 1. Application denied under § 455.434; or 2. Enrollment reminder under § 455.416 e. Adjustment of risk level. The State agency must adjust the categorical risk level from “limited” or “moderate” to “high” when any of the following occurs: 1. The State Medicaid agency imposes a payment suspension on a provider based on credible allegation of fraud, waste or abuse, the provider has an existing Medicaid overpayment, or the provider has been excluded by the OIG or another State’s Medicaid program within the previous 10 years. 2. The State Medicaid agency of CMS in the previous 6 months lifted a temporary moratorium for the particular provider type and a provider that was prevented from enrolling based on the moratorium applies for enrollment as a provider at any time within 6 months from the date the moratorium was lifted. Medicaid Provider Enrollment Compendium (MPEC)

2024-076 The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure timely review of hospital complaints. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2305WA5MAP; 2305WA5ADM; 2305WAIMPL; 2405WA5MAP; 2405WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Provider Health and Safety Standards Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-076 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.5 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. During fiscal year 2024, the program spent more than $20.6 billion in federal and state funds. The Centers for Medicare and Medicaid Services (CMS), which administers the program at the federal level, relies on states to regulate and license hospitals that serve Medicaid clients. Medicaid coverage for hospitals is authorized only when services are provided in a facility that is licensed and certified by the state survey agency (for non-deemed hospitals) or an accrediting organization (for deemed hospitals). The term “deemed” means the facility has voluntarily requested and received permission from CMS to be certified by an accrediting organization, while hospitals that are “non-deemed” have not. The Department of Health is Washington’s state licensing agency, and is also responsible for investigating hospital complaints. The Department’s Office of Investigation and Legal Services (OILS) is the front-line response system for providing the intake and assignment functions for complaints from staff, patients, accrediting organizations and the public. The Department’s Office of Health Systems Oversight is responsible for coordinating and performing investigation surveys. Deemed hospitals are surveyed for CMS certification by their accrediting organizations. However, the Department performs an investigation survey for complaints that meet the federal prioritization level. People can submit complaints to OILS online or by mail, email or telephone. OILS uses the Integrated Licensing and Regulatory System (ILRS) to input and track complaints. OILS intake staff review report types regardless of delivery method before entering them into ILRS. Intake staff check for possible imminent danger and then deliver the complaint to the Department’s Office of Health Systems Oversight, as well as upload an electronic copy to a secure drive. The CMS State Operations Manual, which is binding on Medicare-certified and Medicare- Medicaid-certified providers, provides state agencies with procedural guidelines for surveying and managing complaints and incidents. Hospitals are responsible for following the provider health and safety standards that are mandated by state and federal regulations. When the Department receives hospital complaints, state regulations require staff to perform an initial assessment of the reports within 21 days. In addition, staff must review the reports for possible imminent danger within two working days of receiving them. If staff identify imminent danger, they must immediately forward the report for processing. The following two tables outline the federal requirements for response times the Department must follow for deemed hospitals and non-deemed hospitals. Priority levels and response times for non-deemed hospitals Priority levels Required response times Immediate Jeopardy Initiate onsite survey within two business days of receipt Non-Immediate Jeopardy High Initiate onsite survey within 45 calendar days of prioritization Non- Immediate Jeopardy Medium Must investigate no later than when the next onsite survey occurs Non-Immediate Jeopardy Low Must track/trend for potential focus areas during the next onsite survey Priority levels and response times for deemed hospitals Priority levels Required response times Immediate Jeopardy Initiate onsite survey within two business days of receipt of regional office authorization Non-Immediate Jeopardy High Initiate onsite survey within 45 calendar days of receipt of regional office authorization Non-Immediate Jeopardy Medium Complainant is referred to the applicable accrediting organization(s) Non-Immediate Jeopardy Low Complainant is referred to the applicable accrediting organization(s) The CMS State Operations Manual requires people with certain qualifications to assess each hospital complaint. These people must be professionally qualified to evaluate the nature of the problem based on their knowledge and experience of current clinical standards of practice and federal requirements. If OILS determined possible imminent danger, the case manager and survey manager review the complaints for immediate jeopardy. If they determine there is possible imminent danger, then an Expedited Case Management Team is designated. If they do not identify immediate jeopardy, they prioritize the complaint at the next weekly case management meeting. Once case managers decide that a complaint at a non-deemed hospital meets the state and federal prioritization level for investigation, they assign it to field staff. For complaints at deemed hospitals that meet the federal prioritization level for investigation, case managers request authorization from the CMS regional office through the Aspen Complaint Tracking System (ACTS) to initiate an investigation. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure timely review of hospital complaints. The prior finding number was 2023-076. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure timely review of hospital complaints. The Department received 1,784 hospital complaints during state fiscal year 2024. We evaluated all of them to ensure the Department performed an initial assessment and review of the complaints for imminent danger within the required timelines. We found the Department did not review 1,624 complaints (91%) for imminent danger within two working days of receiving them. The review time for these complaints ranged between three and 71 days. In addition, the Department did not review 303 complaints (17%) within the 21-day basic assessment period. The review time for these complaints ranged between 22 and 170 days. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not implement adequate internal controls to ensure staff reviewed the complaints within the required timeframe. Management also acknowledged that the Department was understaffed, which contributed to its failure to comply with the 21-day basic assessment period. In addition, the Department asserted that the ILRS system is not configured to accurately capture the dates of when program staff review complaints for imminent danger. Effect of Condition When the Department does not prioritize and perform a prompt initial assessment of complaints, vulnerable patients are at higher risk of abuse, neglect and substandard care. The delays in reviewing these complaints also affect the Department’s ability to initiate timely investigations of issues concerning providers. Further, when the Department does not promptly follow up on a complaint, the state also runs the risk of paying Medicaid funding to a noncompliant facility. Recommendation We recommend the Department implement internal controls to ensure it reviews complaints and documents the reviews for imminent danger within two working days of receiving the complaints and within the 21-day basic assessment, as state regulations and the State Operations Manual require.  Department’s Response We appreciate the State Auditor’s Office audit of the Medicaid Special Tests Health and Safety Standards grant requirement. The Department of Health is committed to ensuring our programs comply with federal regulations and concurs generally with the finding. While the Department continues to assert that it has a process to screen complaints for possible imminent danger, the Department has assessed and instituted system internal controls necessary to demonstrate compliance and properly reflect the accurate date of initial screening for imminent danger within two working days of receiving a complaint, as required by the CMS State Operations Manual, and subsequent 21-day basic assessment and review timeline per internal policies. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington Administrative Code 246-14-040 Uniform Procedures For Complaint Resolution, states: Initial assessment of reports. 1. Initial assessment is the process of determining whether a report warrants an investigation and becomes a complaint. The complainant and credential holder or applicant will be notified as soon as possible after the initial assessment is complete. 2. The basic time period for initial assessment is twenty-one days. 3. All reports will be reviewed for imminent danger within two working days. If imminent danger is identified, the report will be immediately forwarded for processing. The Centers for Medicare and Medicaid Services, State Operations Manual, Chapter 5 – Complaint Procedures, states in part: Section 5010 –General Intake Process A complaint is an allegation of noncompliance with Federal and/or State requirements. If the SA determines that the allegation(s) falls within the authority of the SA, the SA determines the severity and urgency of the allegations, so that appropriate and timely action can be pursued. Each SA is expected to have written policies and procedures to ensure that the appropriate response is taken for all allegations and is consistent with Federal requirements as well as with procedures in the Sate Operations Manual. This structure needs to include response timelines and a process to document actions taken by the SA in response to allegations. If a state’s time frames for the investigation of a complaint/incident are more stringent than the Federal time frames, the intake is prioritized using the State’s timeframes. The SA is expected to be able to share the logic and rationale that was utilized in prioritizing the complaint/incident for investigation. The SA response must be designed to protect the health and safety of all residents, patients, and clients. Section 5070 –Priority Assignment for Nursing Homes, Deemed and Non-Deemed Non- Long Term Care Providers/ Suppliers, and EMTALA An assessment of each complaint or incident intake must be made by an individual who is professionally qualified to evaluate the nature of the problem based upon his/her knowledge of Federal requirements and his/her knowledge of current clinical standards of practice. … For non-long term care providers/suppliers, in situations where a determination is made that immediate jeopardy may be present and ongoing, the SA is required to start the on site investigation within two business days of receipt of the complaint or incident report, or, in the case of a deemed provider or supplier, within two business days of RO authorization for investigation. The same process applies to EMT ALA complaints or a survey related to a report of a hospital or CAH Distinct Part Unit patient death associated with the use of restraint or seclusion. The SA’s investigation must be initiated within two business days of RO authorization for investigation. … CMS expects SAs to prioritize complaints at the appropriate level that is warranted. The timeframes in Section 5075 below represent maximum timeframes for investigation; … the SA is not precluded from investigating complaints and facility- reported incidents within a shorter timeframe. In addition, the SA is not precluded from taking other factors into consideration in its triage decision. For example, the SA may identify a trend in allegations that indicates an increased risk of harm to residents or the SA may receive corroborating information from other complainants regarding the allegation…. Section 5075.9 – Maximum Time Frames Related to the Federal Onsite Investigation of Complaints/Incidents Provider Type Intake Prioritization - Immediate Jeopardy Non-deemed non-long term care providers/suppliers SA must initiate an onsite survey within 2 business days of receipt. Deemed providers/suppliers SA must initiate an onsite survey within 2 business days of receipt of RO authorization.

2024-077 The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements to ensure it referred all credible allegations of provider fraud to the state’s Medicaid Fraud Control Unit. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2305WA5MAP; 2305WA5ADM; 2305WAIMPL; 2405WA5MAP; 2405WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Medicaid Fraud Control Unit Known Questioned Cost Amount: None Prior Year Audit Finding: No Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.5 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the State’s federal expenditures. During fiscal year 2024, the program spent more than $20.6 billion in federal and state funds. States are required as part of their Medicaid state plans to maintain a Medicaid Fraud Control Unit (MFCU). The primary mission of the MFCU is to investigate and prosecute fraud by Medicaid providers, to review and investigate complaints alleging abuse or neglect of patients in Medicaid-funded healthcare facilities, and to review and investigate complaints of patient abuse or neglect in board and care facilities or involving Medicaid beneficiaries in noninstitutional and other settings. States must have methods and criteria for identifying suspected fraud cases, methods for investigating these cases, and procedures, developed in cooperation with legal authorities, for referring credible allegations of fraud cases to law enforcement officials. Credible allegations of provider fraud must be referred to the state MFCU, a division within the Office of the Attorney General. States must have an agreement with the MFCU, which includes methods of coordination and procedures for referring potential fraud. Case managers and field staff at the Department of Social and Health Services, as well as their contractor, Consumer Direct Care Network Washington (CDWA) who manages Individual Providers delivering direct care to clients, help identify potential and suspected provider fraud for the Department to consider. The program integrity units within the Aging and Long-Term Support Administration (ALTSA) and Developmental Disabilities Administration (DDA) at the Department receive allegations of potential fraud and conduct further research to determine if the potential fraud is credible. If it is credible, and the fraud is a potential loss of more than $1,000, the Department refers the case to MFCU. Fraud allegations under $1,000 are reviewed and tracked to ensure any repeat allegations can be compiled to show a pattern of possible fraudulent behaviors. The Department and CDWA work together to offer provider education and billing standards training and once completed, the training is documented and then used to support any future allegations. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it referred all credible allegations of provider fraud to the state’s MFCU. To determine if the Department properly reviewed and investigated all allegations of fraud and referred those which were credible to MFCU, we reviewed allegations that program integrity units at ALTSA and DDA received. For allegations of fraud ALTSA reviewed, we used a statistical sampling method to randomly select and examine 56 out of a total population of 490 allegations. We determined ALTSA did not properly refer 13 (23 %) credible allegations of fraud to MFCU. For allegations of fraud DDA reviewed, we used a nonstatistical sampling method to randomly select and examine 13 out of a total population of 79 allegations. We determined DDA did not properly refer two (15 %) credible allegations of fraud to MFCU. We determined the Department’s internal controls were ineffectively designed to prevent noncompliance with MFCU requirements. Specifically, the Department’s decision to only refer cases of fraud with a potential loss of more than $1,000 is not in compliance with federal law, which requires the Department to refer all credible allegations to MFCU regardless of the amount of potential loss. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Department management said they were under the impression that MFCU did not want the Department to refer credible allegations of fraud with a potential loss of less than $10,000 to them for investigation. However, the Department determined that it would refer credible allegations with a potential loss of $1,000 or more. Effect of Condition Because the Department uses a monetary threshold, it does not refer most credible allegations of fraud with a potential loss of less than $1,000 to MFCU, as required. This prevents MFCU from considering some credible allegations of fraud for investigation; the State is therefore at risk of not recovering Medicaid funds that may have been fraudulently paid to providers. Recommendation We recommend the Department create and implement internal controls, policies and procedures that allow it to refer all credible allegations of fraud to MFCU. Department’s Response The Department concurs with the finding. The Department was under the impression that MFCU did not want referrals of credible allegations of fraud with a potential loss of less than $10,000 sent to them for investigation. However, management determined the Department would refer allegations of fraud with a potential loss of $1,000 or more. The 15 cases (13 for ALTSA and two for DDA) that were not referred to MFCU were each under $1,000 of potential loss. Provider education was completed by CDWA, and the funds were returned to Medicaid. Fraud referrals under $1,000 are all reviewed and tracked to ensure any repeat referrals can be compiled to show a pattern of possible fraudulent behaviors. The Department and CDWA work together to determine if provider education is appropriate. After CDWA completes the provider education and billing standards, training is documented and then used to support any future referrals. The Department met with CDWA to discuss a revised process that will ensure compliance with MFCU requirements. In addition, DSHS Medicaid Provider Fraud Referral form 12-210 will be modified to include CDWA as an entity. The Department and CDWA will revise and finalize existing procedures related to the submission of fraud referrals and referrals of all credible allegations regardless of the amount of potential loss. Approval will be requested for the creation of a ticketing system for CDWA to submit provider fraud referrals directly into SharePoint to streamline the process to reduce workload and ensure compliance with MFCU Requirements. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 42 CFR Part 455, section 21, Cooperation with State Medicaid fraud control units, states in part: a. The agency must 1. Refer all cases of suspected provider fraud to the unit; The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-078 The Department of Social and Health Services, Aging and Long-Term Support Administration, did not have adequate internal controls over and did not comply with survey requirements for Medicaid intermediate care facilities. Assistance Listing Number and Title: 93.775 - State Medicaid Fraud Control Units 93.777 - State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare 93.777 COVID-19 – State Survey and Certification of Health Care Providers and Suppliers 93.778 - Medical Assistance Program (Medicaid; Title XIX) 93.778 COVID-19 – Medical Assistance Program (Medicaid; Title XIX) Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: 2305WA5MAP; 2305WA5ADM; 2305WAIMPL; 2405WA5MAP; 2405WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Test and Provisions: Provider Health and Safety Standards Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-078 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.5 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. During fiscal year 2024, the program spent over $20.6 billion in federal and state funds and had three ICF/IID facilities that were Medicaid certified. Residential Care Services (RCS), under the Department of Social and Health Services, Aging and Long-Term Support Administration, is the State’s Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICF/IID) survey agency. An ICF/IID is an institution with the primary purpose of providing health or rehabilitation services to people with intellectual disabilities or related conditions who receive care and services under Medicaid. The Department must perform a federal certification survey of each ICF/IID. The certification survey is a resident-centered inspection that gathers information about the quality of service provided in a facility to determine compliance with the participation requirements. The survey focuses on the facility’s administration and patient services, as well as the outcome of the facility’s implementation of ICF/IID active treatment services. The survey also assesses compliance with federal health, safety and quality standards designed to ensure patients receive safe and quality care services. The State must complete a standard survey for each ICF/IID facility within 15.9 months after the previous survey, and the statewide average for all ICF/IID facilities must not exceed 12.9 months for all ICF/IID facilities, as required by Centers for Medicare and Medicaid Services (CMS). All staff surveyors are required to receive specific RCS training in order to be qualified to conduct surveys. If a survey uncovers deficiencies, the Department must mail a Statement of Deficiency (SOD) to the facility within 10 working days of the survey date. The facility must submit a Plan of Correction (POC) that the Department determines is acceptable within 10 calendar days of receipt of the SOD. The facility has a total of 60 days to be back in compliance or risk forfeiting its Medicaid certification. In addition to federal requirements, the Department has established its own policies and procedures requiring that it review a submitted POC within five working days after receiving it. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls to ensure it conducted timely surveys and followed up on deficiencies. The prior finding numbers were 2023-078, 2020-053, 2019-061, 2018–052, 2017-042, 2016-037, 2015-045, and 2014-046. Description of Condition The Department did not have adequate internal controls over and did not comply with survey requirements for Medicaid intermediate care facilities. The Department uses a tracking spreadsheet as an internal control to monitor and track the survey frequencies as well as the statewide average frequency to ensure it meets the mandated 15.9 month survey frequency, and the statewide average of 12.9 months between surveys for each facility. The Department uses a separate tracking spreadsheet to track individual surveys for SOD and POC due dates and approaching deadlines. We found the Department did not ensure that all recertification surveys were completed promptly. The Department did not adequately monitor the tracking sheet and complete surveys for all three of the ICF/IIDs within the required 15.9 months and 12.9 month statewide average. While assessing the Department’s compliance with these requirements, we considered the time period where survey activities were suspended due to the COVID-19 pandemic and did not include that period of suspended activities in our calculation between survey dates. The statewide average is calculated on the federal fiscal year. For federal fiscal year 2024, the statewide average for the three surveys was 22.1 months. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition As a result of the public health emergency, the Department had an extensive backlog of complaints and recertification surveys. While trying to address the backlog there were new complaints that also had to be prioritized. Although there are only three facilities, there is only one team that handles the surveys, complaints and revisits for this provider type across the entire state. Management did not monitor its survey schedules adequately to ensure compliance in meeting the survey timeline. Effect of Condition Without conducting recertification surveys timely, the State is at risk of paying facilities for services provided to Medicaid clients without assurance the facilities are complying with federal and state health standards and regulations. Clients residing in facilities that do not meet federal health and safety requirements for participating in the Medicaid program could be at increased risk of abuse, mistreatment, neglect or substandard care. By not meeting the statewide average requirement for recertification surveys, the Department has not met federal Medicaid requirements and could be subject to sanctions by the grantor. Recommendation We recommend the Department:  • Establish adequate internal controls to ensure compliance with facility survey timeliness requirements • Ensure it completes recertification surveys within 15.9 months and within the 12.9 month statewide average Department’s Response The Department partially concurs with the finding. We do not concur there is a lack of internal controls. It was through our applied internal controls we identified concerns and allocated resources to meet the most serious concerns. The Field Manager meets with the Administrative Assistant and reviews the 365-day average report to determine if survey schedules need to be modified in order to meet the federal requirement on a quarterly basis (12.9 and 15.9 month timeline). In FY 2023 and FY 2024, the team was trying address the backlog but had to prioritize new complaints. Although there are only three facilities, there is only one team that handles the surveys, complaints and revisits for this provider type across the entire state. The 12.9 month average is based on the overall average of the months for all ICF-IID surveys, and some of those surveys were in a significant backlog due to the pandemic. The Department continues to show progress in shortening the recertification survey intervals. For the reporting period of June 2024 through September 2025, the federal Certification and Survey Provider Enhanced Reporting tool (CASPER) has indicated that the Department’s survey average intervals are currently at 13.3 months, which is an improvement from the 22.1 months in FY23 and FY24. Regional Administrators have met with their ICF/IID teams to look ahead at survey scheduling for the year to ensure teams will be able to meet targeted survey completion dates and meet the 15.9 and 12.9 timeframes by December 2025. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR, Part 442, Standards for Payment to Nursing Facilities and Intermediate Care Facilities for Individuals with Intellectual Disabilities, states in part: Section 442.109 – Certification period for ICF/IIDs: General Provisions (a) A survey agency may certify a facility that fully meets applicable requirements. The State Survey Agency must conduct a survey of each ICF/IID not later than 15 months after the last day of the previous survey. (b) The statewide average interval between surveys must be 12 months or less, computed in accordance with paragraph (c) of this section. Title 42 CFR, Part 488, Survey, Certification, and Enforcement Procedures, states in part: Section 488.28 – Providers or suppliers, other than Skilled Nursing Facilities (SNFs), Nursing Facilities (NFs), and Home Health Agencies (HHAs) with deficiencies (a)If a provider or supplier is found to be deficient in one or more of the standards in the conditions of participation, conditions for coverage, or conditions for certification or requirements, it may participate in, or be covered under, the Medicare program only if the provider or supplier has submitted an acceptable plan of correction for achieving compliance within a reasonable period of time acceptable to CMS. In the case of an immediate jeopardy situation, CMS may require a shorter time period for achieving compliance. (b)The existing deficiencies noted either individually or in combination neither jeopardize the health and safety of patients or are of such character as to seriously limit the provider's capacity to render adequate care. (c) (1) If it is determined during a survey that a provider or supplier is not in compliance with one or more of the standards, it is granted a reasonable time to achieve compliance. (2)The amount of time depends upon the - (i)Nature of the deficiency; and (ii)State survey agency's judgment as to the capabilities of the facility to provide adequate and safe care. (d)Ordinarily a provider or supplier is expected to take the steps needed to achieve compliance within 60 days of being notified of the deficiencies but the State survey agency may recommend that additional time be granted by the Secretary in individual situations, if in its judgment, it is not reasonable to expect compliance within 60 days, for example, a facility must obtain the approval of its governing body, or engage in competitive bidding. The Centers for Medicare and Medicaid Services, State Operations Manual, Chapter 2 – The Certification Process, states in part: 2138G – Schedule for Recertification (Rev. 91, Issued: 09-27-13, Effective: 09-27-13, Implementation: 09-27-13) The SA completes a recertification survey an average of every 12 months and at least once every 15 months (see §2141). 2141 – Recertification – ICFs/IID (Rev. 91, Issued: 09-27-13, Effective: 09-27-13, Implementation: 09-27-13) • The regulation at §442.15 provides that provider agreements for ICF/IID’s would remain in effect as long as the facility remains in compliance with the Conditions of Participation (COP’s). Regulations at §442.109 through §442.111. • Beginning on May 16, 2012, ICF/IID’s are no longer subject to time-limited agreements. However, they are to be surveyed for re-certification an average of every 12 months and at least once every 15 months. • If during a survey the survey agency finds a facility does not meet the standards for participation the facility may remain certified if the survey agency makes two determinations – The facility may maintain its certification if the survey agency finds Immediate Jeopardy doesn’t exist, and if the facility provides an acceptable plan of correction. • An ICF/IID may be decertified under procedures outlined in Section 3012 of the State Operations Manual. More specifically, a facility may be decertified if an immediate jeopardy finding remains unabated after 23 days or if it fails to regain compliance with conditions of participation after 90 days. ICF/IID’s will be subject to survey an average of every 12 months and at least every 15 months, the same period that is applied to Nursing Homes. The Department of Social and Health Services, Residential Care Services Standard Operating Procedure: Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICF/IID), Chapter 16C2 – ICF/IID Plan of Correction (PoC) states in part: Overview Following the survey process and upon receipt of the SOD, the facility must develop a Plan of Correction (PoC) to address all stated deficiencies outlined in the SOD within 10 calendar days of receipt of the SOD. Regulations allow certification of ICF/IID facilities with deficiencies at the standard level “only if the facility has submitted an acceptable PoC for achieving compliance within a reasonable period of time acceptable to the Secretary.” Failure to submit a PoC could result in termination of the facility agreement. Decisions on acceptance of the PoC by the survey team must occur within 5 working days of receipt by RCS. The facility has no longer than 60 calendar days to implement the PoC and correct the deficiency. The correction date for a specific deficiency may be less depending on the circumstances of the deficiency. Procedure Surveyor/Complaint Investigator will: 1.Review the PoC within 5 working days of receipt of the PoC. 2. An acceptable PoC must contain the following elements: • The plan for correcting the specific deficiency cited. The plan should address the internal facility processes that lead to the deficiency being cited; • The procedures for implementing the PoC for the specific deficiency cited; • The monitoring procedure to ensure that the PoC is effective and that specific deficiency cited remains corrected and in compliance with the regulatory requirements; • The title of the person responsible for implementing the PoC. 3. PoCs must be specific and realistic, stating exactly how the correction to the deficiency occurred. The administrator, or other authorized official, must sign and date the PoC. Additional documentation attached to CMS Form 2567 is acceptable. All deficiencies corrected since the survey must have the corrected date on the form. 4. Do not routinely accept dates for correction at 60 calendar days. If a corrected deficiency is possible well before 60 calendar days, then the correction date should reflect that. 5. Discuss the decision with the Field Manager. Determine possible revisits as needed. 6. If the PoC is acceptable (depending on a paper review and/or onsite revisit if needed), complete the CMS Form 2567B in ASPEN. 7.If the PoC is not acceptable, see Chapter 16C3: Unacceptable PoC for procedures. 8. Report the decision to the Administrative Assistant 3 (AA3) for documentation.

2024-079 The Department of Social and Health Services, Aging and Long-Term Support Administration did not have adequate internal controls over and did not comply with survey requirements for Medicaid nursing homes. Assistance Listing Number and Title: 93.775 - State Medicaid Fraud Control Units 93.777 - State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare 93.777 COVID-19 – State Survey and Certification of Health Care Providers and Suppliers 93.778 - Medical Assistance Program (Medicaid; Title XIX) 93.778 COVID-19 – Medical Assistance Program (Medicaid; Title XIX) Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: 2305WA5MAP; 2305WA5ADM; 2305WAIMPL; 2405WA5MAP; 2405WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Test and Provisions – Provider Health and Safety Standards Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-079 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.5 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. During fiscal year 2024, the program spent over $20.6 billion in federal and state funds and had 194 Medicaid certified nursing homes. Residential Care Services (RCS), under the Department of Social and Health Services, Aging and Long-Term Support Administration, is the State’s nursing home survey agency. A nursing home facility is an institution with the primary purpose of providing 24-hour supervised nursing care, personal care, therapy, nutrition management, organized activities, social services, room, board and laundry to people who receive care and services under Medicaid. The Department must perform a federal certification or recertification survey of each nursing home. The certification survey is a resident-centered inspection that gathers information about the quality of service provided in a facility to determine compliance with the participation requirements. The survey focuses on the facility’s administration and patient services. The survey also assesses compliance with federal health, safety and quality standards designed to ensure patients receive safe and quality care services. The State must complete a standard survey for each nursing home facility within 15.9 months after the previous survey, and the statewide average for all nursing homes must not exceed 12.9 months for all nursing homes, as required by Centers for Medicare and Medicaid Services (CMS). All staff surveyors are required to receive specific RCS training in order to be qualified to conduct surveys. If a survey uncovers deficiencies, the Department must mail a Statement of Deficiency (SOD) to the facility within 10 working days of the survey date. The facility must submit a Plan of Correction (POC) that the Department determines is acceptable within 10 calendar days of receipt of the SOD. The Department’s procedures require a review of the POC within 5 working days of receipt to verify that it is acceptable. The facility has a total of 60 days to be back in compliance or risk forfeiting its Medicaid certification. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls to ensure it conducted timely surveys and followed up on deficiencies. The prior finding numbers were 2023-079 and 2020-054. Description of Condition The Department did not have adequate internal controls over and did not comply with survey requirements for Medicaid nursing home facilities. The Department uses a tracking spreadsheet as an internal control to monitor and track the survey frequencies as well as the statewide average frequency to ensure it meets the mandated 15.9-month survey frequency, and the statewide average of 12.9 months between surveys for each facility. We found the Department did not ensure that all recertification surveys were completed promptly. The Department did not adequately monitor the tracking sheet and complete surveys for 19 nursing homes in fiscal year 2024 within the required 15.9 months and did not meet the 12.9 month statewide average. While assessing the Department’s compliance with these requirements, we considered the time period where survey activities were suspended due to the COVID-19 pandemic and did not include that period of suspended activities in our calculation between survey dates. The statewide average is calculated on the federal fiscal year. For federal fiscal year 2024, the statewide average for nursing home surveys was 18.6 months. Additionally, we noted that three out of 20 surveys reviewed during the fiscal year contained POCs that were reviewed after the five-day period required by the Department. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The public health emergency created a backlog of recertification surveys that needed to be completed and the Department had a shortage of trained employees able to perform surveys which extended the survey timelines. In addition, management did not monitor its survey schedules adequately to ensure compliance in meeting the survey timeline. Effect of Condition Without conducting recertification surveys timely, the State is at risk of paying facilities for services provided to Medicaid clients without assurance the facilities are complying with federal and state health standards and regulations. Clients residing in facilities that do not meet federal health and safety requirements for participating in the Medicaid program could be at increased risk of abuse, mistreatment, neglect or substandard care. By not meeting the statewide average requirement for recertification surveys, the Department has not met federal Medicaid requirements and could be subject to sanctions by the grantor. Recommendation We recommend the Department: • Establish adequate internal controls to ensure compliance with facility survey timeliness requirements • Ensure it completes recertification surveys within 15.9 months and meets the 12.9 month statewide average Department’s Response The Department partially concurs with the finding. We do not concur there is a lack of internal controls. It was through applied internal controls we identified concerns and allocated resources to meet the most serious concerns. The Field Manager meets with the Administrative Assistant and reviews the 365-day average report to determine if survey schedules need to be modified in order to meet the federal requirement on a quarterly basis (12.9 and 15.9 month timeline). In FY 2023 and FY 2024, the team was trying address the backlog but had to prioritize new complaints. However, as the audit noted, there is only one team that handles surveys, complaints, and revisits for the entire state. The 12.9 month average is based on the overall average of the months for all nursing home surveys, and some of those surveys were in a significant backlog due to the pandemic. The Department continues to show progress in shortening the recertification survey intervals. For the reporting period of June 2024 through September 2025, the federal Certification and Survey Provider Enhanced Reporting tool (CASPER) has indicated that the Department’s survey average intervals are currently at 13.3 months, which is significant improvement from the 19.8 months in FY23 and FY24. Regional Administrators have met with their Nursing Home teams to look ahead at survey scheduling for the year to ensure teams will be able to meet targeted survey completion dates and meet the 15.9 and 12.9 timeframes by December 2025. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR, Part 488 Subpart E, Survey and Certification of Long-Term Care Facilities, states in part: Section 488.308 Survey frequency. (a) Basic period. The survey agency must conduct a standard survey of each SNF and NF not later than 15 months after the last day of the previous standard survey. (b) Statewide average interval. (1) The statewide average interval between standard surveys must be 12 months or less, computed in accordance with paragraph (d) of this section. (2) CMS takes corrective action in accordance with the nature of the State survey agency's failure to ensure that the 12-month statewide average interval requirement is met. CMS's corrective action is in accordance with § 488.320. (d) Computation of statewide average interval. The statewide average interval is computed at the end of each Federal fiscal year by comparing the last day of the most recent standard survey for each participating facility to the last day of each facility's previous standard survey. The Centers for Medicare and Medicaid Services, State Operations Manual, Chapter 2 – The Certification Process, states in part: 2138G – Schedule for Recertification The SA completes a recertification survey an average of every 12 months and at least once every 15 months (see Section 2141) 2728 – Statement of Deficiencies and Plan of Correction, Form-2567 The SA mails the provider/supplier a copy of form CMS-2567 within 10 working days after the survey. If there are deficiencies, the SA allows the provider/supplier 10 calendar days to complete and return the PoC. Requirements pertaining to submittal of the PoC can be found in subsection B. The Department of Social and Health Services, Residential Care Services Division Standard Operating Procedure: Enforcement Chapter 7B3, states in part: Background The Department will review the ePOC within 5 working days of receipt and will verify that it is acceptable. The NH may specify in the ePOC that they are not in agreement with the findings within the SOD report but this does not alter the NH’s responsibility to submit an acceptable ePOC. Off-site POC Review The Surveyor will: 1. Review the ePOC within five (5) working days of receipt and confirm that the POC for each deficiency includes: a. How the NH will correct the deficiency for each numbered resident; b. How the NH will protect residents from similar situations; c. Measures the NH will take or the systems it will change to ensure that the problem does not recur; d. How the NH plans to monitor its ongoing performance to sustain compliance; e. Dates corrective action will be completed; and f. Title of person responsible for correction The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-080 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited cost report data for rate setting, hospital billings, and other financial and statistical records for inpatient hospital services. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2305WA5MAP; 2305WA5ADM; 2305WAIMPL; 2405WA5MAP; 2405WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Inpatient Hospital and Long-Term Care Facility Audits Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-081 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.5 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the State’s federal expenditures. During fiscal year 2024, the Medicaid program spent more than $20.6 billion in federal and state funds, including more than $380 million to hospitals for inpatient services. The Health Care Authority, the state Medicaid agency, pays for inpatient services to hospitals by using rates that are economic, efficient and in accordance with the state plan. Federal law requires the Authority to periodically audit the financial and statistical records of participating providers, as established in the state plan. The Medicaid State Plan, Attachment 4.19, lists the financial audit requirements for establishing payment rates for inpatient hospital services. Before January 1, 2024, the plan said that cost report data used for rate setting may be periodically audited, and hospital billings and other financial and statistical records will be periodically audited. Beginning January 1, 2024, the plan was amended and now says that the financial and statistical records of participating providers will be periodically reviewed and audited by the Authority as necessary. Washington Administrative Code also says that the Authority will periodically audit cost report data used for rate setting, hospital billings, and other financial and statistical records. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited cost report data for rate setting, hospital billings, and other financial and statistical records for inpatient hospital services. The prior finding numbers were 2023-081, 2022-060, 2021-051 and 2020-049. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited cost report data for rate setting, hospital billings, and other financial and statistical records for inpatient hospital services. During the audit period, the Authority relied on internal audit reviews of provider claims to satisfy this requirement. These reviews of claims focused on identifying overpayments using hospital records. However, the Authority did not periodically audit cost report data used for rate setting, hospital billings, or other financial and statistical records, which federal law, state regulations and the state plan require. Additionally, federal law requires the state plan to establish specific audit requirements for the financial and statistical records of participating providers. The Authority does not have documented methodology, policies or procedures that describe when and how the audits will be performed. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Authority did not establish policies and procedures to ensure it periodically audited cost report data, hospital billings, and other financial and statistical records for inpatient hospital services. The Authority has received findings and recommendations over this requirement for several years, including the fiscal year 2023 single audit. The Centers for Medicare and Medicaid Services has reviewed and concurred with the finding results, but the Authority has not implemented sufficient corrective actions to address the issues identified in the prior audit. Effect of Condition By not ensuring that it periodically audits cost report data, hospital billings, and other financial and statistical records, the Authority increases its risk of improperly paying for inpatient hospital services. Recommendation We recommend the Authority establish and implement adequate internal controls, including policies and procedures, to ensure it meets federal inpatient hospital audit requirements. Authority’s Response The Authority does not concur with the finding. The auditor states the Authority “has not implemented sufficient corrective action to address the issues identified in the prior audit.” The Authority disagrees. It worked with CMS to revise the State Plan twice, updated Washington Administrative Code (WAC) to align with CFR and the State Plan, and updated procedures for both the Hospital Rates and Program Integrity sections. In addition, the Authority has reached out to CMS for technical assistance on two occasions. Following these actions, CMS closed the prior year finding. The auditor states the Authority “did not establish policies and procedures to ensure it periodically audited cost report data.” The CFR related to this compliance area does not require the Authority to periodically audit cost report data although the Authority has procedures in place to conduct cost report audits if it believes information contained in a cost report is not consistent with reporting requirements. The auditor states “The Authority does not have documented methodology, policies or procedures that describe when and how the [financial and statistical record] audits will be performed.” The Authority disagrees. The Authority completes a risk assessment to develop its annual audit plan for the financial and statistical records of inpatient hospitals and conducts the audits according to documented policies and procedures. These audits help ensure the data integrity of claims and financial transactions, which impacts the entity’s records used in rate setting. The Authority received guidance from CMS that CMS defers to the states on how these audits are defined. In addition, the Authority contracts with a public accounting firm to conduct audits of its contracted Disproportionate Share Hospitals (DSH). Those audits include the financial and statistical records of DSH hospitals. The Authority has taken corrective action on the prior audit findings, consulted with CMS for direction on the requirement for this compliance area, provided for the filing of cost reports, and audited, or contracted for the audit of, the financial and statistical records of inpatient hospitals during the fiscal year. Auditor’s Remarks The Medicaid compliance supplement states that specific audit requirements will be established by the state plan. In our judgment, the amendments the Authority made to the state plan do not address this requirement. The amendments state the Authority may choose not to perform required audits of financial and statistical records if it deems them not necessary. Additionally, CMS concurred with the prior year finding 2023-081 in its management decision. The CFR related to this compliance area does not require an audit of the cost reports, however it does require an audit of the financial and statistical records that the cost reports depend on. After examining the claim reviews performed by the Authority, we have reaffirmed our understanding that they are not audits. These reviews rely on computer queries to identify payment discrepancies. These tests do not ensure that all inpatient hospitals are reviewed and do not ensure that the financial records used in setting inpatient hospital rates are audited. The Authority also does not track inpatient hospitals to ensure that financial and statistical records are reviewed at every one of them. The external DSH audit the Authority completes utilizes self-reported data on the cost reports to calculate uncompensated care costs. This audit does not include most inpatient hospitals in its population. Additionally, self-reported data can not be used to audit the financial and statistical records of the facilities that submitted the reports. After reviewing the updated policies and procedures provided by the Authority, and reviewing the actions taken, we found that the claims review process has not changed from the processes reviewed during the 2023 single audit. The Authority has not implemented sufficient corrective actions to ensure the financial and statistical records of inpatient hospitals are audited. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR Part 447, Payments for Services, section 447.253, Other requirements, states in part: (a) State assurances. In order to receive CMS approval of a State plan change in payment methods and standards, the Medicaid agency must make assurances satisfactory to CMS that the requirements set forth in paragraphs (b) through (i) of this section are being met, must submit the related information required by § 447.255 of this subpart, and must comply with all other requirements of this subpart. f. Uniform cost reporting. The Medicaid agency must provide for the filling of uniform cost reports by each participating provider. g. Audit requirements. The Medicaid agency must provide for periodic audits of the financial and statistical records of participating providers. i. Rates paid. The Medicaid agency must pay for inpatient hospital and long-term care services using rates determined in accordance with methods and standards specified in an approved State plan. Medicaid State Plan, Attachment 4.19-A Part I Methods and Standards for Establishing Payment Rates for Inpatient Hospital Services, page 60 states in part: 3. Financial Audit Requirements Cost report data used for rate setting may be periodically audited. Hospital billings and other financial and statistical records will be periodically audited by the agency. Washington Administrative Code (WAC) 182-550 – Hospital services specifies requirements for the Authority regarding hospitals providing Medicaid services. WAC 182-550-5410 – CPE Medicaid cost report and settlements, states in part: 4. The Medicaid cost report schedules and supporting documentation are subject to audit by the agency or its designee to verify that claimed costs qualify under federal and state rules governing the CPE payment program. The documentation required includes, but is not limited to: a. The revenue codes assigned to specific cost centers on the Medicaid cost report schedules. b. The inpatient charges by revenue codes for uninsured patients and Medicaid clients enrolled in an MCO plan. c. The outpatient charges by revenue codes for uninsured patients and Medicaid clients enrolled in an MCO plan. d. All payments received for the inpatient and outpatient charges in (b) and (c) of this subsection including, but not limited to, payments for third party liability, uninsured patients, and Medicaid clients enrolled in an MCO plan. WAC 182-550-5700 Hospital reports and audits, states in part: (4) The agency will periodically audit the financial and statistical records of participating providers as needed. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-081 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2305WA5MAP; 2305WA5ADM; 2305WAIMPL; 2405WA5MAP; 2405WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Utilization Control Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-082 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.5 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the State’s federal expenditures. During fiscal year 2024, the program spent more than $20.6 billion in federal and state funds. Under federal regulations, Medicaid state plans must include methods and procedures to safeguard against unnecessary utilization of care and services. The regulations require states to implement a statewide surveillance and utilization control program that:  • Safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments; • Assesses the quality of those services; • Provides for the control of the utilization of all services provided under the plan; and • Provides for the control of the utilization of inpatient services Multiple state agencies in Washington manage aspects of the Medicaid program. The agencies include the Health Care Authority, Department of Social and Health Services, Department of Health, Office of the Attorney General, and Department of Children, Youth, and Families. The Centers for Medicare and Medicaid Services (CMS) considers the Authority to be Washington’s official Medicaid agency. Federal regulations require the Medicaid agency to: (1) Monitor the statewide utilization control program; (2) Take all necessary corrective action to ensure the effectiveness of the program; (3) Establish methods and procedures to implement this section; (4) Keep copies of these methods and procedures on file; and (5) Give copies of these methods and procedures to all staff involved in carrying out the utilization control program. Federal regulations also require the Medicaid agency to have procedures for the ongoing evaluation, on a sample basis, of the need for, quality, and timeliness of Medicaid services. These reviews must occur on a post-payment basis so that the state can review beneficiary utilization and provider service profiles, as well as identify exceptions so that the Authority can correct misutilization practices of beneficiaries and providers. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate control over and did not comply with utilization requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. The prior finding numbers were 2023-082, 2022-061, 2021-050, 2020-047, 2020-048, 2019-052, 2019-053, and 2018-047. We determined the Authority to have resolved finding numbers 2020-047, 2020-048, 2019-052, 2019-053, and 2018-047. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. Washington’s Medicaid state plan asserted it met utilization and quality control requirements directly, but its policies and procedures did not fully address these requirements. We found that the Authority performs various types of program integrity and control utilization reviews, but in our judgment, these efforts did not meet requirements of evaluating the appropriateness and quality of Medicaid services on a post-payment basis. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Authority has a Program Integrity unit that is responsible for safeguarding against unnecessary utilization of care and services for the Medicaid program. However, the Program Integrity unit does not have sufficient policies and procedures to adequately ensure the Authority has met all the compliance requirements for which it is responsible. These requirements include implementing and monitoring the statewide utilization control program, which includes overseeing and monitoring the activities of other state agencies. Additionally, the Program Integrity unit’s scope of reviews does not include post-payment review, on a sample basis, of the need for, quality, and timeliness of Medicaid services. Furthermore, the federal grantor sustained the prior audit finding for utilization control through issuance of a management decision letter to the Authority. Despite this, the Authority has not implemented adequate internal controls to ensure compliance with all requirements. Effect of Condition By not establishing adequate methods and procedures to safeguard against unnecessary utilization of care and services, there is an increased risk of unnecessary or inappropriate use of Medicaid services and payments. Furthermore, the Authority did not meet federal program integrity requirements, and it could be subject to federal sanctions because it has not established a statewide surveillance and utilization program and does not meet the utilization and quality control requirements directly as asserted in the Medicaid state plan. Recommendation We recommend the Authority: • Implement policies and procedures to sufficiently include all the methods and procedures necessary to safeguard against unnecessary utilization of care and services • Implement and monitor a statewide surveillance and utilization control program • Implement adequate internal controls to ensure it complies with utilization control requirements Authority’s Response The Authority concurs with the finding and continues to develop and implement its statewide surveillance and utilization control program. The Authority will continue to develop its policies and procedures and document its internal controls. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR Subchapter C Medical Assistance Programs Part 456, Utilization Control, Subpart A, General Provisions states in part: Section 456.1 Basis and purpose of part. (a) This part prescribes requirements concerning control of the utilization of Medicaid services including – (1) A statewide program of control of the utilization of all Medicaid services; … (b) The requirements in this part are based on the following sections of the Act. Table 1 shows the relationship between these sections of the Act and the requirements in this part. (1) Methods and procedures to safeguard against unnecessary utilization of care and services. Section 1902(a)(30) requires that the State plan provide methods and procedures to safeguard against unnecessary utilization of care and services. … Section 456.2 State plan requirements. (a) A State plan must provide that the requirements of this part are met. (b) These requirements may be met by the agency by: (1) Assuming direct responsibility for assuring that the requirements of this part are met; or (2) Deeming of medical and utilization review requirements if the agency contracts with a QIO to perform that review, which in the case of inpatient acute care review will also serve as the initial determination for QIO medical necessity and appropriateness review for patients who are dually entitled to benefits under Medicare and Medicaid. … Section 456.3 Statewide surveillance and utilization control program. The Medicaid agency must implement a statewide surveillance and utilization control program that – (a) Safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments; (b) Assesses the quality of those services; (c) Provides for the control of the utilization of all services provided under the plan in accordance with subpart B of this part; and (d) Provides for the control of the utilization of inpatient services in accordance with subparts C through I of this part. Section 456.4 Responsibility for monitoring the utilization control program. (a) The agency must – (1) Monitor the statewide utilization control program; (2) Take all necessary corrective action to ensure the effectiveness of the program; (3) Establish methods and procedures to implement this section; (4) Keep copies of these methods and procedures on file; and (5) Give copies of these methods and procedures to all staff involved in carrying out the utilization control program. Section 456.5 Evaluation criteria. The agency must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. This section does not apply to services in hospitals and mental hospitals. For these facilities, see the following sections: §§ 456.122 and 456.132 of subpart C; and § 456.232 of subpart D. Title 42 CFR Subchapter C Medical Assistance Programs Part 456, Utilization Control, Subpart B, Utilization Control: All Medicaid Services states in part: Section 456.21 Scope. This subpart prescribes utilization control requirements applicable to all services provided under a State plan. Section 456.22 Sample basis evaluation of services. To promote the most effective and appropriate use of available services and facilities the Medicaid agency must have procedures for the on-going evaluation, on a sample basis, of the need for and the quality and timeliness of Medicaid services. Section 456.23 Post-payment review process. The agency must have a post-payment review process that – (a) Allows State personnel to develop and review – (1) Beneficiary utilization profiles; (2) Provider service profiles; and (3) Exceptions criteria; and  (b) Identifies exceptions so that the agency can correct misutilization practices of beneficiaries and providers. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-082 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure payments to providers for the Block Grants for Substance Use Prevention, Treatment, and Recovery Services program were allowable and met period of performance requirements. Assistance Listing Number and Title: 93.959 Block Grants for Substance Use Prevention, Treatment, and Recovery Services 93.959 COVID-19 Block Grants for Substance Use Prevention, Treatment, and Recovery Services Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: B08TI03977-01, 1B08TI083519-01, 6B08TI083519-001M001, 6B08TI083519-01M002, 1B08TI084617-01, 1B08TI084681-01, 6B08TI084681-01M001, 6B08TI084681-01M002, 1B08TI085843-01, 6B08TI085843-01M002, 1B08TI087075-01, 1B08TI087075-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/ Cost Principles Period of Performance Known Questioned Cost Amount: $10,467,736 Prior Year Audit Finding: Yes, Finding 2023-084 Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). The Authority subawards federal funds to counties, tribes and nonprofit organizations to develop substance use prevention programs and provide treatment and support services. In fiscal year 2024, the Authority spent about $65.6 million in federal program funds, $50.8 million of which it paid to subrecipients. The Authority can use grant funds only for costs that are allowable and incurred during the period of performance, as specified in the grant’s terms and conditions. At the beginning of each federal fiscal year, and whenever the Authority receives a new federal grant, it establishes new cost objectives and allocation codes to ensure expenditures are charged to the proper grants. When the Authority receives reimbursement requests, program managers are responsible for reviewing supporting documentation to determine if the services billed are for allowable activities and meet the period of performance requirements under the grant. Fiscal managers are also responsible for ensuring that payments are coded to the correct period. The Authority follows the accrual basis of accounting and uses the Agency Financial Reporting System (AFRS), the state’s central accounting system, to record federal expenditures. At the end of the fiscal year, the Authority’s federal financial reporting (FFR) unit estimates the amount of outstanding obligations to providers. These amounts are recorded in AFRS as an accrued expenditure for SUPTRS and subsequently reported to the Office of Financial Management for the compilation of the Schedule of Expenditures of Federal Awards (SEFA). The FFR unit has written procedures for calculating its estimated accruals. The calculation begins by using a spreadsheet that tracks all active contractual obligations to SUPTRS subrecipients and vendors. These amounts are then prorated to include only obligations that are expected during the state fiscal year. Obligations for agency salaries and benefits, interagency agreements, direct purchases, state universities and travel are removed from this total. The remaining total is then reduced by the amount of accruals already recorded and actual payments already made to the subrecipients and vendors. The remaining total is recorded as an estimated accrual for the fiscal year. In the following fiscal year and up to two years after, the Authority liquidates program expenditures associated with the estimated accrual. The liquidations associated to a prior fiscal year estimated accrual do not tie directly to an estimated accrual, instead it is applied to the program as a whole for that period. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure payments to providers for the SUPTRS program were allowable and met period of performance requirements. The prior finding numbers were 2023-084 and 2022-067. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure payments to providers for the SUPTRS program were allowable and met period of performance requirements. During the audit period, the FFR unit recorded two state fiscal year-end estimated accruals totaling $16,195,231. We determined the process to estimate the year-end accruals is reasonable and included only subrecipient obligations for the state fiscal year. To determine if actual expenditures associated with these accruals are for allowable activities and within the period of performance, we tested $5,727,495 in liquidations processed after the state fiscal year close. We used a non-statistical sampling method to randomly select and examine 21 out of a total population of 116 including five individually significant items. There were no issues identified. However, the remaining non-liquidated year-end estimated accruals could not be tested for compliance. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition While the Authority has a process to determine the year-end estimated accruals, management allows for the liquidation of these accruals to be processed over as many as three years after the end of the audit period. Additionally, Authority officials said that the large amount of year-end estimated accruals is due to a significant lag between when services are provided, and reimbursement requests are received. Effect of Condition and Questioned Costs Without having actual expenditures with supporting documentation to account for the amount in the year-end estimated accruals, the Authority cannot reasonably ensure that SUPTRS expenditures reported on the SEFA are for allowable activities and within the period of performance. We identified $10,467,736 in known questioned costs related to estimated year-end accruals. Without establishing adequate internal controls, the Authority cannot reasonably ensure it is using federal funds for allowable purposes and that spending occurs within the allowed period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: • Improve its internal controls to ensure estimated accruals are reasonable and supported • Establish process to associate liquidated provider payments to specific year-end estimated accruals • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Authority’s Response The Authority does not concur with the finding. The auditors are questioning $10,467,736 of unliquidated accruals. This amount does not reflect funds that have been paid or drawn from the grantor, but rather the Authority’s best estimate of fiscal year 2024 expenditures for which invoices have not yet been received. There are no funds associated with the $10.5 million to return to the grantor. As the auditor notes in the finding above, “the process to estimate the year-end accruals is reasonable and included only subrecipient obligations for the state fiscal year.” Further, the auditors tested a sample of liquidations made against the accruals processed through September 30, covering the two-month period after the accruals were recorded. Testing was conducted after this date and could have included additional liquidations, but the auditors chose to limit the sample timeframe.  All reviewed liquidations were for allowable program costs within the grant period of performance, and for activities occurring during the state fiscal year. The Authority has additional controls to review expenditures at the end of each grant to ensure expenditures were within the allowed period of performance. Any liquidations made against the grant can be reviewed through the end of the grant period, and no payments would be liquidated against the accruals that were not for allowable services provided during fiscal year 2024. The auditor concludes the Authority cannot reasonably ensure the expenditures reported on the SEFA are for allowable activities and within the period of performance, with the implication that the $10.5 million should not have been reported on the SEFA. However, removing the $10.5 million would result in a significant misstatement on the SEFA and provide inaccurate information to the grantor. The Authority stands by its accrual methodology and its controls over activities allowed and period of performance requirements. Auditor’s Remarks The Authority reports cash and accrued expenditures on the Schedule of Expenditures of Federal Awards and, as such, the accruals are required to be audited. We therefore tested the liquidations associated with these accruals. While we did not find noncompliance with the samples selected and tested, we cannot determine if the remaining year end estimated accruals that have not been liquidated are for allowable activities and within their period of performance. We reaffirm our finding and will follow up on the status of the Authority’s corrective action during our next audit period. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 502, Basis for determining federal awards expended, states in part: a. Determining Federal awards expended. The determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs. Generally, the activity pertains to events that require the non-Federal entity to comply with Federal statutes, regulations, and the terms and conditions of Federal awards, such as: expenditure/expense transactions associated with awards including grants, cost-reimbursement contracts under the FAR, compacts with Indian Tribes, cooperative agreements, and direct appropriations; the disbursement of funds to subrecipients; the use of loan proceeds under loan and loan guarantee programs; the receipt of property; the receipt of surplus property; the receipt or use of program income; the distribution or use of food commodities; the disbursement of amounts entitling the non-Federal entity to an interest subsidy; and the period when insurance is in force. Title 45 CFR Part 75, section 510, Financial statements, states in part: b. Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with § 75.502… Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Behavioral Health Grant Unit Year-End Accrual Procedure, states in part: WHAT IS ACCRUAL: Accruals are accounting entries done to record actual or estimated expenditures incurred but not paid. PURPOSE: When done during year-end close, accruals record actual and/or estimated amounts incurred in the closing year that will not be paid until the subsequent year. Within the Federal Financial Reporting (FFR), Behavioral Health (BH) grants staff prepare year-end accruals of contract costs that the Accounting Section does not. The BH supervisor will notify unit staff of the timeline for this process as it may differ from year to year. BACKGROUND: The Accounting Section reviews accruals and liquidations at a high-level (Program, Fund, and Fund Source) to ensure the agency has not exceeded its authority. While some year-end accruals are based on actual billings/claims, many are based on estimates due to the lag time of billings. Estimates are also used due to the number of contracts per grants (typically the Block Grants and the State Opioid Response (SOR) grants). BLOCK GRANT PROCESS: 1. BH Grants staff creates a SFY Accrual workbook using the JV workbook template. 2. BH Grants staff saves a copy of the obligations from DBHR’s tracking workbook and places it in the BH Accrual Folder for the SFY. Copy the relevant data from the DBHR workbook into the SFY workbook created for accrual development. Obligation amounts may differ as DBHR is not necessarily recording obligations for a single state fiscal year. 3. BH Grants staff, on the SFY Obligation tab, removes the following obligations from the accrual process: a. Interagency agreements b. State universities c. Direct purchases d. Agency salaries and benefits e. Travel Note: a. If a contract has not started and has no expenditures verify if an accrual is needed or the obligation amount should be removed. b. Pro-rate contracts that include month of service for the prior or next SFY year, so as to not over accrue. c. If a project is listed, but no contract agreement number has been verified, double check with DBHR program and if not, remove amount from obligation. The workbook will include the revised obligations. 4. BH Grants staff pulls grant direct expenditure data from the beginning of the fiscal year to the end of the fiscal year to include (99 and 25) depending on which fiscal year it is in the biennium. a. First SFY of the biennium include FM01 through FM99 b. Second SFY of the biennium include FM13 through FM25 c. Include GL Account: (6510) cash expenditures and (6505) accruals d. Use grant specific Webi criteria e. Note – Accruals (GL 6505) are included to determine what has already been recorded by AP to ensure total accruals are not overstated. f. Filter out interagency and state universities amounts as well as objects A (salaries), B (benefits), and G (travel) data from original data pull and save this data to another tab. g. Use the data, minus interagency and objects that were removed, to prepare pivot tables. h. Input the obligation amount on the pivot tab from the SFY obligation tab. i. Run each pivot table using the data minus interagency & object tab (see #6 – #10 below). j. Reminder – DO NOT accrue salaries/benefits/travel/direct purchases. 5. Using the revised obligations tab – complete the below pivots. • NOTE: See item #2 - For auditing purposes, place a copy of the original obligation spreadsheet in the accrual folder, date the spreadsheet, so you have backup data to the obligation total you are now using. • Using the tab with our own tracking for the prior state fiscal year (SFYXX). See item #3 - Review contracts to see if they were executed, if not an accrual is not needed. We are ONLY accruing for CONTRACTS. Accruals are booked against the award we are actively spending on. We are not accruing on the award that is spent out. a. First pivot – identifies total expenditures and accruals for SFY being processed. Use the expenditure amount (GL 6510) for the second pivot table. b. Second pivot – establish the most used subobject; allows for the distribution of expenditures between ER and NB as they are the most common. c. Third and Fourth pivots – determines the most common PI each of the subobjects identified in Second pivot. d. Fifth pivot – identifies most common org index. e. Sixth pivot – (SUPTRS only) identifies the ER and NB expenditures by allocation. This allows for the accrual to be prepared as a percentage to each allocation code based on the total expenditures. 6. BH Grants staff calculate percentages to spread the accrual across ER and/or NB in allocations, per grant (ex. 82** for SUPTRS, and 20** for MHBG). 7. BH Grants staff complete the remainder of the workbook following the established JV process: a. Obtain JV number from log b. Add an explanation/purpose for the JV c. Include backup data for the upload and release tab. d. Use the correct transaction codes (TC) for accruals i. TC 736 RCRD ACCT/VOU PAY-NO ENCUMBRANCE 1. GL 6505 – Debit – Accrued Expenditures/Expenses 2. GL 5111 – Credit – Short Term Payables ii. TC 736R RCRD ACCT/VOU PAY-NO ENCUMBRANCE 1. GL 5111 – Debit – Short Term Payables 2. GL 6505 – Credit – Accrued Expenditures/Expenses 8. Upload the JV using the OFM Toolbox and email JV workbook to BH Grants Supervisor and Lead. 9. BH Grants Supervisor and/or Lead reviews, approves, and releases the JV.

2024-083 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Federal Funding Accountability and Transparency Act for the Block Grants for Substance Use Prevention, Treatment, and Recovery Services. Assistance Listing Number and Title: 93.959 Block Grants for Substance Use Prevention, Treatment, and Recovery Services 93.959 COVID-19 Block Grants for Substance Use Prevention, Treatment, and Recovery Services Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: B08TI03977-01, 1B08TI083519-01, 6B08TI083519-001M001, 6B08TI083519-01M002, 1B08TI084617-01, 1B08TI084681-01, 6B08TI084681-01M001, 6B08TI084681-01M002, 1B08TI085843-01, 6B08TI085843-01M002, 1B08TI087075-01, 1B08TI087075-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-086 Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). The Authority subawards federal funds to counties, tribes and nonprofit organizations to develop prevention programs and provide treatment and support services. In fiscal year 2024, the Authority spent about $65.6 million in federal program funds, including about $50.8 million it paid to subrecipients. The Federal Funding Accountability and Transparency Act (Act) requires the Authority to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Authority must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The Act is intended to empower the public with the ability to hold the federal government accountable for spending decisions and therefore reduce wasteful government spending. The Authority includes a subaward identification form, which contains all the required reporting information, when it creates a new SUPTRS subaward or amendment. After all parties sign it, contract unit staff emails the subaward identification form to the federal financial reporting unit. Federal financial reporting staff review these emails and complete the report as required. There were 138 SUPTRS subawards and amendments that the Authority was required to report in fiscal year 2024, totaling $78,875,512. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act for the SUPTRS program. The prior finding numbers were 2023-086, 2022-069 and 2021-058. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Act. During the audit period, the Authority was required to report about $78.9 million of program funds that it awarded to subrecipients through 138 new and amended subawards for the primary SUPTRS awards. We used a non-statistical sampling method to randomly select and examine 18 of the 138 subawards and amendments, and found that 11 (61%), totaling $2.8 million, did not meet reporting requirements. Of these 11 subawards and amendments, ten were not reported in FSRS and one was submitted two months after the reporting deadline. Of the eight that were reported, there were no issues with the accuracy of the data reported. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The federal financial reporting staff relied on subaward identification forms the contract unit emailed to complete FFATA reporting. However, the Authority did not have a process to ensure the contract unit emailed all forms to the federal financial reporting unit. As a result, the Authority did not detect forms that the contract unit did not email to the federal financial reporting unit as missing, and subsequently did not report them. During the audit period, the Authority developed written procedures to address this issue to ensure it submits all reports as required, but did not implement the process until toward the end of the audit period. Effect of Condition Failing to submit the required reports on time diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Authority: • Establish effective internal controls to ensure it submits all required reports • Provide training for employees who oversee reporting and who verify the submission and accuracy of the reports • Ensure management monitors reporting of this information to ensure future reports are submitted completely and timely Authority’s Response The Authority concurs with the finding. Effective internal controls were put into place partway through FY 24, however inconsistencies during initial implementation were identified. These inconsistencies have been identified and resolved, and the Authority will continue to strengthen the processes moving forward. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2. Reporting Requirements. i. The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the subaward was made on November 7, 2025, the subaward must be reported by no later than December 31, 2025). The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-084 The Health Care Authority did not have adequate internal controls to ensure subrecipients of the Block Grants for Substance Use, Prevention, Treatment and Recovery Services program received required single audits, and that it appropriately followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.959 Block Grants for Substance Use, Prevention, Treatment, and Recovery Services 93.959 COVID-19 Block Grants for Substance Use, Prevention, Treatment, and Recovery Services Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: B08TI03977-01, 1B08TI083519-01, 6B08TI083519-001M001, 6B08TI083519-01M002, 1B08TI084617-01, 1B08TI084681-01, 6B08TI084681-01M001, 6B08TI084681-01M002, 1B08TI085843-01, 6B08TI085843-01M002, 1B08TI087075-01, 1B08TI087075-01  Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2023-087 Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Substance Use, Prevention, Treatment and Recovery Services (SUPTRS). The Authority subawards federal funds to counties, tribes and nonprofit organizations to develop substance use prevention programs and provide treatment and support services. In fiscal year 2024, the Authority spent about $65.6 million in federal program funds, including about $50.8 million it paid to subrecipients. Federal regulations require the Authority to monitor its subrecipients’ activities. This includes verifying that its subrecipient that spent $750,000 or more in federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes to subrecipients, the Authority must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for an Authority-funded program, federal law requires the Authority to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the Federal Audit Clearinghouse. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. To monitor its compliance with these requirements, the Authority uses Excel workbooks to track subrecipients’ single audits along with identifying any program-funded findings and associated management decisions and status of corrective action plans. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Authority did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the SUPTRS program received required single audits, and that it appropriately followed up on findings and issued management decisions. The prior finding numbers were 2023-087 and 2022-066. Description of Condition The Authority did not have adequate internal controls to ensure subrecipients of the SUPTRS program received required single audits, and that it appropriately followed up on findings and issued management decisions. The Authority implemented written policies and procedures over its process for tracking subrecipients’ single audits. The procedures included the review of subrecipients’ audits for program-funded findings and the completion of required management decisions. The Authority implemented these policies and procedures in January 2024, halfway through the fiscal year. Before this, the Authority did not have a process in place to ensure compliance. During compliance testing, we did not identify any noncompliance. We consider these internal control deficiencies to be a significant deficiency. Cause of Condition In response to prior year findings, the Authority developed new policies and procedures, but did not fully implement them until halfway through the fiscal year. Effect of Condition Without establishing adequate internal controls, the Authority cannot ensure all subrecipients received single audits when they were required. Further, the Authority cannot ensure it follows up on subrecipient single audit findings and communicates required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and that management monitors them for effectiveness, the Authority cannot determine whether its subrecipients sufficiently corrected issues identified in audit findings. Recommendation We recommend the Authority continue to follow its new policies and procedures to ensure subrecipients obtain required single audits, it issues management decisions when necessary, and that subrecipients develop and take acceptable corrective actions to adequately address all audit recommendations. Authority’s Response The Authority concurs with the finding and will continue to follow the policies and procedures implemented during fiscal year 2024. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, Section 352, Requirements for pass-through entities states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 75.521. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 75.501. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 75.371 and in program regulations. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2024-085 The Military Department did not have adequate internal controls to ensure it accurately filed reports required by the Federal Funding Accountability and Transparency Act for the Disaster Grants Public Assistance program. Assistance Listing Number and Title: 97.036 Disaster Grants – Public Assistance Federal Grantor Name: Department of Homeland Security Federal Award/Contract Number: 1671DRWAP0000001;1734DRWAP0000001; 1817DRWAP0000001;1963DRWAP0000001; 4056DRWAP0000001;4083DRWAP0000001; 4168DRWAP0000001;4188DRWAP0000001; 4242DRWAP0000001;4243DRWAP0000001; 4249DRWAP0000001;4253DRWAP0000001; 4309DRWAP0000001;4418DRWAP0000001; 4481DRWAP0000001;4539DRWAP0000001; 4584DRWAP0000001;4593DRWAP0000001; 4635DRWAP0000001;4650DRWAP0000001; 4682DRWAP0000001 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Washington Military Department, Emergency Management Division, administers the Disaster Grant – Public Assistance (PA) program. The Department subawards federal funds to state agencies, tribes, local governments and certain types of private nonprofit organizations to help fund their response to and recovery from disasters. Following a presidential declaration of a major disaster or an emergency, the Federal Emergency Management Agency (FEMA) provides supplemental federal disaster grants assistance for debris removal, emergency protective measures and the restoration of disaster damaged facilities owned by states, municipalities, tribes and certain types of private nonprofit organizations. In state fiscal year 2024, the Department spent about $530.9 million in federal program funds, including about $529.8 million it paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The Act is intended to empower the public with the ability to hold the federal government accountable for spending decisions and therefore reduce wasteful government spending. Department policy requires it to report all subawards in FSRS regardless of if they are more than the $30,000 threshold. FEMA issues subaward and amendment obligation of project funding notifications as an S1 report. PA program staff use the S1 report to enter obligation details into the Contracts Unit’s FFATA Reporting Spreadsheet that contains the required reporting information for the subawards. Contracts staff then submit the report based on the FFATA Reporting Spreadsheet. There were 447 PA subawards and amendments that the Department was required to report in fiscal year 2024, totaling $922,836,314. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure it accurately filed reports required for the PA program. We used a statistical sampling method and randomly select and examine 55 out of the total population of 447 subawards and subaward amendments. We found: • The Department did not report one subaward (2%) totaling $97,515 in FSRS • The Department overreported one subaward obligation (2%) totaling $1,615,363 by $20,000 • One subaward (2%) totaling $43,497 contained the wrong subaward identification number in FSRS • The Department did not report five subawards and amendments (9%) totaling $50,662 on time in FSRS. Additionally, there were 10 subawards (18%), totaling $1,128,644, in which the subaward obligation date did not match the obligation date reported in FSRS. We consider these internal control deficiencies to be a significant deficiency. This issue was not reported as a finding in the prior audit. Cause of Condition The Department had procedures in place to ensure it reported subawards and amendments in FSRS. However, management did not ensure program staff entered all subaward information in the FFATA reporting spreadsheet correctly. Effect of Condition Failing to submit the required reports on time and accurately diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Department: • Establish effective internal controls to ensure it submits all required reports on time and accurately • Follow established procedures to ensure it enters all required information accurately into FSRS Department’s Response During SFY 2023-24, FEMA implemented two significant methodology changes: • FEMA transitioned from using FEMA EMMIE Reports to FEMA Grants Portal Reports for S1 forms.  During this transition, the PA Program staff encountered challenges when trying to identify the accurate obligation date for each sub-recipient, which resulted in discrepancies in the data we reported in FFATA. • U.S. General Services Administration was continuing to transition from using DUNS to UEI numbers. During this transition, the PA Program staff and Contracts Office had to work extensively with sub-recipients to obtain the subrecipients’ UEI numbers so FFATA reports could be submitted. If the sub-recipients had not yet provided their UEI number but was granted a sub-award, the sub-award was submitted on the FFATA report without a UEI number. During this time period, the PA Program was involved in nine major disaster declarations, creating a much higher workload than normal. PA Program personnel were spread across four locations: the PA Program main office at Camp Murray, a Joint Field Office (JFO) in Lacey, an Area Field Office (AFO) in Spokane, and an Area Field Office (AFO)-Bellingham. Simultaneously, the PA Program experienced a significant staff turnover at the program staff and supervisory levels. Between the change in data collection/reporting processes, increased workload, decentralization of employees, and employee turnover, data entry errors were more prevalent during this time period. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subaward and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for the subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2. Reporting Requirements. i. The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the subaward was made on November 7, 2025, the subaward must be reported by no later than December 31, 2025). The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington Military Department, Finance Division Procedure No. FIN-108-13, Federal Funding Accountability and Transparency Act (FFATA) Reporting, states in part: The WMD Contracts Office is responsible for all FFATA Reporting, which will be conducted no later than the end of each month. A. FFATA Reporting: 1. Monthly FFATA reports will be generated and filed in the FFATA Subaward Reporting System (FSRS) website by the end of the month following the month in which WMD awards any subcontract greater than $30,000. The reports generated and filed using the “Submitting FFATA Reports” procedures established by the Contracts Office. 2. By the 15th of each month, the Public Assistance program will enter all subawards for the reporting month in the FFATA reporting worksheet located on the Grants page within the Finance Department’s SharePoint site. All PA awards included in the FFATA reporting worksheet are reported by the contracts office, even if it is under the $30,000 threshold.

2023-002 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with required monitoring of subrecipients of the Child and Adult Care Food Program. Assistance Listing Number and Title: 10.558 Child and Adult Care Food Program Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 237WAWA3N2020; 227WAWA3N2020 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Child and Adult Care Food Program (CACFP) reimburses child and adult care institutions and family or group day care homes for providing nutritious meals and snacks that contribute to the wellness, healthy growth, and development of young children, and the health and wellness of older adults and people with disabilities. In Washington, the Office of Superintendent of Public Instruction administers CACFP. The Office spent about $45.5 million in federal funds, more than $44.8 million of which it paid to subrecipients. The Office is responsible for monitoring all institutions participating in CACFP to ensure compliance with meal pattern, recordkeeping, and other program requirements. Institutions that provide meals can participate through a sponsoring organization that will be financially and administratively responsible, or they can apply directly to the state agency and operate as an independent center. Federal regulations require the Office to monitor the activities of subrecipients to ensure they use subawards for authorized purposes and in compliance with federal statutes, regulations, and the terms and conditions of the subaward. This monitoring must include reviewing financial and performance reports, and taking timely and appropriate action on all deficiencies pertaining to the federal award. The federal grantor, the U.S. Department of Agriculture (USDA), requires states to monitor subrecipients at least once every three years. During the COVID-19 pandemic, the USDA granted a gap year and subsequently provided the Office with a waiver reducing the monitoring frequency to once every four years. Based on the waiver and a total of 503 active subrecipients during fiscal year 2023, the Office was required to monitor at least 125 subrecipients. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and did not comply with required monitoring of subrecipients of the CACFP. During the audit period, the Office identified 239 subrecipients that required monitoring and assigned them to a monitoring plan for fiscal year 2023. This monitoring plan would meet the USDA’s minimum required monitoring of 125 subrecipients, as well as allow the Office to catch up on all monitoring that was behind schedule since the pandemic gap year. We examined the Office’s review schedule and quality assurance tool to assess the monitoring completed or started during the audit period and compared it to this plan. We identified 84 reviews that were started during the audit period, but only 50 of them were completed. We found that the program did not start or perform monitoring for 155 subrecipients (65 percent) in its plan, including: • 115 subrecipients (48 percent) that the program postponed until fiscal year 2024. • Eight subrecipients (3 percent) misidentified in the plan because they no longer participated in the program. We examined a sample of 17 subrecipients that received financial and programmatic monitoring by the Office during the audit period, to ensure they were performed properly. We found all 17 subrecipients received adequate monitoring. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Due to the pandemic and gap year during 2020 where no monitoring was completed, the Office fell significantly behind schedule on its minimum required monitoring of subrecipients. The program has more than 500 subrecipients, some requiring monitoring annually depending on various risk criteria. The program was understaffed, which presented a significant obstacle for the Office to get its monitoring plan back on schedule. Effect of Condition Without establishing adequate internal controls, the Office cannot reasonably ensure that it can meet the minimum monitoring requirements imposed by the federal grantor or maintain the schedule identified by an internal monitoring plan. In addition, without proper and timely monitoring of financial and programmatic performance, the Office does not have reasonable assurance that each subrecipient has complied with the terms and conditions of the subaward. Recommendations We recommend the Office strengthen internal controls to ensure it monitors subrecipients according to the grantor’s minimum requirements and other federal regulations. Office’s Response Multiple staff vacancies were a significant contributor to the Office not completing the planned monitoring. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities. Title 2 CFR) Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-003 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Child and Adult Care Food Program. Assistance Listing Number and Title: 10.558 Child and Adult Care Food Program Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 237WAWA3N2020; 227 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Child and Adult Care Food Program (CACFP) reimburses child and adult care institutions and family or group day care homes for providing nutritious meals and snacks that contribute to the wellness, healthy growth, and development of young children, and the health and wellness of older adults and people with disabilities. In Washington, the Office of Superintendent of Public Instruction administers CACFP. The Office spent about $45.5 million in federal funds, more than $44.8 million of which it paid to subrecipients. The Office is responsible for monitoring all institutions participating in CACFP to ensure compliance with meal pattern, recordkeeping and other program requirements. Institutions that provide meals can participate through a sponsoring organization that will be financially and administratively responsible, or they can apply directly to the state agency and operate as an independent center. Federal regulations require pass-through entities to ensure that every subaward is clearly identified to a subrecipient as a subaward, and that it includes 14 federal award identification elements. These elements include the subrecipient’s unique entity identifier, the Federal Award Identification Number (FAIN), name of the federal awarding agency, the program’s Assistance Listing Number and title, obligation amounts, project periods, and more. When some of this information is not available, the pass-through entity must provide the best information available to describe the federal award and subaward. In addition, pass-through entities must impose requirements on subrecipients so that they use the program funds in accordance with federal statutes, regulations, and the terms and conditions of the federal award. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to CACFP subrecipients. We identified 291 nonprofit subrecipients of the program who were paid with federal funds during fiscal year 2023 and were subject to the Uniform Guidance requirements. We examined the various methods that the Office used to communicate the required federal award identification elements to subrecipients. These methods included periodic permanent agreements, an annual application process, and program communications during the current program year. We found that these methods did not constitute official subawards and did not properly communicate all federal award elements, terms and conditions, and other federal award requirements to the subrecipient. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management responsible for ensuring compliance were not familiar with subrecipient monitoring requirements. As a result, management did not know that the program must identify and communicate the federal award identification elements to subrecipients, and that permanent agreements and annual application renewals do not constitute or substitute for a formal subaward. Effect of Condition Without proper identification and communication of the federal award, the Office cannot properly notify subrecipients about the required federal award elements, nor impose requirements so the subrecipients use the federal award in accordance with its terms and conditions, federal statutes, and regulations. Further, the Office cannot impose any additional requirements of the pass-through entity on the subrecipient to meet its own responsibilities to the federal awarding agency, as well as other requirements as specified in the Uniform Guidance. Recommendations We recommend the Office: • Establish policies and procedures to ensure subawards are clearly identified as a subaward and communicate all required information according to the Uniform Guidance • Establish internal controls to formally communicate federal award information and requirements to subrecipients • Consult with the grantor for additional guidance on subrecipient monitoring requirements Office’s Response The Office concurs with the finding. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities. Title CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-004 The Office of Superintendent of Public Instruction did not have internal controls over and did not comply with requirements to verify single audits were completed for all subrecipients of the Child and Adult Care Food Program. Assistance Listing Number and Title: 10.558 Child and Adult Care Food Program Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 237WAWA3N2020; 227WAWA3N2020 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Child and Adult Care Food Program (CACFP) reimburses child and adult care institutions and family or group day care homes for providing nutritious meals and snacks that contribute to the wellness, healthy growth, and development of young children, and the health and wellness of older adults and people with disabilities. In Washington, the Office of Superintendent of Public Instruction administers CACFP. In fiscal year 2023, the Office spent about $45.5 million in federal funds, more than $44.8 million of which it paid to subrecipients. The Office is responsible for monitoring all institutions participating in CACFP to ensure compliance with meal pattern, recordkeeping, and other program requirements. Institutions that provide meals can participate through a sponsoring organization that will be financially and administratively responsible, or they can apply directly to the state agency and operate as an independent center. Federal regulations require the Office to monitor its subrecipients’ activities. This includes: • Verifying that subrecipients obtain a single audit if they spend $750,000 or more in federal awards during a fiscal year • Following up and ensuring that subrecipients take timely and appropriate action on all deficiencies pertaining to the federal award • Issuing a management decision to the subrecipient for applicable audit findings pertaining to the federal award Federal regulation requires recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have internal controls over and did not comply with requirements to verify single audits were completed for all CACFP subrecipients. The Office had processes in place to monitor that subrecipients received single audits. During the audit period, the Office had 503 CACFP subrecipients, and 47 of them were local education agencies (LEAs), or school districts. The Office’s federal compliance staff had a centralized process for LEAs to ensure they received the required audits, and we found these controls were effective. For the 456 subrecipients that were not LEAs, the Office used information in the Federal Audit Clearinghouse (FAC) to identify subrecipients requiring a single audit. If a subrecipient that required a single audit did not complete or file its audit report timely, then the information in the FAC database would lead the Office to erroneous conclusions. As a result, we determined that the Office did not have adequate controls to identify all subrecipients that required a single audit. We also determined the Office did not have adequate documentation that this single audit tracking process was completed during the audit period. We identified 62 subrecipients in this documentation that program staff compiled from the FAC database, and we used a statistical sampling method to randomly select and examine 12 of those subrecipients. We also judgmentally selected one subrecipient that had a program-related finding during the audit period, for a total of 13 testing samples. We found that one of these subrecipients required a single audit, but did not complete or did not submit its audit report during the audit period. The Office did not have any record that staff followed up with this subrecipient regarding the missing audit report. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The program staff responsible for the single audit tracking process retired, and the Office could not determine if the process was completed during the audit period. In addition, management was not aware that using the FAC database did not provide reasonable assurance that the Office identified all subrecipients requiring a single audit. Effect of Condition Without establishing adequate internal controls, the Office cannot ensure that all subrecipients requiring a single audit receive one, that timely and appropriate action is taken for subrecipients that did not obtain a single audit, and that subrecipients with audit findings receive required management decisions. Recommendations We recommend the Office: • Establish effective internal controls to ensure it identifies all subrecipients requiring single audits and follows up on any program-related findings, if applicable • Follow up with the subrecipient we identified as not having an audit to ensure it obtains its required single audit Office’s Response The Office concurs with the finding. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Audit findings, establishes requirements for pass-through entities. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-005 The Office of Superintendent of Public Instruction did not have adequate internal controls over and was not compliant with requirements to perform risk assessments for subrecipients of the Child and Adult Care Food Program. Assistance Listing Number and Title: 10.558 Child and Adult Care Food Program Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 237WAWA3N2020; 227WAWA3N2020 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Child and Adult Care Food Program (CACFP) reimburses child and adult care institutions and family or group day care homes for providing nutritious meals and snacks that contribute to the wellness, healthy growth, and development of young children, and the health and wellness of older adults and people with disabilities. In Washington, the Office of Superintendent of Public Instruction administers CACFP. In fiscal year 2023, the Office spent about $45.5 million in federal funds, more than $44.8 million of which it paid to subrecipients. The Office is responsible for monitoring all institutions participating in CACFP to ensure compliance with meal pattern, recordkeeping, and other program requirements. Institutions that provide meals can participate through a sponsoring organization that will be financially and administratively responsible, or they can apply directly to the Office and operate as an independent center. Federal regulations require the Office to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. To determine the appropriate level of monitoring, federal regulations require the Office to evaluate each subrecipient’s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and was not compliant with requirements to perform risk assessments for subrecipients of the CACFP. As part of the audit, we requested the Office to identify the key internal controls it had in place to ensure it complied with the requirement to perform risk assessments for subrecipients. However, we determined the Office did not perform formal risk assessments, as required by federal law. We consider these internal control deficiencies to be a material weakness that lead to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The program staff were not aware of the Uniform Guidance requirements to perform risk assessments and were relying on their other program monitoring that followed USDA guidance to identify risks for subrecipients. Effect of Condition Without performing risk assessments, the Office cannot determine the appropriate amount of monitoring required for each subrecipient. It also makes it less likely the Office will detect a subrecipient’s noncompliance with federal statutes and regulations and the terms and conditions of the subaward. Recommendation We recommend that the Office establishes adequate internal controls to ensure it performs risk assessments for each subrecipient to determine the appropriate level of monitoring. Office’s Response The Office believed it was meeting risk assessment requirements per USDA guidance. After discussion with the SAO regarding requirements in the Uniform Guidance, additional areas will be addressed to ensure compliance. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Audit findings, establishes requirements for pass-through entities. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-006 The Employment Security Department made improper payments to ineligible beneficiaries of the Unemployment Insurance program. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: UI-34528-20-60-A-53; UI-34748-20-55-A-53; UI-35682-21-55-A-53; UI-35977-21-60-A-53; UI-37098-21-55-A-53; UI-37256-22-55-A-53; UI-37313-22-55-A-53; UI-38013-22-60-A-53; UI-38163-22-55-A-53; UI-38511-22-55-A-53; UI-38580-22-75-A-53; UI-39303-23-55-A-53; UI-39355-23-55-A-53; UI-34092-20-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed, Eligibility Known Questioned Cost Amount: $603 Prior Year Audit Finding: No Background The Unemployment Insurance (UI) program was created by the Social Security Act, and provides benefits under the Unemployment Compensation program to people for periods of involuntary unemployment. It provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Employment Security Department administers the state’s UI program. During fiscal year 2023, the Department paid more than $1.1 billion in unemployment insurance benefits to people in Washington. In 2020, the U.S. Department of Labor (DOL) established new unemployment compensation programs, including Pandemic Unemployment Assistance (PUA), to provide additional unemployment assistance benefits to eligible workers affected by the COVID-19 pandemic. These programs were extended and modified through the American Rescue Plan Act of 2021. Under the temporary programs, which expired on September 6, 2021, states must process and pay benefits to eligible people for all weeks of unemployment ending on or before the date of termination or eligibility expiration (whichever comes first). People eligible for PUA included those not eligible for regular unemployment compensation, such as people who have already exhausted their regular UI benefits, are self-employed, seeking part-time employment, or lack sufficient work history. The first week in which claimants were eligible to receive PUA benefits began on January 27, 2020. During the pandemic, people applying for PUA benefits were required to self-certify that they were unemployed, partially unemployed, or unable or unavailable to work due to COVID-19. However, in January 2021, DOL announced a change to federal law through Unemployment Insurance Program Letter (UIPL) 16-20, Change 4. This change required that people receiving PUA benefits on or after December 27, 2020, submit proof of documentation to the state substantiating their employment, self-employment, or planned start of employment or self-employment in order to receive their benefits, regardless of when their benefits are actually paid. This includes people requesting retroactive payments of PUA benefits that are not received until after December 27, 2020. Description of Condition The Department did not ensure that payments were made only to eligible beneficiaries of the UI program. We found the Department had adequate internal controls to ensure it paid UI benefits to eligible people, and it materially complied with the federal requirements. However, we identified questioned costs for benefits awarded to PUA claimants. We used a statistical sampling method to randomly select and examine 78 out of a total population of 20,447 claims for weekly PUA benefits. For these claims, the Department was required to determine the eligibility of each claimant to receive benefits, including verifying proof of employment, self-employment, or planned start of employment or self-employment. We found three instances (5.1 percent) where the Department paid weekly benefits without requesting and reviewing documentation from the claimant substantiating employment, self-employment, or planned start of employment or self-employment, as required by the federal grantor. These three claims resulted in $603 in known overpayments of PUA benefits by the Department, as each claim was paid after December 27, 2020, and during our audit period. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a single audit exceed $25,000. We are issuing this finding because, as stated in the Effect of Condition and Questioned Costs section of this finding, the estimated questioned costs exceed that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition Department officials did not correctly interpret the guidance outlined in the UIPL change to reflect that claimants were required to provide documentation substantiating proof of employment or self-employment in order to receive payments from the state after December 27, 2020. The Department did not request documentation from PUA claimants to substantiate employment prior to paying the claims. Effect of Condition and Questioned Costs We identified $603 in known federal questioned costs and $208,975 in likely federal questioned costs. We considered these questioned costs because the people receiving the benefit payments did not meet all the program’s eligibility requirements at the time of payment. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our “best estimate of total questioned costs,” as required by 2 CFR § 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Verify people applying for PUA benefits have met all eligibility requirements before issuing weekly benefit payments • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Department does not concur with the finding. The State Auditor’s Office asserts the Department incorrectly interpreted guidance outlined in the UIPL regarding PUA benefit eligibility requirements. However, citing the UIPL below: UIPL 16-20 change 4 2. Requirement to submit documentation substantiating employment or self-employment (Section 241 of the Continued Assistance Act) (new). The first full paragraph of section C.2. of attachment I, UIPL 16-20 change 4 says that: “Anyone that receives a payment of PUA on or after December 27, 2020, (the enactment date of the Continued Assistance Act) will be required to submit documentation substantiating employment or self-employment, or the planned commencement of employment or self-employment.” [emphasis added] Under this guidance, the claimant had to first have been issued a payment after the Continued Assistant Act (CAA) became effective (regardless of the week or weeks the payment(s) were for) before the Department could set the issue to request the documentation. In the exceptions noted by SAO, the first claimant wasn’t paid at all until 2023. Once the payment was issued to the claimant, the PUA Documents Required (PDR) issue was properly set. In the second, the claimant received some payments before 12/27/20 and then had other payment stops on her claim that were not removed until 2023. The removal of those payment stops triggered a payment for the remaining weeks claimed. Because those payments were made after 12/27/20, the PDR issue was set. Under the same section, item c. limits the date the Department can start the denial for failing to comply with the PDR issue: c. Failure to Comply. Individuals who do not provide documentation substantiating employment/self-employment (or planned employment/self-employment) within the required timeframe, as described above, are not eligible for PUA. For DUA, if the individual fails to submit documentation substantiating employment or self-employment, the state must establish an overpayment for the entire DUA claim, per 20 C.F.R. 625.6(e)(2). However, as provided in Section 241(b)(2) of the Continued Assistance Act, for PUA, if the individual fails to submit such documentation, the state may only establish an overpayment for those weeks of unemployment ending on or after December 27, 2020 (the enactment date of the Continued Assistance Act). For example, an individual has a PUA claim effective on November 1, 2020, and files and is paid for weeks of unemployment ending November 7, 2020, through weeks ending January 9, 2021. Because the individual received a payment for PUA after December 27, 2020, the state must notify the individual on January 4, 2021, about the requirement to provide documentation substantiating employment/self-employment (or planned employment/self-employment) within 90 days (by April 4, 2021). If, in that timeframe, the individual fails to provide documentation or fails to show good cause to have the deadline extended, an overpayment must be established for all the weeks paid beginning with the week ending January 2, 2021. This is because the individual cannot be deemed ineligible for a week of unemployment ending before the date of enactment solely for failure to submit documentation (emphasis added). In the cases reviewed, the claimants did not respond to the issue or provide their documentation. Because the denial is limited to only claimed weeks following the enactment of the CAA (weeks ending 1/2/21 and later), any weeks from 2020 that were paid in 2023 had no potential for denial and therefore should not be considered to be incorrectly paid, similar to the example given above from the UIPL. If addition, if claimants never claimed a week ending after the CAA was effective, the PDR issue will set but never be adjudicated because they had never claimed a week that was potentially deniable. In discussions with SAO, the Office cited paragraph b(ii) of the UIPL, to indicate that any claims paid by the State on or after 12/27/2020 require the claimant to provide documentation substantiating employment or self-employment within 90 days of payment, or when directed to submit the documentation by the state workforce agency, whichever is later. This section of the UIPL solely lays out the requirements for establishing the respond-by dates for providing documentation for review. The deadline for responses is different depending on whether the PUA claim was filed before 1/26/21 or on/after that date. This paragraph does not establish the requirements for payment or non-payment of PUA weeks. Additionally, the Department received further guidance in a webinar with USDOL on Monday, January 11, 2021, which reinforced the methodology used by the Department in these cases. Auditor’s Remarks For the claimants in question, we did not receive any documentation from the Department demonstrating that a request was sent to the claimant to provide supporting documentation substantiating employment, nor was there evidence provided that the claims in-question were suspended due to missing documentation from the claimants. Federal guidance contained in Attachment I to UIPL 16-20, Change 4 – Pandemic Unemployment Assistance (PUA) Implementation and Operating Instructions stipulates the following: “Anyone that receives a payment of PUA on or after December 27, 2020, (the enactment date of the Continued Assistance Act) will be required to submit documentation substantiating employment or self-employment, or the planned commencement of employment or self-employment. This includes any individual who receives any payment of PUA on or after December 27, even if the payment is for a week of unemployment that occurred before December 27, 2020. The deadline for providing such documentation depends on when the individual filed the initial PUA claim. • Filing New Applications for PUA on or after January 31, 2021. Individuals filing a new PUA application on or after January 31, 2021 (regardless of whether the claim is backdated), are required to provide documentation within 21 days of application or the date the individual is directed to submit the documentation by the State Agency, whichever is later. The deadline may be extended if the individual has shown good cause under state UC law within 21 days. • Filing Continued Claims for PUA. Individuals who have an existing PUA claim as of December 27, 2020, (the enactment date of the Continued Assistance Act) or who file a new initial PUA claim before January 31, 2021, and who receive PUA on or after December 27, 2020, must provide documentation within 90 days of the application date or the date the individual is instructed to provide such documentation by the state agency (whichever date is later).” We questioned these payments due to the Department not receiving any supporting documentation substantiating employment or self-employment from these claimants during the audit period, and failing to establish overpayment notices to the claimants during the audit period. For all three payments in-question, the claimant filed for PUA prior to December 27, 2020, and therefore would have been required to submit supporting documentation substantiating employment to the Department within 90 days, or as directed by the Department. Because the Department did not receive supporting documentation from the claimants for these benefit weeks during the audit period, we could not determine that the payments were allowable and that the claimants met the PUA eligibility requirements for their benefit weeks paid. We reaffirm our finding and will follow-up on the Department’s corrective action during the next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs. Office of Management and Budget, 2 CFR Part 200, Appendix XI, Compliance Supplement, Unemployment Insurance, states in part: E. Eligibility 1. Eligibility for Individuals a. PUA – PUA provides benefits to covered individuals, who are those individuals not eligible for regular unemployment compensation (UC or extended benefits under state or federal law or PEUC, including those who have exhausted all rights to such benefits). Covered individuals also include self-employed, those seeking part-time employment, individuals lacking sufficient work history, and those who otherwise do not qualify for regular unemployment compensation or extended benefits under state or federal law or PEUC. PUA is payable to individuals who are ineligible for regular UC, EB, or PEUC and are unemployed, partially unemployed, or unable or unavailable to work due to one of the COVID-19 related reasons identified in Attachment I to UIPL No. 16-20, Change 6. Section 2102(a)(3)(A)(ii)(I) of the CARES Act included 10 specific COVID-19 related reasons. The Department, under the authority provided by Section 2102(a)(3)(A)(ii)(I)(kk) of the CARES Act, added additional COVID-19 related reasons three new COVID-19 related reasons with the publication of UIPL No. 16-20, Change 5 on February 25, 2021. All COVID-19 related reasons apply retroactively to the beginning of the PUA program. Additionally, individuals who are paid on or after December 27, 2020, must submit proof of documentation substantiating employment, self-employment, or the planned commencement of employment or self-employment (see Attachment I, Section C.2. of UIPL No. 16-20, Change 4). This includes individuals requesting retroactive payments that are not received until after December 27, 2020.

2023-007 The Employment Security Department did not have adequate internal controls to ensure it submitted accurate financial reports for the Unemployment Insurance program. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: UI-34528-20-60-A-53; UI-34748-20-55-A-53; UI-35682-21-55-A-53; UI-35977-21-60-A-53; UI-37098-21-55-A-53; UI-37256-22-55-A-53; UI-37313-22-55-A-53; UI-38013-22-60-A-53; UI-38163-22-55-A-53;UI-38511-22-55-A-53; UI-38580-22-75-A-53; UI-39303-23-55-A-53; UI-39355-23-55-A-53; UI-34092-20-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Unemployment Insurance (UI) program was created by the Social Security Act, and provides benefits under the Unemployment Compensation program to people for periods of involuntary unemployment. It provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Employment Security Department administers the state’s UI program. During fiscal year 2023, the Department paid more than $1.1 billion in unemployment insurance benefits to people in Washington. The Unemployment Insurance Reports Handbook No. 401 – published by the U.S. Department of Labor (DOL), Employment and Training Administration, Office of Unemployment Insurance – outlines the requirements for states to submit financial and performance reports to the federal government so it can evaluate their UI programs. The ETA 9130 – Financial Status Report is submitted quarterly, and is used to report program and administrative expenditures for UI programs. This financial data is reported cumulatively and separately for regular UI programs, as well as Pandemic Emergency Unemployment Compensation, Pandemic Unemployment Assistance, Disaster Unemployment Assistance, Trade Readjustment Assistance, and Reemployment Trade Adjustment Assistance. The Department requires fiscal analysts to prepare these reports, and grants management reviews and approves the reports before submitting them to DOL. Additionally, the Department is required to submit to DOL the ETA 2112 – UI Financial Transaction Summary. This report provides a monthly summary of UI transactions that accounts for all funds received in, passed through or paid out of the state unemployment fund. The Department’s Assistant Treasury Supervisor is responsible for preparing these reports, and the Treasurer reviews the reports for accuracy and certifies them before they are submitted to DOL. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure it submitted accurate financial reports for the UI program. During fiscal year 2023, the Department was required to submit 104 quarterly ETA 9130 financial reports to DOL. We used a non-statistical sampling method to randomly select and examine 15 reports. We found that five of the 15 reports (33 percent) were not certified by the Grants Manager before they were submitted to DOL. In addition, the Department was required to submit 12 monthly ETA 2112 financial reports to DOL. We used a non-statistical sampling method to randomly select and examine five reports. We found one of the five reports (20 percent) was not reviewed and approved by the Treasurer before it was submitted to DOL. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Department officials said that the Grants Manager responsible for reviewing the ETA 9130 reports for accuracy resigned during the audit period, prior to the due date of the five reports that were not certified. As a result, the Department submitted these reports without a secondary review. Department officials said that the Treasurer discussed the ETA 2112 report with the Assistant Treasury Supervisor as fiscal analysts prepared the draft. However, the Treasurer did not document their approval of the report, and the Department did not retain any documentation supporting that the Treasurer reviewed and certified the report. Effect of Condition When management does not follow the Department’s established internal controls to ensure that all required financial reports are accurate, the Department is at an increased risk of inaccurately reporting financial data to the federal grantor. Recommendation We recommend the Department improve internal controls to ensure that management properly reviews and certifies all required financial reports before they are submitted to the federal grantor. This should include maintaining records to show that management completed these reviews. Department’s Response The Department concurs with the finding and thanks SAO’s work to ensure federal requirements are met over the UI grant. The Department has implemented procedures to ensure reports are reviewed prior to submission, and submission dates and approvals are documented. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Office of Management and Budget, 2 CFR Part 200, Appendix XI, Compliance Supplement, Unemployment Insurance, states in part: L. Reporting 1. Financial Reporting d. ETA 9130, Financial Status Report, UI Programs – This report is used to report program and administrative expenditures. All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Additional information on OMB Number 1205-0461 can be accessed at http://www.dol.gov/agencies/eta/grants/management and scroll down to the section on Financial Reporting. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UI Projects (administration and benefits). See TEGL No. 02-16 for specific and clarifying instructions about the ETA 9130 https://wdr.doleta.gov/directives/corr_doc.cfm?DOCN=5156. ETA 2112, UI Financial Transaction Summary (OMB No. 1205-0154) – A monthly summary of transactions, which account for all funds received in, passed through, or paid out of the state unemployment fund (ET Handbook 401).

2023-008 The Employment Security Department did not have adequate internal controls to ensure it submitted accurate monthly reports for the Unemployment Insurance program. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: UI-34528-20-60-A-53; UI-34748-20-55-A-53; UI-35682-21-55-A-53; UI-35977-21-60-A-53; UI-37098-21-55-A-53; UI-37256-22-55-A-53; UI-37313-22-55-A-53; UI-38013-22-60-A-53; UI-38163-22-55-A-53; UI-38511-22-55-A-53; UI-38580-22-75-A-53; UI-39303-23-55-A-53; UI-39355-23-55-A-53; UI-34092-20-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-005 Background The Unemployment Insurance (UI) program was created by the Social Security Act, and provides benefits under the Unemployment Compensation program to unemployed workers for periods of involuntary unemployment. It provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Employment Security Department administers the UI program. During fiscal year 2023, the Department paid more than $1.1 billion in unemployment insurance benefits to people in Washington. The Unemployment Insurance Reports Handbook No. 401—published by the U.S. Department of Labor (DOL), Employment and Training Administration, Office of Unemployment Insurance – outlines the requirements for states to submit financial and performance reports to the federal government so it can evaluate their UI programs. The ETA 9055 – Appeals Case Aging – Lower and Higher Authority Appeals report (OMB No. 1205-0359) is submitted monthly, and it provides information on the inventory of lower and higher-authority single claimant appeals cases that have been filed in court but not yet decided. These reports provide the federal government with information about the number of days from the date an appeal was filed through the end of the month covered by the report, as well as the average and median age of the pending appeals cases. The Department prepares this report using data obtained through interagency data-sharing agreements with the Washington State Office of Administrative Hearings and the Washington State Administrative Office of the Courts. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls to ensure it submitted accurate monthly reports for the UI Program. The prior finding number was 2022-005. Description of Condition The Department did not have adequate internal controls to ensure it submitted accurate monthly reports for the UI program. During fiscal year 2023, the Department was required to submit monthly ETA 9055 performance reports to DOL. The Department did not require or perform a secondary review of the reports before submitting them. A single Department employee manually prepared the information contained in the reports and submitted them to the federal grantor, and no one verified they were accurate and complete before submission. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Although Department officials said they implemented a secondary review of the 9055 report in May 2023, management did not monitor the completion of these reports throughout the audit period to determine whether internal controls would be sufficient to detect and correct any potential data entry errors. In addition, management relied on staff knowledge and other agencies to provide accurate and complete information. Effect of Condition By not establishing adequate internal controls to ensure monthly performance reports are complete and accurate, the Department is at an increased risk of inaccurately reporting data to the federal grantor. Recommendation We recommend the Department implement internal controls to ensure it has an effective review process in place before submitting monthly reports to the federal grantor. Department’s Response The Department concurs with the finding and thanks the State Auditor’s Office for its work over this area. The Department immediately implemented the secondary review of these reports in response to a prior year finding over this issue. However, the recommendation from the prior year and the Department’s implementation occurred after the new state fiscal year had begun. The Department expects the control to be in place and functioning for the entire year in our next audit. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The U.S. Department of Labor, Employment and Training Administration, Office of Unemployment Insurance, Unemployment Insurance Reports Handbook No. 401, Section V: Benefits Time Lapse and Quality, states in part: ETA 9055 – APPEALS CASE AGING Section V-5 1. General Reporting Instructions Appeals Case Aging measures require states to report data on the universe of all single claimant appeals cases that have not been decided prior to the end of the reporting period. Edit checks can be found in Handbook 402, Unemployment Insurance Required Reports User’s Manual, Appendix C. 4. Pending Lower Authority Single Claimant Appeals Case Aging. I. Includes all lower authority single claimant appeals cases, including those remanded by the higher authority for a hearing and decision reopened appeals cases not decided at the end of the month. 5. Pending Higher Authority Single Claimant Appeals Case Aging. a. Includes all higher authority single claimant appeals cases, including remanded and reopened appeals cases, not decided at the end of the month. An appeals case that has been remanded to the lower authority for additional evidence and will be returned to the higher authority for a decision is reported in this inventory. An appeals case that has been remanded to the lower authority for a new hearing and decision is not a pending higher authority appeals case and should not be counted as such. Office of Management and Budget, 2 CFR Part 200, Appendix XI, Compliance Supplement, Unemployment Insurance, states in part: L. Reporting 2. Performance Reporting States are required to submit periodic reporting to evaluate the performance of the states’ UI programs. The auditor should test the information included in the key reports included below that ensure the timeliness of benefits paid. Detailed information on these reports can be accessed under: https://www.dol.gov/sites/dolgov/files/ETA/handbooks/2017/ETHand401_5th.pdf

2023-009 The Employment Security Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the Benefit Accuracy Measurement program of the Unemployment Insurance program in a timely manner. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: UI-34528-20-60-A-53; UI-34748-20-55-A-53; UI-35682-21-55-A-53; UI-35977-21-60-A-53; UI-37098-21-55-A-53; UI-37256-22-55-A-53; UI-37313-22-55-A-53; UI-38013-22-60-A-53; UI-38163-22-55-A-53; UI-38511-22-55-A-53; UI-38580-22-75-A-53; UI-39303-23-55-A-53; UI-39355-23-55-A-53; UI-34092-20-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: UI Benefits Payments Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-006 Background The Unemployment Insurance (UI) program was created by the Social Security Act, and it provides benefits under the Unemployment Compensation program to unemployed workers for periods of involuntary unemployment. The program provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Improper Payment Elimination and Recovery Act of 2010 requires state workforce agencies to maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is the U.S. Department of Labor’s quality control system designed to assess the accuracy of unemployment insurance benefit payments and denied claims in separation status. The program estimates error rates and dollar amounts of benefits improperly paid or denied by projecting the results from investigations in a state. The Employment Security Department administers the state’s UI program. During fiscal year 2023, the Department paid more than $1.1 billion in unemployment insurance benefits to people in Washington. Under the BAM program, the Department is required to draw a weekly sample of payments and denied claims. The Department must complete this sampling promptly and conduct an in-depth investigation of the claims to determine the degree of accuracy in administering the state’s Unemployment Compensation program and compliance with federal law (20 CFR 602.21(d)). The Department has established a dedicated BAM unit to meet these requirements. The Benefit Accuracy Measurement State Operations Handbook, which is published by the U.S. Department of Labor’s Employment and Training Administration, indicates the time frame and requirements for conducting BAM program case sampling for paid claims. States must complete reviews of: • 70 percent of the sampled cases within 60 days of the week ending date of the batch; and • 95 percent of the sampled cases within 90 days of the week ending date of the batch; and • 98 percent of sampled cases within 120 days of the ending date of the annual report period. In addition, states must sample denied claims and review: • 60 percent of the sampled cases within 60 days of the week ending date of the batch; and • 85 percent of the sampled cases within 90 days of the week ending date of the batch; and • 98 percent of the sampled cases within 120 days of the end of the calendar year. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported that the Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the BAM program of the UI program in a timely manner. The prior finding numbers were 2022-006, 2021-005 and 2020-011. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the BAM program of the UI program in a timely manner. The Department did not effectively recruit, develop and retain staff to ensure it materially complied with the BAM program’s case review requirements. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not adequately staff its BAM unit with resources sufficient to meet BAM program requirements. Management did not allocate sufficient resources to the BAM unit, and did not effectively retain its investigative staff assigned to the BAM unit to support its minimum required caseload. Effect of Condition The Department did not comply with the federally required timelines for completing its case sampling. For paid claims, we found the Department: • Failed to complete the minimum required annual allocation for sampling for paid claims. The Department completed 472 of the required 480 samples. • Completed only 425 (90.4 percent) of its 472 sampled cases within 90 days of the week ending date of the batch, failing to meet the federal requirement of 95 percent • Completed only 446 (94.5 percent) of its 472 sampled cases within 120 days of the ending date of the annual report period, failing to meet the federal requirement of 98 percent We also found the Department failed to complete the minimum required annual allocation for sampling for denied claims. The Department completed 436 of the required 450 samples for the annual allocation. By not complying with the federally required timelines for completing case sampling, the Department cannot fully evaluate the accuracy of its claim decisions and is less likely to detect fraudulent payments. Recommendation We recommend the Department allocate the necessary staffing resources to ensure it complies with the U.S. Department of Labor’s timelines for BAM case sampling. Department’s Response The Department concurs with the finding and recommendation and thanks the State Auditor’s Office for its work to ensure the Department meets case sampling requirements. Historically, the Benefit Accuracy Measurement (BAM) unit has been challenged to maintain full levels of staffing. Staff turnover, long training requirements, and unique skill sets make these positions difficult to maintain. The Department continues to hire, develop, and retain staff to fully meet USDOL requirements. The Department further continues to partner and frequently communicate with the U.S. Department of Labor (USDOL) Regional Offices to discuss staffing and training models. The Quality Assurance Manager and the Case Review Supervisor are committed to routinely monitoring caseload, workload, and the overall assurance of meeting the BAM operations performance goals and measures as set forth by USDOL. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 20 CFR Part 602, Quality Control in the Federal-State Unemployment Insurance System, section 21, Standard methods and procedures, establishes the requirements for states to conduct representative case sampling for quality control study of unemployment benefit claims, which state in part: §602.21 Standard methods and procedures. Each State shall: a. Perform the requirements of this section in accordance with instructions issued by the Department, pursuant to 602.30(a) of this part, to ensure standardization of methods and procedures in a manner consistent with this part; b. Select representative samples for QC study of at least a minimum size specified by the Department to ensure statistical validity (for benefit payments, a minimum of 400 cases of week paid per State per year); c. Complete prompt and in-depth case investigations to determine the degree of accuracy and timeliness in the administration of the State UC law and Federal programs with respect to benefit determinations, benefit payments, and revenue collections; and conduct other measurements and studies necessary or appropriate for carrying out the purposes of this part; d. Furnish information and reports to the Department, including weekly transmissions of case data entered into the automated QC system and annual reports, without, in any manner, identifying individuals to whom such data pertain; The U.S. Department of Labor, Employment and Training Administration Benefit Accuracy Measurement State Operations Handbook – ET Handbook No. 395, 5th Edition, Chapter VI – Investigative Procedures, Section 13: Completion of Cases and Timely Data Entry, states in part: The following time limits are established for completion of all cases for the year. (The “year” includes all batches of weeks ending in the calendar year.): • A minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch, and 95 percent of cases must be completed within 90 days of the week ending date of the batch; and • A minimum of 98 percent of cases for the year must be completed within 120 days of the week ending date of the calendar year. ET Handbook No. 395, 5th Edition, Chapter VI – Investigative Procedures, Section 12: Sampling Selection, states in part: The annual sample size for UI paid claims and the three types of denials are fixed by DOL for the calendar year. BAM supervisors may change the weekly sample sizes in the input control record to accommodate investigator vacation schedule or other staffing contingencies. However, state are expected to pull at least the minimum number of cases each week. States may not over sample during a portion of the year in order to meet the annual sample allocation and then suspend sampling for the remainder of the calendar year. The minimum weekly and quarterly samples, based on current annual sample allocations are: *Allocation for ten smallest states in terms of UI workload. ** 150 cases each of monetary, separation, and non-separation denials will be selected each year, for a total of 450 DCA cases. ET Handbook No. 395, 5th Edition, Chapter VIII – Denied Claims Accuracy (DCA), Section 7: Completion of DCA Cases and Timely Data Entry, states in part: As in paid claims, prompt completion of investigations is important to ensure the integrity of the information being collected by questioning claimant and employers before the passage of time adversely affects recollections. However, due to the fact that contacting the claimant and obtaining claimant information is more difficult than in paid claims, the timeliness standards differ as the following indicates: • A minimum of 60 percent of cases must be completed within 60 days of the week ending date of the batch, and 85 percent of cases must be completed within 90 days of the week ending date of the batch; and • A minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the Calendar Year.

2023-010 The Employment Security Department did not have adequate internal controls over and did not comply with requirements to ensure it profiled all claimants under the Unemployment Insurance program to identify people likely to need reemployment services and ensure staff providing those services received required training. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: UI-34528-20-60-A-53; UI-34748-20-55-A-53; UI-35682-21-55-A-53; UI-35977-21-60-A-53; UI-37098-21-55-A-53; UI-37256-22-55-A-53; UI-37313-22-55-A-53; UI-38013-22-60-A-53; UI-38163-22-55-A-53; UI-38511-22-55-A-53; UI-38580-22-75-A-53; UI-39303-23-55-A-53; UI-39355-23-55-A-53; UI-34092-20-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – UI Reemployment Programs: Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Unemployment Insurance (UI) program was created by the Social Security Act, and it provides benefits under the Unemployment Compensation program to unemployed workers for periods of involuntary unemployment. The program provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Employment Security Department administers the state’s UI program. During fiscal year 2023, the Department paid more than $1.1 billion in unemployment insurance benefits to people in Washington. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as the primary programs that facilitate the reemployment of UI claimants. RESEA is authorized by Section 306 of the Social Security Act, and it uses an evidence-based integrated approach that combines an assessment for continuing UI eligibility and the provision of reemployment services. The Department uses a RESEA program to satisfy the WPRS mandate in accordance with federal requirements, and its program design is documented in the RESEA State Plan approved by the U.S. Department of Labor. According to the Department’s RESEA State Plan, the agency profiles unemployment claimants using a scoring model that is built into its Unemployment Tax and Benefit (UTAB) system to identify claimants who are likely to exhaust benefits and are in need of job search assistance to obtain new employment. The profiling model must statistically combine information on the person’s work industry, occupation, education level, county of residence, and other personal characteristics, including veteran and union status, and labor market characteristics to generate a numerical score indicating their likelihood of exhausting regular unemployment benefits before finding work. The claimants are to be ranked in a queue based on their individual score from most likely to least likely to exhaust benefits. On a weekly basis, the Department selects people from this queue for available appointments for reemployment evaluations. In July 2019, the Department implemented an online appointment scheduling system called the Reemployment Appointment Scheduler (RAS) to facilitate the appointment scheduling process for the Department’s WorkSource offices. In June 2021, the Department deployed a pilot program proposed by the U.S. Department of Labor known as a randomized control trial (RCT), to randomly assign profile scores in lieu of using the risk profile model to profile all unemployment claimants. The objectives of the trial were to assess the impact of the RESEA program concerning duration of unemployment claims, earnings, and employment probability of claimants following the provision of RESEA services, and to assess whether the program improved the identification of claimant eligibility issues and improper payment detection. Under the RCT, the WPRS score used to rank claimants was replaced with a randomly generated score, after excluding the top 5 percent of people with the highest WPRS scores. The Department’s UI staff oversee the RESEA program, which includes participating in the planning, administration and oversight of the program, providing appropriate training to staff conducting applicant eligibility reviews, completing individual reemployment plans, and providing information and access to career and reemployment services, including referrals to other services. All staff working within the RESEA program must, at a minimum, be trained in the programmatic requirements, state laws, rules, and agency policies once a year. Staff are required, by Department policy to take an intensive training before providing reemployment services to claimants, as well as take an annual refresher training once a year. Training includes information regarding job search requirements, reporting requirements, and UI eligibility assessments. In addition, all staff working with RESEA participants must be trained to detect and report potential issues to the UI claims center. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure the Department profiled all claimants under the UI program, to identify those likely to need reemployment services and ensure staff providing reemployment services received required training. Identification for People Eligible for Reemployment Services The Department did not adequately monitor its UTAB scoring model to ensure applicant risk profile scores were accurate to identify those claimants most likely to exhaust their unemployment benefits. The Department is required to use a scoring model to profile all claimants to identify those likely to need reemployment services. During the audit period, the score calculated by the model was only applied for 5 percent of claimants with the highest score. A random score was assigned to the remaining 95 percent of claimants. The random score assignment did not provide adequate assurance that those people most likely to exhaust benefits were prioritized to receive reemployment services. To determine a claimant’s profile score, the scoring model assigns 10 different coefficient rates associated with attributes that were determined by the Department to signify how likely a claimant will be to exhaust their unemployment benefits. The Department could not explain the methodology for determining an applicant’s profile score based on these 10 attributes, or how to independently recalculate the score. The Department has not tested the calculation of the profile score to ensure it is functioning as intended and producing accurate results. In addition, management could not provide historical records to demonstrate the calculation had ever been tested since its first implementation. Therefore, the Department has no assurance that the calculation provides an accurate measurement of the risk a claimant will exhaust their benefits. To test whether the UTAB system correctly determined and assigned coefficients based on the claimant attributes, we created four test scenarios containing specific attributes and the expected assigned coefficient value. The UTAB system did not assign the expected coefficient value for three of the 10 attributes. Department officials did not know how the system determined and assigned the coefficient value for these three attributes or why the value did not agree to the system reference tables. Therefore, we cannot conclude whether the assigned values for these three coefficients or the profile score assigned based on the coefficients are accurate. In addition, management did not monitor to determine whether the RAS system had received all eligible claimants. There is a daily process to send eligible claimants to the RAS selection queue, but there were no internal controls in place to ensure that all files sent to RAS were received and processed. In addition, RAS does not have a working test environment to test whether the system effectively schedules claimants based on defined rules and requirements. Employee Training The Department uses a tracking report to monitor the status of completed training for each RESEA employee. However, the Department did not adequately monitor to ensure staff who administered RESEA services to clients took required training. We used a statistical sampling method to randomly select and examine 55 out of a total population of 441 employees that Department officials said were available to provided RESEA services during fiscal year 2023. We examined records for all RESEA training courses completed by these employees and found that the Department did not have documentation evidencing that two employees (3.6 percent) completed annual RESEA training during the audit period. Both employees administered RESEA appointments to claimants during the audit period. We also found three employees (5.5 percent) were missing from the Department’s tracking report, and four additional employees completed a training course that was not listed on the report. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Identification for People Eligible for Reemployment Services During the implementation of the RCT, the Department did not monitor the profiling and prioritization of claimants for RESEA participation to determine whether claimants prioritized for receiving RESEA services were the most likely to exhaust their unemployment benefits. Department management asserted in writing that its UTAB risk scoring model was operating during the audit period to ensure claimants were profiled to determine those most likely to exhaust unemployment benefits and need reemployment services. However, after our Office tested the risk scoring model and identified system weaknesses, the Department informed us that the scoring model was not working as intended and disabled during the audit period. Employee Training The Department did not maintain historical records of employee training profiles. Instead, management retained only documents supporting the most recent training course completed by each employee. Additionally, management did not adequately maintain its tracking reports to ensure all completed training sessions were documented for each employee. Effect of Condition Identification for People Eligible for Reemployment Services Without monitoring its automated scoring model for effectiveness, the Department cannot ensure that its systems select RESEA participants based on a valid risk profile and priority of need for reemployment services. By disabling the automated scoring model, the Department is not in compliance with provisions in the RESEA State Plan, and it cannot ensure that claimants selected for RESEA appointment services should have received consideration over higher-risk claimants who may be excluded in the RCT. Employee Training By not maintaining adequate training records for its employees, the Department cannot demonstrate that all RESEA staff have been properly trained on unemployment eligibility requirements in order to administer reemployment services to clients, as required in the RESEA State Plan. Recommendations We recommend the Department: • Review the design of its UTAB calculation to determine an applicant’s risk profile score, and test the calculation of the score to determine whether the system is accurately identifying claimants most likely to exhaust benefits. This understanding and testing should ensure that coefficient values are correctly determined and assigned by the UTAB system. • Reconcile the interface between the UTAB system and the scheduling system to ensure that all RESEA eligible claimants were received by the RAS scheduling system • Consider implementing additional internal controls to ensure claimants are profiled and prioritized for reemployment services based on their risk of exhausting unemployment benefits, in accordance with federal requirements • Establish adequate internal controls to ensure all employees receive required RESEA training before providing reemployment screening services to claimants • Verify all staff administering RESEA services on behalf of the Department have completed required training before providing services to claimants Department’s Response The Department partially concurs with the finding. UTAB Recommendations: I. Review the design of its UTAB calculation to determine an applicant’s risk profile score, and test the calculation of the score to determine whether the system is accurately identifying claimants most likely to exhaust benefits. This understanding and testing should ensure that coefficient values are correctly determined and assigned by the UTAB system. Department response: The Department concurs with the recommendation. For clarification, the coefficient values are calculated outside of UTAB. The coefficients are then input into UTAB which then calculates the profile score. The Department will review processes to effectively validate profile scores based upon new coefficients. II. Reconcile the interface between the UTAB system and the scheduling system to ensure that all RESEA eligible claimants were received by the RAS scheduling system. Department response: The Department partially concurs with the recommendation. Regarding the recommendation, there is no interface between UTAB and RAS to reconcile. The UTAB system is capable of generating an “exit file” which indicates the profile score for all the applicants that have a work search requirement. This file is sent and input into the RAS scheduler which automatically assigns the applicant. The Department will review its processes to verify that the RAS properly sets appointments from the UTAB exit file. b. Consider implementing additional internal controls to ensure claimants are profiled and prioritized for reemployment services based on their risk of exhausting unemployment benefits, in accordance with federal requirements. Department Response: The Department does not concur with this recommendation. In the Background section above, SAO stated “In June 2021, the Department deployed a pilot program proposed by the U.S. Department of Labor known as a randomized control trial (RCT), to randomly assign profile scores in lieu of using the risk profile model to profile all unemployment claimants.” The pilot program was not implemented in lieu of the risk model, but concurrently as described above. In brief, all applicants are scored and provided both a risk scoring profile based on established standards, and a random score, as described in the pilot program. Based on the risk scoring model, the top scores are automatically selected for RESEA. The remainder of the applicants are assigned based on the random score. The use of the top scorers and the random scoring methodology allows for the Department to meet the both the standard requirements by RESEA and the pilot program. Considering this, the Department believes it is compliant with both the risk based and random scoring profile requirements. Training Recommendations: • Establish adequate internal controls to ensure all employees receive required RESEA training before providing reemployment screening services to claimants. Department Response: The Department does not concur with the recommendation. In the Background stated above, SAO noted “All staff working within the RESEA program must, at a minimum, be trained in the programmatic requirements, state laws, rules, and agency policies once a year. Staff are required, by Department policy to take an intensive training before providing reemployment services to claimants, as well as take an annual refresher training once a year.” For accuracy, staff are required by the US DOL as follows (UIPL 08-24) page 15: Required Engagement of UI Staff – UI staff must be engaged in the administration of the RESEA program. This includes, but is not limited to: I. Participating in the planning, administration, and oversight of the RESEA program; II. Providing all appropriate staff training on UC eligibility requirements; III. Ensuring accurate data are provided in the RESEA-required reports; and IV. Conducting eligibility determinations and redeterminations resulting from issues identified through RESEA participation. The first day of RESEA Intensive Training is UI eligibility training which is designed and conducted by UICS Trainers. The Policy 4050-1 indicates that staff are required to have yearly training, but this is not specified by Policy definition and provides for the ad hoc and monthly trainings put on by programs. Additionally, there is no RESEA Department “policy” regarding training. The current program team fulfills the UIPL mandated UI Eligibility requirement through the required RESEA Intensive Training for all RESEA staff - as has been the process since 2020. The refresher trainings were implemented by programs to bring those trained, non-regular RESEA staff and local leaders up to date on changes, address in an effort to improve performance and reinforce staff confidence in their work. This is an internal process. The Department does have controls in place to ensure all employees receive required RESEA training, an internal spreadsheet, updated by training staff which was provided to the auditors. The two exceptions of the 55 sampled were staff who completed RESEA Intensive Training prior to the fiscal year audited. USDOL requires only that RESEA staff be trained and RESEA Policy indicates that training can occur as needed and in any form (monthly program call, ad hoc office training, etc.). Formal training is completed every 6 weeks and ad hoc trainings are provided on a monthly basis at a minimum. Therefore, the Department believes it meets the minimum standards as required by USDOL. • Verify all staff administering RESEA services on behalf of the Department have completed required training before providing services to claimants. Department Response: The Department does not concur with the recommendation. The Cause of the Condition for the training requirements as noted by SAO is a determination that ESD did not maintain training records. The exceptions noted in this area appear to be centered around two seasonal staff who were trained, though their training records were found outside the audit period. As stated in our response above, USDOL does not require yearly training. ESD implemented this programmatically in Fall of 2022. RESEA Policy 4050-1 indicates that staff should receive regular training, but intentionally does not specify the formality, format or content, allowing us to provide this in regular program calls and in ad hoc office trainings. Specifically the policy states “(3.A): *Staff training requirement for RESEA services - Staff working in the RESEA program must, at a minimum, be trained in the program’s requirements, including state laws, rules, and agency policies related to job search, reporting requirements and UI eligibility assessments, prior to providing direct services to claimants and then receive annual refresher training thereafter. All staff working with RESEA participants must be trained to detect and report potential issues to the unemployment insurance claims centers.” The RESEA lead trainer provided other documentation to the auditors - both from the LMS and our ESD’s own internal spreadsheets. Program records reflect the same information as LMS records but for the lone retiree (who showed up in our records but was archived from the LMS records). The two non-regular/seasonal staff who provided services in the audit period but did not have a record of that training in the audit period had previously completed required intensive training - which is more than the minimum required by USDOL. Auditor’s Remarks Identification for People Eligible for Reemployment Services The Department could not explain how the calculation of a claimant’s profile score occurred in UTAB in order to demonstrate that the automated calculation is working as intended to ensure claimants who are most likely to exhaust their unemployment benefits and need reemployment services are correctly identified. By implementing the RCT instead of assessing each claimant’s risk of exhausting unemployment benefits, and rank-ordering each claimant for RESEA selection based on that risk, the Department’s claimant selection design does not ensure that it prioritizes selecting claimants more likely to exhaust their benefits over other claimants with a lower likelihood of exhausting their benefits. This approach does not meet the federal requirement to ensure those individuals likely to exhaust their unemployment benefits are prioritized for RESEA services. Without monitoring to ensure all claimants determined eligible to receive RESEA services are transmitted to RAS, the Department cannot ensure that claimants selected to receive RESEA appointments represent those claimants who are most likely to exhaust their regular unemployment benefits and are most in-need of reemployment services. Additionally, by not reconciling claimants selected for appointments in RAS with claimants profiled in UTAB, the Department cannot reasonably ensure that all claimants eligible to receive RESEA services have been considered for appointment selection. Employee Training The Department’s policy 4050-1 stipulates that the annual refresher course is required to be completed by staff rendering RESEA services to claimants. Our testing focused on those individuals available to provide RESEA services to claimants during the audit period, and therefore we concluded that these individuals were required to receive an annual refresher training course during the audit period. The Department stated in its response that it implemented the programmatic annual refresher training requirement in Fall 2022, however Department policy 4050-1 became effective on October 15, 2020. The Department did not accurately track employee training completed during the audit period using its internal monitoring spreadsheet. Without monitoring to ensure all training records have been accurately reflected in the spreadsheet, management cannot ensure that all staff providing RESEA services have completed required training programs and therefore does not have reasonable assurance of compliance with RESEA training requirements as outlined in the Department’s policy. Furthermore, we disagree with the Department’s assertion that annual training is not required for all RESEA staff. Both the Policy 4050-1 and the RESEA State Plan state that staff providing direct services to claimants must receive annual refresher training from the Department in addition to initial training on program requirements, state laws, rules and agency policies. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 United States Code, Chapter 7 – Social Security, Subchapter III – Grants to States for Unemployment Compensation Administration, § 503 – State laws, states in part: (j) Worker profiling (1) The State agency charged with the administration of the State law shall establish and utilize a system of profiling all new claimants for regular compensation that – (A) Identifies which claimants will be likely to exhaust regular compensation and will need job search assistance services to make a successful transition to new employment; (B) Refers claimants identified pursuant to subparagraph (A) to reemployment services, such as job search assistance services; available under any State or Federal law; Revised Code of Washington (RCW), Title 50, Unemployment Compensation, Section 50.20.011, Profiling system to identify individuals likely to exhaust benefits – Confidentiality of information – Penalty, states in part: 1. The commissioner shall establish and use a profiling system for new claimants for regular compensation under this title that identifies permanently separated workers who are likely to exhaust regular compensation and will need job search assistance services to make a successful transition to new employment. The profiling system shall use a combination of individual characteristics and labor market information to assign each individual a unique probability of benefit exhaustion. Individuals identified as likely to exhaust benefits shall be referred to reemployment services, such as job search assistance services, to the extent such services are available at public expense. 2. The profiling system shall include collection and review of follow-up information relating to the services received by individuals under this section and the employment outcomes for the individuals following receipt of the services. The information shall be used in making profiling identifications. Washington State Employment Security Department, Wagner-Peyser Employment Service Policy 4050, Reemployment Services and Eligibility Assessments (RESEA) program, states in part: 3. Policy: A. Staff Training requirements for RESEA Services Staff working in the RESEA program must, at a minimum, be trained in the program’s requirements, including state laws, rules, and agency policies related to job search, reporting requirements and UI eligibility assessments, prior to providing direct services to claimants and then receive annual refresher training thereafter. All staff working with RESEA participants must be trained to detect and report potential issues to the unemployment insurance claims centers. B. Claimant selection for RESEA services RCW 50.20.11 states, in part, that a profiling system must be established to identify new permanently separated claimants most likely to exhaust regular UI benefits and that are in need of job search assistance services to make successful transitions to new employment. This system uses a combination of individual characteristics and labor market information to assign each individual a unique probability of benefit exhaustion known as the profile score. Claimants with a work search requirement will be given a profile score. Those still attached to an employer will not receive a profile score. Based on ranked scoring, claimants are selected and added to an electronic list as eligible to receive RESEA services. Claimants identified as most likely to exhaust, or as UCX receive top priority. Selection occurs between the second and fifth week of a valid claim. Claimants waiting on decisions or for their claims to become valid are not selected until they have valid claims and are eligible for benefits.

2023-011 The Employment Security Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act for the Workforce Innovation and Opportunity grant. Assistance Listing Number and Title: 17.258 Workforce Innovation and Opportunity Adult Program 17.259 Workforce Innovation and Opportunity Youth Activities 17.278 Workforce Innovation and Opportunity Dislocated Worker Formula Grants Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: AA-34801-20-55-A-53 AA-36352-21-55-A-53 AA-38562-22-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Employment Security Department administers the Workforce Innovation and Opportunity Act (WIOA) grant to help job seekers access employment, education, training and support services to succeed in the labor market. WIOA provides employment and training programs for adults, dislocated workers, and youth. In fiscal year 2023, the Department spent about $69.7 million in WIOA federal funding, including about $65 million paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower the public with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. When a new subaward is executed, Department staff prepare the Fund Manager Spreadsheet that contains the required reporting information for the subawards. Staff then submit the report based on the Fund Manager Spreadsheet. There were 20 WIOA subawards and amendments that were required to be reported in fiscal year 2023, totaling $52,126,097. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Act for the WIOA grant. The Department does not have written procedures over this reporting process. During the audit period, Department officials said that management reviews the reports to ensure they are accurate and submitted timely. However, there was no documentation to demonstrate the reviews occurred. During the audit period, the Department was required to report 20 subawards totaling about $52 million of program funds that was awarded to 12 subrecipients. We used a non-statistical sampling method to randomly select and examine seven out of the total population of 20 subawards. We found: • Two out of seven subawards (29 percent), totaling $94,618, were not reported in FSRS. • The other five subawards (71 percent), totaling $23,067,323, had the incorrect subaward obligation/action dates, and we were unable to determine if they were submitted timely. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not have procedures in place to ensure management’s review was documented and effective, reports were retained when submitted, and FSRS login credentials were retained with staff changes. The manager responsible for reviewing this report is no longer with the Department. This person was the only staff with FSRS login credentials for the subawards we tested, so other Department officials were not able to log into the system to see when the subawards were submitted. Effect of Condition Failing to submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Department: • Establish effective internal controls to ensure it submits all required reports timely and accurately • Establish policies and procedures for filing reports • Provide training for employees who prepare the reports Department’s Response The Department concurs with the finding and thanks SAO’s work to ensure federal requirements are met over the WIOA grant. The Department has implemented procedures to ensure reports are submitted timely, reviewed and submission dates are documented. Additionally, the Department has expanded FFATA requirements training to all personnel within the Grants Management Unit to ensure the accuracy of reporting. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2020. 3.What to report. You must report the information about each obligating action that the submission instructions posted at https://www.fsrs.gov specify. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-012 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction program. Assistance Listing Number and Title: 20.205 Highway Planning and Construction Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Washington State Department of Transportation’s Local Programs Office administers Highway Planning and Construction Program funding to local agencies throughout the state for highway construction projects. The Department spent about $603 million on highway projects during fiscal year 2023. Of that amount, it passed through about $331 million to local agencies through subawards for 378 new and existing projects across the state. Pass-through entities are required to monitor the activities of their subrecipients to ensure they are properly using federal funds. To determine the appropriate level of monitoring, federal regulations require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. For the subawards made during fiscal year 2023, Department management delegated the responsibility to complete risk assessments for individual projects to the Local Programs Engineers who were assigned to the regional office that oversees the project. When the Department prepares to monitor or review a subrecipient, it selects an open and active project and evaluates the subrecipient based on its performance under that project. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction program. We randomly selected and examined 55 of the 378 projects awarded funding during the audit period to determine if the Department performed a risk assessment of each project to determine the appropriate level of monitoring required for the subrecipient. We found the Department did not complete risk assessments for 17 of the 55 projects (30 percent). These risk assessments were signed and dated by Department staff after the audit period had ended. In addition, we found that 13 of the 17 assessments were not signed until after our Office requested them. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not ensure the Local Programs Engineers performed the risk assessments for each subrecipient project awarded program funds. Effect of Condition Not performing risk assessments makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the grant’s terms and conditions. Without verifying the Local Programs Engineers completed risk assessments for each awarded project, the Department cannot ensure it is performing risk assessments consistently and using the proper criteria to determine the appropriate amount of monitoring required for each subrecipient project. Recommendations We recommend the Department: • Ensure it properly performs and documents the required risk assessments, which would allow management to evaluate the results and demonstrate compliance with federal requirements • Improve its monitoring of regional Local Programs Engineers to ensure they complete risk assessments for each program-funded project Department’s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor’s Office audit of the Highway Planning and Construction program. WSDOT is committed to ensuring our programs comply with federal regulations. Risks assessments for subrecipients in this FHWA grant program are the responsibility of WSDOT’s Regional Local Programs Engineers, located in the six WSDOT Regions. While every attempt is made to complete a risk assessment at each phase of a project, staff turnover contributed to the lack of consistency and timeliness in completing these assessments. To help ensure consistency, the Department has updated position descriptions for Local Programs Engineers to reflect this requirement. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, section 332, Requirements for pass-through entities, establishes requirements for pass-through entities to evaluate each subrecipients’ risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate level of subrecipient monitoring. Title 2 CFR Part 200, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-013 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to collect certified payrolls from contractors on projects funded by the Highway Planning and Construction program. Assistance Listing Number and Title: 20.205 Highway Planning and Construction 20.205 COVID-19 Highway Planning and Construction Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – Wage Rate Requirements Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Washington State Department of Transportation receives federal funding under the Highway Planning and Construction Program for highway construction projects throughout the state. Some of these projects are awarded to contractors who perform the work on behalf of the Department. The Department spent about $706 million in federal Highway Planning and Construction program funds during fiscal year 2023. Of that amount, it spent more than $343 million on state-administered construction projects. All laborers and mechanics employed by contractors or subcontractors to work on construction contracts exceeding $2,000 financed by federal assistance funds must be paid wages that are no less than those established for the locality of the project (prevailing wage rates) by the Department of Labor. All contractors and subcontractors are required to submit a copy of their payroll and a statement of compliance (certified payrolls) on a weekly basis, for each week in which any applicable contract work is performed. The Department’s construction projects typically involve both a prime contractor and subcontractors to complete work on the project. The Department requires field inspectors to be onsite during construction work to ensure projects are completed in accordance with contract specifications. For every day of the week when contract work is performed, the inspector completes an Inspector Daily Report (IDR) and documents if there was any labor or mechanical work performed on that day. The IDRs are submitted to the Project Engineer, Project Manager, or Chief Inspector overseeing construction, who then reviews them to determine if any contractors must submit certified payrolls for that work week. Project Engineers are also required to document which contractors are required to submit certified payrolls each week by using a tracking report and maintaining it to identify all certified payrolls received from contractors and ensure they are documented and verified. The Department publishes the Standard Specifications for Road, Bridge, and Municipal Construction (Standard Specifications), in addition to the Construction Manual (M.41-01.41), which applies to its construction contracts, and is approved by the U.S. Federal Highway Administration of the Department of Transportation. These specifications require contractors to submit certified payrolls to the Department on a weekly basis for each weekly payroll period. The Standard Specifications further stipulate that contractors must use the Washington State Department of Labor and Industries Prevailing Wage Intents and Affidavit System (PWIA) to submit weekly certified payrolls on federal projects. The Department’s Project Engineers are required to verify that contractor’s certified payrolls are submitted on a weekly basis in PWIA. If the contractor’s certifications are not submitted in a timely manner, the specifications allow the Department to withhold payment from contractors and enact other sanctions as necessary. The Construction Manual also requires contractors to submit a Request to Sublet to gain authorization to use a subcontractor on a project. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to collect certified payrolls from contractors on projects funded by the program. We found that the Department’s internal controls were not adequate to ensure all contractors and subcontractors submitted certified payrolls on a weekly basis, as required by federal law and the Standard Specifications. We used a statistical sampling method and randomly selected 58 out of a total 3,931 of weeks in which contract work was performed on federally funded construction projects, to determine whether the Department received certified payrolls from the prime contractor and all subcontractors performing work on the project on a weekly basis, as required by federal law. We identified all 58 weeks required a total of 245 certified payrolls to be submitted to the Department. Collecting certified payrolls The Department did not collect all certified payrolls from the prime contractor and subcontractors on a weekly basis for 48 of the 58 weeks we examined (83 percent). For 45 of those weeks, we determined the Project Engineer did not notify the contractor in PWIA to submit the required payrolls. The Department provided no documentation demonstrating it withheld payments from or imposed additional sanctions upon prime contractors with late or overdue certified payrolls. Of the 245 total certified payrolls submitted, 153 (62 percent) were not submitted within seven days (or one week) of the payroll week ending date, as required. On average, these payrolls were 23 days late, and 25 payrolls were more than 30 days late. For each of the 48 weeks, between one and 13 certified payrolls were submitted late. The Department requested overdue payrolls from contractors for 13 of those weeks. We also found 12 weeks where the Project Engineer failed to document that certified payrolls were due for contractors that later submitted them in PWIA. Internal controls and review of certified payrolls We found that five of the 58 (9 percent) selected weeks were for projects that did not have an approved Request to Sublet form for all subcontractors on the project, as required by Department policy. We also found that for 57 weeks, the Project Engineer assigned to oversee the project did not document that all required certified payrolls were received from contractors, as required by Department policy. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not adequately monitor to ensure compliance with federal requirements. While the Department’s Construction Manual and Standard Specifications have documented policies and procedures in place for Project Engineers and regional offices to follow to track certified payrolls, follow-up on late submissions, and issue sanctions, Project Engineers did not consistently follow these policies in monitoring contractors for compliance. In addition, the Department’s Construction Manual does not specify how Project Engineers must document certified payrolls due for construction projects, and management does not have a standardized form for Project Engineers to use for tracking certified payrolls. Management did not adequately monitor Project Engineers to ensure they followed the standards outlined in the Construction Manual. Effect of Condition When the Department does not collect all certified payrolls timely, it cannot ensure that laborers working on federally funded construction contracts are paid the applicable prevailing wages, as required by law. In addition, by not collecting certified payrolls on a weekly basis, the Department is not in compliance with federal requirements, and may be subject to actions by the federal grantor. Recommendations We recommend the Department: • Monitor project offices to ensure contractors are notified when they have not provided certified payrolls for a given week of contract work • Improve internal controls to ensure project offices monitor the status of certified payrolls due from contractors on a weekly basis, contractors are made aware of delinquent payrolls, and consideration is given to assessing sanctions on noncompliant contractors in accordance with its Standard Specifications, such as withholding any or all payments, as necessary, when contractors do not submit required certified payrolls on a weekly basis • Ensure certified payrolls are collected from prime contractors and all subcontractors on a weekly basis, in accordance with federal law and the Construction Manual Department’s Response The Washington State Department of Transportation appreciate the State Auditor’s Office (SAO) audit of the Federal Highway Administration’s (FHWA) Program. The Department is committed to ensuring our programs comply with federal regulations. As WSDOT indicated in previous years for similar findings, the draft audit finding does not consider the nature of the contractual relationship between the contractor and WSDOT as the owner. The owner's compliance with the Davis-Bacon Act and regulations cited in the finding is determined by collective actions specified by regulations and not merely by how many payrolls are collected from the contractor within a 7-day window. WSDOT, in close consultation with the FHWA, has established contract administration processes with contingencies built in to address and correct for contractor noncompliance. In addition, WSDOT will not issue project Completion until all certified payrolls are collected (Standard Specifications 1-08.5.2, Time for Completion). FHWA guidance recommends actions to take if a contractor is habitually late in submitting payrolls but leaves it up to WSDOT to determine when sanctions should be imposed. WSDOT’s Standard Specifications (1-07.9(5)) on certified payrolls aligns with FHWA guidance. Sanctions are imposed as appropriate during the life of a contract. In FHWA’s letter of April 25, 2019, in response to a similar finding for FY 2018, the grantor states “WSDOT’s process and policy concerning certified payrolls has been approved by FHWA through the approval of WSDOT’s Construction Manual and Standard Specifications. As part of FHWA’s approval FHWA agreed that these processes are reasonable and satisfy the intent of the Department of Labor’s certified payroll requirements, as FHWA understands them. FHWA believes that the procedures contain the necessary controls to ensure compliance with 29 CFR 5.5 and FHWA Davis-Bacon and Related Acts…” In the July 6, 2020, response from FHWA on a similar finding for FY 2019, FHWA indicated “FHWA believes that WSDOT’s procedures contain the necessary controls to ensure reasonable compliance with 29 CFR 5.5 and FHWA Davis-Bacon and Related Acts Questions and Answers. FHWA considers this finding to be resolved.” In this year’s audit, the State Auditor sampled 58 weeks and the required 245 certified payrolls for contract work performed on federally funded construction projects during that time period. WSDOT collected all of the required 245 certified payrolls. Of these payrolls 153 were received one or more days late, but of these only 28 were 30-days or more late and only 15 (6%) were 60-days or more late. This represents only 1 percent above the exception threshold typically allowed by the State Auditor. At 60-days, the Department has its first opportunity to initiate sanctions against the contractor. Of the 15 payrolls that were at least 60-days late, WSDOT deferred (withheld) 10 payments on 2 of the contracts. Sanctions prior to 60-days, are not feasible, as the contractors are paid monthly for the prior month’s work, and WSDOT has 30-days to process payments. The draft finding notes that for several weeks “the Project Engineers did not notify the contractor in PWIA to submit the required payrolls”, however, many notifications were provided via email for 5 of tested contracts, but these were not taken into account, as SAO indicated they did not use the “approved method.” WSDOT is in the midst of delivering its largest and one of its most complex construction programs in our history, and is doing so with lower and less experienced staffing levels than it had to deliver past construction programs. We will continue to look for opportunities to improve our process as well as our documentation to demonstrate compliance with the Davis-Bacon Act requirements. In addition, we will continue consulting with FHWA for any further actions needed to resolve this finding. Auditor’s Remarks The U.S. Department of Labor establishes the Davis-Bacon Act and related requirements concerning federally-funded construction projects. Title 29 Code of Federal Regulations (CFR) Subpart A – Davis-Bacon and Related Acts Provisions and Procedures, Subsection 5.5, requires that the Department collect certified payrolls from its contractors. 5.5(a)(ii)(A) stipulates that contractors and/or subcontractors must submit payrolls weekly and for each week in which Davis-Bacon or Related Acts-covered work is performed. The Department enters into federal-aid construction contracts with its contractors and is therefore required to ensure compliance with these federal requirements for its projects. Furthermore, the USDOL Wage and Hour Division’s Final Rule (effective October 23, 2023) concerning the Davis-Bacon and Related Acts Regulations, stipulates that “contractors and subcontractors are required to provide certified payrolls to the contracting agency to demonstrate their compliance with Davis-Bacon Act requirements on a weekly basis,” and that “the Department cannot allow contractors to pay required prevailing wages or submit certified payrolls on a basis less frequent than weekly.” In its response, the Department states it has established contract administration processes with contingencies built in to address and correct for contractor noncompliance regarding missing and/or late certified weekly payrolls. However, the high rate of noncompliance identified in the audit indicates that these processes are not effective in ensuring that contractors submit the required certified payrolls weekly, as required by federal law and the Department's Construction Manual. Additionally, for each of the 48 weeks we identified in which contractors failed to submit certified payrolls timely, our Office requested from the Department evidence that it imposed sanctions upon the contractors, and the Department provided us with no such documentation. The Department also states it is not feasible to impose sanctions upon contractors with habitually late payrolls before 60 days have passed from the week(s) of work ending due to its designed payment delivery method. Without ensuring its prime contractors have submitted certified payrolls for their employees and for all approved subcontractors performing work under the contract, the Department cannot ensure the contractor has paid prevailing wages to all laborers and mechanics, and that laborers have been paid on a weekly basis, as required by federal law. Additionally, the Department electing to pay its contractors up to 30 days after construction work has been performed is not effective to prevent contractor noncompliance with submitting certified payrolls on a weekly basis, as required. The Construction Manual, Section 1-07.9(5) Required Documents, states that certified payroll must be submitted to the Project Engineer through PWIA for each contractor, subcontractor, and each lower tier subcontractor performing work on the project, and that the PWIA system will be used to track requests made for missing certified payrolls. Therefore, we noted in our audit finding the instances when the Department’s Project Engineers failed to request overdue certified payrolls from contractors in PWIA, as that is the official system of record required to be used by the Department. We reaffirm our audit finding and we will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 29 CFR Part 5, Labor Standards Provisions Applicable to Contract Covering Federally Financed and Assisted Constructed (Also Labor Standards Provisions Applicable to Nonconstruction Contracts Subject to the Contract Work Hours and Safety Standard Act), section 5, Contract provisions and related matters, establishes the requirements for including prevailing wage clauses in federal-aid contracts, payment withholding, and required documents. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The Federal Highway Administration Davis-Bacon and Related Acts Questions and Answers, section 56, states that contracting agencies are responsible for properly applying and enforcing prevailing wage requirements in covered contracts including: a) Verifying that covered contracts have incorporated the required Davis-Bacon clauses and the applicable wage determination(s); b) Verifying that the Davis-Bacon notice and the applicable wage determination(s) are displayed at the site of the work in a conspicuous location in clear view of everyone; c) Reviewing certified payrolls in a timely manner; d) Conducting employee interviews; e) Conducting reviews and investigations of covered contracts in conjunction with FHWA as appropriate; f) Forwarding refusal to pay and/or debarment consideration cases to the USDOL Wage and Hour Division for appropriate action; and g) Submitting enforcement reports and semi-annual enforcement reports to the USDOL Wage and Hour Division. The Washington State Department of Transportation’s Construction Manual M41-01.41, December 2022 edition, section 1-07.9, Wages, states in part: Federal Prevailing Wage Enforcement of Federal Prevailing Wage Provisions In addition to the requirements of Standard Specifications Section 1-07.9, all Contracts financed with Federal funding includes the Required Contract Provisions for Federal-Aid Construction Contracts (FHWA-1273). These provisions identify Federal wage requirements. The Federal prevailing wage requirements included in these provisions are also commonly referred to as Davis Bacon and Related Acts (DBRA). It is the Project Engineer’s responsibility to monitor and enforce these provisions to the degree necessary to ensure full compliance. In order to comply with these requirements, the Contractor must: Submit weekly certified payrolls to the Project Engineer through LNI’s Prevailing Wage Intents and Affidavits (PWIA) system. Ensure each Subcontractor, and each agent or lower-tier subcontractor submits weekly certified payrolls to the Project Engineer through PWIA. SS1-07.9(5) Required Documents Statement of Intent Every Contractor, Subcontractor, agent, or lower tier subcontractor performing work on a public works contract must submit a Statement of Intent to Pay Prevailing Wages to LNI for approval. Separate Intents are required for each Request to Sublet submitted on the project. Hiring Contractors are required to file an Intent if they hire a lower tier subcontractor subject to prevailing wages. Certified payroll must be submitted to the Project Engineer through PWIA for each Contractor, Subcontractor, and each lower tier subcontractor performing work on the project, regardless of funding source or delivery method. Certified payrolls are required from the time each Firm begins performing Contract work until the time the Affidavit is visible in PWIA, or until the Contractor has identified their last certified payroll has been submitted. A tracking sheet is required to document when Project Office staff verify that certified payrolls are received through PWIA. The frequency of verification depends on the funding source of the project. Weekly verification is required for federally funded projects, while monthly verification is required for state funded contracts. The tracking sheet needs to indicate that all active Contracts have been checked for late or missing certified payrolls. PWIA will be used to track requests made for missing certified payrolls. A separate tracking sheet may be used to track which certified payrolls have been verified for each project. Federally funded projects require weekly submittals. Further review of the payroll will be required to ensure the Federal prevailed wage rate is met using the Wage Determination included in the Contract Special Provisions. Federally funded Contracts: • Weekly submittals • No leniency on late submittals • Required for every week, whether work was performed or not • Enforcement of all Federal requirements will remain WSDOT responsibility Federally funded projects require weekly submittal of certified payrolls. If the Contractor is unable to submit their payroll electronically using PWIA, they must submit the certified payrolls directly to the Project Office. Non-compliance or non-submittal could result in the Project Engineer withholding an appropriate portion of payment (see Section SS 1-09.9). The Washington State Department of Transportation’s Construction Manual M41-01.41, December 2022 edition, section 1-09, Measurement and Payment, subsection 9, Payments, states in part: Withholding of Payments Withholding payments for the work the Contractor has performed and completed in accordance with the contract should not be done casually. There must be clear contract language supporting the action. The authority to withhold progress payments is subdelegated to the Regions. Further delegation to the Project Engineers is at the discretion of each Region. Delinquent Contractor Submittals Missing submittals is a principal source of delays in closing out the project and processing the final estimate. As the project proceeds toward completion, the Project Engineer and the Contractor should attempt to obtain all submittals as the need arises. These might include such things as materials certificates, certified payrolls, extension of time requests, or any other item or document that delay processing the final estimate.

2023-014 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with quality assurance program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed testing for projects funded by the Highway Planning and Construction Cluster. Assistance Listing Number and Title: 20.205 Highway Planning and Construction Program Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – Quality Assurance Program Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-011 Background The Washington State Department of Transportation receives federal funding under the Highway Planning and Construction Program for highway construction projects throughout the state. Some of these projects are awarded to contractors who perform the work on behalf of the Department. The Department spent about $706 million in federal Highway Planning and Construction program funds during fiscal year 2023. Of that amount, it spent more than $343 million on state-administered construction projects. Federal regulations require that the Department have a quality assurance (QA) program, approved by the Federal Highway Administration (FHWA), for construction projects on the National Highway System to ensure that materials and workmanship conform to approved plans and specifications. Verification sampling must be performed by qualified testing personnel employed by the Department or its designated agent, excluding the contractor. The Department’s QA program requirements are outlined in the Construction Manual, which is approved by the FHWA. This manual documents how materials are tested for acceptance before being incorporated into construction projects. Materials can be accepted in various ways, such as sample testing, a visual inspection documented by the Field Note Record or Inspector’s Daily Report, or a certification of compliance from the manufacturer. If a materials test is required, the Department must ensure that only qualified people perform the testing, including independent testers, consultants or certified Department employees. To ensure that materials incorporated into a project meet approved plans and specifications, the Department prepares a list of prescribed materials to be used on the project. The Department uploads this list to a program called the Record of Materials (ROM). The ROM sets forth the materials and quantities that are expected to be used on the project, and it documents the proper acceptance criteria, including any test(s) personnel are required to perform on a material. Once created, Project Engineers responsible for managing the construction project update the ROM to indicate the type and quantity of materials incorporated into the project so management can ensure the materials test(s) that are required for acceptance have occurred. To ensure that only qualified people perform the testing, testers must pass a certification exam, which consists of a written and performance exam. After passing both, the testers are entered into the Qualified Tester Database and are certified for five years, after which they must recertify by passing both exams again. There are two different types of tester qualifications: module and method. Module testers are proficient in multiple method tests that can encompass all method tests for a particular material, whereas method testers may only be proficient in particular tests for any given material. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with QA program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed materials testing for projects funded by the Highway Planning and Construction Cluster. The prior finding numbers were 2022-011, 2021-011, 2020-017 and 2019-019. Description of Condition The Department did not have adequate internal controls over and did not comply with QA program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed testing for projects funded by the Highway Planning and Construction Cluster. We used a statistically valid sampling method to randomly select 58 out of 1,991 materials that were used on federally funded projects during state fiscal year 2023. Materials acceptance testing did not conform to Standard Specifications and the Construction Manual For the 58 randomly selected materials, we requested supporting documentation for acceptance and/or testing of the material. We found: • Three materials (5 percent) where testing did not occur, or the Department was unable to provide documentation justifying the item did not require testing. • Two additional materials (3 percent) where the Department did not provide adequate supporting documentation to demonstrate the materials we selected were properly tested, according to the Standard Specifications. One of these materials did not meet the minimum acceptance criteria outlined in the Standard Specifications, and the Department paid the contractor for the material used on the project. Testing personnel were not properly certified We reviewed documentation to verify whether the testers performing sampling activities for the Department had all required documents to support their certification. We found: • Four instances (7 percent) where the tester was missing a required exam for certification • Three instances (5 percent) where the Department was unable to provide documentation to support that the tester met certification requirements. All three instances correspond to materials for which the Department could produce no records demonstrating the items were tested for acceptance. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Materials acceptance testing did not conform to Standard Specifications and the Construction Manual Management did not adequately monitor project offices to ensure required materials testing and acceptance occurred in accordance with the Construction Manual. Testing personnel were not properly certified Project Engineers did not ensure tester qualifications were current, and management did not ensure that only qualified testers performed materials testing and acceptance on behalf of the Department. Effect of Condition By not adequately monitoring project materials to ensure they conform to approved plans and specifications, the Department does not have reasonable assurance that materials incorporated into projects conform to standard specifications and the Construction Manual. By not properly verifying and documenting the testers’ qualifications, the Department risks improper materials testing. This could result in the Department using materials that may not conform to approved plans and specifications. Recommendations We recommend the Department: • Improve internal controls, and monitor project offices, to ensure that required sampling activities occur, as required, and permanently incorporated materials conform to standard specifications for all federal aid construction projects • Strengthen internal controls to ensure testers have completed all required exams—and that they have proper documentation of passing these exams—before performing sampling activities Continue to review all testers to ensure they meet the minimum requirements for certification Department’s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor’s Office (SAO) audit of the Federal Highway Program and the federally required Quality Assurance (QA) program. The Department is committed to ensuring our programs continue to comply with federal regulations and recognizes that there are always opportunities for improvement to its QA program. The Department is working towards replacement of its ROM legacy system; therefore, it was not practical to modify this system to help correct issues reported in a similar finding in the FY 2022 Single Audit. Instead, the Department eliminated its practice requiring updates to the ROM within 30 days of payment and instead relies on the required documentation, as evidence of proper material acceptance. These changes were made during FY2023, which did not allow time to be fully reflected in the current year’s audit. In addition, in January 2023 WSDOT modified its practice related to how tester data is reviewed and entered into the tester certification tracking system, as a result of audit recommendations from the FY 2022 audit. All offices now funnel tester data to the Headquarters Quality Assurance Program for review and entry. These changes to practices were communicated to appropriate staff and are reflected in the Construction Manual, which was reviewed and approved by FHWA. Materials Acceptance The construction contracts awarded in FY23 utilizing federal funding contained more than 4,700 materials, with approximately 1,100 of them requiring testing. The State Auditor tested 58 materials of the approximately 1,100 requiring testing; however, through our review the Department found only 4 materials (6.8%) where we could not provide documentation to support that testing occurred or was not required. Testing Personnel Certifications The State Auditor reviewed documentation for whether the testers performing materials sampling activities for the Department had all required documents to support their certification and took exception to documentation provided. The Department did not provide certification documents for 2 of the testers responsible for 4 of the materials tests included in the audit. The Department has worked closely with the Federal Highway Administration (FHWA) on our QA program and continues to receive feedback from them on the strength of our program. The Department will continue to put improvements in place for the QA program based on the SAO audit recommendations. These issues were discussed at the 2024 Material Assurance Training offered 3/20/2024, and we will continue to deliver other training to Project Engineering Offices to emphasize QA program requirements throughout the year. Auditor’s Remarks We thank the Department for its cooperation and assistance during the audit. We maintain that there are five materials out of 58 (8.6 percent) examined during the audit that did not have adequate supporting documentation to demonstrate the materials met the minimum acceptance criteria according to the Department’s Construction Manual. We used a statistical sampling methodology for this test and therefore expect the error rate of 8.6 percent to be representative of the entire population of 1,100 materials. We reaffirm our audit finding and will follow up on the Department’s corrective action during the next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 23 U.S. Code of Federal Regulations (CFR) Part 637, Construction Inspection and Approval establishes the following applicable requirements: Section 637.201 Purpose To prescribe policies, procedures, and guidelines to assure the quality of materials and construction in all Federal-aid highway projects on the National Highway System. Section 637.205 Policy a) Quality assurance program. Each STD shall develop a quality assurance program which will assure that the materials and workmanship incorporated into each Federal-aid highway construction project on the NHS are in conformity with the requirements of the approved plans and specifications, including approved changes. The program must meet criteria in (Section 637.207) and be approved by the FHWA. b) STD capabilities. The STD shall maintain an adequate, qualified staff to administer the quality assurance program. The State shall also maintain a central laboratory. The State’s central laboratory shall meet requirements in (Section 637.209(a)(2)). c) Verification sampling and testing. The verification sampling and testing are to be performed by qualified testing personnel employed by the STD or its designated agent, excluding the contractor and vendor. d) Random samples. All samples used for quality control and verification sampling and testing shall be random samples. Section 637.207 Quality assurance program a. Each STD’s quality assurance program shall provide for an acceptance program and an independent assurance (IA) program consisting of the following: 1. Acceptance program. i. Each STD’s acceptance program shall consist of the following: A. Frequency guide schedules for verification sampling and testing which will give general guidance to personnel responsible for the program and allow adaptation to specific project conditions and needs. B. Identification of the specific location in the construction or production operation at which verification sampling and testing is to be accomplished. C. Identification of the specific attributes to be inspected which reflect the quality of the finished product. ii. Quality control sampling and testing results may be used as part of the acceptance decision provided that: A. Frequency guide schedules for verification sampling and testing which will give general guidance to personnel responsible for the program and allow adaptation to specific project conditions and needs. B. Identification of the specific location in the construction or production operation at which verification sampling and testing is to be accomplished. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The Department of Transportation’s Construction Manual (M41-01), Chapter 9: Materials, states in part: 9-1 General The quality of materials used on the project will be evaluated and accepted in various ways, whether by testing of samples, visual inspection, or certification of compliance. This chapter details the manner in which these materials can be accepted. Requirements for materials are described in Standard Specifications for Road, Bridge, and Municipal Construction M 41-10 Section 1-06 and Division 9. It is the Project Engineer’s responsibility to accept materials in accordance with this chapter. For materials tests that do not meet specification requirements, the Project Engineer shall contact the State Construction Office which will coordinate with the State Materials Engineer or Assistant State Materials Engineer to determine the appropriate action. 9-1.2C Record of Materials The Record of Materials (ROM) is used to track material type, make/model, approval, acceptance, field verification documentation, Certificate of Materials Origin, and other materials documentation. The Project Office utilizes the ROM program to track all permanently incorporated materials that are placed in on the Contract. Temporary materials are also tracked in the ROM when the contract documents contain temporary material requirements. The Project Engineer is responsible for the accuracy of the ROM, other documentation methods used, and Certification of Materials. Acceptance requirements shown in the ROM can be modified by referencing the properly submitted QPL page or the approved Request for Approval of Materials. Reviewing the contract plans and provisions may identify additional materials documentation requirements as well as construction items that shall be added to the ROM and tracked for completion throughout the course of the project work. In order to ensure clarity upon completion of the work and to allow for easy certification of the project by both the Project Engineer and the Region, the ROM needs to be maintained throughout the course of the project. “Maintained” and “maintain” means the ROM is updated to reflect materials placed within 30 calendar days of the material payment. This includes material type, make/model, approval, acceptance, field verification documentation, Certificate of Materials Origin and other materials documentation. For materials used in the Contract, the Project Office is required to maintain the Status Work Completed (WC)/Documentation Complete (DC) / Not Used (NU) fields in the ROM. The Project Office is required to maintain quantities paid, quantities placed, quantities field verified for materials that have sampling frequencies, WSDOT Fabrications Inspection items, where the Acceptance Criteria requires quantities such as Manufacturer Certificate of Compliance, or when quantities are noted in the initial materials and acceptance criteria. 9-5.3 WAQTC Testing Technician Qualification Program The Region Independent Assurance Inspectors are responsible for maintaining the Tester Qualification database information for their Region WAQTC Testers as well as maintaining the WAQTC internal certifications and records (physical and digital). 9-5.4 Method Qualified Tester Program The Region Independent Assurance Inspectors are responsible for maintaining the Tester Qualification database information for their Region Method Testers as well as maintaining the Method internal certifications and records (physical and digital).

2023-015 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with cash management requirements for the Formula Grants for Rural Areas program. Assistance Listing Number and Title: 20.509 Formula Grants for Rural Areas Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: WA-2019-091-01; WA-2020-038-01; WA-2021-052-01; WA-2021-130-01; WA-2021-133-01; WA-2022-031-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Cash Management Known Questioned Cost Amount: $41,555 Prior Year Audit Finding: No Background The Washington State Department of Transportation administers the Section 5311 program— Formula Grants for Rural Areas—to rural transportation areas by providing financial assistance for operating, planning, administrative expenses, and the acquisition, construction, and improvement of facilities and equipment. In addition, Section 5311 specifically provides for the support of rural intercity bus services, as well as funding for training, technical assistance, research, and related services to support the rural transit service. The Department spent about $80.3 million in program funds during fiscal year 2023. Of that amount, it passed through about $35.2 million to subrecipients through subawards. The Formula Grants for Rural Areas program is not subject to the Cash Management Improvement Act, and is not included in the Treasury-State Agreement for Washington. Programs not covered by a Treasury-State Agreement are subject to the provisions of Title 31 of the U.S. Code of Federal Regulations, Part 205, Subpart B, which specifies how funds transfers from the federal government must be processed. The Department requests monthly federal reimbursements for operating expenses and disbursements to subrecipients. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with cash management requirements for the Formula Grants for Rural Areas program. We used a non-statistical sampling method to randomly select and examine 17 draws of program funds out of a total population of 128. We also selected six large draws that were individually significant. During our review, we found that one draw in the amount of $41,555 was made for an incorrect program. Management reviewed, verified, and approved this draw, but the Department did not detect that funds were drawn for the incorrect program during the audit period. We consider these questioned costs. Additionally, we found that two of the six individually significant draws were not made timely. One draw for $6.3 million was made in June 2023 for expenditures the Department incurred and paid in fiscal year 2021. Similarly, another draw for $9 million was made in April 2023 for expenditures the Department incurred and paid for in fiscal year 2022. Based on the length of time it took to perform the associated draws, we determined that the Department did not comply with federal requirements to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Therefore, the Department’s controls did not ensure timely draws in compliance with federal regulations. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management review was insufficient for ensuring that program funds were drawn only for allowable program expenditures. Additionally, management did not ensure that draws were performed timely in accordance with federal regulations and said this was due to difficulties in reconciling expenditure accruals to the payment system. Effect of Condition and Questioned Costs Drawing funds for the incorrect federal program can potentially result in uncollected funds in one program and overdrawing another. Further, delaying federal drawdown requests results in state funds being advanced longer than necessary and lost interest revenue for the state. The table below summarizes the questioned costs our audit identified. Projection to population Likely Questioned Costs (Estimate) Known Questioned Costs $41,555 Federal expenditures $298,218 Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our “best estimate of total questioned costs,” as required by 2 CFR §200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Improve its internal controls to ensure reimbursement requests are for the correct federal award • Ensure draws of federal program funds are performed in a timely manner • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor’s Office (SAO) audit of the Formula Grants for Rural Areas Program. The Department is committed to ensuring our programs comply with federal regulations related to Cash Management. WSDOT has implemented additional controls to help ensure the draws of program funds are accurate, drawn on the correct program, and timely. The updated procedures include: Identifying back up staff to ensure coverage during regular staff absences; Change in the timing of draws of program funds; Use of automatic ECHO system confirmations for draws entered; Additional reviews of draw amounts by project, and a Validation process with the WSDOT program staff. In addition, the questioned costs have been refunded to the incorrectly charged federal program. In an effort to ensure increased compliance, these procedures will be reviewed regularly and updated as required. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Title 31 CFR Part 205.33, How are funds transfers processed?, states in part: a. A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State’s actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A–102 (For availability, see 5 CFR 1310.3.). The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-016 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with subrecipient monitoring requirements for the Formula Grants for Rural Areas program. Assistance Listing Number and Title: 20.509 Formula Grants for Rural Areas Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: WA-2019-091-01; WA-2020-038-01; WA-2021-052-01; WA-2021-130-01; WA-2021-133-01; WA-2022-031-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Washington State Department of Transportation administers the Section 5311 program— Formula Grants for Rural Areas—to rural transportation areas by providing financial assistance for operating, planning, administrative expenses, and the acquisition, construction, and improvement of facilities and equipment. In addition, Section 5311 specifically provides for the support of rural intercity bus services, as well as funding for training, technical assistance, research, and related services to support the rural transit service. The Department spent about $80.3 million in program funds during fiscal year 2023. Of that amount, it passed through about $35.2 million to subrecipients through subawards. When passing federal funds through to subrecipients, federal regulations require the Department to monitor them based on a risk assessment to ensure: • Federal funds are used for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the subaward. • Subaward performance goals are achieved. • The subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award, when applicable. The Department’s subrecipient monitoring activities include virtual and physical site visits for various types of reviews based on risk assessments performed on a biennial basis, including: • Financial reviews • Administrative policy reviews • Drug and alcohol compliance reviews • Capital (equipment) reviews According to the Department’s Consolidated Grant Guidebook, which outlines general grant terms and conditions, the Department conducts biennial risk assessments to evaluate each subrecipient’s risk of noncompliance with grant requirements. The Department then determines the frequency of site visits for each subrecipient based on risk level, and schedules them accordingly. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with subrecipient monitoring requirements for the Formula Grants for Rural Areas program. We used a nonstatistical sampling method to randomly select and examine 12 site visits out of a total population of 65 to verify if the Department appropriately monitored its subrecipients. We found the Department did not perform two site visits during the audit period (17 percent). We also reviewed the Department’s site visit tracker and found three additional site visits that were not performed at the time of our audit. Additionally, we found that 10 other site visits were not completed by the Department’s scheduled due date (20 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department’s use of a tracker to schedule and complete site visits timely was insufficient to ensure that it appropriately monitored subrecipients in accordance with federal regulations. In addition, the Department’s policies and procedures did not specify when site visits must be conducted for subrecipients based on their assessed risk score or risk level. Accordingly, management did not enforce the due date for each subrecipient’s site visits established in the tracker, and did not ensure that all required site visits were completed. Effect of Condition During the audit period, the Department did not complete five out of 65 (8 percent) scheduled site visits for subrecipients. By not performing monitoring visits timely, the Department is at a higher risk of not detecting or preventing noncompliance with federal regulations and the grant’s terms and conditions. Additionally, the Department is at increased risk of not ensuring that subaward performance goals are achieved, and is unable to ensure subrecipients correct any existing deficiencies in a timely manner. Recommendations We recommend the Department: • Strengthen internal controls to ensure that it performs and documents monitoring visits based on its risk assessments of its subrecipients to ensure compliance with federal regulations and its own guidebook • Update its written policies and procedures to address the minimum requirements for conducting site visits, including determining how a subrecipient’s assessed risk score and risk level affect the timing and number of site visits required • Monitor the status of site visits for all its subrecipients to ensure that each one is evaluated in accordance with the requirements in its own guidebook • Follow up on subrecipients with overdue site visits to ensure they are conducted timely Department’s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor’s Office audit of the Formula Grants for Rural Areas. WSDOT is committed to ensuring our programs comply with federal regulations. WSDOT concurs with the finding and plans to implement the recommendations. Specifically, our Public Transportation Division will: • Update Public Transportation policy and procedure to more fully document its risk-based site visit approach. This update will clarify how an organization’s risk assessment score impacts the timing and number of administrative and financial site visits. This update will not impact capital and drug and alcohol site visits because Public Transportation Division staff conduct them every two years regardless of risk assessment scores. • Evaluate new ways for management, supervisors and staff to more effectively monitor site visit completion by established due dates. Once this group develops a new approach, management will ensure that staff document it in its policies and procedures and communicate the new approach to impacted staff. As of October 2023, the Public Transportation Division had conducted all five site visits listed in the condition of this finding. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The Washinton State Department of Transportation Consolidated Grant Guidebook (M130 (March 2022 version)), Chapter 1 – Requirements and guidelines for all projects, states in part: Program compliance and project reporting Risk assessments Every two years and in accordance with 2 CFR 200.332(b)(1-4), WSDOT conducts risk assessments to evaluate each grantee’s risk of noncompliance with the grant requirements. We use the risk assessment results to determine how much technical assistance and oversight may be necessary to help organizations comply with grant requirements. WSDOT will designate organizations that have a strong record of grant compliance and project delivery as low risk. The benefits of low-risk status may include less frequent site visits. High-risk status may result in more frequent site visits and a higher level of monitoring between site visits. For example, grantees may be required to provide full back up documentation with their claims. Frequency of site visits The frequency of site visits depends on the type of project, the funding source, type of site visit, and your risk scores. Below is general information on the frequency of site visits: • Operating projects WSDOT will perform administrative and financial site visits at least once every four years on active projects based on an organization’s risk score. • Planning projects WSDOT will perform administrative and financial site visits at least once every four years on active projects based on an organization’s risk score. • Capital vehicle and equipment projects WSDOT will perform administrative and capital site visits at least once every four years on active projects based on an organization’s risk score through the useful life of the vehicle and/or equipment. • Drug and alcohol program reviews WSDOT will perform a drug and alcohol site visit every biennium as needed based on an organization’s risk. This applies only to grantees awarded Sections 5339 and 5311 funding.

2023-017 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to ensure payments to subrecipients of the Emergency Rental Assistance program were allowable and properly supported. Assistance Listing Number and Title: 21.023 COVID-19 Emergency Rental Assistance Program Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: $4,123,486 Prior Year Audit Finding: Yes, Finding 2022-016 Background Congress passed two acts authorizing federal funds for the Emergency Rental Assistance (ERA) program to respond to the COVID-19 pandemic. The Consolidated Appropriations Act, 2021, enacted on December 27, 2020, provided $25 billion for ERA. These funds are known as ERA1. The American Rescue Plan Act of 2021, enacted on March 11, 2021, provided $21.55 billion in additional funding for ERA. These funds are known as ERA2. The funds are provided directly to states, U.S. territories, local governments and, in the case of ERA1, Indian tribes, to assist eligible households through existing or newly created rental assistance programs. The Department of Commerce administers the ERA program in Washington. The Department subawarded federal funds to subrecipients to provide financial assistance to households, landlords and utility providers. In fiscal year 2023, the Department spent about $62.5 million in ERA1 and ERA2 funds. During the audit period, the Department allocated program funds to 13 ERA1 subrecipients and 12 ERA2 subrecipients. Grant recipients may use ERA1 and ERA2 funds for administrative expenses, housing stability services, financial assistance, and other affordable rental housing and eviction prevention purposes. Most of the expenditures the Department spent were for financial assistance to eligible households, which included payment of rent, rental arrears, utilities and home energy costs, utilities and home energy costs arrears, housing stability services and other expenses related to housing. Under the ERA1 program, award funds used for “other expenses” must be related to housing and “incurred due, directly or indirectly, to the COVID-19 outbreak.” The amount for prospective rent cannot exceed three months under a single household application. Financial assistance arrears may only cover household expenses accrued on or after March 13, 2020, up to a maximum of 15 months for ERA1 and a maximum of 18 months under ERA1 and ERA2 combined. There is no maximum dollar amount for the cumulative financial assistance that may be provided on behalf of an eligible household beyond the requirement that the amounts paid be based on documentation of household income, leases and equivalent forms. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to subrecipients of the ERA program were allowable and properly supported. The prior finding number was 2022-016. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments for the ERA program were allowable and properly supported. During the audit period, the Department had procedures in place, which required staff to review supporting documentation when approving payments. We used a statistical sampling method to randomly select and examine 48 out of a total population of 136 subrecipient payments. Additionally, we judgmentally reviewed two significant payments that each exceeded $3 million. In total, we examined more than $39 million in provider payments as part of the audit. Of the 48 randomly selected payments examined, we identified seven (15 percent) that did not have adequate documentation to ensure the payment was for allowable activities, met cost principles, and occurred within the award’s period of performance. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition In July 2022, the Department implemented procedures requiring staff to review supporting documentation to ensure reimbursement requests were for allowable activities before reimbursing subrecipients. However, Department staff did not follow these procedures and approved reimbursements to subrecipients that did not provide adequate supporting documentation. Management said that this was caused by staff turnover during the audit period. Effect of Condition and Questioned Costs We determined the Department did not receive adequate supporting documentation before reimbursing subrecipients to ensure that expenditures were for allowable activities, met cost principles, and occurred within the award’s period of performance. As a result, we identified $4,123,486 in known federal questioned costs and $11,511,399 in likely federal questioned costs. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our “best estimate of total questioned costs,” as required by 2 CFR 200.516(a)(3). Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes and that program spending occurs within the allowed period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Improve internal controls to ensure payments to subrecipients are not approved without a review of adequate supporting documentation • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Department acknowledges the payments reported lacked adequate documentation to ensure compliance with federal requirements. In July 2022, the Department began requiring subrecipients to submit supporting backup documentation for all expenditures to the program for review and approval. Due to the temporary nature of the Emergency Rental Assistance (ERA) program, all staff supporting the administration of the program held temporary positions and staff turnover impacted consistency with compliance of federal requirements. As a result, supporting documentation for seven of the randomly selected 48 payments were approved before they were fully reviewed and determined to be properly supported. The Department will obtain the supporting documentation for those transactions to ensure the invoices paid were properly supported and to retail with the corresponding invoices. The Department has used the reported deficiency to improve our internal control processes and has since implemented a new control process requiring staff include a note to the invoicing system recording documentation received supported and reconciled to the submitted invoice before payment is approved. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs. Title 2 CFR Part 200.403, Uniform Guidance, establishes the factors affecting the allowability of costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-018 The Department of Commerce did not have adequate internal controls over and did not comply with reporting requirements for the Emergency Rental Assistance program. Assistance Listing Number and Title: 21.023 COVID-19 Emergency Rental Assistance Program Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Requirements: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022- 017 Background Congress passed two acts authorizing federal funds for the Emergency Rental Assistance (ERA) program to respond to the COVID-19 pandemic. The Consolidated Appropriations Act, 2021, enacted on December 27, 2020, provided $25 billion for ERA. These funds are known as ERA1. The American Rescue Plan Act of 2021, enacted on March 11, 2021, provided $21.6 billion in additional funding for ERA. These funds are known as ERA2. The funds are provided directly to states, U.S. territories, local governments and, in the case of ERA1, Indian tribes, to assist eligible households through existing or newly created rental assistance programs. The Department of Commerce administers the ERA program in Washington. The Department subawarded federal funds to subrecipients to provide financial assistance to households, landlords and utility providers. In fiscal year 2023, the Department spent about $62.5 million in ERA1 and ERA2 funds. During the audit period, the Department allocated program funds to 12 ERA1 subrecipients and 11 ERA2 subrecipients. Grant recipients may use ERA1 and ERA2 funds for administrative expenses, housing stability services, financial assistance, and other affordable rental housing and eviction prevention purposes. The Department is required to submit quarterly ERA Compliance Reports for ERA1 and ERA2, which contain information on the number of participating households that received financial assistance and the amount of ERA funds expended or obligated by the Department to or for participating households. The federal grantor specified there were four key line items on the ERA Compliance Report that contained critical information. 1. Administrative Cost Ratio: Total obligations and/or expenditures for administrative costs does not exceed relevant threshold of total allocation (10 percent across the prime and all subrecipients for ERA1, not to exceed 15 percent for ERA2 across the prime and all subrecipients). 2. Housing Stability Services Ratio: Total obligations and/or expenditures for housing stability services is not greater than 10 percent of total amount allocated. 3. System for Prioritizing Assistance: The number of households with less than 50 percent area median income (AMI) receiving financial assistance is greater than the number of households with greater than 50 percent AMI receiving assistance. 4. Participant Households at Certain Income Levels Eligibility: The total households receiving assistance is not greater than the sum of the AMI-banded eligible households with a 5 percent to 10 percent margin of error to avoid false positives for medium to large recipients. Each ERA subrecipient completes a templated spreadsheet that includes these four line items and submits it monthly to the Department. The Department then sends these spreadsheets to a third-party vendor that aggregates the monthly data for each quarter and performs data validation and diagnostic checks, including deduplication and data cleanup. The Department uses a summary of the vendor’s aggregated data to complete the ERA Compliance Report. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with reporting requirements for the ERA program. The prior finding number was 2022-017. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements for the ERA program. During the audit period, the Department’s program staff said that all subrecipient monthly reports were reviewed and approved by the appropriate personnel before being sent to the third-party vendor for aggregation. However, program staff did not document their review or approval, so we are unable to determine if the proper reviews occurred. Additionally, the Department did not review the vendor’s aggregated data to ensure it was complete and accurate before submitting it to the grantor. We used a non-statistical sampling method to randomly select and examine four out of a total population of seven reports. All four reports we examined had material errors, as summarized below: Report One – ERA1 Q3 2022 • The Department underreported administrative expenses by $2,576,697 (59 percent) and housing stability services by $31,927 (100 percent). Report Two – ERA1 final report • The Department underreported the number of participating households by 9,880 (20 percent). Report Three – ERA2 Q3 2022 • The Department underreported total financial assistance by $1,567,045 (9 percent) because it did not ensure all subrecipients submitted data timely for reporting. Report Four – ERA2 Q1 2023 • The Department could not provide the completed report, so we were unable to identify the amounts reported or determine if they were accurate. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not require management to document their reviews of reports and supporting documentation before submitting them to the grantor. If reviews of the reports were performed, they were inadequate for detecting the identified errors. Further, the Department did not monitor or review the vendor’s aggregated data to ensure it was reliable. The Department also did not maintain copies of these reports after submitting them. The Department tried to download a copy of the fourth report from the reporting website, but some required fields were blank. The Department contacted the grantor for assistance but did not receive a response. Effect of Condition By not reviewing and reconciling aggregated subrecipient data and supporting documentation, management was unable to demonstrate the amounts reported were complete and accurate. In addition, by not retaining completed reports, management was unable to demonstrate the Department reported key line items to the grantor. Without establishing adequate internal controls, the Department cannot reasonably ensure that the required line items reported to the grantor are complete and accurate. Recommendations We recommend the Department: • Ensure it retains copies of completed reports after submitting them to the grantor • Ensure that management performs and documents an adequate review of the supporting documentation before submitting reports to the grantor • Ensure it reviews the aggregated subrecipient data collected from the third-party vendor for completeness and accuracy Department’s Response The Department contracted with a vendor skilled in performing data analytics to aggregate the data required in the monthly and quarterly reports submitted to the Department of Treasury (Treasury). Each Treasury report included data on thousands of households served as well as millions of dollars expended in financial assistance. Department staff reviewed grantee’s data before it was submitted to the vendor and often communicated with grantees to recommend corrections to their data, however, that review process was not explicitly documented. During a review of cumulative data for Emergency Rental Assistance (ERA) 1 and ERA2, an error was made, two numbers were transposed when reporting households served, resulting in underreporting in the ERA1 Final Report. Treasury guided grantees to correct previous report issues on future reports instead of submitting a new report for that quarter, resulting in late or corrected data being updated on a future ERA2 report. The Department was unable to access Treasury reports even though Treasury reports were supposed to be available for download through their reporting portal. However, the download function was often unavailable. When the Department requested the ERA2 Q1 2023 report from Treasury, Treasury was unresponsive, and the Department was unable to obtain and provide the data requested by the State Auditor’s Office (SAO). We thank the SAO for the opportunity to respond to the concerns reported as a result of the audit for ERA reporting. We strive to improve our internal controls and increase our compliance. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Monitoring and reporting program performance, section 329, states in part: (b) Reporting program performance. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. As appropriate and in accordance with above mentioned information collections, the Federal awarding agency must require the recipient to relate financial data and accomplishments to performance goals and objectives of the Federal award. Also, in accordance with above mentioned common information collections, and when required by the terms and conditions of the Federal award, recipients must provide cost information to demonstrate cost effective practices (e.g., through unit cost data). In some instances (e.g., discretionary research awards), this will be limited to the requirement to submit technical performance reports (to be evaluated in accordance with Federal awarding agency policy). Reporting requirements must be clearly articulated such that, where appropriate, performance during the execution of the Federal award has a standard against which non-Federal entity performance can be measured. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. 15 U.S. Code 9058c, Emergency rental assistance, establishes funding and allocation requirements.

2023-019 The Department of Commerce did not have adequate internal controls over reporting requirements for the Emergency Rental Assistance program. Assistance Listing Number and Title: 21.023 COVID-19 Emergency Rental Assistance Program Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Special Tests and Provisions: ERA Funds Reallocation Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-017 Background Congress passed two acts authorizing federal funds for the Emergency Rental Assistance (ERA) program to respond to the COVID-19 pandemic. The Consolidated Appropriations Act, 2021, enacted on December 27, 2020, provided $25 billion for ERA. These funds are known as ERA1. The American Rescue Plan Act of 2021, enacted on March 11, 2021, provided $21.6 billion in additional funding for ERA. These funds are known as ERA2. The funds are provided directly to states, U.S. territories, local governments and, in the case of ERA1, Indian tribes, to assist eligible households through existing or newly created rental assistance programs. The Department of Commerce administers the ERA program in Washington. The Department subawarded federal funds to subrecipients to provide financial assistance to households, landlords and utility providers. In fiscal year 2023, the Department spent about $62.5 million in ERA1 and ERA2 funds. During the audit period, the Department allocated program funds to 13 ERA1 subrecipients and 11 ERA2 subrecipients. Grant recipients may use ERA1 and ERA2 funds for administrative expenses, housing stability services, financial assistance, and other affordable rental housing and eviction prevention purposes. The Department is required to submit quarterly financial reports (SF-425) for ERA1 and ERA2. These reports contain information on award receipts, expenditures by state and federal share, cash on hand, any unobligated balance, and indirect costs for the reporting period. The U.S. Department of the Treasury uses the cumulative obligated and expended amounts in these quarterly reports to make reallocation determinations to ensure ERA funds remain available to grantees in accordance with jurisdictional needs and demonstrated capacity to deliver assistance while the ERA appropriations remain available. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with reporting requirements for the ERA program. The prior finding number was 2022-017. Description of Condition The Department did not have adequate internal controls over reporting requirements for the ERA program. The Department’s procedure requires the Grants and Loan Manager, or their delegate, to review and approve each SF-425 report in the Department’s Contract Management System (CMS) before it is submitted to Treasury. This review process ensures the reports are complete, accurate and reconcile with backup documentation from the agency’s accounting system. We used a non-statistical sampling method to randomly select and examine four out of a total population of seven quarterly financial reports. We found one report (25 percent) that was not reviewed or approved in CMS until 45 days after it was submitted to Treasury. We consider this internal control deficiency to be a material weakness. This issue was reported as a finding in the prior audit. Cause of Condition Department officials said staff turnover and a lack of management oversight resulted in the report being submitted to Treasury without the required approval in CMS. Effect of Condition By not properly reviewing the SF-425 report, the Department risks inaccurate reporting and cannot reasonably ensure that the expenditure and obligation amounts reported to Treasury are complete and accurate. As a result, Treasury may not be able to make accurate reallocation determinations. Recommendations We recommend the Department: • Ensure management review and approve the SF-425 reports before staff submit them to Treasury • Properly train new staff and ensure management oversee the ERA reporting process Department’s Response The Department would like to thank the State Auditor’s Office for their diligence in auditing emergency rental assistance reporting for fiscal year 2023. The Department acknowledges an error was made and one SF-425 approval was not documented in the Contracts Management System prior to submission to the Department of Treasury as required. The Department has made significant improvement in documenting program reviews and approvals in the submission of required reports. The Department initiated a spreadsheet for fiscal analysts, supervisors and/or program managers to document their approval in CMS after review of the SF-425. This will ensure submission approval is made in CMS for all future reports. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. 15 U.S. Code § 9058a – Emergency rental assistance (d) Reallocation of unused funds Beginning on September 30, 2021, the Secretary shall recapture excess funds, as determined by the Secretary, not obligated by a grantee for the purpose described under subsection (c) and the Secretary shall reallocate and repay such amounts to eligible grantees who, at the time of such reallocation, have obligated at least 65 percent of the amount originally allocated and paid to such grantee under subsection (b)(1), only for the allowable uses described under subsection (c). The amount of any such reallocation shall be determined based on demonstrated need within a grantee’s jurisdiction, as determined by the Secretary. Department’s Federal Financial Reporting (FFR) Process PART II – Preparing the FFR 6) In box 13a – 13e enter the information for the individual preparing the FFR. Grants & Loans Manager or delegate must review and sign the FFR prior to submittal.

2023-020 The Department of Commerce did not have adequate internal controls over and did not comply with subrecipient monitoring requirements for the Emergency Rental Assistance program. Assistance Listing Number and Title: 21.023 COVID-19 Emergency Rental Assistance Program Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background Congress passed two acts authorizing federal funds for the Emergency Rental Assistance (ERA) program to respond to the COVID-19 pandemic. The Consolidated Appropriations Act, 2021, enacted on December 27, 2020, provided $25 billion for ERA. These funds are known as ERA1. The American Rescue Plan Act of 2021, enacted on March 11, 2021, provided $21.6 billion in additional funding for ERA. These funds are known as ERA2. The funds are provided directly to states, U.S. territories, local governments and, in the case of ERA1, Indian tribes, to assist eligible households through existing or newly created rental assistance programs. The Department of Commerce administers the ERA program in Washington. The Department subawarded federal funds to subrecipients to provide financial assistance to households, landlords and utility providers. In fiscal year 2023, the Department spent about $62.5 million in ERA1 and ERA2 funds. The Department allocated program funds to 12 subrecipients for ERA1 and 11 subrecipients for ERA2. Federal regulations require the Department to monitor the activities of its subrecipient as necessary to ensure that they use their subawards for authorized purposes, comply with the terms and conditions of their subawards, and achieve performance goals. The Department performed one round of monitoring for each of the ERA1 and ERA2 subrecipients to ensure compliance. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with subrecipient monitoring requirements for the ERA program. During the audit period, the Department had written procedures requiring reviewers to examine client files. However, they were only required to examine five client files for ERA1 and 10 client files for ERA2. We used a non-statistical sampling method to randomly select and examine five out of a total population of 12 subrecipients. For these five subrecipients, we verified that staff reviewed the number of client files that management required for each program. However, there were a total of 30,153 households served for ERA1 and 30,963 households served for ERA2. Thus, the Department reviewed less than one-half of 1 percent of client files for each ERA1 and ERA2 subrecipient. We determined the individual client reviews were sufficient. However, in our judgment, the total number of client files reviewed for each subrecipient was inadequate to reasonably ensure compliance with program requirements. The following table summarizes the percentage of client files reviewed for each subrecipient: We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Department officials said that limited staffing capacity determined how many client files were reviewed. Effect of Condition Subrecipient monitoring procedures are critical for ensuring program compliance and identifying potential misappropriations of public funds. Without establishing adequate internal controls, the Department cannot reasonably ensure that its subrecipients are using federal funds for allowable purposes. Additionally, without adequately monitoring each subrecipient’s uses of federal funds, the Department does not have reasonable assurance that the subrecipient has complied with the terms and conditions of the subaward. Recommendation We recommend the Department modify its written procedures to require an adequate number of subrecipient client files to be reviewed during program monitoring to provide reasonable assurance that each subrecipient is compliant with program requirements. Department’s Response The Emergency Rental Assistance (ERA) program monitoring commenced in fiscal year 2022 and continued in fiscal year 2023. The program established a process to monitor five to ten client files, which included randomly selected fiscal back up documentation from an invoice for each subrecipient. This process is included in the ERA monitoring procedure. On average it has taken three months to collect the required monitoring documentation from grantees due to the complicated nature of the program and administrative burden subrecipients faced in administering the award. The program has an average of three project staff to perform all monitoring duties which has resulted in program monitoring taking longer than anticipated. The program opted to focus on being able to do a smaller monitoring for every subrecipient instead of completing a larger monitoring for only a few subrecipients. This process allowed the Department to successfully complete a program monitoring for all ERA subrecipients. We understand that the sample size we are able to monitor is not sufficient given the size of the ERA program. SAO has not provided explicit guidance as to what an appropriate ratio of client files would be compared to the amount of households served and financial assistance expended. The program and the Department strive to improve subrecipient monitoring to address the appropriate level of risk for each recipient of federal funds. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.

2023-021 The Department of Commerce did not have adequate internal controls over federal requirements to ensure subawards for the Emergency Rental Assistance program contained the correct federal award identification elements. Assistance Listing Number and Title: 21.023 COVID-19 Emergency Rental Assistance Program Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background Congress passed two acts authorizing federal funds for the Emergency Rental Assistance (ERA) program to respond to the COVID-19 pandemic. The Consolidated Appropriations Act, 2021, enacted on December 27, 2020, provided $25 billion for ERA. These funds are known as ERA1. The American Rescue Plan Act of 2021, enacted on March 11, 2021, provided $21.6 billion in additional funding for ERA. These funds are known as ERA2. The funds are provided directly to states, U.S. territories, local governments and, in the case of ERA1, Indian tribes, to assist eligible households through existing or newly created rental assistance programs. The Department of Commerce administers the ERA program in Washington. During the audit period, The Department subawarded federal funds to subrecipients to provide financial assistance to households, landlords and utility providers. In fiscal year 2023, the Department spent about $62.5 million in ERA1 and ERA2 funds. The Department allocated program funds to 12 subrecipients for ERA1 and 11 subrecipients for ERA2. Federal regulations require pass-through entities to ensure that every subaward is clearly identified as a subaward to a subrecipient, and that it includes the 14 federal award identification elements. These elements include the subrecipient’s unique entity identifier, the Federal Award Identification Number, the name of the federal awarding agency, the program’s Assistance Listing Number and title, and more. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over federal requirements to ensure ERA subawards contained the correct federal award identification elements. During the audit period, the Department executed one ERA subaward for more than $4 million. We examined the subaward and found it contained the 14 required elements. However, we found it was not clearly identified as a federal subaward, and the subrecipient was referred to as a contractor throughout the award. We consider this internal control deficiency to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department could not provide documentation to show it had an adequate internal control in place to ensure that the subaward included all the correct information. Furthermore, the subrecipient was referred to as a contractor throughout the award because the Department used a contract template; it did not have a subaward template available at that time. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure it has communicated all required data elements to the subrecipient. Furthermore, by not clearly identifying the subaward as such, the Department cannot ensure the subrecipient has been adequately informed of the program requirements, federal regulations, and the subaward’s terms and conditions. Recommendations We recommend the Department establish adequate internal controls to ensure it includes all required information in every federal subaward. This must include ensuring that the award is clearly identified as a subaward and not a contract. Department’s Response The Department agrees with the Washington State Auditor’s Office (SAO) that our contract template refers to the subrecipient in the contract as a “contractor”. That terminology was used to identify the recipient as part of the contract, not the type of federal recipient. We identified the need to specify the federal recipient type in the contract in 2022 and in October 2022 we changed the face sheets of all of our federal contract templates to identify each recipient as a subrecipient or contractor. Unfortunately, there was a timing issue with the issuance of the contract included in the audit and the prior federal template was used. The Department treated the recipient as a subrecipient and followed all of the Code of Federal Regulations (CFR) requirements. We communicated the Requirements for Pass Through Entities to the recipient which is only communicated to subrecipients per the CFR. Going forward, all program contracts will be issued on the updated federal contract templates which will designate the recipient type as either a subrecipient or contractor. Short of an error being made, the Department feels this exception has been resolved. We appreciate the opportunity to respond to this error. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes requirements for all pass-through entities.

2023-022 The Housing Finance Commission did not have adequate internal controls over eligibility requirements for the Homeowner Assistance Fund program. Assistance Listing Number and Title: 21.026 COVID-19 Homeowner Assistance Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The American Rescue Plan Act of 2021 provided $9.96 billion to the Homeowner Assistance Fund (HAF) program. The U.S. Department of the Treasury provides funds directly to states, U.S. territories, and Indian tribes to assist eligible homeowners experiencing financial hardship due to the COVID-19 pandemic. Program funds can be used to prevent mortgage delinquencies and defaults, foreclosures, loss of utilities or home energy services, and homeowner displacement. The law prioritizes funds for homeowners who have experienced hardships, leveraging local and national income indicators to maximize the program’s impact. The Housing Finance Commission administers the HAF program in Washington. In fiscal year 2023, the Commission spent about $34.7 million in HAF funds. The Commission is required to ensure all homeowners who receive HAF funds are eligible for the program. The HAF Plan Term Sheet, approved by the federal grantor, outlines the general eligibility requirements for the program. The Commission entered into an agreement with a contractor to perform eligibility determinations for the program. As part of the agreement, the contractor reviews eligibility determinations for 10 percent of applications that were approved, denied and withdrawn each quarter. The contractor provides these results to the Commission. To ensure the contractor made the correct determinations, Commission staff reviews 10 percent of the eligibility determinations that the contractor reviewed. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Commission did not have adequate internal controls over eligibility requirements for the HAF program. During the audit period, the Commission only reviewed 1 percent of all approved, denied and withdrawn applications. The determinations that staff reviewed were only taken from those that the contractor selected, so the Commission had no assurance that the 90 percent of the determinations the contractor did not select were made properly. Because the Commission did not perform any additional independent reviews, we determined the Commission did not perform an adequate level of review to ensure proper eligibility determinations were made for the program as a whole. We consider this internal control deficiency to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Management believed the level of review performed by Commission staff was adequate to ensure proper eligibility determination for all HAF applicants. Effect of Condition Without establishing adequate internal controls, the Commission is at a higher risk of paying ineligible homeowners. In addition, by only reviewing cases that the contractor selected, there is a risk that the eligibility determinations that Commission staff reviewed were not representative of the program as a whole. Recommendations We recommend the Commission: • Improve internal controls to ensure it only provides HAF funds to eligible homeowners • Ensure that Commission staff perform and document an adequate review of approved, denied and withdrawn HAF applications that are independent of those reviewed by the contractor Commission’s Response The Commission concurs with this finding. The Commission will strengthen its controls and increase its level of reviews, including a selection of applications independent of those verified by the contractor to ensure a more representative population. Auditor’s Remarks We thank the Commission for its cooperation and assistance throughout the audit. We will review the status of the Commission's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The U.S. Department of the Treasury’s Homeowner Assistance Fund: Guidance on Participant Compliance and Reporting Responsibilities, states, in part: Eligibility. Under this program, HAF participants are responsible for ensuring funds are used for eligible purposes. Generally, HAF participants must develop and implement policies and procedures, and record retention, to determine and monitor implementation of criteria for determining the eligibility of beneficiaries and / or Subrecipients. HAF participants, and if applicable, the Subrecipient(s) administering a program on behalf of the HAF participant, will need to maintain procedures for obtaining information evidencing a given beneficiary, Subrecipient, or contractor’s eligibility, including a valid SAM.gov registration. Implementing risk-based due diligence for eligibility determinations is a best practice to augment your organization’s existing controls.

2023-023 The Housing Finance Commission did not have adequate internal controls over earmarking requirements for the Homeowner Assistance Fund program. Assistance Listing Number and Title: 21.026 COVID-19 Homeowner Assistance Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Earmarking Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The American Rescue Plan Act of 2021 provided $9.96 billion to the Homeowner Assistance Fund (HAF) program. The U.S. Department of the Treasury provides funds directly to states, U.S. territories, and Indian tribes to assist eligible homeowners experiencing financial hardship due to the COVID-19 pandemic. Program funds can be used to prevent mortgage delinquencies and defaults, foreclosures, loss of utilities or home energy services, and homeowner displacement. The law prioritizes funds for homeowners who have experienced hardships, leveraging local and national income indicators to maximize the program’s impact. The Housing Finance Commission administers the HAF program in Washington. In fiscal year 2023, the Commission spent about $34.7 million in HAF funds. The Commission must meet earmarking requirements for the following four categories: 1. Counseling or educational efforts by housing counseling agencies approved by the U.S. Department of Housing and Urban Development (HUD), tribal government (including such efforts by in-house housing counselors who are HUD certified or tribally approved), or legal services, targeted to households eligible to be served with funding from the HAF related to foreclosure prevention or displacement, in an aggregate amount up to 5 percent of the funding from the HAF received by the HAF participant. 2. Planning, community engagement, needs assessment, and administrative expenses related to the HAF participant’s disbursement of HAF funds for qualified expenses, in an aggregate amount not to exceed 15 percent of the funding from the HAF received by the HAF participant. 3. Participants are providing not less than 60 percent of funds to homeowners with income less than 100 percent of area median income (AMI) or 100 percent of U.S. median income. 4. Participants target homeowners who are classified as socially disadvantaged individuals (SDIs) and 100 percent AMI or less. The Commission is required to meet the requirements of the first, second and third earmarks when the HAF funds are fully expended. When administering the program, the Commission is required to have processes in place to track these requirements to ensure it is compliant at the end of the award. The HAF Plan, approved by the federal grantor, outlines the program design and the budget allocation for the earmarking categories. These amounts are based on the award being fully expended. For the first two earmarking requirements, the Commission used these budgets to contract for necessary services. Commission staff then maintained a tracking spreadsheet to ensure payments did not exceed the contracted amount. For the third earmark requirement, the Commission allocated 77 percent of the HAF award to homeowners, and it required all homeowners to have an income less than 100 percent AMI. For the fourth earmark requirement, the Commission contracted with a contractor to perform outreach targeting SDIs and those that are less than 100 percent AMI. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Commission did not have adequate internal controls over earmarking requirements for the HAF program. During the audit period, the Commission tracked contractor payments applicable to the first and second earmarking requirements. However, expenditures were tracked in relation to the amounts budgeted in the HAF Plan. The Commission did not review these expenditures in relation to overall program expenditures to ensure they were on track to be compliant with the established earmarks. For the third earmarking requirement, the Commission relied on eligibility determinations made by a contractor to ensure all homeowners in the HAF program have income less than 100 percent AMI. We determined the Commission did not have an adequate process to ensure all applicants met eligibility requirements. This condition is reported as a material weakness in internal controls in audit finding 2023-022. Our audit did not identify issues with the fourth earmarking requirement. We consider this internal control deficiency to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition While Commission staff tracked payments made to contractors allocated in the HAF Plan, management did not implement procedures to track these amounts to the total program expenditures to be able to ensure compliance. In addition, management believed the level of eligibility determination review performed by Commission staff was adequate to ensure proper eligibility determination for all HAF applicants. Effect of Condition Without adequate internal controls, the Commission is at risk of not meeting the earmarking requirements when the award closes if budget allocations change or the award is not fully expended. Recommendations We recommend the Commission: • Establish effective internal controls to ensure that it tracks and meets the earmarking requirements • Improve internal controls to ensure eligibility determinations are made properly Commission’s Response The Commission concurs with this finding. The Commission will develop a system to track and meet earmarking requirements relative to expenditure levels. Additionally, the Commission will strengthen its controls and increase its level of reviews, including a selection of applications independent of those verified by the contractor to ensure a more representative population. Auditor’s Remarks We thank the Commission for its cooperation and assistance throughout the audit. We will review the status of the Commission's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The U.S. Department of the Treasury’s Homeowner Assistance Fund Guidance, states, in part: Qualified Expenses: Counseling or educational efforts by housing counseling agencies approved by HUD or a tribal government (including such efforts by in-house housing counselors who are HUD certified or Tribally approved), or legal services, targeted to households eligible to be served with funding from the HAF related to foreclosure prevention or displacement, in an aggregate amount up to 5% of the funding from the HAF received by the HAF participant. Planning, community engagement, needs assessment, and administrative expenses related to the HAF participant’s disbursement of HAF funds for qualified expenses, in an aggregate amount not to exceed 15% of the funding from the HAF received by the HAF participant.

2023-024 The Housing Finance Commission did not have adequate internal controls over and did not comply with reporting requirements for the Homeowner Assistance Fund program. Assistance Listing Number and Title: 21.026 COVID-19 Homeowner Assistance Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The American Rescue Plan Act of 2021 provided $9.96 billion to the Homeowner Assistance Fund (HAF) program. The U.S. Department of the Treasury provides funds directly to states, U.S. territories, and Indian tribes to assist eligible homeowners experiencing financial hardship due to the COVID-19 pandemic. Program funds can be used to prevent mortgage delinquencies and defaults, foreclosures, loss of utilities or home energy services, and homeowner displacement. The law prioritizes funds for homeowners who have experienced hardships, leveraging local and national income indicators to maximize the program’s impact. The Housing Finance Commission administers the HAF program in Washington. In fiscal year 2023, the Commission spent about $34.7 million in HAF funds. The Commission is required to submit quarterly HAF financial reports that have information on the cumulative obligations and expenditures to date. These reports are due 45 days after the end of each quarter. The federal grantor specified there were two key lines items on the report that contained critical information: 1. Administrative Expenses – Quantifiable Objective Criteria: Obligations and expenditures do not exceed 15 percent for admin expenses. 2. Services, Counseling & Education – Quantifiable Objective Criteria: Obligations and expenditures do not exceed 5 percent for legal services, counseling and education. The HAF Plan, approved by the federal grantor, outlines the budget allocation of administrative, services, counseling and education expenditures. The Commission uses these budgets to contract required services. Commission staff maintain a tracking spreadsheet for HAF obligations and payments made to contractors. Staff use data from this spreadsheet to fill out the quarterly reporting template. Once completed, the Commission submits the report in the HAF reporting portal. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Commission did not have adequate internal controls over and did not comply with reporting requirements for the HAF program. The spreadsheets used to track obligation and expenditure data to prepare reports were not accurate and complete. We determined staff were reporting expenditures that had not been paid in the expenditure category instead of as obligations. We also determined staff made errors when recording the obligation amounts. These errors included not properly realizing all of the expenditures in the accounting system, not realizing all administrative obligations and including obligations that were not supported. We used a non-statistical sampling method to randomly select and examine four out of a total population of seven quarterly reports. All four reports (100 percent) that we examined had errors, as summarized in the table below. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition These reports are mainly comprised of financial information that is recorded in the Commission’s accounting system. Commission officials said there was a lack of coordination between program and finance staff in compiling these reports to ensure the correct data was used. Furthermore, the Commission did not require management to review the reports and their supporting documentation before submitting them to the grantor. Effect of Condition Without establishing adequate internal controls, which should include reviewing the reports and the supporting documentation to ensure the correct source data is reported, management cannot ensure that the reports are complete and accurate. Recommendations We recommend the Commission: • Establish effective internal controls to ensure the reports are accurate and complete • Ensure that management performs and documents an adequate review of the supporting documentation before submitting reports to the grantor • Consult with the federal grantor to determine if revision and resubmission of the reports are necessary to correct amounts reported Commission’s Response The Commission concurs with this finding. The Commission will implement a system of controls and management review to ensure that data reported to the federal grantor is complete and accurate. In addition, the Commission will confirm with the grantor to determine if revision is necessary. Auditor’s Remarks We thank the Commission for its cooperation and assistance throughout the audit. We will review the status of the Commission's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 328, Financial reporting, states: Unless otherwise approved by OMB, the Federal awarding agency must solicit only the OMB-approved governmentwide data elements for collection of financial information (at time of publication the Federal Financial Report or such future, OMB-approved, governmentwide data elements available from the OMB-designated standards lead. This information must be collected with the frequency required by the terms and conditions of the Federal award, but no less frequently than annually nor more frequently than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes, and preferably in coordination with performance reporting. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The U.S. Department of Treasury’s Homeowner Assistance Fund: Guidance on Participant Compliance and Reporting Responsibilities, states, in part: Programmatic Information Requirements The following programmatic information will be required in Quarterly Reports. f. Program(s) Information- HAF participants will provide information on all HAF programs. Programs are new or existing eligible government services or investments funded in whole or in part by HAF funding. For each program, the HAF participant will be required to enter the following information: • Total Obligations Cumulative to Calendar Quarter end date; • Total Expenditures Cumulative to Calendar Quarter end date; g. Expenditures- HAF participants are required to report the HAF assistance expended or spent by the HAF participant. HAF participants will be asked to report expenditures on a cumulative basis at the following levels: the participant-level, program-level, and program design element-level. At the participant-level, HAF participants will be asked to disaggregate expenditures or amounts expended by the categories noted under the Disaggregated Information requirement below. • The information provided in this section will relate to the HAF Grantee Plan Budget Expenditures broken out by Program Design Element. h. Obligations- HAF participants are required to report the HAF assistance obligated. HAF participants will be asked to report obligations on a cumulative basis at the participant-level, program-level, and program design element-level. HAF participants will be asked to disaggregate participant-level obligations by the categories noted under the Disaggregated Information requirement below.20 The information provided in this section will relate to the HAF Grantee Plan Budget Obligations broken out by Program Design Element.

2023-025 The Housing Finance Commission did not have adequate internal controls over and did not comply with reporting requirements for the Homeowner Assistance Fund program. Assistance Listing Number and Title: 21.026 COVID-19 Homeowner Assistance Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The American Rescue Plan Act of 2021 provided $9.96 billion to the Homeowner Assistance Fund (HAF) program. The U.S. Department of the Treasury provides funds directly to states, U.S. territories, and Indian tribes to assist eligible homeowners experiencing financial hardship due to the COVID-19 pandemic. Program funds can be used to prevent mortgage delinquencies and defaults, foreclosures, loss of utilities or home energy services, and homeowner displacement. The law prioritizes funds for homeowners who have experienced hardships, leveraging local and national income indicators to maximize the program’s impact. The Housing Finance Commission administers the HAF program in Washington. In fiscal year 2023, the Commission spent about $34.7 million in HAF funds. The Commission implemented a pilot program before launching the main HAF program. The Commission contracted with a contractor to help implement the main HAF program and maintain participant data. The Commission is required to submit an annual performance report that provides an overview of its intended and actual uses of funding to-date for the pilot and main HAF programs. The federal grantor identified two key lines items on the report that contained critical information: 1. Socially Disadvantaged Individuals (SDIs) – Quantifiable Objective Criteria: Participants are providing not less than 60 percent of funds to homeowners with income less than 100 percent area median income (AMI) or 100 percent of U.S. median income. 2. AMI – Quantifiable Objective Criteria: Participants target homeowners that are classified as SDI and 100 percent AMI or less. The HAF Plan, approved by the federal grantor, outlines the budget allocations, goals, and types of assistance for the Washington HAF program. The HAF reporting portal automatically populates each section of the annual report template with information from this plan. The Commission is required to submit a narrative on the status of each section. Commission staff use participant data provided by the contractor to complete the report template. Once completed, Commission management review the report, and then the preparer submits it in the HAF reporting portal. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Commission did not have adequate internal controls over and did not comply with reporting requirements for the HAF program. The contractor only provided summary-level data to the Commission at the time of reporting. As a result, Commission staff did not have detailed supporting documentation to review to verify that the total amounts in the contractor’s reports were complete and accurate. Additionally, the Commission did not have documented evidence to support that management reviewed the annual report prior to submission. We reviewed the report submitted on November 9, 2022, that covered the start of the award through September 30, 2022. The report identified 58 SDIs, and we determined the total is actually 87 SDIs (33 percent underreported) for the pilot and main programs combined. We found the Commission did not report SDIs that were identified as “other” in the pilot program. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Commission did not require the contractor to submit detailed support for the total numbers provided for reporting to ensure all categories were included. In addition, the Commission did not ensure adequate management review of the report prior to submission. Effect of Condition Without establishing adequate internal controls, which should include reviewing the reports and the detailed supporting documentation to ensure the correct data is reported, management cannot ensure that the reports are complete and accurate. Recommendations We recommend the Commission: • Establish effective internal controls to ensure the reports are accurate and complete • Ensure that management performs and documents an adequate review of the supporting documentation before submitting reports to the grantor • Consult with the federal grantor to determine if revision and resubmission of the reports are necessary to correct amounts reported Commission’s Response The Commission concurs with this finding. The Commission will implement a system of controls and management review to ensure that data reported to the federal grantor is complete and accurate. In addition, the Commission will confirm with the grantor to determine if revision is necessary. Auditor’s Remarks We thank the Commission for its cooperation and assistance throughout the audit. We will review the status of the Commission's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 328, Financial reporting, states: Unless otherwise approved by OMB, the Federal awarding agency must solicit only the OMB-approved governmentwide data elements for collection of financial information (at time of publication the Federal Financial Report or such future, OMB-approved, governmentwide data elements available from the OMB-designated standards lead. This information must be collected with the frequency required by the terms and conditions of the Federal award, but no less frequently than annually nor more frequently than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes, and preferably in coordination with performance reporting. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The U.S. Department of the Treasury’s Homeowner Assistance Fund: Guidance on Participant Compliance and Reporting Responsibilities, states, in part: Programmatic Information Requirements HAF participants are required to submit an Annual Performance Report on an annual basis and demonstrate the impact of the HAF-financed programs. Reports should include data related to program outputs and outcomes against the stated objectives of the HAF participant’s HAF Grant Plan. Performance Goals HAF participants initially submitted performance goals on the use of HAF awarded funds in their approved Grantee Plan. Each one of the performance goals should have identified how the HAF participant will address homeowner needs and should have been disaggregated by key characteristics such as mortgage type, racial and ethnic demographics, and/or geographic areas, as appropriate. HAF participants will be required to provide a status update and quantitative measures, if applicable, on each of their initial performance goals set forth in their Grantee Plan. Please note, HAF participants will not have the ability to alter their original performance goals noted in their Grantee Plan nor add additional performance goals in the Annual Report. Methods for Targeting and HAF Funding HAF participants were asked in their original Grantee Plan to describe how the HAF participant will effectively target HAF award funds to (1) homeowners with incomes equal to or less than 100% of the area median income or equal to or less than 100% of the median income for the United States, whichever is greater; and (2) socially disadvantaged individuals. The description included the HAF participant’s targeting strategies. HAF participants will be required to provide an update on their targeting methods and if they have appropriately executed targeting methods according to their original Grantee Plan.

2023-026 The Office of Financial Management did not have adequate internal controls over and did not comply with requirements to ensure Coronavirus State and Local Fiscal Recovery Funds were used for only allowable activities. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: $300,000,000 Prior Year Audit Finding: Yes, Finding 2022-018 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF) provides direct payments to states to respond to the COVID-19 pandemic and its negative economic effects. Washington has received about $4.4 billion of SLFRF funds from the U.S. Department of the Treasury (Department). Federal law stipulate that states may use SLFRF funds to: • Support public health expenditures, including COVID-19 prevention and mitigation efforts • Address negative economic impacts caused by the public health emergency • Replace lost public sector revenue • Provide premium pay for essential workers • Invest in water, sewer, and broadband infrastructure States may only use funds to cover costs incurred during the period of performance, which began on March 3, 2021, and ends on December 31, 2024. Under the Department’s final rule, SLFRF recipients could use funds to replace lost public sector revenue to provide government services. Recipients could elect a one-time standard allowance of $10 million to spend on the provision of government services during the grant’s period of performance. Alternatively, SLFRF recipients could calculate lost revenue based on a formula established by the Department to determine the amount of SLFRF funds that can be used for the provision of government services. Washington chose to calculate its lost revenue rather than use the standard allowance. The calculated amount of revenue loss determines the limit of SLFRF funds that recipients can use to provide government services. For reporting purposes on the Schedule of Expenditures of Federal Awards (SEFA), the aggregate expenditures for all eligible use categories must be reported, not the result of the revenue loss calculations or the standard allowance. Washington received $2.2 billion of its total $4.4 billion SLFRF allocation in May 2022. When received, the funds were accounted for in the state’s Coronavirus State Fiscal Recovery Fund (Fund 706). Washington State Substitute Senate Bill 5165, section 408, included distributions totaling $600 million from Fund 706 to various state transportation-related accounts. According to the Office of Financial Management, these distributions compensated for revenue loss in state fiscal years 2020 and 2021 relative to revenues collected in state fiscal year 2019, and they were to be used to maintain government services. The Office attributed $300 million of this as SLFRF expenditures for transportation-related accounts on the state’s fiscal year 2023 SEFA. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Office did not have adequate internal controls over and did not comply with requirements to ensure SLFRF funds were used for only allowable activities. The prior finding number was 2022-018. Description of Condition The Office did not have adequate internal controls over and did not comply with requirements to ensure SLFRF funds were used for only allowable activities. While recipients are allowed to use SLFRF funds to replace lost public sector revenues, the state was required to identify actual expenditures that were provided for government services. At the time of audit, the state had not identified such expenditures. Rather, the state asserted that all expenditures in the transportation accounts receiving the SLFRF funds were appropriated for government services, so there was no doubt as to the allowability of the use of funds. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition Office management does not agree that federal requirements and the Department’s final rule required the state to separately identify actual expenditures that equal the amount of SLFRF expenditures claimed. It is the Office’s position that all expenditures in the transportation-related accounts were for government services, so the state had sufficient expenditures to meet the grant requirement. During the last audit, the Office contacted the Department for guidance on the matter. The Department has maintained a FAQ document for the SLFRF program, and the answer to question 13.15, states in part, “recipients should not deviate from their established practices and policies regarding the incurrence of cost, and that they should expend and account for the funds in accordance with laws and procedures for expending and accounting for the recipient’s own funds.” A Department representative acknowledged this FAQ guidance, and said the Department does not have additional, specific requirements about how recipients should internally track their use of SLFRF funds for revenue replacement. At the time of this audit, the Office had not received the Department’s management decision regarding the prior audit finding. Effect of Condition and Questioned Costs Without a population of actual expenditures to audit, we could not design tests to verify that the costs the Office charged to the grant were only for allowable activities, met cost principles, and were incurred during the grant’s period of performance. In our judgment, without identifying the specific expenditures charged to the SLFRF program, the Office did not comply with federal requirements. Therefore, we are questioning the $300 million in costs that were not supported by specifically identified expenditures for government services. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its federal expenditures. Recommendations We recommend the Office: • Identify the actual government service expenditures that are the basis for the $300 million in SLFRF expenditures recorded on the state’s fiscal year 2023 SEFA • Review the supporting documentation for the expenditures to ensure they meet compliance requirements for the SLFRF program and are adequately documented, while also documenting the details of this review • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Office’s Response The Office does not concur with the audit finding. The state of Washington implemented internal controls and created Fund 706 to track the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) expenditures. Following U.S. Department of Treasury guidance and instructions, the state of Washington determined there was approximately $3 billion in revenue loss. The state, through legislation, approved the transfer of $300 million from the SLFRF account to various state transportation accounts under the revenue loss provision. Each transportation account that received SLFRF funds was established in statute and is for a specific “government service” purpose. Therefore, all payments from those accounts would be considered an actual government service expenditure. The U.S. Treasury FAQ 3.2 states that “Government services generally include any service traditionally provided by a government, unless Treasury has stated otherwise.” We reaffirm that all expenditures from the transportation accounts that received the SLFRF funds were used to maintain government services. The State Administrative and Accounting Manual requires all state agencies to establish internal controls over payments for goods and services, including ensuring payments are lawful and for proper purposes, reviewing payments to ensure they are supported, as well as documenting the review of all payments. State agencies continued to follow their established internal controls to ensure expenditures from the transportation accounts were proper and allowable. Additionally, the Office followed consistent policies and practices regarding the incurrence of costs in the transportation accounts for both non-SLFRF and SLFRF funds, which complied with federal guidance. The Office disagrees that the total amount of lost revenue transferred to the transportation accounts should be considered questioned costs because the auditors were unable to design tests for compliance. Questioned costs, if any, could have been identified through appropriate and relevant audit procedures. The Office continues to work with U.S. Treasury, through the Management Decision process, to ensure no questioned costs are required to be repaid. Auditor’s Remarks We believe that the federal requirement is that SLFRF recipients must separately identify actual expenditures that equal the amount of SLFRF expenditures stated on the Schedule of Expenditures of Federal Awards. This is consistent with the State’s practice for recording expenditures for all other federal programs. Because the Office did not identify specific expenditures for the SLFRF program in the accounting system, we were unable to test SLFRF expenditures from the State’s transportation accounts. The expenditures for the State coded to the Office’s SLFRF account (706) did not include the distributions mentioned by the Office in its response, above, and therefore there was no expenditure activity for our Office to test for compliance. We reaffirm our finding and will follow-up on the Office’s corrective action during the next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 302, Financial management, states in part: The financial management system of each non-Federal entity must provide for the following (see also 200.334, 200.335, 200.336, and 200.337) 1. Identification, in its accounts, of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, federal award identification number and year, name of the Federal agency, and name of the pass-through entity, if any. 2. Records that identify adequately the source of the application of funds for federally funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation Title 2 CFR Part 200, Uniform Guidance, section 410, Collection of unallowable costs, establishes requirements for the collection of unallowable costs. Title 2 CFR Part 200, Uniform Guidance, section 403, establishes the factors affecting the allowability of costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-027 The Department of Commerce did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported, and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Subrecipient Monitoring Known Questioned Cost Amount: $95,560 Prior Year Audit Finding: Yes, Finding 2022-019 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2023, state agencies spent about $1.9 billion in SLFRF funds, more than $718 million of which was spent by the Department of Commerce. The Department used SLFRF funds to administer and provide economic assistance to households at risk of eviction and homelessness primarily through the Eviction Rental Assistance Program (ERAP 2.0) and Treasury Rent Assistance Program (TRAP 2.0), in addition to transportation, tourism and other pandemic-recovery projects. During fiscal year 2023, the Department expended about $253.5 million on reimbursements and advance payments to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for making direct payments of rent and utilities for eligible low-income households with overdue rent payments dating as far back as March 2020. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with federal requirements for monitoring subrecipients to ensure payments were allowable, properly supported and within the period of performance. The prior finding number was 2022-019. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to monitor subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF program. During the audit period, the Department only required summary level supporting documentation when approving subrecipient payments. Since detailed source documentation was not required at the time of reimbursement, the Department implemented a fiscal review process for ERAP and TRAP 2.0 subrecipients. We used a statistical sampling method to randomly select and review 56 out of 554 payments. Of the payments examined, we identified nine (16 percent) payments that were not allowable under terms and conditions of the subaward. Specifically: 1. Seven payments (13 percent) were for advances to the subrecipient, which are specifically prohibited under the terms and conditions of the Department’s subaward 2. Four payments (7 percent), including one of the payments mentioned above, did not have adequate documentation to ensure the payment was for an allowable activity under the subaward, met cost principles and occurred within the award’s period of performance. The Department’s invoice review procedure required the Department to verify that each subrecipient submitted, along with its invoice, a voucher detail worksheet that outlines expenses by budget category, and a general ledger report detailing the expenses incurred by the subrecipient during the invoice period. For four of the nine payments referenced above, we found the Department approved them for payment without receiving a general ledger report from the subrecipient detailing all incurred expenses. In one of these instances, we also found the Department advanced program funds to the subrecipient without reviewing supporting documentation from the subrecipient to demonstrate that all expenditures were incurred to support the amount advanced by the Department. We were not provided with any documentation demonstrating these funds were returned to the Department. We also used a non-statistical sampling method to randomly select and examine nine out of 35 subrecipients for which the Department completed monitoring during the audit period. We determined five of the nine fiscal reviews completed (56 percent) were insufficient to ensure payments to the subrecipients were allowable and adequately supported. We came to this conclusion because the support we were provided lacked enough details to ensure the activities were allowable and within the period of performance. In addition, the Department did not have evidence that it obtained supporting documentation for client files from one of the nine subrecipients we examined. We also examined program monitoring documentation completed for the same nine subrecipients. The Department only selected five households from each subrecipient for eligibility verification. There was a total of 53,699 households served for ERAP 2.0, and an additional 8,373 households served for TRAP 2.0. Therefore, the Department reviewed less than one-half of one percent of client files for each subrecipient. For these nine subrecipients, we verified that staff reviewed the number of client files that management required under the program. However, in our judgment, the total number of client files reviewed for each subrecipient was inadequate to reasonably ensure compliance with program requirements. The following table summarizes the percentage of client files the Department reviewed for each subrecipient during the audit period: We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management did not ensure that proper internal controls were in place to oversee ERAP 2.0 and the use of SLFRF funds. The Department approved payments to subrecipients without reviewing adequate supporting documentation, and management relied on annual program and fiscal monitoring to ensure subrecipients had proper supporting documentation and only served eligible households. In addition, it issued advance payments to subrecipients despite the subawards explicitly stating this was not allowable. Management did not ensure program and fiscal monitoring conducted included a sufficient sample of subrecipient records, and required detailed source documentation, to provide reasonable assurance of material compliance with federal SLFRF requirements and the terms and conditions of the subawards. Effect of Condition and Questioned Costs We determined the Department did not request and review adequate supporting documentation before paying subrecipients, and it did not perform adequate fiscal monitoring to ensure that funds advanced to subrecipients were disbursed to eligible households and for allowable activities. As a result, we identified $95,560 in known federal questioned costs and $1,482,489 in likely federal questioned costs. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our “best estimate of total questioned costs,” as required by 2 CFR § 200.516(3). To ensure a representative sample, we stratified the population by dollar amount. Without establishing adequate internal controls and reviewing required supporting documentation from subrecipients, the Department cannot reasonably ensure it is using federal funds for allowable purposes and that spending occurs within the allowed period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Update its written procedures to require an adequate number of subrecipient client files to be reviewed during fiscal and program monitoring to provide reasonable assurance that each subrecipient is compliant with program requirements • Improve internal controls to ensure subrecipients provide adequate supporting documentation when requesting reimbursement • Request and review supporting documentation from all participating subrecipients on households served with SLFRF funds to determine if any amounts reimbursed to the subrecipients must be returned to the Department • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The State and Local Fiscal Recovery Funds were provided to the state as an advanced payment by which the Department used them to address the immense rent assistance needs as a result of the COVID-19 pandemic. Commerce funded subrecipients up to 25% of their contract total in an effort to mitigate cash flow issues to allow the swift distribution of funding. The Department utilized this method as obtaining documentation and processing reimbursements on a weekly basis still could not provide sufficient funding for all of the rent assistance needs. The Department now acknowledges the advanced payments were not authorized per federal guidance, however, all housing expenses were verified through thorough review of subrecipient expenditure supporting documentation. The Department completed fiscal and program monitoring of each subrecipient over the contract period, however, neither the Code of Federal Regulations nor the Washington State Auditor’s Office has been able to provide the Department with the number of client files that would need to be reviewed to be considered adequate. The Department created a procedure to review a minimum of five client files per subrecipient and followed this procedure. The Department understands that given the urgent need for assistance and the enormous amount of rent assistance funding distributed, thousands of client files would had to have been reviewed in a short period of time and we could not build and sustain the necessary staff capacity to match the fast-paced program delivery. The Department did increase internal controls related to program monitoring to more accurately comply with federal requirements as a result of the prior audit results. In July 2022, the Department began to review supporting backup documentation for all expenditures. The Department did not yet understand that transaction level detail was required and its review included a higher level of detail. Since the process was newly implemented in fiscal year 2023, it took some time to work out compliance challenges and provide technical assistance to subrecipients in order to comply with the federal requirements. The Department’s expenditure backup documentation review process began including transaction level detail in fiscal year 2023 as a result of the prior audit results. Any repayment of questioned costs will be determined through the standard resolution process with the United States Department of Treasury. Auditor’s Remarks Federal regulations require pass-through entities to monitor the activities of subrecipients as necessary to ensure that subawards are used for authorized purposes and in compliance with federal requirements and the terms and conditions of the subaward. In our judgement, the Department’s design of monitoring subrecipients for fiscal and program compliance did not provide this level of assurance. Specifically, the Department’s decision to review only five client files per subrecipient did not provide reasonable assurance of each subrecipient’s compliance when the average subrecipient served 1,413 clients, as illustrated in the Description of Condition. Based on this evidence, the Department only reviewed a total of 230 client files during the audit period, which makes up less than 0.4 percent of the total number of clients served. In addition, the Department’s decision to not review transaction-level supporting documentation at the time of issuing payment to subrecipients means that the monitoring of subrecipients was also being relied upon to ensure all payments made to subrecipients were only for allowable activities under the subaward. In our judgment, the procedures in place requiring only five client files be reviewed for each subrecipient were not sufficient to provide reasonable assurance of material compliance with the requirements for Activities Allowed or Unallowed and Allowable Costs/Cost Principles. We reaffirm our audit finding and will follow up on the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting the allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-028 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to monitor subrecipients and to ensure payments were allowable, properly supported, and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Subrecipient Monitoring Known Questioned Cost Amount: $75,251,225 Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local, and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2023, state agencies spent about $1.9 billion in SLFRF funds, more than $718 million of which was spent by the Department of Commerce. The Legislature appropriated SLFRF funding to the Department for the purpose of providing assistance to public and private water, sewer, garbage, electric, and natural gas utilities to reduce residential customer account balances that were accrued between March 1, 2020, and December 31, 2021, and were unpaid due to the COVID-19 pandemic and the related economic downturn. The Department’s Energy Division expended more than $101 million in payments to public and private utilities as subrecipients. Each utility that wished to participate in the program was required to submit an application for financial assistance documenting the current arrearage balances for residential customers as of March 31, 2022, as well as any available information on arrearage balances of low-income customers, including those receiving government assistance through the Low-Income Home Energy Assistance Program, Low-Income Water Assistance Program, or other ratepayer-funded Department programs as of March 31, 2022. In the event that the utility did not have access to this customer information, the Department distributed SLFRF funds to the community action program serving the same area as the utility. In determining the amount of funding that each utility could receive, the Department was required by the Legislature to consider: • Each participating utility’s proportion of the aggregate amount of arrearages among all participating utilities; • Utility service areas that are situated in locations experiencing disproportionate environmental health disparities; • American community survey poverty data; and • Whether the utility has leveraged other fund sources to reduce customer arrearages. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to monitor subrecipients and to ensure payments were allowable, properly supported, and met period of performance requirements for the SLFRF program. During the audit period, the Department reimbursed more than $101 million in SLFRF funds to 62 different utilities and community action program subrecipients. Utilities were instructed to submit a request summarizing the outstanding arrearage balance for existing utility customers as of March 31, 2022. We determined the Department did not adequately monitor any of the 62 utilities and community action program subrecipients to ensure that payments issued by the Department were for allowable activities and only eligible households received assistance. The Department received the arrearage balances and awarded funds to utilities in November 2022. At the time the Department awarded funds, utilities were directed to provide updated balances. Several utilities reported changes to their arrearage balances, and no longer needed awards based on the initial data. These funds were returned to the Department and redistributed to other utilities that had remaining arrearage balances after the initial allotment of funds. We used a non-statistical sampling method to randomly select and examine 15 out of 94 payments to subrecipients, in addition to seven individually significant payments. Of the payments examined, we found none of the 22 payments had adequate documentation to support the payments were for allowable activities under the subaward, met cost principles, and occurred within the award’s period of performance. The Department did not obtain documentation from the utilities demonstrating when each household arrearage balance was accrued. Therefore, we cannot determine whether the amounts reimbursed to subrecipients were adequately supported, and that the underlying costs were incurred during the period of performance of the subaward. The Department also did not ensure subawards issued to subrecipient utilities contained accurate information. We randomly selected and examined 12 out of 62 subawards issued during the audit period, including five individually significant subawards, and found all 17 subawards (100 percent) did not include the correct period of performance of the federal SLFRF award. In each instance, the Department communicated to the subrecipient that the period of performance of the subaward should include low-income customer arrearages that were accrued between March 1, 2020, and December 31, 2021. However, the period of performance for the federal award began on March 3, 2021. In addition, the Legislature required participating utilities to submit reports to the Department by March 1, 2023, documenting how funds were used to support households. We determined the Department did not collect and review these reports from any of its subrecipients, and did not perform any additional fiscal or programmatic monitoring. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Division management for the Department did not request reports on households served with program funding from its subrecipients, as the Legislature required. Instead, the Department instructed subrecipients to summarize the number of households that qualified for assistance, and the Department did not request supporting documentation to demonstrate that individual households were eligible to receive assistance and the amounts reimbursed to the subrecipient for each household’s utility arrearage were accurate and adequately supported. Additionally, the Legislature authorized the Department to expend these funds for activities that partly occurred outside of the period of performance for the federal award. Effect of Condition and Questioned Costs We determined the Department did not request and review adequate supporting documentation before paying subrecipients, and it did not perform adequate fiscal monitoring to ensure that funds paid to subrecipients were disbursed only for eligible households and for allowable activities. As a result, we identified $75,251,225 in known federal questioned costs and $101,433,722 in likely federal questioned costs. Without establishing adequate internal controls and reviewing required supporting documentation from subrecipients, the Department cannot reasonably ensure it is using federal funds for allowable purposes and that spending occurs within the allowed period of performance. Further, by not properly labeling the subawards, the subrecipients may not be aware that federal regulations pertaining to subrecipients apply to their subawards. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Establish internal controls to ensure payments to subrecipients are adequately supported, allowable and only reimburse costs incurred during the period of performance • Ensure each subaward contains all federally required elements, in accordance with Uniform Guidance, including clearly identifying it as a subaward • Ensure it collects the household reports from all subrecipients, as required by the Legislative mandate • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The COVID-19 pandemic caused a global economic slowdown and an economic downturn in Washington State, which resulted in layoffs and reduced work hours for a significant percentage of our workforce and reductions in business activity. The pandemic resulted in significant economic impacts on our economy including the threat of utility services being disconnected and late payment fees imposed. Maintaining utility services during the crises was an essential tool in sustaining and protecting the health and welfare of our businesses and citizens. On February 29, 2020 Proclamation 20-23.2 Ratepayer Assistance and Preservation of Essential Services was signed to protect the availability and affordability of essential utility services for those economically impacted by the COVID-19 pandemic through a variety of measures, including: suspending disconnection of utilities for nonpayment, waiving late fees, working with affected utility customers to establish payment arrangements, and improving access to energy assistance for affected customers. The result of this proclamation compounded customer account balances and generated over $160 million in arrearages for Washington utilities. ENGROSSED SUBSTITUTE SENATE BILL 5693, Section 128 (199), 2022 Supplemental Operating Budget provided the Legislature appropriate $100 million for public and private water, sewer, garbage, electric and natural gas utilities arrearages. The funding was used by utilities to reduce residential customer accrued arrearages. As a result of the bill, the Department received specific information from each utility provider expecting that information was appropriate documentation at that time. The Department acknowledges the information obtained did not include the appropriate supporting documentation as required by the Code of Federal Regulations. The Department funded the arrearages for the period of performance allowed in the Senate Bill from March 1, 2020 through December 31, 2021. The Senate Bill approved and provided the incorrect period of performance which may have resulted in unallowable costs of arrearages paid between March 1, 2020 through March 2, 2021. The Department will work with the legislature and Office of Financial Management (OFM) on next steps. OFM has already been notified of this circumstance. The Department will also work with utility providers to obtain detailed supporting documentation to reconcile all arrearages paid to determine and verify the amounts expended. All variances will be reviewed. The Department will work with OFM to determine next steps for the reporting of any variances or deficiencies identified. All deficiencies reported will be used to strengthen internal controls and compliance for future awards. In 2022, prior to this audit, all Department federal contract templates were updated to identify if the contract recipient type was a contractor or subrecipient. The Department’s use of the term “contractor’ was in reference to the contract, it was not intended to designate the recipient type. The updated templates now remove any confusion of the recipient type. We thank the Washington State Auditor’s Office for the opportunity to provide a response to the audit finding and provide the steps the Department is actively taking to remediate all deficiencies. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Title 31 CFR Part 35, Pandemic Relief Programs, section 5, Use of funds, establishes the period of performance for the Coronavirus State and Local Fiscal Recovery Funds and states, in part: 35.5 Use of funds. (a) In general. A recipient may only use funds for the purposes enumerated in § 35.6 (b) through (f) to cover costs incurred during the period beginning March 3, 2021, and ending December 31, 2024, subject to the restrictions set forth in sections 602(c)(2) and 603(c)(2) of the Social Security Act, as applicable. A recipient may only use funds for the purposes enumerated in § 35.6 (g) through (h) to cover costs incurred during the period beginning December 29, 2022, and ending December 31, 2024, subject to the restrictions set forth in sections 602(c)(2), 602(c)(5)(C), 603(c)(2), and 603(c)(6)(B) of the Social Security Act, as applicable. (b) Costs incurred. A cost shall be considered to have been incurred for purposes of paragraph (a) of this section if the recipient has incurred an obligation with respect to such cost by December 31, 2024. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. State of Washington Engrossed Substitute Senate Bill 5092, 67th Legislature 2021 Regular Session, Operating Budget, states in part: Section 128. FOR THE DEPARTMENT OF COMMERCE Coronavirus State Fiscal Recovery Fund – Federal The appropriations in this section are subject to the following conditions and limitations; (1) $100,000,000 of the coronavirus state fiscal recovery fund – federal appropriation is provided solely for grants for public and private water, sewer, garbage, electric, and natural gas utilities to address low-income customer arrearages compounded by the COVID-19 pandemic and the related economic downturn that were accrued between March 1, 2020, and December 31, 2021. a. By May 27, 2022, each utility that wishes to participate, must opt-in to the grant program by providing the department the following information: i. Current arrearage balances for residential customers as of March 31, 2022; and ii. Available information on arrearage balances of low-income customers, including customers who received assistance from the low-income home energy assistance program, low-income water assistance program, or ratepayer-funded assistance programs between April 1, 2020, and March 31, 2022, as of March 31, 2022. If a utility does not have access to information regarding customer participation in these programs, the department must distribute funding to the community action program serving the same service area as the utility instead of the utility. b. In determining the amount of funding each utility may receive, the department must consider: i. Each participating utility’s portion of the aggregate amount of arrearages among all participating utilities; ii. Utility service areas that are situated in locations experiencing disproportionate environmental health disparities; iii. American community survey poverty data; and iv. Whether the utility has leveraged other fund sources to reduce customer arrearages. c. The department may retain up to one percent of the funding provided in this subsection to administer the program. d. Each utility shall disburse funds directly to customer accounts by December 31, 2022. Funding shall only be distributed to customers that have participated in the low-income home energy assistance program, low-income water assistance program, or ratepayer-funded assistance programs. e. Utilities may, but are not required to, work with other utilities or use community action agencies to administer these funds following the eligibility criteria for the low-income home energy assistance program and the low-income household water assistance program. f. By March 1, 2023, each utility who opted into the grant program must report to the department, utilities and transportation commission, and state auditor on how the funds were utilized and how many customers were supported. g. Utilities may account for and recover in rates administrative costs associated with the disbursement of funds provided in this subsection.

2023-029 The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Subrecipient Monitoring Known Questioned Cost Amount: $312,659,850 Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program provides direct payments to states to respond to the COVID-19 pandemic and its negative economic effects. Washington received about $4.4 billion of SLFRF funds from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2023, state agencies spent more than $1.7 billion in SLFRF funds, $344 million of which was spent by the Department of Social and Health Services. The Department spent more than $332 million to administer financial assistance through the Washington Immigrant Relief Fund to people in Washington who lacked permanent legal status. The purpose of this program was to provide cash grants to residents of Washington who were at least 18 years old and were ineligible to receive federal economic impact payments or unemployment benefits due to their immigration status. The Legislature appropriated $340 million to the Department in SLFRF funding to administer one-time grants to eligible recipients during fiscal year 2023. Under the legislative mandate, the Department could not spend more than 10 percent of the appropriated funds for the administration of the program. In total, the Department paid more than $312 million in cash grants to approved recipients. According to the legislative mandate, people needed to complete an application and meet the following eligibility requirements to receive a grant: • The person must live in Washington state. • The person must be age 18 years, or older. • After January 1, 2021, and before June 30, 2023, the person must have been significantly affected by the COVID-19 pandemic. • The person must not be eligible to receive federal economic impact payments or unemployment insurance benefits due to immigration status. • The person may not receive more than three grants. The Department was required to prioritize granting payments to people who had the greatest need of assistance. The factors used to prioritize need included: • People who had a total household income at or below 250 percent of the federal poverty level • People who were the primary or sole income earner of their household • People who experienced housing instability • People who contracted or were at high risk of contracting COVID-19 During the audit period, the Department contracted with a for-profit subrecipient to implement and manage the program. The funds expended in the audit period were the final round of funding for this program. In prior years, there were two other rounds of funding, each of which provided $1,000 cash grants to approved recipients. For the final round of funding, the Department reimbursed the subrecipient for issuing additional grants of $3,075 to 101,678 approved recipients in the form of either a check or prepaid debit card. Each round of funding was managed by a different subrecipient. To receive a grant, the Department instructed its subrecipients to approve applications for people who met all criteria outlined above, as well as demonstrate the applicants had not yet received the maximum allowable number of three grants. Applicants were allowed to participate in all three rounds of funding, provided they met all eligibility requirements to receive assistance. In total, the same recipient could have received $5,100 in cash grants from the state as part of the Immigrant Relief program. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Some federal awards may be passed through to for-profit entities, who are accountable to the pass-through entity for the use of the federal funds provided. Because for-profit subrecipients are not subject to audit requirements under the Uniform Guidance, Subpart F, the Department is responsible for establishing requirements, as necessary, to ensure the for-profit subrecipient complies with the terms and conditions of its subaward. The agreement with the for-profit subrecipient should describe applicable compliance requirements and the for-profit subrecipient’s compliance responsibility. Methods to ensure for-profit subrecipients’ compliance may include pre-award audits, monitoring the subrecipient during the agreement, and conducting post-award audits. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the SLFRF program. During the audit period, the Department awarded funds to its subrecipient to implement and manage the program, including creating an application platform, determining the eligibility of applicants to receive financial assistance, and distributing Department funds to third-party vendors to facilitate payments to recipients. However, the application developed by the subrecipient and approved by the Department did not address each eligibility criterion established by the Legislature. In addition, the application’s questions were written in a way that a person’s responses could be truthful and make them appear to be eligible for assistance but not meet the criteria of the legislative mandate. Specifically, the application: • Asked applicants to answer whether they “received a federal stimulus check” or “received unemployment benefits during the pandemic,” without specifically asking if it was due to their immigration status, which was a core eligibility requirement • Included two scenarios that did not necessarily indicate whether someone had been significantly affected by the COVID-19 pandemic. These scenarios were whether applicants had borrowed money from a friend or relative, and whether they were past due on rent, mortgage payments, utility bills, or had lost their housing. The Department’s award contract to the subrecipient outlined that for the subrecipient to receive funds for the grant award, it would need to submit a list of all approved applicants when requesting payments. However, the subrecipient was required to redact all personally identifiable information before submitting the list of applicants to the Department. The contract also specified the Department would complete a review of applications to ensure the subrecipient was correctly determining eligibility. The subrecipient included the list of approved applicants when it submitted invoices to the Department requesting reimbursement for funds rendered to clients. However, these invoices contained only the application identification numbers for approved applicants and their payment amounts. The invoices did not include any information to identify the applicant or support the subrecipient’s eligibility determination. Department officials said the subrecipient maintained all supporting documentation to demonstrate an applicant was eligible. However, because the Department did not request documentation from the subrecipient to support those grant payments to applicants, the Department could not determine if the applicants were eligible and the payments were actually dispersed to them. Ultimately, due to the lack of supporting documentation, we could not determine whether the Department used program funds for allowable activities, or that recipients who received grants met all requirements established by the Legislature. On four separate occasions, the Department requested the subrecipient to provide 250 beneficiary applications so staff could review them to determine whether the subrecipient correctly determined that applicants were eligible to receive financial assistance. The subrecipient picked the samples each time, and the Department did not receive details about the sampling methodology the subrecipient used to determine the samples. Each batch only included de-identified samples that did not have any personally identifiable information. Therefore, the Department did not have sufficient information to review to ensure all eligibility and prioritization criteria, as outlined in the legislative mandate, were met. In addition, the Department did not retain any of the supporting documentation it did receive from the subrecipient. We determined the Department’s monitoring design for the subrecipient was insufficient to determine whether only eligible applicants received grants, or if all recipients actually existed. Specifically, the Department could not determine whether the recipients: • Had already applied for and were denied eligibility for unemployment insurance benefits by the state, due to their immigration status • Were not eligible to receive federal economic impact payments due to their immigration status • Were residents of Washington state • Did not already receive the maximum allowable number of grants under the program • Met the income requirement to be at or below 250 percent of the federal poverty level Once the application period ended, the subrecipient provided the Department with a list of all approved applicants, which totaled 101,678 people. Although the first two awards given to recipients were $1,000 each, the Department decided it would evenly distribute the remaining funds between everyone who had been approved to receive a grant. Department management said they chose to distribute the remaining funds this way to minimize public concerns about unallocated grants. Based on the total number of applicants and the remaining funds, management in the Department’s Office of Refugee and Immigrant Assistance determined each grant award would be $3,075. While the Department did perform some fiscal monitoring of the subrecipient’s administrative costs, management chose not to complete any fiscal monitoring of the grant award payments. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department approved the eligibility application that the subrecipient created, but the application did not ensure only eligible applicants were approved because it included criteria that was not in the legislative mandate. In addition, management wrote the award contract in a way that restricted the subrecipient from providing any personally identifiable information for applicants. Without this information, the Department could not sufficiently monitor the subrecipient to ensure only eligible applicants were approved and received grant funds. Since the subrecipient was required to retain all supporting documentation, the Department could have performed fiscal monitoring to ensure the grant payments to the subrecipient were distributed only to eligible applicants. However, management said the Department had no plans to do so. Effect of Condition and Questioned Costs We determined the Department did not review adequate supporting documentation before paying the subrecipient for applications processed during the audit period. Since the Department did not perform adequate monitoring to ensure that expenditures were for allowable activities, it does not have assurance that the subrecipient spent program funds in accordance with the legislative mandate. As a result, we identified $312,659,850 in known federal questioned costs. Without establishing adequate internal controls and reviewing detailed supporting documentation from the subrecipient for grant awards, including verifying that only eligible applicants received grant funds, the Department did not reasonably ensure it used federal funds for allowable purposes and that spending occurred within the allowed period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Perform a sufficient level of subrecipient monitoring that meets federal requirements so the Department can reasonably determine whether its subrecipient only disbursed grant funds to eligible applicants • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Department partially concurs with the Auditor’s findings. The Department’s Office of Refugee and Immigrant Assistance (ORIA) administered the fund and contracted with a subrecipient organization to conduct eligibility determinations and to approve and disburse funds to undocumented immigrants. The final payments went out in early 2023 and the Washington COVID-19 Immigrant Relief Fund is now closed and all subrecipient contracts have ended. We concur that we should have strengthened our internal controls to have reasonably determined the subrecipient only disbursed grant funds to eligible applicants. ORIA will work with contracts and accounting staff to develop effective internal controls and clear written procedures covering subrecipient monitoring requirements. ORIA will train all staff responsible for subrecipient monitoring on the newly established internal controls and written procedures. In addition, the Office of the Secretary will request the Department’s Internal Audit and Consultation office conduct an internal audit of ORIA to ensure the program implements strong internal controls, properly accounts for federal funds, and materially complies with federal requirements. The Department does not concur with the questioned costs. The Department used the funds to assist Washington workers/families who were affected by the COVID-19 pandemic but were unable to access federal stimulus programs and other social supports due to their immigration status. Repayment of these funds would only hinder the state’s ability to provide critical services to our clients. If the grantor contacts the Department regarding the questioned costs, the Department will discuss the manner in which we used the funds with the Department of Health & Human Services and will take additional action if appropriate. Auditor’s Remarks We appreciate the Department acknowledging that internal controls need to be strengthened. Regarding the Department not concurring with questioned cost, we determined the Department did not review supporting documentation from the subrecipient to demonstrate that assistance only went to eligible beneficiaries and therefore does not have assurance that federal funds were properly spent. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200.1, Uniform Guidance establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs. Title 2 CFR Part 200.403, Uniform Guidance establishes the factors affecting the allowability of costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. State of Washington Engrossed Substitute Senate Bill 5092, 67th Legislature 2021 Regular Session, Operating Budget, states in part: NEW SECTION. Section 205. FOR THE DEPARTMENT OF SOCIAL AND HEALTH SERVICES – ECONOMIC SERVICES PROGRAM Coronavirus State Fiscal Recovery Fund – Federal The appropriations in this section are subject to the following conditions and limitations: 15. $340,000,000 of the coronavirus state fiscal recovery fund – federal appropriation is provided solely for the Washington immigrant relief fund, a disaster assistance program to provide grants to eligible persons. Administrative costs may not exceed 10 percent of the funding in this subsection. a. A person is eligible for a grant who: I. Lives in Washington state; II. Is at least 18 years of age; III. After January 1, 2021, and before June 30, 2023, has been significantly affected by the coronavirus pandemic, such as loss of employment or significant reduction in work hours, contracting the coronavirus, having to self-quarantine as a result of exposure to the coronavirus, caring for a family member who contracted the coronavirus, or being unable to access childcare for children impacted by school or childcare closures; and IV. Is not eligible to receive federal economic impact (stimulus) payments or unemployment insurance benefits due to the person’s immigration status. b. The department may not deny a grant to a person on the basis that another adult in the household is eligible for federal economic impact (stimulus) payments or unemployment benefits or that the person previously received a grant under the program. However, a person may not receive more than three grants. c. The department’s duty to provide grants is subject to the availability of the amounts specified in this subsection, and the department must prioritize grants to persons who are most in need of financial assistance using factors that include, but are not limited to: (i) Having an income at or below 250 percent of the federal poverty level; (ii) being the primary or sole income earner of household; (iii) experiencing housing instability; and (iv) having contracted or being at high risk of contracting the coronavirus. The department may contract with one or more entities to administer the program. If the department engages in a competitive contracting process for administration of the program, experience in administering similar programs must be given weight in the selection process to expedite the delivery of benefits to eligible applicants.

2023-030 The Office of Financial Management did not have adequate internal controls over and did not comply with reporting requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-020 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the American Rescue Plan Act of 2021, delivered $350 billion to state, local, and tribal governments to support the response to and recovery from the COVID-19 public health emergency. The program also provides resources to fight the pandemic, address economic impacts, maintain vital public services, and build a strong, resilient, and equitable recovery. Washington received about $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2023, Washington spent more than $1.8 billion in federal program funds. Under the SLFRF program, recipients are required to submit Project and Expenditure Reports during the covered period, which began March 3, 2021, and ends December 31, 2024. Treasury identified the following key line items that contain critical information: 1. Obligations and Expenditures a. Current period obligation b. Cumulative obligation c. Current period expenditure d. Cumulative expenditure 2. Revenue loss calculation validation 3. Capital Expenditures The Office was responsible for compiling information from state agencies and submitting the reports no later than the last day of the month following the end of each reporting period. The Office was also responsible for calculating and reporting the state’s revenue losses from the pandemic, as well as identifying SLFRF projects with capital expenditures that required written justifications. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Office did not have adequate internal controls over and did not comply with reporting requirements for the SLFRF program. The prior finding number was 2022-020. Description of Condition The Office did not have adequate internal controls over and did not comply with reporting requirements for the SLFRF program. During the audit period, the Office submitted four quarterly Project and Expenditure Reports: • Report No. 4 (covering activity from July 1, 2022, through September 30, 2022) • Report No. 5 (covering activity from October 1, 2022, through December 31, 2022) • Report No. 6 (covering activity from January 1, 2023, through March 31, 2023) • Report No. 7 (covering activity from April 1, 2023, through June 30, 2023) Office staff prepared the reports by collecting and compiling reporting information from each state agency. For all four reports, we found that the Office did not have adequate supporting documentation for amounts reported under current period and cumulative obligations. We also found the Office did not have adequate internal controls to ensure material compliance with the capital expenditure requirement. We identified 14 out of 95 projects for which the Office did not follow up to determine whether there were capital expenditures incurred. Eight projects had expenditures greater than $1 million during fiscal year 2023, and two of those projects required written justifications. We found the Office did not have the required written justifications for two out of eight (25 percent) projects. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Office did not require state agencies to include supporting documentation when they reported their obligations at the end of each reporting period. Instead, the Office relied on self-reporting by agencies without ensuring supporting documentation was provided and retained. In addition, management did not ensure that information provided by agencies was reviewed to ensure the project and expenditure reports are complete, accurate, and adequately supported. In addition, the Office was unable to confirm all information reported for capital expenditures was adequately supported. Effect of Condition We focused our review on the obligation and expenditure key line items for the Department of Commerce (Commerce) and Department of Social and Health Services (DSHS). Combined, these two agencies accounted for about 57 percent of total SLFRF expenditures during fiscal year 2023. We determined that both agencies’ current period and cumulative expenditures were accurate and supported, and any variances were not material to the overall reporting. However, we were unable to confirm whether the supporting documentation for both agencies’ reported obligations accounted for all activity during each reporting period. Therefore, our estimates of overreported and underreported obligations for both agencies in the tables below are based on the agency reports for obligations available at the time of the audit. Commerce We found that the current period obligations for Commerce in all four reports did not have adequate supporting documentation. We also found that cumulative obligations for Commerce in all four reports did not have adequate supporting documentation. As of the final fiscal year 2023 report, Commerce’s cumulative obligations totaled $985,274,734 and cumulative expenditures totaled $783,360,809. Because Commerce’s expenditures were accurate and supported, we calculated the variance to be the net of the unsupported obligations minus supported expenditures, or $201,913,924 (difference due to rounding). DSHS In two reports, we identified reporting variances for current period obligations reported for DSHS, including $7,158,350 in overreported obligations in Report No. 7. DSHS reported $17,781,970 in current obligations for Report No. 7. We also found that cumulative obligations were underreported by $1,445,556 compared to estimated expected obligations of $363,451,530. To determine the magnitude of the reporting variances, we totaled the largest current period obligation variance for DSHS with the net unsupported obligations for Commerce. This totaled $209,081,184, or about 11 percent of total SLFRF expenditures during fiscal year 2023. Our determination of the variance is an estimate because documentation necessary to calculate accurate obligation amounts for each reporting period was not available. By not establishing adequate internal controls, the Office cannot ensure that information reported to the federal grantor is complete and accurate. Without complete supporting documentation for obligations, management is not able to demonstrate that amounts reported to the federal grantor are complete and accurate. Recommendations We recommend the Office: • Establish internal controls to ensure reported obligations are supported by source documentation, which should be retained and available for review • Improve internal controls to ensure staff continue to follow up with agencies that report incomplete information • Ensure that management verifies reporting information is adequately supported before certifying and submitting the report Office’s Response The Office will continue to communicate to agencies the importance of maintaining adequate source supporting documentation for future project and expenditure reports. Although a complete cumulative obligations report as of the report date was not maintained supporting the project and expenditure report, all obligations are supported by grant agreements, contracts, and purchase orders. Additionally, the Office was able to provide the auditor a current report including all obligations to date which exceeded the cumulative obligations during the reporting period. The Office continues to improve the reporting template used to collect the required information from agencies and frequently meets with agencies to discuss the reporting requirements to ensure the quarterly Project and Expenditure Reports are complete, accurate, and supported. The Office will continue its review and verification process to ensure information is adequately supported before certifying and submitting the report. As noted in the U.S. Treasury reporting guidance, corrections or any changes to the report need to be reflected in the next Project and Expenditure report. As a result, the supporting documentation for the quarter may not align with the quarterly reports. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Office of Management and Budget, 2 CFR Part 200, Appendix XI, 2023 Compliance Supplement, for Assistance Listing 21.027 Coronavirus State and Local Fiscal Recovery Funds, states in part: L. Reporting 2. Performance Reporting Title of Report: Project and Expenditure Report PRA Number: 1505-0271 Reporting Cycle: Quarterly and Annual Authoritative Requirement: 2 CFR 200.328 and 31 CFR section 35.4(c) Reporting and requests for other information Blank Copy of the Report: https://home.treasury.gov/policyissues/coronavirus/assistance-for-state-local-and-tribal-governments/state-andlocal-fiscal-recovery-funds/recipient-compliance-and-reporting-responsibilities – See pages 17 through 34. Report Instructions: https://home.treasury.gov/policyissues/coronavirus/assistance-for-state-local-and-tribal-governments/state-andlocal-fiscal-recovery-funds/recipient-compliance-and-reporting-responsibilities – See pages 17 through 34. Report Corrections: Recipients will have an opportunity to reopen and provide edits to their submitted Project and Expenditure Reports any time before the reporting deadline. Recipients will then be required to re-certify and submit the report again to properly reflect any edits made. After the reporting deadline, unless prompted by Treasury staff, recipients will not be able to edit their submitted report, any changes or revisions will need to be reflected in the next Project and Expenditure report. The Office of Recovery Program’s (ORP) reporting portal has built-in functionality to reopen a report and allow recipients to make edits after the reporting deadline. However, it is ORP’s policy that recipients may only make revisions if authorized by Treasury staff for a period of up to 60 days after the reporting deadline. After the revision period ends, the report is final. A resubmitted report becomes a recipient’s final report within ORP’s reporting portal. Recipients can generate PDFs of this reports at any time. Key Line Item(s)- The following line items contain critical information: 1. Obligations and Expenditures- Quantifiable Objective Criteria: Reported obligations and expenditures. (See pages 16 and 17 of the above links.) a. Current period obligation b. Cumulative obligation c. Current period expenditure d. Cumulative expenditure Revenue loss calculation validation- Note- Recipients may elect a “standard allowance” of up to $10 million to spend on government services through the period of performance instead of using the full formula specified in the final rule. The standard allowance is available to all recipients. See page 30 for when recipients may modify their revenue loss election. Quantifiable Objective Criteria: Recipient’s application of the revenue loss calculation is accurate if they did not elect the standard allowance. Specific information regarding the revenue loss formula can be found in paragraph (d)(2) of 31 CFR § 35.6 at 31 CFR § 35.6(d)(2)(d)(2). Capital Expenditures- Quantifiable Objective Criteria: The recipient has the required written justification in their grant file if the total of the capital expenditures costs in a project is greater than or equal to $1 million and less than $10 million; or, the recipient submitted the required justification to Treasury if (1) a project has total capital expenditures costs greater than $10 million for capital expenditures enumerated by Treasury in the final rule; or (2) the total of a project’s capital expenditures costs is greater than $1 million for capital expenditures not enumerated by Treasury in the final rule. Note: Capital expenditures paid for using revenue replacement funds are not subject to this requirement. Tribal governments are not required to complete the written justification. (See 31 CFR section 35.6(b)(4))

2023-031 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-021 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local, and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2023, state agencies spent about $1.9 billion in SLFRF funds, more than $718 million of which was spent by the Department of Commerce. The Legislature appropriated $100 million to the Department in SLFRF funding to award assistance to public and private water, sewer, garbage, electric, and natural gas utilities. With these funds, utilities could reduce residential customer account balances that were left unpaid due to the COVID-19 pandemic and the related economic downturn that were accrued between March 1, 2020, and December 31, 2021. The Department’s Energy Division expended about $100 million in payments to public and private utilities as subrecipients. Each utility that wished to participate in the program was required to submit an application for financial assistance documenting the current arrearage balances for residential customers as of March 31, 2022, as well as any available information on arrearage balances of low-income customers, including those receiving government assistance through the Low-Income Home Energy Assistance Program, Low-Income Water Assistance Program, or other ratepayer-funded Department programs as of March 31, 2022. In the event that the utility did not have access to this customer information, the Department distributed SLFRF funds to the community action program serving the same area as the utility. In determining the amount of funding that each utility could receive, the Department was required by the legislative mandate to consider: • Each participating utility’s proportion of the aggregate amount of arrearages among all participating utilities • Utility service areas that are situated in locations experiencing disproportionate environmental health disparities • American community survey poverty data • Whether the utility has leveraged other fund sources to reduce customer arrearages Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. To determine the appropriate level of monitoring, federal regulations require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the SFLRF. The prior finding number was 2022-021. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for SLFRF subrecipients. During the audit period, the Department awarded more than $99.8 million in SLFRF funds to 62 different utilities and community action programs. We determined the Department did not perform a risk assessment to determine the appropriate level of monitoring for each of its 62 subrecipients. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition Program management for the Department was not aware of the requirement to conduct a formal risk assessment over each subrecipient’s use of SLFRF funds, and did not consider performing a risk assessment over the subrecipients when following legislative guidance. Additionally, management outside of the Department’s Energy Division did not monitor to ensure risk assessments were performed before executing subawards with utilities. Effect of Condition Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients’ noncompliance with federal regulations and the terms and conditions of subawards. Recommendations We recommend the Department: • Establish internal controls to ensure it performs risk assessments for all subawards issued to subrecipients • Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results and demonstrate compliance with federal requirements • Update its risk assessment procedures to ensure factors related to potential noncompliance with requirements for low-income utility grants and SLFRF are incorporated into the risk assessment results Department’s Response The Department thanks the Washington State Auditor’s Office for the opportunity to respond to the finding. The Department respectfully disagrees with the finding as the Auditor’s Office has provided no requirements or codes nor has the Department been informed of any which require a risk assessment process for this award applied to arrearage balances. Additionally, the Department asserts it had internal controls in place for the program requirements. The Washington State Legislature issued the following proviso for funding by the Department: “$100,000,000 of the coronavirus state fiscal recovery fund federal appropriation is provided solely for grants for public and private water, sewer, garbage, electric, and natural gas utilities to address low-income customer arrearages compounded by the COVID-19 pandemic and the related economic downturn that were accrued between March 1, 2020, and December 31, 2021.” The Washington State Legislature informed utility representatives of the availability of funding following the funding awarded to the Department. Commerce received the award for this program as part of the supplemental operating budget included in Senate Bill 5693, affective March 31, 2022. The Department held webinars allowing all interested utility service providers to obtain information on how to fund outstanding arrearage balances compounded by the COVID-19 pandemic. Utility providers requesting funding communicated their customer arrearage balances to the Energy Office who followed a reporting process for funding. The reporting process included receipt of the number of customers with arrearage balances, the amount applied to customer balances, if they were low income customers amongst other elements required to receive funding. By May 27, 2022, each utility that wished to participate opted-in to the grant program by providing the Department with the specific information. The opt-in was available for all utility service providers who had customers who met the low-income requirements. The proviso did not include any requirements for subrecipient monitoring elements, including the performance of risk assessments of utility providers. The proviso included who was eligible for funding and the period of performance. The compliance supplement for Assistance Listing Number 21.027 under 2 CFR 200 did not include any requirements for subrecipient monitoring for risk assessments. The Department’s Assistant Director for the Energy Division created the process in which utility service providers provided information for funding. At that time the Assistant Director created internal controls over reporting, fiscal monitoring and subrecipient monitoring which included the submission of required information including, low-income eligibility, customer accounts had to be in an arrearage status, dates of arrearage balances and confirmation of expenses paid for customer arrearages. That data was compiled in a monitoring workbook, monitored and retained. Commerce did not identify or implement an internal control over risk assessments as utility service providers were not ranked or categorized for funding as the award included funding for all eligible customers from the utilities who requested funding. A risk assessment was not necessary nor required as part of the compliance supplement or any other Code of Federal Regulation related to this award. Commerce implemented internal controls for all areas in which the regulations required. Further, Commerce created and maintained an appropriate level of monitoring for the elements identified for funding by the legislature through our obtaining low-income eligibility status and other factors required for funding. No risk assessment process was required as all eligible utility providers were funded. The Department strives to meet all requirements related to federal funding and will continue to improve internal controls and compliance when deficiencies are identified. Auditor’s Remarks Federal regulations, specifically 2 CFR 200.332 - Requirements for pass-through entities, requires risk assessments be performed for all subrecipients to determine the appropriate level of monitoring required to ensure the subrecipient complies with terms and conditions of the subaward. The fact that the state legislative proviso did not contain this provision did not absolve the Department from complying with the federal requirement. We informed the Department during the audit that we would be assessing its compliance with this requirement. This requirement is also outlined in the state’s grant agreement with the Department of the Treasury and is outlined in the federal grant compliance supplement that is published by the federal Office of Management and Budget every year. We reaffirm our audit finding and will follow up on the Department’s corrective action during the next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-032 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Coronavirus State and Local Fiscal Recovery Fund. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRFP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local, and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state’s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2023, state agencies spent about $1.9 billion in SLFRF funds, more than $718 million of which was spent by the Department of Commerce. The Department used SLFRF funds to administer and provide economic assistance to households at risk of eviction and homelessness primarily through the Eviction Rental Assistance Program, in addition to transportation, tourism, and other pandemic-recovery projects. During fiscal year 2023, the Department expended about $253.5 million on reimbursements and advance payments to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for making direct payments of rent and utilities for eligible low-income households with overdue rent payments dating as far back as March 2020. Federal regulations require pass-through entities to ensure that every subaward is clearly identified as a subaward to a subrecipient, and that it includes 14 federal award identification elements. These elements include the subrecipient’s unique entity identifier, the Federal Award Identification Number, the name of the federal awarding agency, the program’s Assistance Listing Number and title, and more. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure it communicated all federal award identification elements to subrecipients of the SLFRF. During the audit period, the Department awarded new contracts and amendments totaling more than $16.8 million in SLFRF funds to 13 subrecipients. We examined all 13 subawards and determined all 13 did not clearly identify the agreement as a federal subaward and the subrecipient was referred to as a contractor throughout the award. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department could not provide documentation to show it had adequate internal controls in place to ensure that the subawards included all the correct information. Furthermore, the subrecipients were referred to as contractors throughout each award because the Department used a contract template; it did not have a subaward template available at the time the subawards were issued. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure it has communicated all required data elements to its subrecipients. Furthermore, by not clearly identifying the subaward as such, the Department cannot ensure its subrecipients have been adequately informed of the program requirements, federal regulations, and the subaward’s terms and conditions that it must comply with. Under federal law requirements for a subrecipient and a contractor are substantially different. Recommendation We recommend the Department establish adequate internal controls to ensure it includes all required information in every federal subaward. This must include ensuring that the award is clearly identified as a subaward and not a contract. Department’s Response The Department treated the recipient as a subrecipient and followed all of the Code of Federal Regulations (CFR) requirements, including communicating the Requirements for Pass-through Entities to all recipients through the 14 elements checklist in a contract amendment process. The Department informed the audit team that they had this documentation but the documentation was not requested. The Department agrees with the Washington State Auditor’s Office (SAO) that our contract template refers to the subrecipient in the contract as a “contractor”. That terminology was used to identify the recipient as part of the contract, not the type of federal recipient. We identified the need to specify the federal recipient type in the contract in 2022 and in October 2022 we changed the face sheets of all of our federal contract templates to identify each recipient as a subrecipient or contractor. Unfortunately there was a timing issue with the issuance of the contract included in the audit and the prior federal template was used. Going forward, all program contracts will be issued on the updated federal contract templates which will designate the recipient type as either a subrecipient or contractor. The Department supports it communicated the Requirements for Pass-Through entities federal identification elements through the subaward amendments that were issued during the period, however, the communication was made during the audit year and did not cover the full period of performance. Short of an error being made, the Department feels this exception has been resolved. We thank the Auditor’s Office for the opportunity to respond to the finding. Auditor’s Remarks We acknowledge the Department updated its subaward template during the audit period. However, we want to clarify that for the subawards examined during this audit, the Department did not issue written subaward amendments to communicate federal subaward elements to its subrecipients. Instead, the Department sent email correspondence to each subrecipient with a file attachment listing the fields required under 2 CFR 200.332(a)(1)(i) through (xiv). This attachment was not incorporated by reference into the subaward amendments executed during the audit period, and therefore we did not consider the information as part of the Department’s subaward. We reaffirm our audit finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes requirements for all pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-033 The Office of Superintendent of Public Instruction did not have adequate internal controls to ensure it filed all reports required by the Federal Funding Accountability and Transparency Act for the Title I, Part A program. Assistance Listing Number and Title: 84.010 Title I Grants to Local Educational Agencies Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: S010A200047; S010A210047; S010A220047 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Office of Superintendent of Public Instruction administers the Title I Grants to Local Educational Agencies (Title I, Part A) program in Washington. The program provides financial assistance to help improve the teaching and learning of children who are at risk of not meeting challenging academic standards and who reside in areas with high concentrations of children from low-income families. In fiscal year 2023, the Office spent about $276 million in federal program funds, including about $271 million paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Office is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Office must report subawards by the end of the month following the month in which it made the subaward. The intent of the Act is to empower the public with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. All program subawards are issued through both iGrants and the Education Grants Management System. The Office uses these systems to gather all the appropriate data for reporting. There were 503 Title I, Part A subawards eligible for reporting in fiscal year 2023, totaling $276,437,586. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls to ensure it filed all reports required by the Act for the Title I, Part A program. During the audit period, the Office was required to report 503 subawards, totaling about $276 million of program funds that it awarded to subrecipients. We used a statistical sampling method to randomly select and examine 56 of the 503 subawards and found that two (3.6 percent), totaling $207,833, were not reported within FSRS. We consider these internal control deficiencies to be a significant deficiency. This issue was not reported as a finding in the prior audit. Cause of Condition When uploading files into FSRS, records can be rejected from the report due to congressional district errors that occur when ZIP codes in the database do not match what is included in an uploaded report. When records are removed from the upload, they must be manually added back into the report. While manually readding records that were removed, the Office inadvertently missed reporting some subawards. Effect of Condition Failing to submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Office: • Establish effective internal controls to ensure all required reports are submitted • Ensure management monitors reporting of this information to ensure future reports are submitted completely and accurately Office’s Response In response to the audit finding, the Office will: • Establish effective internal controls to ensure all required reports are submitted. Current cross-checking will always include the Title I, part A program. • Ensure management monitors reporting of this information monthly to ensure future reports are submitted completely and accurately. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2020. 3. What to report. You must report the information about each obligating action that the submission instructions posted at https://www.fsrs.gov specify. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-034 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with requirements to ensure it met the earmarking requirements for the Special Education program. Assistance Listing Number and Title: 84.027 Special Education Grants to States (IDEA, Part B) 84.027 COVID-19 Special Education Grants to States (IDEA, Part B) 84.173 Special Education–Preschool Grants (IDEA Preschool) 84.173 COVID-19 Special Education–Preschool Grants (IDEA Preschool) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: H027A200074-20A; H027A210074-21A; H027A220074–21A; H027X210074; H173A200074; H173A210074; H173A220074; H173X210074 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Earmarking Known Questioned Cost Amount: $378,206 Prior Year Audit Finding: Yes, Finding 2022-025 Background The Individuals with Disabilities Education Act’s (IDEA) Special Education Grants to States program (IDEA, Part B) provides grants to states, and through them to local educational agencies (LEAs), to help provide special education and related services to eligible children with disabilities. IDEA’s Special Education Preschool Grants program (IDEA Preschool), also known as the “619 program,” provides grants to states, and through them to LEAs, to assist with providing special education and related services to children with disabilities ages 3 through 5 and, at a state’s discretion, to 2-year-old children with disabilities who will turn 3 during the school year. The Office of Superintendent of Public Instruction administers the Special Education program in Washington, which serves about 143,000 eligible students. The program provides specially designed instruction that addresses students’ unique needs. The Office offers the program at no cost to parents, and it includes the related services students need to access their educational program. The Office spent about $282 million in federal IDEA grant funds during fiscal year 2023, and passed about $278 million of that funding through to LEAs and educational service districts. IDEA, Part B identifies the amount of funds the Office must distribute to its LEAs on a formula basis, as well as the amount it can set aside for administration and other state-level activities. The Office was awarded $8,433,118 for the fiscal year 2021 IDEA Preschool Grant. From this award, $2,222,340 was earmarked to be spent on state-level activities. This is split between administrative costs of up to $444,468 and other state-level activities for the remaining amount. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Office did not have adequate internal controls over and did not comply with requirements to ensure it met the earmarking requirements for the program. The prior finding number was 2022-025. Description of Condition The Office did not have adequate internal controls over and did not comply with requirements to ensure it met the earmarking requirements for the program. During the audit period, the Office did not accurately track expenditures for administration and other state-level activities. For the life of the grant, the Office spent $2,600,340 on other state-level activities, which exceeded the maximum by $378,206. As a result, we are questioning the $378,206 as unallowable state-level costs. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition Although management were aware of the required earmarks, the Office did not address identified variances in the spending plan for them. This was due in part to staff changes within the program that led to inconsistencies in tracking expenditures of the earmarked funds. Effect of Condition and Questioned Costs Without adequate internal controls, the Office cannot ensure that it meets the grant’s earmarking requirements. By not complying with the grant’s earmarking requirements, the Office improperly spent $378,206 on activities that exceeded the allowable earmarked amount. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Office: • Improve internal controls to ensure it does not exceed the maximum allowable amounts that are earmarked for administration and other state-level activities • Consult with the federal grantor to discuss whether the questioned costs identified in the audit should be repaid Office’s Response The Office of Superintendent of Public Instruction (OSPI) concurs with this finding. When special education fiscal leadership transitioned in 2021, the incoming director identified necessary changes in agency procedures for closing out the fiscal year for special education. Since that time, the following internal controls have been fully implemented to ensure spending plans do not exceed the maximum allowable amounts earmarked for administration and other state-level activities: 1. At the beginning of the fiscal year, the Director of Operations/Budget Analysis meet to review the criteria for spending plans. 2. Copies of GAN and Grants to States Summary Table and Preschool Grants to States Summary Table are shared with the Budget Analysis. 3. Director of Operations/Budget Analysis meet to review the GAN and Grants to States Summary Table and Preschool Grants to States Summary Table. 4. Director of Operations/Budget Analysis meet to review spending plan and update the maximum allowable amounts earmarked for administration and other state-level activities in the spending plan. 5. Maximum allowable amounts earmarked for administration and other state-level activities are reviewed throughout the fiscal year. 6. Director of Operations/Budget Analysis meet weekly to review spending plan. 7. Spending Plan updated as requests are received. 8. Monthly expenditure reports are produced and during weekly meetings, Director of Operations/Budget Analysis review expenditures. These internal controls have contributed to increased communication and partnership between the Director of Operations/Budget Analysis. With implementing these consistent controls, we can ensure that maximum allowable amounts that are earmarked for administration and other state-level activities will meet compliance. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Title 34 CFR Part 300, Assistance to States for the Education of Children with Disabilities, states in part: Section 300.812 Reservation for State activities, states: a. Each State may reserve not more than the amount described in paragraph (b) of this section for administration and other State-level activities in accordance with §§ 300.813 and 300.814. b. For each fiscal year, the Secretary determined and reports to the SEA an amount that is 25% of the amount the State received under section 619 of the Act for fiscal year 1997 cumulatively adjusted by the secretary for each succeeding fiscal year by the lesser of – 1. The percentage increase, if any, from the preceding fiscal year in the State’s allocation under section 619 of the Act; or 2. The rate of inflation, as measured by the percentage increase, if any, from the preceding fiscal year in the Consumer Price Index for All Urban Consumers, published by the Bureau of Labor Statistics to the Department of Labor. Section 300.813 State administration, states: a. For the purpose of administering section 619 of the Act (including the coordination of activities under Part B with the Act with, and providing technical assistance to, other programs that provide services to children with disabilities), a State may use not more than 20 percent of the maximum amount the State may reserve under § 300.812 for any fiscal year. b. Funds described in paragraph (a) of this section may also be used for the administration of Part C of the Act. Section 300.814 Other State-level activities. Each State must use any funds the State reserves under § 300.812 and does not use for administration under § 300.813 – a. For support services (including establishing and implementing the mediation process required by section 615€ of the Act), which may benefit children with disabilities younger than three or older than five as long as those services also benefit children with disabilities aged three through five; b. For direct services for children eligible for services under section 619 of the Act; c. For activities at the State and local levels to meet the performance goals established by the State under section 612(a)(15) of the Act; d. To supplement other funds used to develop and implement a statewide coordinated services system designed to improve results for children and families, including children with disabilities and their families, but not more than one percent of the amount received under section 619 of the Act for a fiscal year; e. To provide early intervention services (which must include an educational component that promotes school readiness and incorporates preliteracy, language, and numeracy skills) in accordance with Part C of the Act to children with disabilities who are eligible for services under section 619 of the Act and who previously received services under Part C of the Act until such children enter, or are eligible under State law to enter, kindergarten; or f. At the State's discretion, to continue service coordination or case management for families who receive services under Part C of the Act, consistent with § 300.814(e) The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-035 The Office of Superintendent of Public Instruction improperly charged $42,265 to the Special Education Cluster. Assistance Listing Number and Title: 84.027 Special Education Grants to States (IDEA, Part B) 84.027 COVID-19 Special Education Grants to States (IDEA, Part B) 84.173 Special Education–Preschool Grants (IDEA Preschool) 84.173 COVID-19 Special Education–Preschool Grants (IDEA Preschool) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: H027A200074-20A; H027A210074-21A; H027A220074–21A; H027X210074; H173A200074; H173A210074; H173A220074; H173X210074 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Period of Performance Known Questioned Cost Amount: $42,265 Prior Year Audit Finding: No Background The Individuals with Disabilities Education Act’s (IDEA) Special Education Grants to States program (IDEA, Part B) provides grants to states, and through them to local educational agencies (LEAs), to help provide special education and related services to eligible children with disabilities. IDEA’s Special Education Preschool Grants program (IDEA Preschool), also known as the “619 program,” provides grants to states, and through them to LEAs, to assist with providing special education and related services to children with disabilities ages 3 through 5 and, at a state’s discretion, to 2-year-old children with disabilities who will turn 3 during the school year. The Office of Superintendent of Public Instruction administers the Special Education program in Washington, which serves about 143,000 eligible students. The program provides specially designed instruction that addresses students’ unique needs. The Office offers the program at no cost to parents, and it includes the related services students need to access their educational program. The Office spent about $282 million in federal IDEA grant funds during fiscal year 2023, and passed about $278 million of that funding through to LEAs and educational service districts. IDEA, Part B identified that obligations charged to the fiscal year 2021 Special Education grants must be liquidated within 120 days after the budget period ended on September 30, 2022. Description of Condition The Office improperly charged $42,265 to the Special Education Cluster. We found the Office had adequate internal controls to ensure it materially complied with period of performance requirements. However, we examined two charges that were coded to the fiscal year 2021 Special Education grants after the liquidation period ended. We reviewed the supporting documentation for each expenditure to ensure it was allowable and took place during the period of performance. We found that both charges were recorded after the liquidation period for services and purchases that occurred during the period of performance. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a single audit exceed $25,000. We are issuing this finding because, as stated in the Effect of Condition and Questioned Costs section of this finding, the estimated questioned costs exceed that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition Office staff made accounting adjustments to the fiscal year 2021 IDEA, Part B grants after the liquidation period ended, and did not request a late liquidation from the U.S Department of Education. Effect of Condition and Questioned Costs We identified $42,265 in questioned costs that were paid outside the program’s period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Office consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Office’s Response OSPI has established internal controls to address allowable periods for journal vouchers (corrections). The correction cycle will be aligned with federally established liquidation periods. OSPI will communicate the corrective action plan with internal stakeholders to ensure compliance with updated process/procedures. Internal Control Details: • Monitor expenditures (through monthly reports) to ensure the agency stays within the allowable set-aside threshold and grant maximum • Complete expenditure corrections within the grant liquidation period • Liquidation is done on the last business day of January (or 120 days after the budget period ends) • Submit late liquidation requests to the appropriate federal point of contact, as needed Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Guidance establishes definitions for questioned costs. Part 200.410 establishes requirements for the collection of unallowable costs. Fiscal Year 2021 Special Education Grant Award, Grant Award Notification, establishes the federal funding period for award numbers H173A200074 and H027A200074 as July 1, 2018, through September 30, 2021. Title 20 United States Code 1225(b), Section 421(b), General Education Provisions Act, establishes that any funds that are not obligated at the end of the federal funding period shall remain available for obligation for an additional period of 12 months

2023-036 The Office of Superintendent of Public Instruction did not have adequate internal controls to ensure it performed risk assessments for subrecipients of the Special Education program. Assistance Listing Number and Title: 84.027 Special Education Grants to States (IDEA, Part B) 84.027 COVID-19 Special Education Grants to States (IDEA, Part B) 84.173 Special Education Preschool Grants (IDEA Preschool) 84.173 COVID-19 Special Education–Preschool Grants (IDEA Preschool) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: H027A200074 – 20A; H027A210074 – 21A; H027A220074 – 21A; H027X210074; H173A200074; H173A210074; H173A220074; H173X210074 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-026 Background The Individuals with Disabilities Education Act’s (IDEA) Special Education Grants to States program (IDEA, Part B) provides grants to states, and through them to local educational agencies (LEAs), to help provide special education and related services to eligible children with disabilities. IDEA’s Special Education Preschool Grants program (IDEA Preschool), also known as the “619 program,” provides grants to states, and through them to LEAs, to assist with providing special education and related services to children with disabilities ages 3 through 5 and, at a state’s discretion, to 2-year-old children with disabilities who will turn 3 during the school year. The Office of Superintendent of Public Instruction administers the Special Education program in Washington, which serves about 143,000 eligible students. The program provides specifically designed instruction that addresses students’ unique needs. The Office offers the program at no cost to parents, and it includes the related services students need to access their educational program. The Office spent about $282 million in federal IDEA grant funds during fiscal year 2023, and it passed about $278 million of that funding through to LEAs and all nine educational service districts (ESDs) in the state. Federal law requires the Office to evaluate each subrecipient’s risk of noncompliance with federal statues, regulations, and the terms and conditions of the subaward for determining the appropriate amount and type of subrecipient monitoring. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Office did not have adequate internal controls over requirements to perform risk assessments for the program’s subrecipients. The prior finding numbers were 2022-026 and 2021-023. Description of Condition The Office did not have adequate internal controls to ensure it performed risk assessments for subrecipients of the Special Education program. As a result, the Office did not perform risk assessments for the nine ESDs that received program funding during the audit period. We consider this internal control deficiency to be a significant deficiency. Cause of Condition In response to the prior year audit finding, the Office provided training to ESDs on the new monitoring manual for them. It also updated the ESD contracts to reflect monitoring activities that would start during the 2022–23 school year. Documentation for these monitoring activities is not required to be submitted until February 2024. Since the Office did not plan to review monitoring until March 2024, it did not perform risk assessments of any ESDs that received program funding during the audit period. Effect of Condition Without conducting risk assessments, management cannot ensure the Office performs the appropriate amount of monitoring to ensure subrecipients comply with program requirements. Further, without appropriate levels of subrecipient monitoring, the Office cannot have reasonable assurance that federal requirements are being met. Recommendation We recommend the Office establish and follow adequate internal controls to ensure it performs the required risk assessments, which would allow management to evaluate the results, monitor subrecipients appropriately, and demonstrate compliance with federal requirements. Office’s Response The Office of Superintendent of Public Instruction (OSPI) concurs with this finding. In April 2022, OSPI Special Education division revised and expended the form package that Educational Service Districts (ESDs) need to submit as part of year-end reporting. Additionally, ESDs are required to respond to a services of questions and provide applicable documentation for contracts and procurement, time and effort process and reports, documentation for professional development expenditures, and year-end expenditure reports. Based on the results from monitoring activities over year-end reporting, ESDs will be selected for additional monitoring and may be subject to an onsite visit if deemed necessary. In March 2023 the Special Education Office finalized the Fiscal Monitoring Procedures Handbook for ESDs. The following timeline has been developed for full implementation of the corrective actions: • ESDs are required to upload documentation by February 1, 2024. • The Special Education Office will complete reviews of submitted documents and issue reports to ESDs by February 2024. Reports will identify any required of recommended corrective actions. • The Special Education Office will issue final reports to ESDs within 60 calendar days after documentation review by March 2024. Auditor’s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-037 The Office of Financial Management did not have adequate internal controls over and did not comply with federal level of effort requirements for the Education Stabilization Fund program. Assistance Listing Number and Title: 84.425D COVID-19 Elementary and Secondary School Emergency Relief Fund (ESSER) 84.425R COVID-19 Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) 84.425U COVID-19 American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) 84.425V COVID-19 American Rescue Plan – Emergency Assistance to Non-Public Schools (ARP EANS) 84.425W COVID-19 American Rescue Plan – Elementary and Secondary School Emergency Relief –Homeless Children and Youth (ARP HCY) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: S425D200015; S425D210015; S425R210012; S425U210015; S425V210012; S425W210049 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Level of Effort Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The U.S. Department of Education distributed funding to multiple federal subprograms of the Education Stabilization Fund (ESF). Beginning in March 2020, Congress set aside the Elementary and Secondary School Emergency Relief (ESSER) Fund to address the effect that COVID-19 has had, and continues to have, on elementary and secondary schools across the nation. Several rounds of funding were distributed to states under the ESF program, each with the intent to support public and non-public schools. The U.S Department of Education awarded ESF grants to the Office of Financial Management (Office), which then dispersed funds to the Office of Superintendent of Public Instruction for pass through to Local Education Agencies (LEAs). During fiscal year 2023, the state spent more than $1.03 billion in ESF federal funding. The ESF program included a level of effort requirement to ensure states provided a minimum level of funding to LEAs based on prior years. Under the American Rescue Plan Act of 2021, ESF recipients were required to meet a proportional amount of their state’s support for elementary and secondary education relative to their overall spending, averaged over fiscal years 2017, 2018 and 2019. In fiscal year 2022, the state did not meet the proportional spending amount for K-12 education, but received a waiver for this requirement after the year had ended. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and did not comply with federal level of effort requirements for the ESF program. The Office did not perform the calculations required to monitor the level of effort requirements for the ESF program during fiscal year 2023. After the year was over, the Office determined that the fiscal year 2023 expenditures did not meet the level of effort requirement. When compared to overall state spending, the average amount of state spending on elementary and secondary education for fiscal years 2017, 2018 and 2019 totaled 49.35 percent of the state’s budget. The state was required to spend at least this percentage toward education in fiscal year 2023. However, the state only expended 42.99 percent of total state spending on education, meaning the level of effort requirement was not met by about 6.36 percent, or $2,103,004,922. In fiscal year 2022, the Office submitted a waiver request to the U.S. Department of Education for fiscal years 2022 and 2023. However, the U.S. Department of Education did not approve the waiver for fiscal year 2023. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition In response to the effects of the COVID-19 pandemic, the Legislature approved a 2021-23 state budget that spent proportionally more on social supports like food, rent and medical services than in prior years. Further, some state revenues declined between fiscal years 2020 and 2022 due to restrictions included in the Governor’s pandemic-related emergency proclamations that were intended to slow the spread of COVID-19. These changes, as well as directives to achieve state spending reductions, resulted in not meeting the ESF program’s level of effort requirement because the state budget allocated less funding to elementary and secondary education than the average of the previous three fiscal years. Effect of Condition By not establishing adequate internal controls, the Office cannot ensure the state is meeting the federal level of effort requirement for the ESF program. In addition, receiving a waiver from the U.S. Department of Education for this requirement is not guaranteed, and the waiver submitted for 2023 was not approved while the 2022 waiver was. By not complying with federal requirements, the Office risks having to repay federal funds or having future federal funds withheld. Recommendation We recommend the Office: • Consult with the grantor to discuss the pending waiver request and the next steps it should take • Consult with the appropriate state-level authority to ensure the state maintains the level of effort required to comply with federal law Office’s Response The Office of Financial Management (OFM) does not concur with the finding and maintains that there are adequate internal controls in place to ensure compliance with federal requirements. The finding was based on preliminary information and data that the auditors obtained in November 2023, despite our request to wait until the end of December 2023 when updated data would be available for submission to the Office of Elementary and Secondary Education (OESE). The updated data we subsequently submitted to OESE was prepared in accordance with OESE guidance on maintenance of effort (MOE) requirements to correctly include every budgeted funding source in the MOE calculations. The updated data demonstrated that the state was successful in meeting MOE requirements for K-12 in FY23, which was the basis for reporting the final FY23 overall State spending data in the spring of 2024 per federal requirements. Because OFM met the MOE requirement for FY23, there is no need for a waiver request. SAO’s assertion that our Office did not monitor data throughout the period is inaccurate. The Office maintains monthly monitoring details on agency expenditures. The expenditure data has not changed since the close of the fiscal year, but rather was compiled differently for reporting to OESE using the correct methodology prescribed by the grantor. OFM will also continue to work with the Legislature, which is the state-level authority for state appropriations to ensure the state maintains the maintenance of effort requirements. Auditor’s Remarks The Office could not provide us with data required to perform the maintenance of effort calculations when we initially requested it in early November 2023 and confirmed no data had been pulled to determine whether the requirement had been met. While the Office appears to monitor monthly agency expenditure details, this was not done to determine if the state had met the maintenance of effort requirement. We acknowledge that the final report on the maintenance of effort would not be available until spring 2024. However, we will not test this report and only reviewed activities performed during the audit period to determine whether the state met the maintenance of effort requirements. Once we were provided the necessary data to perform the calculations, it showed that the state did not meet the maintenance of effort requirements as of June 30, 2023. After we completed our testing, the Office notified us that the methodology used to determine what expenditures were allowable to include in the maintenance of effort calculations was updated. We understand the Office updated the methodology that was used when reporting data to the Office of Elementary and Secondary Education (OESE), however this methodology was changed over 6 months after the audit period was over. We reaffirm our finding and will follow-up on the Office’s corrective actions in the next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Coronavirus Response and Relief Supplemental Appropriations Act, 2021 (CRRSA Act) Sec. 317, states in part: (a) At the time of award funds to carry out sections 312 or 313 of this title, a State shall provide assurances that such State will maintain support for elementary and secondary education (which shall include State funding to institutions of higher educations and state need-based financial aid, and shall not include support for capital projects or for research and development or tuition fees paid by students) in fiscal year 2022 at least at the proportional levels of such State’s support for elementary and secondary educations and for higher education relative to such State’s overall spending, averaged over fiscal years 2017, 2018, and 2019. (b) The Secretary may waive the requirement in subsection (a) for the purpose of relieving the fiscal burdens on State that have been experienced a precipitous decline in financial resources. The American Rescue Plan Act of 2021, Section 2004. Maintenance of Effort and Maintenance of Equity, states in part: I. State Maintenance of Effort. – e. In general.–As a condition of receiving funds under sections 2001, a State shall maintain support for elementary and secondary education, and for higher education (which shall include state funding to institutions of higher education and State need-based financial aid, and shall not include support for capital projects or for research and development or tuition and fees paid by students), in each of fiscal years 2022 and 2023 at least at the proportional levels of such state’s support for elementary and secondary education and for higher education relative to such State’s overall spending, averaged over fiscal years 2017, 2018, and 2019. Waiver.—For the purpose of relieving fiscal burdens incurred by States in preventing, preparing for, and responding to the coronavirus, the Secretary of Education may waive any maintenance of effort requirements associated with the Education Stabilization Fund.

2023-038 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with federal reporting requirements for the Education Stabilization Fund program. Assistance Listing Number and Title: 84.425D COVID-19 Elementary and Secondary School Emergency Relief Fund (ESSER) 84.425R COVID-19 Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) 84.425U COVID-19 American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) 84.425V COVID-19 American Rescue Plan – Emergency Assistance to Non-Public Schools (ARP EANS) program 84.425W COVID-19 American Rescue Plan – Elementary and Secondary Schools Emergency Relief Fund Homeless Children and Youth (ARP HCY) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: S425D200015; S425D210015; S425R210012; S425V210012; S425U210015; S425W210049 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The U.S. Department of Education distributed funding to multiple federal subprograms of the Education Stabilization Fund (ESF). Beginning in March 2020, Congress set aside the Elementary and Secondary School Emergency Relief (ESSER) Fund to address the effect that COVID-19 has had, and continues to have, on elementary and secondary schools across the nation. Several rounds of funding were distributed to states under the ESF program, each with the intent to support public and non-public schools. The U.S. Department of Education awarded ESF grants to the Office of Financial Management, which then dispersed funds to the Office of Superintendent of Public Instruction, for pass through to Local Education Agencies (LEAs). In fiscal year 2023, the state spent more than $1 billion in ESF federal funding. The ESF program requires the Office to submit an annual performance report for the ESSER fund, with data on expenditures, planned expenditures, subrecipients, and uses of funds, including for mandatory reservations. Compliance testing of the annual performance report is only required for the following four key line items identified in the 2023 Compliance Supplement (Part 4 – Agency Program Requirements): - Line 3.b1: LEA expenditures by ESSER subgrant fund, expenditure category and object code - Line 3.b10: Number of specific positions supported with ESSER Funds - Line 3.c: Allocation of ESSER funds to schools and criteria used to allocate them - Line 5.a: Full-time equivalent positions Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and did not comply with federal reporting requirements for the ESF program. We reviewed the Office’s annual ESSER report, and found it did not submit any data related to the four key line items. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Office did not have systems in place to collect the necessary data from LEAs to report on the four key line items. As a result, the Office did not collect the data from LEAs necessary to fulfill this requirement. Effect of Condition Failing to submit the required information diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Office: • Establish effective internal controls to ensure that it collects the data necessary to submit the annual ESSER report • Consult with the federal grantor to determine if it is necessary to revise and resubmit the report Office’s Response OSPI acknowledges that certain data reporting elements in the ESSER report were not submitted. We reject the notion that this was due to lack of internal controls. Instead, the absence of data was a result of several factors, including but not limited to the timing of the publishing of the final federal reporting template, and the span of time for which we were reporting costs. The final reporting template for this information was published after several revisions after the time frame in which we would have needed to communicate with districts the specific level of detail at which costs would need to be captured for this purpose. Since the time frame for reporting costs did not align with the school district fiscal year, there was no reasonable way that OSPI could have used annual financial reporting for an approximation of expenditures. OSPI was not comfortable in making broad statewide assumptions across multiple cost categories to report at a district-by-district level with a high degree of accuracy. In lieu or reporting information that based on state level assumptions that likely would have conflicted with actual school district level expenditures, OSPI made the decision to leave certain sections of the cost report blank. In order to not have blank fields on future federal ESSER reporting, OSPI is organizing a series of webinars and trainings for districts so that they are prepared to report this information directly to OSPI for future federal reporting periods. Through these webinars, OSPI’s fiscal team can answer questions and assist districts with this reporting to ensure it is timely, accurate, and tells the district story instead of a statewide assumption of the district story. We have been in ongoing conversation with ED regarding our federal reporting on ESSER funds. At this time, there is no indication that they will request that the information be reporting by districts and then resubmitted to the Feds. We have communicated our challenges, concerns, and proposed resolution to them regarding this issue. We do not have any specific outstanding data requests due to the feds on this issue, and we do not plan on resubmitting. Auditor’s Remarks We appreciate the Office’s commitment to resolving these issues. We reaffirm our finding and will review the status of the Office’s corrective action during the next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-039 The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act. Assistance Listing Number and Title: 93.044 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.044 COVID-19 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.045 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.045 COVID-19 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.053 Nutrition Services Incentive Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: Various Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Aging Cluster programs, which include Supportive Services and Senior Centers, Nutrition Services, and the Nutrition Services Incentive Program, provide services and meals to older people. The Supportive Services program helps states and area agencies on aging facilitate the development and implementation of a comprehensive, coordinated system for providing long-term care in homes and community-based settings in a way that responds to the needs and preferences of older people and their family caregivers. Nutrition Services programs support nutrition services and provide resource incentives to encourage and reward effective and efficient performance delivery of nutritious meals to older people. The Department of Social and Health Services administers federal programs under the Older Americans Act, including the Aging Cluster programs. In fiscal year 2023, the Department spent about $39.5 million in Aging Cluster federal funding, including about $38.4 million paid to 13 area agencies on aging (AAAs). Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower the public with the ability to hold the federal government accountable for spending decisions and, as result, reduce wasteful government spending. The Department issues subawards to AAAs for multiple Older American Act grants in the same contract, including grants that are not a part of the Aging Cluster. When a new subaward is executed, Department staff enter the required reporting information for the subawards in a tracking spreadsheet. Staff use the tracking spreadsheet to submit the required reports in FSRS. The Department had 93 subawards and amendments totaling $216,486,694 that it was required to report in fiscal year 2023. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. The Department did not follow its written procedures over the reporting process. Specifically, staff did not enter the information required for reporting into the tracking spreadsheet when subawards and subaward amendments were executed, and the Department did not report any subawards in FSRS during fiscal year 2023. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department had procedures in place to ensure subawards and amendments were reported in FSRS. However, due to management turnover throughout the fiscal year, staff did not enter subawards and amendments into the tracking spreadsheet, and did not report any of the subawards in FSRS. Effect of Condition Failing to submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendation We recommend the Department strengthen internal controls to ensure it accurately reports all first-tier subawards of $30,000 or more in FSRS by the federal deadlines. Department’s Response The Department agrees with the finding. Due to management and fiscal staff turnover throughout the fiscal year, staff did not enter information required for Federal Funding Accountability and Transparency Act (FFATA) reporting into the Subawards and Amendments Tracking Spreadsheet when subawards and subaward amendments were executed and did not report any of the subawards in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) during fiscal year 2023. Effective January 17, 2024, the Subawards and Amendments Tracking Spreadsheet was created with the required fields to ensure contract information for all current contracts was entered. By January 31, 2024, FFATA reports for FFY2024 Older Americans Act (OAA) funded contracts, executed in December 2023, will be entered in FSRS to meet the 30-day reporting requirement. Effective January 17, 2024, two fiscal staff were assigned to submit FFATA reports in the FSRS system to ensure reporting activities are completed by federal deadline. By Feb 1, 2024, the Office Chief or designee will review the Subawards and Amendments Tracking Spreadsheet with FFATA reporting dates monthly to ensure federal deadlines for FFATA reporting are met consistently. The Department will work with the Administration of Community Living to develop a plan to address the FFATA reporting backlog that exists between SFY22-SFY23 for OAA grants to ensure all FFATA reports are entered in FSRS for all previous years by June 30, 2024. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2020. 3.What to report. You must report the information about each obligating action that the submission instructions posted at https://www.fsrs.gov specify. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-040 The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Aging Cluster Programs. Assistance Listing Number and Title: 93.044 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.044 COVID-19 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.045 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.045 COVID-19 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.053 Nutrition Services Incentive Program Federal Grantor Name: U.S. Department of Health & Human Services Federal Award/Contract Number: Various Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Aging Cluster programs, which include the Supportive Services and Senior Centers, Nutrition Services, and the Nutrition Services Incentive Program, provide services and meals to elderly people. The Supportive Services program helps states and area agencies on aging (AAAs) facilitate the development and implementation of a comprehensive, coordinated system for providing long-term care in home and community-based settings in a way that responds to the needs and preferences of older people and their family caregivers. The Nutrition Services programs support nutrition services and provide resource incentives to encourage and reward effective and efficient performance in the delivery of nutritious meals to elderly people. The Department of Social and Health Services administers federal programs under the Older Americans Act, including the Aging Cluster programs. In fiscal year 2023, the Department spent about $39.5 million in Aging Cluster federal funding, including about $38.4 million paid to 13 AAAs. Federal regulations require the Department to ensure that every subaward is clearly identified to the subrecipient as a subaward and includes 14 federal identification elements. These elements include the subrecipient’s unique entity identifier, the Federal Award Identification Number (FAIN), name of the federal awarding agency, the program’s Assistance Listing Number, title, and more. The Department is required to communicate this information at the time of the subaward and, if any of these elements change, include the changes in a subsequent subaward modification. In addition, the Department is responsible for communicating all requirements it has imposed on its subrecipient so that they use the federal award in accordance with federal statutes, regulations, and the terms and conditions of the award. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Aging Cluster programs. We used a non-statistical sampling method to randomly select and examine six of 13 subawards to determine if every subaward was clearly identified to the subrecipient as a subaward and included all 14 federal identification elements. We found that all six subawards did not include the following four required federal identification elements: • FAIN • Federal award date • Name of federal award agency, pass-through entity, and contact information for awarding official of the pass-through entity • Indirect cost rate for the federal award We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department communicated the four excluded identification elements in the Notice of Award (NOA) that was posted on its intranet. The Department wanted to simplify the procedure of notifying AAAs about the NOAs but, while the process was being developed, the Department neglected to communicate the required information to the AAAs in the subawards. This required information and its location were not referenced in the subaward. Effect of Condition By not clearly identifying the required information in the subaward, the Department cannot ensure it has adequately informed its subrecipients of the program requirements for each federal award. Recommendation We recommend the Department strengthen internal controls and ensure it communicates all required information in future subawards, as required by federal law. Department’s Response The Department agrees with this finding. The Department receives Notices of Award (NOA) from the Administration of Community Living 3-4 times per award in partial amounts. To reduce the time and effort it takes to issue subaward amendments to 13 Area Agency on Aging (AAA), the Department decided to post NOAs on the Intranet used to communicate Management Bulletins and other documents to AAAs to make the process more efficient. Unfortunately, the Department did not update subaward language to outline this change in the process. Effective July 31, 2024, Initial Notices of Award (NOA), with all 14 federal identification elements, will be included for each funding source in the initial subaward as an Exhibit D. Language will be added to the subaward informing Area Agency on Aging that the future NOAs will be posted on the intranet. In addition, the fiscal staff assigned will inform all AAA fiscal staff when new NOAs are posted via e-mail. Contracts staff will ensure Exhibit D is attached to the initial subaward before signing the contract. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes federal award identification requirements for subawards. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-041 The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements to ensure subrecipients of the Aging Cluster programs obtained required single audits. Assistance Listing Number and Title: 93.044 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.044 COVID-19 Special Programs for the Aging – Title III, Part B – Grants for Supportive Services and Senior Centers 93.045 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.045 COVID-19 Special Programs for the Aging – Title III, Part C – Nutrition Services 93.053 Nutrition Services Incentive Program Federal Grantor Name: U.S. Department of Health & Human Services Federal Award/Contract Number: Various Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Aging Cluster programs, which include the Supportive Services and Senior Centers, Nutrition Services, and the Nutrition Services Incentive Program, provide services and meals to elderly people. The Supportive Services program helps states and area agencies on aging (AAAs) facilitate the development and implementation of a comprehensive, coordinated system for providing long-term care in home and community-based settings in a way that responds to the needs and preferences of older people and their family caregivers. The Nutrition Services programs support nutrition services and provide resource incentives to encourage and reward effective and efficient performance in the delivery of nutritious meals to elderly people. The Department of Social and Health Services administers federal programs under the Older Americans Act, including the Aging Cluster programs. In fiscal year 2023, the Department spent about $39.5 million in Aging Cluster federal funding, including about $38.4 million paid to 13 AAAs. Federal regulations require the Department to monitor its subrecipients’ activities. This includes: • Verifying that subrecipients obtain a single audit if they spend $750,000 or more in federal awards during a fiscal year • Following up and ensuring that subrecipients take timely and appropriate action on all deficiencies pertaining to the federal award • Issuing a management decision to the subrecipient, within six months, for applicable audit findings pertaining to the federal award Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure subrecipients of the Aging Cluster programs obtained required single audits. The Department had processes in place to monitor that subrecipients obtained single audits. To monitor compliance with these requirements, the Department used Excel spreadsheets to track subrecipients’ single audits. During the audit period, however, the Department did not adequately perform this process. The Department did not regularly check to ensure every subrecipient obtained a single audit when it was due, and did not verify the single audit report had been submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. We used a non-statistical sampling method to randomly select and examine six out of a total population of 13 AAAs, as well as two additional AAAs that were individually significant, to verify whether they had obtained single audits. We found four AAAs did not obtain and submit a single audit by the required deadlines, and there was no evidence that the Department communicated with the AAAs when the reports were late. During our testing, we found three AAAs eventually submitted their single audit reports after the due date. We also found one AAA has not submitted the required single audit report. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Due to management turnover throughout the fiscal year, staff were behind on monitoring whether the Department’s subrecipients obtained their required single audits. In addition, management did not exercise sufficient oversight to ensure staff completed the monitoring. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure that all subrecipients requiring a single audit obtain one, that timely and appropriate action is taken for subrecipients that did not obtain a single audit, and that subrecipients with audit findings receive required management decisions timely. Recommendations We recommend the Department strengthen internal controls to ensure: • Subrecipients obtain a single audit if they spend $750,000 or more in federal awards during a fiscal year • Subrecipients take timely and appropriate action on all deficiencies pertaining to the federal award • It issues all required management decisions to subrecipients, within six months, for applicable audit findings pertaining to the federal award Department’s Response The Department agrees with the finding. The Federal Compliance Manager position was vacant from April 2021 to April 2022 and once the position was filled the priority was to catch up on monitoring, reviewing area plans and cost allocations submitted by the Area Agency on Aging (AAA). It was for that reason that tracking whether the Department’s subrecipients obtained and submitted their required single audits was not completed during the audit period. The two AAAs that did not submit single audits were contacted in January 2024 and remediation of the audit exceptions are underway. Effective March 31, 2024, the Single Monitor Tracking Sheet will be updated to document the dates of audit requests, receipts, date of review, confirmation of FAC audit receipt, date of communication with AAA, and when a management letter is sent and the AAA responses. By July 1, 2024, a reminder process will be implemented for all AAAs to submit their audits six months after the subrecipient fiscal year-end close. Email reminders will be sent until single audits are received or once the AAA has communicated an estimated audit completion date. Communication will be documented in Tracker. The AAA & Grants Unit Manager or Office Chief will review the Single Monitor Tracking Sheet nine months after the sub-recipient fiscal year-end close to ensure all Single audits are received timely. Follow up will occur monthly on outstanding audits and timing of management letters. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes federal award identification requirements for subawards. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-042 The University of Washington did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: NU2GGH002038; NU2GGH002116; NU2GGH002157; NU2GGH002242 NU2GGH002298; NU2GGH002360 NU2GGH002374; NU2GGH002423 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-029 Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President’s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University’s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2023, the University spent almost $70 million in federal program funds, more than $41 million of which it awarded to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the University is required to collect and report information on each subaward of federal funds more than $30,000. The University must report subawards by the end of the month following the month in which it made the subaward or subaward amendment. The intent of the Act is to empower citizens with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. The University generates subawards and subaward modifications using information from its Sponsored Projects Administration and Electronic Research Compliance (SPAERC) system. The Office of Sponsored Programs (OSP) is responsible for monitoring whether FFATA applies to a subaward and ensuring the FFATA reporter is notified. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the University did not establish and follow internal controls to ensure compliance with reporting requirements. The prior finding number was 2022-029. Description of Condition The University did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the act. During the audit period, the University was required to report 45 subawards/modifications totaling more than $41 million of program funds that it awarded to 14 subrecipients. We used a non-statistical sampling method and randomly selected ten out of 45 subawards required to be reported during the audit period. We found the University failed to report two subawards (20 percent) totaling $245,942 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The University uses SPAERC to identify and monitor active subawards and subaward modifications for the Global AIDS program. However, OSP does not currently use SPAERC data to generate external reports to identify subawards and subaward modifications that require reporting in FSRS. During the audit period, the subaward administrator responsible for identifying and actively monitoring subawards and modifications for reporting purposes did not notify the FFATA reporter that such reporting applied to these subaward modifications. Effect of Condition Failing to submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. The terms and conditions of the federal award allow the grantor to penalize the University for noncompliance by suspending or terminating the federal award or withholding future awards. Recommendations We recommend the University: • Establish effective internal controls to ensure reports are submitted, as required • Ensure management monitors reporting of this information to ensure future reports are submitted completely and accurately University’s Response The University acknowledges that two subawards were not reported in accordance with Federal Funding Accountability and Transparency Act (FFATA) requirements. The University: • Submitted the required reports as of November 21, 2023. • Reviewed reporting for all subawards for the program active during fiscal year 2023 and ensured that all reports were submitted. The University will continue to use the controls in place related to FFATA reporting, but will enhance through better use of the data in the Sponsored Projects Administration and Electronic Research Compliance (SPAERC) system and customized/configured reports using SPAERC data to identify reporting needs. The University will: • Strengthen management monitoring process to ensure compliance with FFATA reporting requirements. • Test the reports to assist in the identification and review of FFATA-reportable actions. Given the timing of the audit filing, which was not until June, and the significant enterprise-wide financial system replacement and implementation, the work to implement all corrective action steps, including enhanced FFATA reporting tracking, was slow in FY23. Specifically, creation and implementation of the customized/configured reports using SPAERC data was delayed due to the enterprise-wide financial system replacement in July 2023, only one month after the official filing of the FY22 audit report. This impacted the Decision Support Services team responsible for generating such reconfigured reports, and that interrupted OSP’s ability to test out these reports. We expect these to be delivered and tested in FY25, but, in meantime, will use a more generic report generated by OSP staff to identify each subaward of federal funds more than $30,000, for timely reporting. Auditor’s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) 3. What to report. You must report the information about each obligating action that the submission instructions posted at http://www.fsrs.gov specify.

2023-043 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: NU2GGH002038; NU2GGH002116; NU2GGH002157; NU2GGH002242; NU2GGH002298; NU2GGH002360; NU2GGH002374; NU2GGH002423 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-030 Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President’s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University’s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2023, the University spent almost $70 million in federal program funds, about $42 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the University did not establish adequate internal controls over and did not comply with federal requirements for subrecipient monitoring. The prior finding number was 2022-030. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: • Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed • Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 19 subrecipients. We found the University did not adequately monitor four subrecipients (57 percent) to ensure they received a required single or program-specific audit. Additionally, we found three of the four subrecipients received audit findings for the Global AIDS program, but the University did not issue a written management decision to the subrecipients and ensure appropriate corrective actions would be taken to correct the deficiencies reported, as required. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The University’s Office of Sponsored Programs used a spreadsheet to track subrecipient certifications and whether they were subject to a single or program audit. However, the University did not obtain updated annual audit certifications from these subrecipients to determine if they required an audit and, therefore, did not require the subrecipients to provide documentation of a single or program-specific audit. In addition, University management did not follow up with the subrecipients to verify that audits were performed. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: • Follow policies and procedures to ensure subrecipients receive required single or program-specific audits • Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required • Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations • Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations • Issue a written management decision for all applicable audit findings, if necessary University’s Response In the prior audit, it was found the University did not establish adequate internal controls over and did not comply with federal requirements for subrecipient monitoring. The prior finding number was 2022-030. As a result of that finding, the University took corrective action, which was conveyed in November 2023, but given the significant enterprise-wide financial system replacement and implementation, the work to implement all corrective action steps, including single audit verification, has been interrupted and audit certification was not performed consistently during FY23. The University uses a certification process to obtain information and documentation needed to assess each subrecipient. As part of corrective action from finding 2022-030, the University updated the certification process with all subrecipients to confirm if federal expenditures during a fiscal year exceed the $750,000 threshold to require a single or program-specific audit by revising the initial certification form used to gather information and carry out a risk assessment. However, the University is still working on enhancing the annual certification process to confirm subrecipients receive required single or program-specific audits each year, to review such audit reports, and issue written management decisions, as required, including that subrecipient develop and perform acceptable corrective actions to address all applicable audit recommendations. Auditor’s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, Section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes requirements for pass through entities including monitoring of subrecipients. Title 45 CFR Part 75, section 501, Audit requirements, establishes the single audit requirements for recipients of federal assistance. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington’s Policies, Procedures and Guidance (UW Research), GIM 8 – Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients’ risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW’s subrecipient monitoring requirements are comprised, at a minimum, of the following: • Completion of the UW’s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring – Entity Level Entity level monitoring consists of a combination of the following: • Initial Subrecipient Certification Form completion and assurance by subrecipient’s authorized official • Annual audit assurance through an annual audit certification form • Maintenance of a subrecipient profile list, which includes information on the entity’s past audit information and certificationsRisk assessment carried out at each annual renewal of a subaward.

2023-044 The Department of Health did not have adequate internal controls to ensure payments to subrecipients were allowable, met cost principles, and were within the period of performance for the Immunization Cooperative Agreements program. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: 6NH231IP922619-04-01; 5 NH23IP922619-04-00;6 NH23IP922619-02-04; 6 NH23IP922619-02-06; 6 NH23IP922619-02-03; 6 NH23IP922619-02-02 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: $416,027 Prior Year Audit Finding: Yes, Finding 2022-031 Background The Department of Health administers the Immunization Cooperative Agreements program, which aims to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. Emphasis is placed on populations at highest risk for underimmunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2023, the Department spent more than $24.6 million in federal program funds, about $8.5 million of which it disbursed to subrecipients. The Department also received more than $97.6 million in non-cash assistance from the federal grantor in the form of vaccines. To help carry out the program’s objectives, the Department issues consolidated contracts to Local Health Jurisdictions that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. Each federal grant specifies a performance period during which recipients must obligate and liquidate program costs. The periods for this program are July 1 through June 30 of the associated fiscal year. Payments for costs charged before a grant’s beginning date or after the ending date are not allowed without the grantor’s prior approval. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate and high-risk subrecipients for each of the following expense categories: • Salaries and benefits • Equipment ($5,000 or more) • Materials and supplies • Meals • Outreach materials • Travel • Training • Contracts • Sub-subrecipients • Administrative/indirect costs During the audit period, subrecipients submitted invoices to the Department’s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The accounting unit emailed the requests to Department program staff requesting review to ensure the payment was allowable and within the period of performance. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable, met cost principles and were within the period of performance for the program. The prior finding number was 2022-031. Description of Condition The Department did not have adequate internal controls to ensure payments to subrecipients were allowable, met cost principles, and were within the period of performance for the program. Department program staff were required to use the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, were within the period of performance and included required supporting documentation. However, program staff did not communicate their approval to the accounting unit that issues payment. As a result, the Department paid the subrecipients without knowing whether these expenditures had been reviewed and approved by program staff. We used a statistical sampling method to randomly select and examine 56 out of 681 provider payments. Additionally, we judgmentally reviewed two individually significant payments that exceeded $476,000 each. In total, we examined more than $2.4 million in provider payments as part of the audit. Of the 58 payments examined, we identified seven payments (12.5 percent) and one individually significant payment that did not have the required supporting documentation for the subrecipients’ assigned risk level. In addition, we judgmentally selected and examined six high-risk transactions out of a population of 1,293 expenditures charged to the federal fiscal year 2023 award that opened during the audit period. We found four expenditures that were improperly charged to the grant because the activity occurred before the period of performance. We also judgmentally selected and examined two out of a population of 167 expenditures charged to the federal fiscal year 2022 award that closed during the audit period. We found one expenditure was improperly charged to the grant because the activity occurred after the period of performance. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department’s established procedures allowed for paying providers without ensuring program staff reviewed and determined the payment was allowable, within the period of performance, and adequately supported. Furthermore, program management did not ensure staff followed the existing review procedures. Additionally, the Department did not ensure that expenditures that were cost allocated and directly charged during the opening and closing of awards were within the award’s period of performance. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes and within the period of performance. By not ensuring subrecipients submitted required supporting documentation, staff could not adequately verify the reimbursement claims, and the Department could not ensure its subrecipients complied with the subaward’s terms and conditions. The eight payments for which the Department did not have required supporting documentation from subrecipients totaled $404,592 in known questioned costs. Based on these results, we estimate that the total amount of likely improper payments using federal funds to be $588,502. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our “best estimate of total questioned costs,” as required by 2 CFR § 200.516(3). To ensure a representative sample, we stratified the population by dollar amount. For the federal fiscal year award 2023 that opened during the audit period, we identified questioned costs totaling $3,852. For the federal fiscal year 2022 award that closed during our audit period, we identified questioned costs totaling $7,583. In total, we identified $416,027 in known federal questioned costs and $599,937 in likely questioned costs. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Improve internal controls to ensure that it obtains adequate supporting documentation from subrecipients before reimbursing them • Improve internal controls to ensure program staff review, approve, and communicate approval of expenditures to those issuing payment to verify they are for allowable activities and within the period of performance prior to payment • Improve its internal controls to ensure expenditures charged at the beginning and end of an award are within the period of performance • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response We appreciate the State Auditor’s Office audit of the Immunizations grant. DOH is committed to ensuring our programs comply with federal regulations. The Department does not concur with the finding. While the Department has taken steps to ensure payments to providers contain proper support in line with our A19 matrix for risk assessed of our subrecipients, we continue to disagree with SAO’s assessment of a material weakness in internal controls over the consolidated contract provider payment process. As noted in the finding, program staff now document their review and approval of consolidated contract reimbursement requests. If the payment has no issues or concerns, the total payment is logged in a spreadsheet with documented review and approval to denote no issues and that full payment can be made. If there is a question on allowable cost, period of performance, a need for additional backup or an error, program Immunization staff will update spreadsheet with the amounts in question and communicate with the Local Health Jurisdiction, document the correspondence, and contact the accounting consolidated contract payment desk to withhold the specific amount of payment until the issue is resolved. Once resolved staff update the spreadsheet to denote the issue has been resolved and email accounting to release the payment amount in question. The defined process of consolidated contract payments has been in place for well over a decade and was implemented in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions (LHJs) for state and federal programs in order to serve the residents of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the LHJs. We do not concur with several of the exceptions and questioned costs identified. The Department believes there was a lack of understanding of DOH process related to allocation of space costs and how overtime is earned and accounted for according the Collective Bargaining Agreement. Additionally, while in some instances the level of support did not meet our internal policies, which are held to a higher standard than federal requirements, the level of documentation received from the subrecipient accounting system gave us assurance that the transactions/costs questioned met federal cost principles for allowability and period of performance. This, along with the following additional overall internal monitoring and policy processes support our overall assurance of the allowability of payments: • The Immunization program staff maintain detailed budget information for each subrecipient by project area, and as A-19s are submitted, program and accounting staff update budget spreadsheets. When reviewing the support provided by the subrecipient, they ensure amounts submitted by project are reasonable and are in alignment with expectations for the budget period submitted. • The Immunization program refer to the federal Immunization Program Operations Manual (IPOM) to determine allowable costs, purchase, and procurement procedures. •The Fiscal Monitoring Unit provides technical assistance and training, not only to program staff, but to the subrecipients while onsite and at the request of the entities receiving funding. • The Immunizations program provides technical assistance, policies, and training to Immunization subrecipients related to both allowability and compliance. • The Immunizations program has continued to strengthen processes to ensure that the backup documentation received is in alignment with the agency’s documentation matrix for sub-recipients per their risk level. Auditor’s Remarks While management has implemented a new procedure for program staff to document their review and approval of subrecipient reimbursement requests, this approval is not communicated to fiscal staff before payments are issued. As a result, approval is assumed and not verified by fiscal staff when no response is received from the program staff. The amount of supporting documentation submitted by a subrecipient utilizing consolidated contracts is extensive and often covers multiple reimbursement requests for more than one federally funded program. In our judgment, this increases the risk that a proper review is not performed before payments are issued. The Department did not concur with some of the identified exceptions and stated it believed it was due to our Office’s lack of understanding of their processes. This assertion is not accurate. We understand their processes, but four of the exceptions were payments for services that occurred prior to the grant being open (expenses were for the month of June 2022, but the award opened July 1, 2022. These four exceptions included the “allocation of space costs and how overtime is earned and accounted for” referred to in the Department’s response. These exceptions were discussed in detail with the Department and during these discussions the Department mistakenly asserted that the time of payment was what determined compliance, not when the activity occurred. This is not correct and may be part of why the Department did not concur with the exceptions. We reaffirm our finding and will follow up on the status of the Department’s corrective action during our next audit period. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 2, Definitions, includes the definition of improper payment. Title 45 CFR Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. 45 CFR Part 75, section 403, Factors Affecting Allowability of Costs. 45 CFR Part 75, section 410, Collection of Unallowable Costs Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 7/1/22 This is the backup documentation required based on the determined risk level. More supporting documentation may be requested by programs at any time regardless of risk category. Please review your statement of work to determine if there are additional documentation requirements. NOTE: Indirect costs included on A19s must include verification of the following: • Indirect plan is current and on file with DOH • Indirect rate is being applied accurately to allowable expenditures • If the indirect cost rate plan has expired, no indirect costs can be charged If the subrecipient is using 10% de minimis they must complete DOH de minimis certification

2023-045 The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Federal Funding Accountability and Transparency Act for the Immunization Cooperative Agreements program. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 6NH23IP922619-04-01; 5NH23IP922619-04-00; 6NH23IP922619-02-04; 6NH23IP922619-02-06; 6NH23IP922619-02-03; 6NH23IP922619-02-02 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-032 Background The Department of Health administers the Immunization Cooperative Agreements (Immunization) program. The objective of the program is to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. Emphasis is placed on populations at highest risk for under immunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2023, the Department spent more than $24.6 million in federal program funds, about $8.5 million of which it disbursed to subrecipients. The Department also received more than $97.6 million in non-cash assistance from the federal grantor in the form of vaccines. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower people with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. When a new subaward or amendment is executed, Department staff update a spreadsheet throughout the month with the subaward information required for reporting. Staff then send the spreadsheet to management for approval before submitting the report. The Department was required to report 36 subawards and amendments in fiscal year 2023, totaling $20,915,787. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate controls over and did not comply with requirements to ensure it filed reports required by the Act for the Immunization program. The prior finding number was 2022-32. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Act for the Immunization program. During the first three months of the audit period, management did not review the reports prior to submission. During this period, the Department executed 30 out of the 36 subawards and amendments (83 percent) totaling $17,474,404, which represented 84 percent of the total amount obligated in the fiscal year. We used a non-statistical sampling method to randomly select and examine nine out of the total population of 36 subawards and amendments. We found: • Five of the nine subawards and amendments (56 percent) were not reported timely. • One of the nine subawards (11 percent) contained an incorrect Unique Entity ID (UEI), subawardee name and address. We consider this internal control deficiency to be a material weakness that led to material noncompliance. Cause of Condition For the first three months of the audit period, when most of the subawards were executed, the Department did not have procedures in place to ensure management did an adequate review of the reports—and documented that it occurred—before submitting them in FSRS. Furthermore, Department officials acknowledged that for the first part of the year, staff did not use the signature date as the obligation date, which resulted in reports being submitted late. Department officials also said the amendments were submitted late because they did not have the UEIs for the subawardees, which are required to complete the submission. Effect of Condition Without performing an adequate review, management cannot ensure the Department submits accurate, complete and timely reports. Furthermore, failing to submit complete, accurate and timely reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Lastly, the terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance by suspending or terminating the federal award or withholding future awards. Recommendation We recommend the Department ensure management reviews required reports to ensure they are accurate and complete before submission. Department’s Response We appreciate the State Auditor’s Office audit of the immunization grant. DOH is committed to ensuring our programs comply with federal regulations. As a result of the prior year’s recommendation the Department put procedures in place to address the identified exceptions. Unfortunately, the procedures were not in place for a portion of the fiscal year due to the timing of the audit and when issues were identified. Moving forward with current controls in place, this should eliminate these errors from occurring in the future. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 U.S. CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation 1. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) 3. What to report. You must report the information about each obligating action that the submission instructions posted at https://www.fsrs.gov specify. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-046 The Department of Health did not have adequate internal controls to ensure payments to subrecipients were allowable, met cost principles, and were within the period of performance for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU50CK000515-05-00; NU50CK000515-01-06; NU50CK000515-01-07; NU50CK000515-01-08; NU50CK000515-02-04; NU50CK000515-01-09; NU50CK000515-02-01; NU50CK000515-02-06; NU50CK000515-02-03; NU50CK000515-02-09; NU50CK000515-02-07; NU50CK000515-03-03; NU50CK000515-03-01; NU50CK000515-04-00; NU50CK000515-04-03 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: $1,735 Prior Year Audit Finding: Yes, Finding 2022-033 Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local, and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction, and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory, and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports several specific infectious disease programs and projects, and provides special appropriations in response to infectious disease emergencies. The Department spent about $198.5 million in federal grant funds in fiscal year 2023, about $17 million of which was disbursed to subrecipients. To help carry out the program’s objectives, the Department issues consolidated contracts to Local Health Jurisdictions that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate and high-risk subrecipients for each of the following expense categories: • Salaries and benefits • Equipment ($5,000 or more) • Materials, supplies, and other • Travel (in-state and out-of-state) • Contracts and sub-subrecipients • Administrative/indirect costs During the audit period, subrecipients submitted invoices to the Department’s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The emails were sent to Department program staff requesting review to ensure the payment was allowable. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Beginning in February 2023, program staff documented their review and approval of the reimbursement request on a spreadsheet. The spreadsheet was only used at the program level, so it was not shared with the fiscal staff to communicate approval prior to issuing payment. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with fiscal monitoring requirements to ensure subrecipients of the ELC program only used funds for allowable activities and met cost principles. The prior finding number was 2022-033. Description of Condition The Department did not have adequate internal controls to ensure payments to subrecipients were allowable, met cost principles, and were within the period of performance for the ELC program. Department program staff were required to use the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, were within the period of performance and included required supporting documentation. However, program staff did not communicate their approval to the accounting unit that issues payment. As a result, the Department paid the subrecipients without knowing whether these expenditures had been reviewed and approved by the program staff. We used a statistically valid sampling method to randomly select and examine 55 out of 441 subrecipient payments. Additionally, we judgmentally reviewed one individually significant payment that totaled $939,182. In total, we examined more than $8.8 million in subrecipient payments as part of the audit. Of the 55 randomly selected payments examined, we identified two payments (3.6 percent) that did not have the required supporting documentation for the subrecipients’ assigned risk level. We consider these internal control deficiencies to be a material weakness. Cause of Condition The Department’s established procedures allowed for paying subrecipients without ensuring program staff reviewed and determined the payment was allowable and adequately supported. Furthermore, program management did not ensure staff followed the existing review procedures. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes and within the period of performance. By not ensuring subrecipients submitted required supporting documentation, staff could not adequately verify the reimbursement claims, and the Department could not ensure its subrecipients complied with the subaward’s terms and conditions. The two payments for which the Department did not have required supporting documentation from subrecipients totaled $1,735 in known questioned costs. Based on these results, we estimate that the total amount of likely improper payments using federal funds to be $46,169. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our “best estimate of total questioned costs,” as required by 2 CFR 200.516(3). To ensure a representative sample, we stratified the population by dollar amount. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Improve internal controls to ensure that it obtains adequate supporting documentation from subrecipients before reimbursing them • Improve internal controls to ensure program staff review and approve expenditures to verify they are for allowable activities prior to payment • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response We appreciate the State Auditor’s Office audit of the ELC grant. DOH is committed to ensuring our programs comply with federal regulations. The Department does not concur with the finding. While the Department has taken steps to ensure payments to providers contain proper support in line with our A19 matrix for risk assessed of our subrecipients, we continue to disagree with SAO’s assessment of a material weakness in internal controls over the consolidated contract provider payment process. As noted in the finding, program staff now document their review and approval of consolidated contract reimbursement requests. If the payment has no issues or concerns, the total payment is logged in a spreadsheet with documented review and approval to denote no issues and that full payment can be made. If there is a question on allowable cost, period of performance, a need for additional backup or an error, program ELC staff will update spreadsheet with the amounts in question and communicate with the Local Health Jurisdiction (LHJ), document the correspondence, and contact the accounting consolidated contract payment desk to withhold the specific amount of payment until the issue is resolved. Once resolved staff update the spreadsheet to denote the issue has been resolved and email accounting to release the payment amount in question. The defined process of consolidated contract payments has been in place for well over a decade and was implemented in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions for state and federal programs in order to serve the residents of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the LHJs. Auditor’s Remarks While management has implemented a new procedure for program staff to document their review and approval of subrecipient reimbursement requests, this approval is not communicated to fiscal staff before payments are issued. As a result, approval is assumed and not verified by fiscal staff when no response is received from the program staff. The amount of supporting documentation submitted by a subrecipient utilizing consolidated contracts is extensive and often covers multiple reimbursement requests for more than one federally funded program. In our judgment, this increases the risk that a proper review is not performed before payments are issued. We reaffirm our finding and will follow up on the status of the Department’s corrective action during our next audit period. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 2, Definitions, includes the definition of improper payment. Title 45 CFR Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. 45 CFR Part 75, section 403, Factors Affecting Allowability of Costs. 45 CFR Part 75, section 410, Collection of Unallowable Costs. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 7/1/2022 This is the backup documentation required based on the determined risk level. Please ensure the detailed GL expenditure report clearly aligns with the A19 form. More supporting documentation may be requested by programs at any time due to programmatic requirements regardless of risk category. NOTE: Indirect costs included on A19s must include verification of the following: • Indirect plan is current and on file with DOH • Indirect rate is being applied accurately to allowable expenditures • If the indirect cost rate plan has expired, no indirect costs can be charged If the subrecipient is using 10% de minimis they must complete DOH de minimis certification

2023-047 The Department of Health did not have adequate internal controls over and did not comply with suspension and debarment requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU50CK000515-05-00; NU50CK000515-01-06; NU50CK000515-01-07; NU50CK000515-01-08; NU50CK000515-02-04; NU50CK000515-01-09; NU50CK000515-02-01; NU50CK000515-02-06; NU50CK000515-02-03; NU50CK000515-02-09; NU50CK000515-02-07; NU50CK000515-03-03; NU50CK000515-03-01; NU50CK000515-04-00; NU50CK000515-04-03 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Components: Suspension and Debarment Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local, and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction, and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory, and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports many specific infectious disease programs and projects, and it provides special appropriations in response to infectious disease emergencies. The Department spent about $198.6 million in federal grant funds during fiscal year 2023. Federal regulations prohibit grant recipients from contracting with or making subawards to parties that are suspended or debarred. The grantee must verify that all contractors and subrecipients receiving $25,000 or more in federal funds have not been suspended, debarred or otherwise excluded. This verification may be accomplished by obtaining a written certification from the contractor or subrecipient, or inserting a clause into the contract where the contractor or subrecipient states it is not suspended or debarred. Alternatively, the grantee may search the federal System for Award Management at SAM.gov to verify the contractor’s or subrecipient’s suspension and debarment status. This requirement must be met before entering into the contract. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with suspension and debarment requirements for the ELC program. During the state fiscal year, the ELC program had 15 newly executed contracts that required a suspension and debarment check. The Department did not perform a suspension and debarment check for nine contracts (60 percent) with educational service districts (ESDs). The remaining six contracts with various entities received a suspension and debarment check. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not have proper management oversight to ensure the ESD contracts received the required suspension and debarment checks. Department officials said that to accelerate contracts during the COVID-19 pandemic, along with the misperception that ESDs are an extension of the Office of Superintendent of Public Instruction, these checks were not performed. Effect of Condition By not performing suspension and debarment checks, the Department cannot ensure all its contractors and subrecipients are allowed to receive federal funds. Without proper checks, the Department could be required to repay the grantor for any payments made to a contractor or subrecipient that is suspended or disbarred. We verified the nine ESDs were not suspended or debarred, so we are not questioning costs. Recommendation We recommend the Department establish adequate internal controls to ensure it completes the required suspension and debarment checks before entering into contracts with contractors and subrecipients that will receive $25,000 or more in federal funds. Department’s Response We appreciate the State Auditor’s Office audit of the ELC grant. DOH is committed to ensuring our programs comply with federal regulations. During the COVID pandemic DOH operated under a competitive procurement waiver in order to expedite funding to critical partners throughout the state. Efforts to accelerate contracts combined with the misperception that Educational Service Districts (ESDs) are an extension of the Office of Superintendent of Public Instruction (OSPI was named in the IAA as a collaborator for the Learn to Return Playbook), prompted the decision to use an Interagency Agreement and no suspension & debarment check was performed at the time. We have corrected this error moving forward with ESD contracts. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 213, Suspension and debarment, states: Non-federal entities are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, 2 CFR parts 180 and 376. These regulations restrict awards, subawards and contracts with certain parties that are debarred, suspended or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-048 The Department of Health did not have adequate internal controls over and did not comply with reporting requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU50CK000515-01-08; NU50CK000515-02-04; NU50CK000515-02-07 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-034 Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local, and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction, and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory, and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports many specific infectious disease programs and projects, and it provides special appropriations in response to infectious disease emergencies. The Department spent about $198.5 million in federal grant funds during fiscal year 2023. During the audit period, the Department was required to submit various reports to the Centers for Disease Control and Prevention (CDC) for three ELC projects: Enhancing Detection, Enhancing Detection Expansion, and Reopening Schools. Fiscal Reporting For all three projects, the Department submits monthly fiscal reports in REDCap, a web-based system used by the CDC to collect data. This report summarizes the total monthly expenses, including salaries, fringe benefits, equipment, travel, supplies and contractual payments. Testing Reporting The Reopening Schools project uses this report to collect data on the use of PCR, antigen, and over-the-counter COVID-19 tests at schools. The Department works with a contractor that compiles testing data and reports the information back to the Department, which then submits the data using the CDC’s report template in REDCap. Case Investigation and Contact Tracing (CICT) Reporting For the Enhancing Detection and Enhancing Detection Expansion projects, the Department is required to submit monthly reports covering various attributes related to the number of COVID-19 cases reported and investigated. When a COVID-19 case is identified in the Washington Disease Reporting System, it is entered into the Case Risk and Exposure Surveillance Tool (CREST). Epidemiologists at the Department follow contact tracing protocols and enter the results of their investigations into CREST. The data is then reported in REDCap. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with reporting requirements for the ELC program. The prior finding number was 2022-034. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements for the ELC program. During the audit period, the Department’s ELC program staff said that all reports were reviewed and approved by appropriate staff before submission to the federal government. However, program staff for the fiscal reports and CICT reports did not document their review or approval until January 2023, so we were unable to determine if the proper reviews occurred for the entirety of the audit period. Furthermore, the Department did not have a documented review during the audit period for the Reopening Schools testing reports. Testing Reporting We used a non-statistical sampling method to select and examine four out of four quarterly Reopening Schools testing reports. We found the total amounts provided by the contractor matched the amounts the Department reported in REDCap for all four quarterly reports. However, the Department did not receive or review the contractor’s detailed data that supports the total amounts to ensure it was complete and accurate before submitting the reports in REDCap. CICT Reporting We used a non-statistical sampling method to randomly select and review five out of 12 monthly CICT reports. We identified one month (20 percent) where the data reported in CREST did not match what was reported in REDCap. Three of the six data fields we tested had variances between CREST and REDCap reports, which ranged from 2.7 percent underreported to 3.79 percent overreported. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Testing Reporting The Department did not require management to document their reviews of reports and supporting documentation before submitting them to the grantor. Therefore, management did not ensure the total amounts provided by the contractor had adequate support to ensure the reports were accurate and complete. CICT Reporting Prior to January 2023, the Department did not require management to document their reviews of reports before or after submission. If management reviewed the CICT reports, the reviews were inadequate for detecting the errors our audit identified. Effect of Condition Testing Reporting By not reviewing and reconciling the contractor’s summary data and supporting documentation, management was unable to demonstrate the amounts reported were complete and accurate. CICT Reporting By not ensuring management completes the proper reviews, the Department cannot reasonably ensure the reports are complete and accurate. Recommendation We recommend the Department establish and follow effective internal controls, including documented reviews, to ensure reports are accurate and complete before submitting them to the federal grantor. Department’s Response We appreciate the State Auditor’s Office audit of the ELC grant. DOH is committed to ensuring our programs comply with federal regulations. As a result of the prior year’s recommendation the Department put procedures in place to address the identified exceptions. Unfortunately, the procedures were not in place for a portion of the fiscal year due to the timing of the audit and when issues were identified. Moving forward with current controls in place, this should eliminate these errors from occurring in the future. In addition, we will work to discuss recommendations with the grants management and contracts teams at the department level to identify best practices to improve internal controls regarding document review and report accuracy to attempt to standardized process and procedures. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-049 The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure subrecipients of the Epidemiology and Laboratory Capacity for Infectious Diseases program received required single audits, and that it appropriately followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health & Human Services Federal Award/Contract Number: NU50CK000515-05-00; NU50CK000515-01-06; NU50CK000515-01-07; NU50CK000515-01-08; NU50CK000515-02-04; NU50CK000515-01-09; NU50CK000515-02-01; NU50CK000515-02-06; NU50CK000515-02-03; NU50CK000515-02-09; NU50CK000515-02-07; NU50CK000515-03-03; NU50CK000515-03-01; NU50CK000515-04-00; NU50CK000515-04-03 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local, and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction, and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory, and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports many specific infectious disease programs and projects, and it provides special appropriations in response to infectious disease emergencies. The Department spent about $198.5 million in federal grant funds during fiscal year 2023, about $17 million of which was disbursed to subrecipients. Federal regulations require the Department to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes to subrecipients, the Department must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a Department-funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the Federal Audit Clearinghouse. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. To monitor its compliance with these requirements, the Department uses an Excel workbook to track subrecipients’ single audits. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure its subrecipients of the ELC program received required single audits, and that it appropriately followed up on findings and issued management decisions. To monitor compliance with these requirements, the Department used an Excel spreadsheet to track subrecipients’ single audits and the agency’s follow-up actions, if necessary. However, during the audit period, the Department did not adequately perform this process. Five subrecipients received an ELC finding, but the spreadsheet did not document them or note the Department’s follow-up actions on the subrecipients’ corrective action plans. In addition, the Department did not issue a management decision letter for any of these five findings, so the tracking spreadsheet also did not document any management decisions. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Department management said that due to high turnover throughout the fiscal year, staff were behind on monitoring the single audits. In addition, management did not exercise sufficient oversight to ensure staff completed the monitoring. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure that all subrecipients requiring a single audit obtain one, and that subrecipients with audit findings receive required management decisions timely. Recommendations We recommend the Department strengthen internal controls to ensure: • All subrecipients receive a single audit, if required • It issues all required management decisions to subrecipients, within six months, for applicable audit findings pertaining to the federal award • Subrecipients take timely and appropriate action on all deficiencies pertaining to the federal award Department’s Response We appreciate the State Auditor’s Office audit of the ELC grant. DOH is committed to ensuring our programs comply with federal regulations. The Department agrees with the finding. The Department will review internal controls over ensuring timely review of federal subrecipient single audits and issuance of management decision letters, including monitoring controls by management to ensure future compliance with the requirement. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, states, in part: All pass-through entities must: d. Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by section 75.521. f. Verify that every subrecipient is audited as required by subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in section 75.501. h. Consider taking enforcement action against noncompliant subrecipients as described in section 75.371and in program regulations. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-050 The Department of Health did not have adequate internal controls over and did not comply with fiscal monitoring requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU50CK000515-05-00; NU50CK000515-01-06; NU50CK000515-01-07; NU50CK000515-01-08; NU50CK000515-02-04; NU50CK000515-01-09; NU50CK000515-02-01; NU50CK000515-02-06; NU50CK000515-02-03; NU50CK000515-02-09; NU50CK000515-02-07; NU50CK000515-03-03; NU50CK000515-03-01; NU50CK000515-04-00; NU50CK000515-04-03 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-033 Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local, and territories’ public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction, and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory, and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports many specific infectious disease programs and projects, and it provides special appropriations in response to infectious disease emergencies. The Department spent about $198.5 million in federal grant funds during fiscal year 2023, about $17 million of which was disbursed to subrecipients. In response to the COVID pandemic, ELC subrecipients have received a significant increase in funding over the last few years. Federal regulations require the Department to monitor the activities of subrecipients to ensure they use subawards for authorized purposes and in compliance with federal statutes, regulations, and the terms and conditions of the subaward. This monitoring must include reviewing financial reports and taking timely and appropriate action on all deficiencies pertaining to the federal award. The Department assigns each subrecipient a compliance risk level based on standardized criteria. The Department’s Fiscal Monitoring Unit (FMU) conducts on-site fiscal reviews of each subrecipient every two years. This review includes all federal awards the subrecipient received from the Department for the period under review. Reviewers complete a standardized template to document their work. Using the subrecipient’s reimbursement requests, reviewers judgmentally determine how many samples of payroll expenditures and contractor payments to review to ensure there is adequate source documentation. Reviewers also look at general accounting information, budget information, equipment purchases and other items. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with fiscal monitoring requirements to ensure subrecipients of the ELC program only used funds for allowable activities and met cost principles. The prior finding number was 2022-033. Description of Condition The Department did not have adequate internal controls over and did not comply with fiscal monitoring requirements for the ELC program. The Department does not have written procedures to guide reviewers on the number of reimbursement samples to review based on the subrecipient’s risk level. We used a nonstatistical sampling method to randomly select and examine five out of a total of 10 subrecipients that received a fiscal review during the audit period. For each subrecipients, we noted that the fiscal monitoring only covered between 0.19 percent and 3.37 percent of total grant awards. Additionally, the Department only sampled between one and nine transactions specific to the ELC program during the reviews. Furthermore, for each subrecipient, the Department only sampled from either payroll or contractor transactions, never both. These samples covered between 0.02 percent to 1.82 percent of the total ELC grant award for the subrecipients. The table below identifies the samples reviewed for each subrecipient. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management has not established guidance for how many transactions fiscal reviewers need to review from source documentation to have assurance subrecipients spent program funds spent accordance with grant requirements. Furthermore, management believed the level of review was adequate to ensure a sufficient level of monitoring. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are spending federal funds in accordance with grant requirements. Without adequately monitoring each subrecipient’s use of federal funds expended during the period of performance of the subaward, the Department does not have reasonable assurance that the subrecipient has complied with the terms and conditions of the subaward. Further, allowing staff to select samples without adequate guidance from management does not provide the Department with reasonable assurance that subrecipients spent program funds in accordance with grant requirements and federal regulations. Recommendation We recommend the Department strengthen internal controls to ensure it performs fiscal monitoring to a level that provides reasonable assurance that subrecipients’ use of federal funds complies with federal laws and regulations and the subaward’s terms and conditions. Department’s Response We do not concur with the finding. We understand that the State Auditor’s Office (SAO) reviewed a specific grant as part of the scope of this audit. The Department of Health (DOH) finds it misleading that SAO did not report on the subrecipient review process in its entirety. The DOH Fiscal Monitoring Unit (FMU) is not an audit department, therefore the standards DOH FMU functions on are very different than what SAO is recommending in the finding. FMU is audited annually by different federal partners, and those partners have identified no concerns with the monitoring visit methodology used as it is in line with compliance requirement 2 CFR 200.332. Federal guidance does not state DOH must select a certain percentage of samples to ensure adequate review. The DOH subrecipient monitoring process is a comprehensive process that starts with an initial risk assessment which is completed prior to contract execution. This assessment determines the level of support each subrecipient is required to submit as back up documentation for payment requests. Programs then have contract managers review this support prior to payment. In addition, monitoring visits are performed on subrecipients. As part of that process, the FMU reviews at least three months of invoices submitted by subrecipients and includes reviews of entity policies, procedures, internal controls both manual and automated, applicable contracts, history of compliance and applicable cost allocation methodology to ensure each entity is compliant with federal requirements and has adequate internal controls. As part of the review, each FMU staff member will judgmentally select items to review from the selected invoices. FMU staff make this selection using their subject matter expertise about DOH, specific programs and federal guidance to identify transactions for review. This review includes looking at supporting documentation such as timesheets and receipts. FMU reviews the entity, not a specific grant when performing a site visit. The reviewer must document the grants the entity receives and then selects a few transactions from each award type, if applicable. Each entity has a consistent control structure across all funding types so there is no value in reviewing a significant number of transactions from each award type as the controls do not vary. As you can see from the table provided, of the invoices reviewed, DOH typically reviews a quarter of the amount invoiced for. If a grant award is not represented in the invoices selected, FMU will select an additional invoice to ensure all awards are included. This happened in the case of sample three. In the case of sample one, no vendor payments were reviewed because the entity only invoiced for payroll for the selected months. Executive leadership supports the approach used by FMU and is not considering program changes related to the recommendation at this time. Auditor’s Remarks While federal regulations do not require a specific percentage of program expenditures be reviewed when entities monitor subrecipients, in our judgment, the amount reviewed by the Department for the ELC program did not provide management with reasonable assurance that subawards were used for authorized purposes, were spent in compliance with federal requirements and the terms and conditions of the awards. The Department cannot rely on reviews performed for other federal awards as an effective means to ensure compliance for the ELC program. The Department asserts that FMU staff selects invoices for all grant awards issued to the subrecipient. Then, FMU staff judgmentally pick samples from the three selected invoices, significantly limiting the number of expenditures reviewed, as evidence in our testing. Furthermore, the Department does not have written procedures guiding FMU staff on the level of fiscal review for federal grant expenditures. It also acknowledges that the risk assessment level drives the level of backup documentation required for payment requests. The risk assessment does not influence the level of fiscal review. The Department provided a table of the number of expenditures it asserts it reviewed at each subrecipient we tested but acknowledges that these expenditures are from all programs and not specific to ELC. The amount of review done for other federal programs or state funded programs is not relevant when determining whether the subrecipient complied with the terms of the ELC subaward. We reaffirm our finding, and we will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-051 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with Temporary Assistance for Needy Families funds were allowable and property supported. Assistance Listing Number and Title: 93.558 Temporary Assistance for Needy Families Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2201WATANF; 2301WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $107,338,725 Prior Year Audit Finding: Yes, Finding 2022-035 Background The Department of Social and Health Service (DSHS), Community Services Office, administers the Temporary Assistance for Needy Families (TANF) grant that provides temporary cash assistance for families in need. To receive TANF benefits, participants must be engaged in activities listed in the Individual Responsibility Plan through the WorkFirst program, unless the TANF benefits are received only on behalf of a child. TANF grant funds are also used to pay clients’ child care costs to meet one of the program’s primary purposes of helping clients obtain employment. Washington has established the Working Connections Child Care (WCCC) program to help eligible working families pay for child care. Both the Department of Children, Youth, and Families (Department) and DSHS administer the program. The Department is responsible for establishing policies and procedures for licensing child care providers and paying them for allowable child care services. DSHS determines TANF client eligibility and reimburses the Department for child care payments under an agreement between the two agencies. In fiscal year 2023, DSHS paid $107,338,725 related to child care services. The Department uses its Social Service Payment System (SSPS) to process the payments it makes to child care providers. The system allocates payments to various funding sources, based on the eligibility of the client. These funding sources include multiple federal programs, multiple Child Care Development Fund (CCDF) federal grant awards, and state funding. The Department uploads the payment data into the state’s accounting system at a summary level based on the various funding sources. DSHS worked with the Department to setup coding in the Payment Allocating Model system that looks at the client-level information and then assigns the correct TANF source of funds. Once the source of funds is identified, that information is then sent to SSPS for allocation assignment. The Department prepares electronic reports for funds allocated to TANF funding sources and sends DSHS a monthly bill. There is always a need to transfer the funding sources for some payments throughout the year to manage federal and state funds properly. In prior audit periods up until fiscal year 2021, the Department prepared supporting documentation for transfers that included details of what payments it was transferring. The purpose of documenting this detail was to maintain proper support for federal expenditures. Some payments the Department makes for child care are funded by both the CCDF and TANF grants. While the two federal programs are separate, the requirements and policies in Washington for child care payments are consolidated under the WCCC program. Federal regulations require grant fund expenditures to be adequately supported to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls that ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with TANF funds were allowable and properly supported. The prior finding numbers were 2022-035 and 2021-028. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with TANF funds were allowable and properly supported. To identify TANF-funded payments the Department made to child care providers, we requested a population of payments charged to TANF sources from SSPS. However, in fiscal year 2021, management informed us that the Department changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditure coding in SSPS inaccurate and unreliable for testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent TANF funds in accordance with federal and state regulations. Further, this meant we could not test the Department’s payments to child care providers for compliance with activities allowed and cost principles. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. The Department’s accounting practices prevent it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions from SSPS that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. Officials from the U.S. Department of Health and Human Services informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition and Questioned Costs By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit the federal dollars it used for payments to child care providers. Because we could not test transaction-level detail, we also could not determine whether the issues we identified in prior audits had improved or worsened, including the Department’s lack of adequate internal controls and significant rate of noncompliance for payments to child care providers. Because the Department did not comply with federal requirements to allow for the tracing of grant expenditures to a payment level, we are questioning all $107,338,725 in federal program costs for child care payments that DSHS paid during the audit period. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules • Update service level agreements with DSHS to ensure payments are sufficient and properly supported • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Department has managed the Working Connections Child Care (WCCC) program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the TANF grant. The Department allocated the TANF grant to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department’s grant adjustments were processed based on eligible clients and allowable activities and did not include child-level data as required by SAO. The Department held an informal meeting on February 23, 2022, with HHS representative, the State Auditor’s Office and the Office of Financial Management. The intent was to obtain the grantor’s perspective in whether proper grant accounting required the use of child-level data. HHS stated they would not offer an opinion until they received the completed finding from the state. However, the Cause of Condition of finding 2021-033 stated, “HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant.” The Department does not agree with SAO’s interpretation of the meeting outcome. In the area of CCDF eligibility, for state fiscal year 2021, the SAO also issued finding 2021-035, with questioned cost of $32 and in state fiscal year 2022, finding 2022-008 (temporary number) with no questioned costs. There were no other findings or exit items in the area of eligibility determination or the cost allocation of funds for the CCDF or TANF grants. Given that eligibility or cost allocation is not an area of concern and transfers were processed between CCDF and TANF source of funds with the same eligibility requirements, the Department is confident TANF funding was spent appropriately within federal regulations. The Department received a management decision letter dated October 3, 2023, from HHS for finding 2021-033 (2020-038) which states: “the ACF noted that the auditor raised concern about the Department’s accounting procedures and efforts made to trace expenditures at the transaction-level. As the basis for the finding, the auditor used CFRs (200.53, 200.303, 200.403, 200.410) that do not apply to CCDF. Federal regulations allow Lead Agencies to expend and account for CCDF funds in accordance with their own procedures.” In addition, ACF did not sustain the disallowance of questioned costs and stated: “Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” The management decision letter also conveyed the following determination by HHS for finding 2021-035, 2020-039 on eligibility compliance: “The ACF believes the corrective actions taken or planned, as stated above, should prevent recurrence of this finding in the future. In addition, we recognize the continuous progression of the State’s actions to fully resolve this finding as the number of error cases and the amount of questioned costs have both significantly declined over the last 3 years. Therefore, the ACF will not pursue the questioned costs of $32 since the state has taken corrective actions that appear to have resulted in an amount of questioned costs that are immaterial.” The ACF recommended, “that the Department work with the auditors to determine an appropriate methodology that can be tested to ensure child care payments comply with Federal regulations.” The Department met with ACF and SAO on November 8, 2023, to discuss the ACF decision at which time ACF upheld the above statements that the finding was not substantiated. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. The SAO maintained that the program is not auditable without child-level data. The Department does not currently have the staff and resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the auditor’s recommendations, the Department has submitted a budget request for the 2024 supplemental budget. If the request is funded, it would allow adjustments to include child-level data. Auditor’s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. During the February 2022 meeting with HHS that the Department referenced in its response, the grantor stated the specific federal law the Department’s accounting procedures were noncompliant with was 45 CFR 98.67. We agree with the HHS management decision that our references to 2 CFR 200.53, 200.303, 200.403 and 200.410 in the prior finding were not correct. However, HHS adopted these same requirements in 45 CFR 75.2, 75.303, 75.403 and 75.410, respectfully. These requirements were all in place during the audit period. The proper references are included in this finding. In its response, the Department references previous findings related to the eligibility compliance requirement as a basis for asserting federal funds were spent properly. The requirements to determine whether a client is eligible to receive subsidized child care are different than the requirements to ensure the payments for those services are allowable, fall within each award’s period of performance and adequately supported. Without adequate transactional level payment data, our Office is unable to perform tests to verify the Department met these requirements. In addition, we also are unable to verify whether the Department complied with matching, level of effort and earmarking requirements, or that required financial information reported to the federal government was accurate. These matters are referenced in separate findings in our report. We disagree with the Department’s description of the meeting held with HHS program staff on November 8, 2023. The Department states HHS “upheld the above statements that the finding was not substantiated.” This is not accurate. During this meeting, HHS representatives conveyed the same message that they did in the management decision issued October 3, 2023. The finding was partially substantiated because the questioned costs identified in the audit would not be disallowed. The management decision states: “The ACF partially sustains the finding and recommendation. The ACF agrees with the auditor that the Department should strengthen internal controls to ensure payments to child care providers are allowable and properly supported.” “The ACF does not sustain a disallowance for the questioned costs in the amount of $271,353,409 representing the entire amount of the CCDF grant award. Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” We are not aware of what procedures ACF performed to conclude expenditures reported by the Department for fiscal year 2022 were spent only for allowable activities, were for allowable costs and met federal cost principles. We questioned all expenditures because, in our judgment, they were unauditable. Lastly, when the Washington State Legislature approved the Department’s 2023-25 biennial budget, it specified: “Funding in this subsection must be expended with internal controls that provide child-level detail for all transactions.” We reaffirm our finding and hope additional resources from the Legislature, to get down to child-level detail for all transactions, will resolve the auditing problems existing at the Department. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings Title 45 CFR, Section 98.67 – Fiscal requirements, states: (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-052 The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act for the Refugee and Entrant Assistance program. Assistance Listing Number and Title: 93.566 Refugee and Entrant Assistance – State Administered Programs Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2201WARSSS, 2301WARSSS-00, 2301WARSSS-01, 2301WARSSS-02, 2301WARSSS-03, 2301WARSSS-04, 2301WARSSS-05, 2301WARCMA-00, 2301WARCMA-01, 2301WARCMA-02 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Refugee and Entrant Assistance – State Administered programs provide states and replacement designees with funds to help refugees, asylees, trafficking victims, special immigrants, and certain humanitarian parolees during the first 12 months after their date of arrival, or date of eligibility, in the U.S to attain economic self-sufficiency as soon as possible after their initial placement. The U.S. Department of Health and Human Services administers this program by providing assistance through Cash and Medical Assistance (CMA) Grants, as well as Refugee Support Services (RSS). Specifically, CMA covers Refugee Cash Assistance, Refugee Medical Assistance, Unaccompanied Refugee Minor assistance, medical screenings and administrative costs. RSS provides formula funding to assist with facilitating employment and other social services for refugees for up to five years after their date of arrival to the U.S., or date of initial eligibility. In 2022, Congress appropriated additional funding under the Additional Afghanistan Supplemental Appropriations Act, and Additional Ukraine Supplemental Appropriations Act. In Washington, the Department of Social and Health Services administers the state’s Refugee and Entrant Assistance programs. In fiscal year 2023, the Department spent about $49.9 million in federal program funding. Of that amount, the Department passed through more than $18.2 million to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower the public with the ability to hold the federal government accountable for spending decisions and, as result, reduce wasteful government spending. In fiscal year 2023, the Department issued 29 subawards and 18 subaward amendments totaling $39.8 million to subrecipients that it was required to report in FSRS. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. The Department did not have written procedures on the reporting process and did not report any subawards in FSRS during the audit period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department had no procedures in place to determine which subawards and amendments were required to be reported in FSRS. Additionally, management did not ensure that reports were submitted, as required. Effect of Condition Failing to submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. The terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance, including suspending or terminating the federal award or withholding future awards. Recommendations We recommend the Department: • Establish effective internal controls and written procedures to ensure it reports all first-tier subawards of $30,000 or more, as required • Verify all subawards and subaward amendments are reported in FSRS, as required Department’s Response The Department concurs with the auditor’s findings. The Refugee and Entrant Assistance program will immediately report all first-tier subawards, including amendments, totaling $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). To ensure ongoing compliance with the Federal Funding Accountability and Transparency Act Reporting requirements, the Refugee and Entrant Assistance program will establish effective internal controls and written procedures to ensure: • The program reports all first-tier initial subawards of $30,000 or more. • If the initial award is below $30,000, the program tracks subsequent grant modifications and reports as soon as the modifications result in a total award equal to or over $30,000. • Reports for submission will contain the required data elements. In addition, the program will work with the Division of Finance and Financial Resources to develop and subsequently implement a process to verify all subawards and subaward amendments were reported in the Federal Funding Accountability and Transparency Act Subaward Reporting System. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to https://www.fsrs.gov. ii .For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2020. 3.What to report. You must report the information about each obligating action that the submission instructions posted at https://www.fsrs.gov specify. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-053 The Department of Social and Health Services did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Refugee and Entrant Assistance programs received required single audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.566 Refugee and Entrant Assistance – State Administered Programs Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2201WARSSS; 2301WARSSS-00; 2301WARSSS-01; 2301WARSSS-02; 2301WARSSS-03; 2301WARSSS-04; 2301WARSSS-05; 2301WARCMA-00; 2301WARCMA-01; 2301WARCMA-02 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Refugee and Entrant Assistance – State Administered programs provide states and replacement designees with funds to help refugees, asylees, trafficking victims, special immigrants, and certain humanitarian parolees during the first 12 months after their date of arrival, or date of eligibility, in the U.S to attain economic self-sufficiency as soon as possible after their initial placement. The U.S. Department of Health and Human Services administers this program by providing assistance through Cash and Medical Assistance (CMA) Grants, as well as Refugee Support Services (RSS). Specifically, CMA covers Refugee Cash Assistance, Refugee Medical Assistance, Unaccompanied Refugee Minor assistance, medical screenings and administrative costs. RSS provides formula funding to assist with facilitating employment and other social services for refugees for up to five years after their date of arrival to the U.S., or date of initial eligibility. In 2022, Congress appropriated additional funding under the Additional Afghanistan Supplemental Appropriations Act, and Additional Ukraine Supplemental Appropriations Act. In Washington, the Department of Social and Health Services administers the state’s Refugee and Entrant Assistance programs. In fiscal year 2023, the Department spent about $49.9 million in federal program funding. Of that amount, the Department passed through more than $26 million to subrecipients. Federal regulations require the Department to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single audit or program-specific audit. Furthermore, federal regulations require subrecipients to submit their audits in the Federal Audit Clearinghouse and to the pass-through entity within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes on to its subrecipients, the Department must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a Department-funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Refugee and Entrant Assistance programs received required single audits, and that it followed up on findings and issued management decisions. We found the Department did not have adequate internal controls in place to verify whether: • Subrecipients met the audit threshold for federal assistance expended for their fiscal year • Subrecipients received required audits, if necessary, and appropriate actions were taken if audits were not filed • Management decisions were required to be issued for subrecipients who received a single audit or program-specific audit We found the Department did not monitor each of its 41 subrecipients to ensure they received a single audit, if required. Six of the subrecipients received single audits during the audit period. One of those six subrecipients’ audits included Refugee and Entrant Assistance as a major program. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department used accounting system reports to determine how much it reimbursed subrecipients with Refugee and Entrant Assistance funds. However, management did not monitor subrecipients to ensure they received single audits, as required. Additionally, management did not assign any specific employees the responsibility for reviewing subrecipient audit reports and findings. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the Department cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions, and management monitors them for effectiveness where required, the Department cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the Department: • Monitor subrecipients to ensure all required audit reports are submitted and reviewed to determine if any additional subrecipients are required to take corrective action to address audit recommendations • Establish effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required • Ensure subrecipients develop and take acceptable corrective actions to adequately address all audit recommendations • Issue a written management decision for all applicable audit findings, if necessary Department’s Response The Department concurs with the auditor’s findings. The Department’s Office of Refugee and Immigrant Assistance (ORIA) will follow-up with the remaining 35 subrecipients to verify that they completed a single/program audit if they received $750,000 or more in federal assistance. For any subrecipients that have not been audited as required, ORIA will inform the subrecipient of the requirement and monitor for completion. ORIA will work with ESA accounting staff to review all completed audit reports and for any findings found, issue a management decision outlining their determination of the effectiveness of the subrecipients’ proposed corrective actions to address the findings. ESA Accounting will monitor the subrecipent’s corrective actions through completion. To ensure ongoing compliance with subrecipient monitoring requirements, ORIA will work with ESA Accounting to establish and implement effective internal controls and written procedures to: • Identify subrecipients who receive $750,000 or more annually in federal assistance from all sources. • Verify if subrecipients completed required audits, if necessary, and take appropriate action if audits are not completed. • Review single and program-specific audit reports for findings. • Write and issue a management decision, when appropriate, within six months outlining the Department’s determination of the adequacy of the subrecipient’s proposed corrective actions to address the finding. • Monitor the subrecipient’s corrective action plan for timely and effective completion. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, Requirements for pass-through entities, establishes requirements for pass through entities including monitoring of subrecipients. Title 45 CFR Part 75, section 501, Audit requirements, establishes the single audit requirements for recipients of federal assistance. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-054 The Department of Social and Health Services did not have adequate internal controls over and did not comply with federal requirements to perform fiscal and program monitoring of subrecipients for the Refugee and Entrant Assistance programs. Assistance Listing Number and Title: 93.566 Refugee and Entrant Assistance – State Administered Programs Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2201WARSSS; 2301WARSSS-00; 2301WARSSS-01; 2301WARSSS-02; 2301WARSSS-03; 2301WARSSS-04; 2301WARSSS-05; 2301WARCMA-00; 2301WARCMA-01; 2301WARCMA-02 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Refugee and Entrant Assistance – State Administered programs provide states and replacement designees with funds to help refugees, asylees, trafficking victims, special immigrants, and certain humanitarian parolees during the first 12 months after their date of arrival, or date of eligibility, in the U.S to attain economic self-sufficiency as soon as possible after their initial placement. The U.S. Department of Health and Human Services administers this program by providing assistance through Cash and Medical Assistance (CMA) Grants, as well as Refugee Support Services (RSS). Specifically, CMA covers Refugee Cash Assistance, Refugee Medical Assistance, Unaccompanied Refugee Minor assistance, medical screenings and administrative costs. RSS provides formula funding to assist with facilitating employment and other social services for refugees for up to five years after their date of arrival to the U.S., or date of initial eligibility. In 2022, Congress appropriated additional funding under the Additional Afghanistan Supplemental Appropriations Act, and Additional Ukraine Supplemental Appropriations Act. In Washington, the Department of Social and Health Services administers the state’s Refugee and Entrant Assistance programs. In fiscal year 2023, the Department spent about $49.9 million in federal program funding. Of that amount, the Department passed through more than $26 million to subrecipients. Federal regulations require the Department to monitor the activities of subrecipients to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. This includes reviewing financial and performance reports required by the pass-through entity. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to perform fiscal and program monitoring of subrecipients for the Refugee and Entrant Assistance programs. The Department’s administrative policy 19.50.30 - Subrecipient Monitoring requires Department staff to conduct programmatic and fiscal monitoring of subrecipients. We found the Department did not monitor 33 out of 41 subrecipients to ensure compliance with Federal statutes, regulations, or that subaward performance goals are achieved. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department had established administrative policies and procedures to monitor subrecipients for programmatic and fiscal compliance; however, ORIA program management did not accurately identify all program subrecipients to develop a comprehensive monitoring plan. In response to a prior audit finding ORIA program management implemented procedures for determining program subrecipients, however this change did not take effect until the end of the audit period. The Department’s program management did not ensure subrecipients were correctly identified and did not review each subrecipient to ensure they were monitored for compliance, as required. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are spending federal funds in accordance with grant requirements. Without adequately monitoring each subrecipient’s use of federal funds expended during the period of performance of the subaward, the Department cannot reasonably ensure that the subrecipient has complied with the terms and conditions of the subaward. Recommendations We recommend the Department: • Establish effective internal controls to ensure all subrecipients are subject to fiscal and program monitoring, as required • Establish effective internal controls to ensure subrecipients are accurately identified by Department program staff • Establish internal controls to ensure Department staff review financial and performance-based reports for every subrecipient • Monitor each subrecipient to obtain reasonable assurance that each subrecipients’ use of federal funds complies with federal laws and regulations, and the subaward terms and conditions • Communicate to subrecipients any deficiencies noted during its review and ensure appropriate corrective action is taken to address the deficiencies Department’s Response The Department concurs with the auditor’s findings. In response to audit finding 2021-015 covering a different grant administered by the Department’s Office of Refugee and Immigrant Assistance (ORIA), ORIA program staff created a Subrecipient vs. Contractor Determination tool. However, this determination tool was not established until April 2023 with implementation and training occurring April through June 2023. For immediate compliance, ORIA will review all active contracts utilizing federal funding and ensure subrecipient status is correctly determined. ORIA has over 200 active contracts with more than 80 unique providers, most of which will require subrecipient monitoring. To address the significant workload that additional fiscal and programmatic monitoring will require, ORIA and ESA Accounting will explore the department’s ability to increase staff resources. For ongoing compliance, ORIA will work with contracts and accounting staff to develop effective internal controls and clear written procedures covering subrecipient monitoring requirements. ORIA will train all staff responsible for subrecipient monitoring on the newly established internal controls and written procedures. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Department of Social and Health Services, Administrative Policy 19.50.30, Subrecipient Monitoring, states in part: Policy E. Fiscal and programmatic monitoring must be completed. (See Attachment C – Sample DSHS Subrecipient Fiscal Monitoring Site Visit Tool) Based on the result of the risk assessment, a desk or on-site review must be completed. Each Program has control over the form and content of its risk assessment tools. 1. If the risk assessment shows the entity is of low to medium risk, the entity may not require an on-site review. The following items, if available, must be documented in a desk review: a) Entity’s invoices and documentation (A-19s). b) Entity’s program or service and financial reports. c) Surveys or feedback cards from clients. d) Client complaints. e) Entity’s audit or financial report follow up and ensuring all appropriate action has been taken on all items detected through audits, on-site reviews and any other means. f) Entity’s indirect rate certification (Certificate of Indirect Costs, form 02-568 or plan), if applicable. g) If any of the above are not reviewed within the desk review, supervisor approval and an explanation for the reason the items were unable or immaterial to be reviewed must be included within the desk review assessment tool. 2. If the risk assessment shows the entity is a high risk, an on-site visit is required. The program/division will assign the appropriate staff to conduct the on-site review. On-site reviews must include all items in a desk review. In addition, on-site reviews may include, as appropriate, the following items: a) A review of the delivery of program services. b) Discussions about the subrecipient’s problems and challenges. c) Follow-up on identified problems from previous visits. d) Review of faculty/personnel licensing. e) Review of surveys and inspections performed by outside parties. f) Interview of staff to determine whether they are familiar with the program. g) Inspection of the entity’s facilities and operations. h) Review of and compliance with the entity’s policies and procedures governing service delivery and financial processes. i) Review of the entity’s monitoring/production reports. j) Review of any independent limited scope program audits. k) Verification of performance from outside source (e.g. sub-contractors). l) Review of the entity’s self-risk assessment survey. m) Review of internal controls. n) Review of billing practices. o) Review of allocation of costs. p) Review of timesheets or activity reports. q) Review of financial records. E. Monitoring must be documented. 1. The ACD must be used to document all subrecipient-related monitoring activities. 2. Assigned staff must document all desk or on-site reviews performed. The program manager overseeing the contract is responsible for making sure that items included in the review are documented in the ACD by the end of the contract period. Each program must maintain contract monitoring documentation per General Administration’s retention schedule (Administrative Policy 5.04, Records Retention).

2023-055 The Department of Commerce did not have adequate internal controls over and did not comply with reporting requirements for the Low-Income Home Energy Assistance Program. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2201WALIEA; 2101WALIEA; 2201WALIEI; 2101WALWC5; 2101WAE5C6; 2102WALWC6 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-039 Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia, and territories. In Washington, the Department of Commerce administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. The Department makes subawards to community-based organizations to provide this assistance. In fiscal year 2023, the Department spent more than $107 million in federal funds, about $99 million of which it paid to subrecipients. The Department is required to collect and report program information through various reports. LIHEAP Performance Data Form The LIHEAP Performance Data Form has two modules. Module 1 is the Grant Recipient Survey that collects and reports data on sources and uses of LIHEAP funds. Module 2 is the performance measures used to report data on energy burden targeting and reduction, as well as the continuity of home energy service. Annual Report on Households Assisted by LIHEAP The Annual Report on Households is used to report data on the number, income levels, and demographic information on both households assisted and households applying for assistance. Both reports are required to separate the data by regular LIHEAP funding and additional LIHEAP funding under the Coronavirus Aid, Relief, and Economic Security (CARES) Act, and the American Rescue Plan Act of 2021 (ARPA). Quarterly Performance and Management Report Starting in fiscal year 2023, the Quarterly Performance and Management Report was required to report aggregated data on total households assisted, performance management metrics, and estimated uses of LIHEAP funds, along with some narrative information about program implementation and support. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate controls over and did not comply with reporting requirements for the LIHEAP Performance Data Form and Annual Report on Households Assisted. The prior finding was number 2022-039. Two audits ago, we also reported the Department did not have adequate controls over and did not comply with reporting requirements for the Annual Report on Households Assisted. This finding number was 2021-032. Description of Condition The Department did not have adequate internal controls over and did not comply with the reporting requirements for LIHEAP. We reviewed the LIHEAP Performance Data Form and Annual Report on Households Assisted for the federal fiscal year ending September 30, 2022. In addition, we reviewed the three Quarterly Performance and Management Reports that the Department submitted during the audit period. We examined each report and attempted to recalculate the information reported using the supporting documentation used to prepare the reports and data from the LIHEAP database. Based on the data the Department provided, we identified the following: LIHEAP Performance Data Form • In Module 1 Estimated Sources and Uses of LIHEAP Funds, 11 of 16 fields (69 percent) were inaccurate, and the Department was not able to provide any support for eight of these 11. • In Module 2 Household Data, 83 of 240 fields (35 percent) we examined were inaccurate. • Most differences in the amounts reported and the data provided were between less than one percent and 100 percent. • All households data were accurate, but subcategories isolating CARES funding and ARPA funding had variances ranging from (5,016) to 4,557 in the average annual household income data. Annual Report on Households Assisted by LIHEAP • 102 of 162 (63 percent) fields we examined were inaccurate. • The differences in the amounts reported and data provided were between less than one percent and 100 percent. • High level totals were generally accurate, but subcategories isolating CARES funding and ARPA funding had variances ranging from (1,780) to 767 in the number of households assisted. Quarterly Performance Management Report • All nine fields (100 percent) we examined were inaccurate. • The differences between values reported and data provided were between 2 percent and 371 percent. • The variances ranged in underreporting total households assisted by 7,932 to overreporting occurrences of households where LIHEAP restored home energy by 4,722. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management did not ensure they properly reviewed and approved these reports before the Department submitted them. Furthermore, the Department did not retain source documentation used at the time of completing these reports, and the data from the LIHEAP database is real-time data that can change over time without the ability to track changes. As a result, the data provided to verify the reported amounts has changed since the time of report submission. In addition, the Department did not properly follow reporting instructions to break down some data types and did not align rounding methodologies for calculating poverty levels according to reporting requirements. Department officials also said the agency is understaffed and experienced turnover among key personnel, including management, who are involved in preparing and submitting the reports. Effect of Condition By not retaining supporting documentation and source data for the reports, management was unable to demonstrate the amounts the Department reported to the federal grantor were complete and accurate. Additionally, the terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance with reporting requirements by suspending or terminating the award, or withholding future awards, should it choose to do so. Recommendations We recommend the Department: • Establish effective internal controls to ensure the reports are accurate and complete • Ensure management is reviewing reports prior to submission • Ensure supporting documentation and real-time data used to prepare the reports are retained • Ensure all amounts reported align with reporting requirements and methodologies • Consult with the federal grantor to determine if revision and resubmission of the reports are necessary to correct amounts reported Department’s Response The Department appreciates the State Auditor’s Office thorough review of our internal controls and compliance over reporting for the Low-Income Home Energy Assistance Program. The program confirms the reports were reviewed and approved by the Managing Director, the program manager did not retain written approvals. The program will add the following bolded steps to the Department's procedures for LIHEAP federal reporting. The retention of the source data at the time the reports are pulled will result in the Department and SAO reviewing the same data from the same time. The Department follows the reporting process outlined below: • Program manager pulls the necessary reports • LIHEAP program manager will retain all data reports from the LIHEAP data system used for reporting. • LIHEAP information technology staff will save a snapshot of the entire database from the date of the report. This will allow the State Auditor’s Office to review the actual information used for reporting. • Managing director reviews reports before submittal. • Managing director will send written/email approval to program manager • Program manager will retain written approval for the State Auditor’s Office review • Program manager submits reports once managing director approval is received. • Program manager receives notice that the report has been accepted by the funder. • Program manager saves a copy of the report, documentation, and acceptance Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, Subpart 342, Monitoring and reporting program performance, states in part: b. Non-construction performance reports. The HHS awarding agency must use standard, OMB-approved data elements for collection of performance information (including performance progress reports, Research Performance Progress Report, or such future collections as may be approved by OMB and listed on the OMB Web site). 1. The non-Federal entity must submit performance reports at the interval required by the HHS awarding agency or pass-through entity to best inform improvements in program outcomes and productivity. Intervals must be no less frequent than annually nor more frequent than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes. Annual reports must be due 90 calendar days after the reporting period; quarterly or semiannual reports must be due 30 calendar days after the reporting period. Alternatively, the HHS awarding agency or pass-through entity may require annual reports before the anniversary dates of multiple year Federal awards. The final performance report will be due 90 calendar days after the period of performance end date. If a justified request is submitted by a non-Federal entity, the HHS awarding agency may extend the due date for any performance report. Title 45 CFR Part 96, Subpart 82, Required report on households assisted, states in part: a. Each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1 – September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Office of Management and Budget, 2023 Compliance Supplement, Assistance Listing 93.568 Low-Income Home Energy Assistance Program, describes the compliance requirements for special and performance reporting. The U.S. Department of Health and Human Services, Division of Energy Assistance, Office of Community Services, Administration of Children and Families, provides the following reporting instructions: • Instructions for the LIHEAP Performance Data Form for FFY 2022 • Instructions for the LIHEAP Household Report for FFY 2022 – Long Form • Instructions for Completion of the Quarterly Performance and Management Report for the Low-Income Home Energy Assistance Program The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11

2023-056 The Department of Commerce did not have adequate internal controls over and did not comply with federal requirements to ensure subawards for the Low-Income Home Energy Assistance Program contained the federal award identification elements. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: U.S Department of Health & Human Services Federal Award/Contract Number: 2301WALIEA, 2301WALIEE, 2301WALIEI, 2201WALIEI Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Department of Commerce administers the Low-Income Home Energy Assistance Program (LIHEAP), which provides financial assistance to low-income households to meet their home energy needs. The Department makes subawards to community-based organizations to provide this assistance. In fiscal year 2023, the Department spent more than $107 million in federal funds, about $99 million of which it paid to subrecipients. The Department administers and awards LIHEAP funds under two programs: the energy assistance program and the weatherization program. During the audit period, the energy assistance program allocated funds to 26 subrecipients to assist low-income households with their energy costs, and the weatherization program allocated funds to 24 subrecipients for construction projects to increase the energy efficiency of homes and apartments. About 85 percent of LIHEAP funds go to the energy assistance program, with no more than 15 percent allocated for weatherization activities. Each program makes separate subawards to subrecipients. Federal regulations require pass-through entities to ensure that every subaward is clearly identified to a subrecipient as a subaward, and that it includes 14 federal award identification elements. These elements include the subrecipient’s unique entity identifier, the Federal Award Identification Number (FAIN), name of the federal awarding agency, the program’s Assistance Listing Number and title, and more. LIHEAP management reviews subawards prior to execution to ensure all elements are included in the subaward. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure LIHEAP subawards contained the federal award identification elements. During the audit period, the Department executed 126 LIHEAP subawards for the energy assistance and weatherization programs. The Department uses the same process for these two programs to ensure the 14 federal award identification elements are included in the subawards. We used a non-statistical sampling method to randomly select and examine 17 of these subawards to determine if the required information was included. We found that six energy assistance subawards (35 percent) did not have the correct FAIN. One of these six subawards (6 percent) also incorrectly communicated seven additional elements, and it did not properly differentiate separate projects and costs and, therefore, did not clearly communicate the allowable activities for each specific FAIN on the subaward. We also judgmentally reviewed three additional energy assistance subawards. For all three, we found eight of the elements were not correctly communicated to the subrecipient, and they did not properly communicate the program’s allowable activities. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition In an effort to be more efficient, program management included two FAINs in one subaward. However, the FAINs had different information for some of the 14 federal award identification elements, and management did not ensure that the necessary information for each FAIN was included in the subaward. Effect of Condition By not clearly identifying the required information in subawards, the Department cannot ensure that subrecipients are adequately informed of program requirements for each federal award. Recommendation We recommend the Department establish policies and procedures and provide training for staff to ensure it includes all required federal award identification elements in subawards. Department’s Response The Department agrees with this finding. The wrong Federal Award Identification Numbers (FAIN) were entered incorrectly due to multiple awards and contracts being sent out. While 13 of the 14 required elements were included, the issue with the multiple awards and FAINs on a single contract will be corrected. The Department will separate the FAIN information by award on the contract in the Contract Face Sheet (CFS), the Contract Information Sheet (CIS), and Section 1. Acknowledgment of Federal Funding in the Special & General Terms & Conditions of the contract. The information will be entered by the LIHEAP Commerce Specialist 3, reviewed by the LIHEAP Program Manager, and then reviewed by the Community & Economic Opportunities Managing Director prior to contracts being sent out. In addition, the Requirements for Pass Through Entities fourteen elements will be communicated to all subrecipients via the Department required communication which was a required process Commerce implemented in 2022. This communication is included as part of each award issued to subrecipients as required by the Code of Federal Regulations. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 352, establishes requirements for pass-through entities. Title 45 CFR Part 75, section 303, Subpart D - Standards for Financial and Program Management 3, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-057 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments and monitor subrecipients of the Low-Income Home Energy Assistance Program. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: U.S. Department of Health & Human Services Federal Award/Contract Number: 2301WALIEA, 2201WALIEA, 2101WALIEA, 2301WALIEE, 2301WALIEI, 2201WALIEI, 2101WAE5C6, 2101WALWC6, 2101WALWC5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Department of Commerce administers the Low-Income Home Energy Assistance Program (LIHEAP), which provides financial assistance to low-income households to meet their energy needs. The Department makes subawards to community-based organizations to provide this assistance. In fiscal year 2023, the Department spent more than $107 million in federal funds, about $99 million of which it paid to subrecipients. The Department administers and awards LIHEAP funds under two programs: the energy assistance program and the weatherization program. The energy assistance program allocated funds to 26 subrecipients to assist low-income households with their energy costs, and the weatherization program allocated funds to 24 subrecipients for construction projects to increase the energy efficiency of homes and apartments. About 85 percent of LIHEAP funds go to the energy assistance program, with no more than 15 percent allocated for weatherization activities. Each program makes separate subawards to subrecipients and conducts risk assessments and monitoring activities independently of each other. For weatherization, the Department includes other federal programs in the monitoring activity, and staff use a checklist to ensure all monitoring is performed. Federal regulations require the Department to evaluate each subrecipient’s risk of noncompliance with federal statues, regulations, and the terms and conditions of the subaward for determining the appropriate amount and type of subrecipient monitoring. Federal regulations also require the Department to monitor the activities of its subrecipients as necessary to ensure that they use their subawards for authorized purposes, comply with the terms and conditions of their subawards, and achieve performance goals. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments and monitor LIHEAP subrecipients. We did not identify issues with the energy assistance program during the audit period. However, we found the Department did not perform risk assessments for any of its 24 subrecipients (100 percent) for the weatherization program. We used a non-statistical sampling method to randomly select and examine eight out of the 24 total weatherization subrecipients to determine if the Department conducted sufficient program and fiscal monitoring. We found Department staff did not fully complete the monitoring checklist for six subrecipients (75 percent). Also, for all eight subrecipients (100 percent), we could not determine if the monitoring activity was specific to the federal requirements for the program. Furthermore, we found seven subrecipients (88 percent) did not have adequate documentation to determine if the reimbursement requests reviewed were for the LIHEAP program. Finally, the Department classified six out of the eight subrecipients examined as high risk and two as low risk. However, all subrecipients received the same level of monitoring regardless of their classified risk level. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department does not have adequate policies and procedures in place to ensure the risk assessments are completed and influence the level of monitoring activity. Furthermore, management did not adequately monitor employees performing the monitoring activity to ensure they properly completed the checklists. Department employees said staffing shortages contributed to delays in performing risk assessments, staff responsible for the risk assessments were not aware they must be completed within each fiscal year, and management did not ensure they were performed. Furthermore, the weatherization program staff said their monitoring activity was focused on ensuring compliance for other federal programs, and they were not aware that monitoring activities must be specific to the requirements and terms and conditions of the LIHEAP awards. Effect of Condition Without conducting risk assessments, management cannot ensure the Department is meeting federal requirements by performing the appropriate level of monitoring to ensure subrecipients comply with program requirements. Furthermore, without proper and complete monitoring documentation, management cannot ensure that Department staff are adequately monitoring subrecipients. Recommendations We recommend the Department: • Improve internal controls to ensure it performs required risk assessments • Improve internal controls to ensure that all monitoring documentation is thorough and complete • Ensure staff conduct program and financial monitoring that is clearly attributable to the federal award’s requirements • Ensure that risk-based monitoring activities are specific to the federal award and distinguishable between low- and high-risk subrecipients Department’s Response The Department concurs with the finding. The Department’s Weatherization program conducts a robust risk assessment annually that includes multiple levels of risks across all programs. The risk assessment reviews risk per subrecipient and is separate from our monitoring process. Over the course of the years of 2022 and 2023, the program underwent some significant staff changes. Three supervisor level positions were vacated and numerous programmatic staff positions changes were made which resulted in the annual risk assessment for fiscal year 2023 not being completed in time and missing data not recorded in monitoring reports. The program’s monitoring team utilizes the risk assessment and other resources to determine the focus areas of weatherization monitoring, not necessarily the number of projects for inspection. The Department of Energy requires all grantees to inspect a minimum of 5% or 10% of completed units be inspected depending on if the agency has a waiver for an independent auditor and inspector. The monitoring team exceeds the DOE requirements by inspecting between 10 and 20 percent of all production, statewide. The monitoring team does not delineate LIHEAP specific projects in their monitoring since very few are solely LIHEAP funded. The vast majority utilize a combination of federal, state and utility funding. The team reserves the right to increase the number of projects inspected based on agency risk and inspection results independent of the funding sources. However, the results of our monitoring in concert with the risk assessment and previously identified concerns determine if an elevated level of review is needed beyond the minimum standards. The Department acknowledges the recommendations set forth by the State Auditor’s Office and plan to implement changes. The team is currently in the process of finalizing the 2023 Risk Assessment which is expected to be finalized by December 31, 2023. The process for the 2024 Risk Assessment will then commence and be completed by May 30, 2024. The team will incorporate a formal checklist process that will assign staff to tasks and include supervisory signatures to ensure compliance and timeliness. All supervisory positions have been filled. A two day meeting is scheduled in January 2024 to review and update all monitoring processes, procedures, forms, and protocols. The goal is to better align monitoring forms and checklists with the risk assessment tools. The team recognizes the need to clarify the process and increase consistency for elevated levels of monitoring while ensuring that all required documentation and checklists are complete. This will include supervisor review and sign off at appropriate milestones of the monitoring process. We intend to have all monitoring forms updated by May 30, 2024. We will work in sync with our LIHEAP program manager to ensure we are in compliance with monitoring expectations specific to the program and determine how we might increase monitoring for weatherization LIHEAP projects. We appreciate the thorough review and feedback, the information provided assisted in our efforts to improve our weatherization monitoring process and service delivery. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 352, Requirements for pass-through entities. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-058 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers for the Child Care and Development Fund Cluster programs were allowable and properly supported. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2203WACCDF; 2203WACCDD; 2303WACCDF; 2303WACCDD; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $356,042,172 Prior Year Audit Finding: Yes, Finding 2022-041 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2023, the Department spent about $547.2 million in federal funding. The Department is responsible for establishing policies to ensure payments to providers for child care services are allowable. In fiscal year 2023, the Department spent more than $356 million on monthly child care subsidy payments to child care providers. There are three child care provider types: licensed centers, licensed family homes, and licensed exempt providers referred to as Family, Friends and Neighbor providers. The Department uses the Social Service Payment System (SSPS) to process the payments it makes to child care providers. The system allocates payments to various funding sources, based on the eligibility of the client. These funding sources include multiple federal programs, multiple CCDF federal grant awards, and state funding. The Department uploads the SSPS payment data into the state’s accounting system at a summary level based on the various funding sources. There is always a need to transfer the funding sources for some payments throughout the year to manage federal and state funds properly. In prior audit periods up until fiscal year 2021, the Department prepared supporting documentation for transfers that included details of what payments it was transferring. The purpose of documenting this detail was to maintain proper support for federal expenditures. The Department of Health and Human Services (HHS), which oversees the CCDF program at the federal level, requires recipients have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers were allowable and properly supported. We have reported this condition since 2005. The most recent audit finding numbers were 2022-041, 2021-033, 2020-038, 2019-035, 2018–034, 2017-024, 2016-021, 2015-023, 2014-023, 2013-016, 12-28, 11-23, 10-31, 9-12 and 8–13. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers for the CCDF programs were allowable and properly supported. In fiscal year 2021, management informed us that the Department changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditure coding in SSPS inaccurate and unreliable for testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent CCDF funds in accordance with federal and state regulations. Further, this meant we could not test the Department’s payments to child care providers for compliance with activities allowed and cost principles. By processing these adjustments at the fund level, the Department invalidated the transaction-level documentation of the original child care expenditure in SSPS and did not identify the new allocation at the payment level. Additionally, the Department transferred some of these child care expenditures more than once at the fund level, making the underlying data increasingly unreliable with each transfer. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. The Department’s accounting practices prevent it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions in the payment system that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition By not complying with requirements in federal law to maintain adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit the federal dollars it used for payments to child care providers. Because we could not test transaction-level detail, we also could not determine whether the issues we identified in prior audits had improved or worsened, including the Department’s lack of adequate internal controls and significant rate of noncompliance for payments to child care providers. The total amount of known child care payments with federal CCDF funds in the audit period was $356,042,172. The Department also partially funded these payments with an additional $48,941,302 in state dollars. Because the Department did not comply with HHS requirements to allow for the tracing of grant expenditures to a payment level, we are questioning all $356,042,172 in federal program costs the Department incurred during the audit period. The payments the Department partially paid with state funds are not included in the federal questioned costs. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department’s grant adjustments were processed based on eligible clients and allowable activities and did not include child-level data as required by SAO. The Department held an informal meeting on February 23, 2022, with HHS representative, the State Auditor’s Office and the Office of Financial Management. The intent was to obtain the grantor’s perspective in whether proper grant accounting required the use of child-level data. HHS stated they would not offer an opinion until they received the completed finding from the state. However, the Cause of Condition of finding 2021-033 stated, “HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant.” The Department does not agree with SAO’s interpretation of the meeting outcome. In the area of CCDF eligibility, for state fiscal year 2021, the SAO also issued finding 2021-035, with questioned cost of $32 and in state fiscal year 2022, finding 2022-008 (temporary number) with no questioned costs. There were no other findings or exit items in the area of eligibility determination or the cost allocation of funds. Given that eligibility or cost allocation is not an area of concern and transfers were processed between CCDF source of funds with the same eligibility requirements, the Department is confident CCDF funding was spent appropriately within federal regulations. The Department received a management decision letter dated October 3, 2023, from HHS for finding 2021-033 (2020-038) which states: “the ACF noted that the auditor raised concern about the Department’s accounting procedures and efforts made to trace expenditures at the transaction-level. As the basis for the finding, the auditor used CFRs (200.53, 200.303, 200.403, 200.410) that do not apply to CCDF. Federal regulations allow Lead Agencies to expend and account for CCDF funds in accordance with their own procedures.” In addition, ACF did not sustain the disallowance of questioned costs and stated: “Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” The management decision letter also conveyed the following determination by HHS for finding 2021-035, 2020-039 on eligibility compliance: “The ACF believes the corrective actions taken or planned, as stated above, should prevent recurrence of this finding in the future. In addition, we recognize the continuous progression of the State’s actions to fully resolve this finding as the number of error cases and the amount of questioned costs have both significantly declined over the last 3 years. Therefore, the ACF will not pursue the questioned costs of $32 since the state has taken corrective actions that appear to have resulted in an amount of questioned costs that are immaterial.” The ACF recommended, “that the Department work with the auditors to determine an appropriate methodology that can be tested to ensure child care payments comply with Federal regulations.” The Department met with ACF and SAO on November 8, 2023, to discuss the ACF decision at which time ACF upheld the above statements that the finding was not substantiated. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. The SAO maintained that the program is not auditable without child-level data. The Department does not currently have the staff and resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the auditor’s recommendations, the Department has submitted a budget request for the 2024 supplemental budget. If the request is funded, it would allow adjustments to include child-level data. Auditor’s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. During the February 2022 meeting with HHS that the Department referenced in its response, the grantor stated the specific federal law the Department’s accounting procedures were noncompliant with was 45 CFR 98.67. We agree with the HHS management decision that our references to 2 CFR 200.53, 200.303, 200.403 and 200.410 in the prior finding were not correct. However, HHS adopted these same requirements in 45 CFR 75.2, 75.303, 75.403 and 75.410, respectfully. These requirements were all in place during the audit period. The proper references are included in this finding. In its response, the Department references previous findings related to the eligibility compliance requirement as a basis for asserting federal funds were spent properly. The requirements to determine whether a client is eligible to receive subsidized child care are different than the requirements to ensure the payments for those services are allowable, fall within each award’s period of performance and adequately supported. Without adequate transactional level payment data, our Office is unable to perform tests to verify the Department met these requirements. In addition, we also are unable to verify whether the Department complied with matching, level of effort and earmarking requirements, or that required financial information reported to the federal government was accurate. These matters are referenced in separate findings in our report. We disagree with the Department’s description of the meeting held with HHS program staff on November 8, 2023. The Department states HHS “upheld the above statements that the finding was not substantiated.” This is not accurate. During this meeting, HHS representatives conveyed the same message that they did in the management decision issued October 3, 2023. The finding was partially substantiated because the questioned costs identified in the audit would not be disallowed. The management decision states: “The ACF partially sustains the finding and recommendation. The ACF agrees with the auditor that the Department should strengthen internal controls to ensure payments to child care providers are allowable and properly supported.” “The ACF does not sustain a disallowance for the questioned costs in the amount of $271,353,409 representing the entire amount of the CCDF grant award. Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” We are not aware of what procedures ACF performed to conclude expenditures reported by the Department for fiscal year 2022 were spent only for allowable activities, were for allowable costs and met federal cost principles. We questioned all expenditures because, in our judgment, they were unauditable. Lastly, when the Washington State Legislature approved the Department’s 2023-25 biennial budget, it specified: “Funding in this subsection must be expended with internal controls that provide child-level detail for all transactions.” We reaffirm our finding and hope additional resources from the Legislature, to get down to child-level detail for all transactions, will resolve the auditing problems existing at the Department. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 2, Definitions, includes the definition of improper payment. 45 CFR Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. 45 CFR Part 75, section 403, Factors Affecting Allowability of Costs. 45 CFR Part 75, section 410, Collection of Unallowable Costs 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 98.67 – Fiscal requirements, states: (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-059 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with client eligibility requirements for child care services paid with the Child Care and Development Fund and Temporary Assistance for Needy Families funds. Assistance Listing Number and Title: 93.558 Temporary Assistance for Needy Families 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2203WACCDF; 2203WACCDD; 2303WACCDF; 2303WACCDD; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2201WATANF; 2301WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-036 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2023, the Department spent $547.2 million in CCDF federal funding. The Department of Social and Health Services (DSHS) administers the Temporary Assistance for Needy Families (TANF) grant. To meet one of the program’s primary purposes of helping clients obtain employment, TANF grant funds may be used to pay clients’ child care costs. If a client obtains employment and is no longer eligible for the program, TANF funds may still be used to pay child care costs to help the client maintain employment. In fiscal year 2023, the Department spent more than $356 million in CCDF and $107.3 million in TANF federal grant funds on child care subsidy payments to providers. Some payments made for child care are paid for by both the CCDF and TANF grants. While the two federal programs are separate, the requirements and policies in Washington for child care payments are consolidated under the Working Connections Child Care program. As of July 1, 2019, the responsibility for making and documenting child care eligibility determinations under the CCDF and TANF grants was transferred from DSHS to the Department. For a family to be eligible for child care assistance, state and federal rules require that at the time of application or reapplication, children must: • Reside in Washington and be a citizen or legal resident of the United States; • Be younger than 13 years, or if for verified special needs, be younger than 19 years; • Reside with a parent(s) or guardian whose countable income does not exceed 60 percent of the state median income at application or 65 percent of the state median income at reapplication; • Reside with a parent(s) or guardian who works or attends a job-training or education program, or needs to be receiving protective services. State rules describe the information clients must provide to the Department to verify their eligibility. The information must be accurate, complete, consistent and from a reliable source. This information includes, but is not limited to, employer and hourly wage information, proof of an approved activity under TANF, and family household size and composition. Once determined to be eligible for the program, a client is eligible for one year unless a change in income causes the client to exceed 65 percent of the state’s median income.  The Department requires that clients self-report such income changes. A written notice communicates the recipients’ reporting requirement and the specific dollar threshold applicable to the household’s annual income. Once the client’s income exceeds this cutoff level, the Department terminates services. The Department has access to systems that contain wage and household benefit and composition data for some, but not all, child care recipients. The Department uses this information in part to determine program eligibility, benefit level, including client copayment, and the amount of child care the family is eligible to receive. If an ineligible client receives assistance, the payment made to the child care provider is not allowable and the client must repay the ineligible amount. Federal regulations require the Department to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the past 11 audits, we reported findings related to eligibility for the Working Connections Child Care program. In these prior audits, we reported the Department did not have adequate internal controls over the eligibility process for child care subsidy recipients. These were reported as finding numbers 2022-036, 2021-035, 2020-039, 2019-032, 2018-030, 2017-026, 2016-023, 2015-026, 2014-026, 2013–017 and 2012-30. Description of Condition The Department did not have adequate internal controls over and did not comply with client eligibility requirements for CCDF and TANF. During the audit period, the Department determined 61,140 children were eligible for child care. We used a statistical sampling method to randomly select and examine 59 of these determinations. In three instances (5.1 percent), we found the Department made eligibility determinations improperly, or did not verify information before authorizing services. Specifically, we found: • One case (1.7 percent) where the Department had incorrectly determined household composition and did not obtain sufficient data for all parents in the household to make an accurate eligibility determination. • Two cases (3.4 percent) where the Department did not follow procedure for verifying the approved activity, which led to an incorrect eligibility determination. Though the Department has established internal controls, they were insufficient for ensuring material compliance with client eligibility requirements. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Department staff made eligibility determinations without obtaining sufficient supporting documentation to ensure households were eligible to receive assistance. This deviated from the standard policies and procedures the Department has established, and management did not monitor sufficiently to ensure staff made proper eligibility determinations. Effect of Condition By not implementing adequate internal controls, the Department is at higher risk of paying providers for child care services when clients are ineligible. Recommendations We recommend the Department improve its internal controls over determining client eligibility to ensure it: • Reviews eligibility determinations sufficiently to detect improper eligibility determinations • Reviews sufficient support for household composition information for accuracy Department’s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor’s Office’s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. Further, we appreciate SAO’s work with us over the several past years to strengthen internal controls for eligibility through the auditing process. The Statewide Single Audit (SWSA) is an important tool in the Department’s continuous quality improvement efforts and together with the Department’s internal controls has helped reduce the audit exceptions to three with zero questioned costs. The Department continues to access data across available state systems to confirm information, including household composition provided by clients. Unfortunately, there is no household composition verification system, and information provided to other state agencies is often provided by client self-attestation. The Department continues to balance verification requirements with providing timely benefit decisions to support family access to high quality child care. Additionally, the Department is being intentional in updating our learning resources for eligibility staff. Information from this and future audits will be used to update training. The Department will continue our internal control and quality improvement efforts and activities to build and maintain our eligibility case accuracy. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington Administrative Code (WAC) 110-15-0015 – Determining family size, states in part: 1. DCYF determines a consumer’s family size as follows: a. For a single parent, including a minor parent living independently, DCYF counts the consumer and the consumer’s children; b. For unmarried parents who have at least one mutual child, DCYF counts both parents and all of their children living in the household; c. Unmarried parents who have no mutual children are counted as separate WCCC households, the unmarried parents and their respective children living in the household; d. For married parents, DCYF counts both parents and all of their children living in the household; e. For parents who are undocumented aliens as defined in WAC 388-424-0001, DCYF counts the parents and children, documented and undocumented, and all other family rules in this section apply. Children needing care must meet citizenship requirements described in WAC 110-15-0005; f. For a legal guardian verified by a legal or court document, adult sibling or step-sibling, nephew, niece, aunt, uncle, grandparent, any of these relatives with the prefix “great,” such as a “great-nephew,” or an in loco parentis custodian who is not related to the child as described in WAC 110-15-0005, DCYF counts only the children and only the children’s income is counted; g. For a parent who is out of the household because of employer requirements, such as training or military service, and expected to return to the household, DCYF counts the consumer, the absent parent, and the children; h. For a parent who is voluntarily out of the household for reasons other than requirements of the employer, such as unapproved schooling and visiting family members, and is expected to return to the household, DCYF counts the consumer, the absent parent, and the children. WAC 110-15-0020 and all other family and household rules in this section apply; i. For a parent who is out of the country and waiting for legal reentry in to the United States, DCYF counts only the consumer and children residing in the United States and all other family and household rules in this section apply; j. An incarcerated parent is not part of the household count for determining income and eligibility. DCYF counts the remaining household members using all other family rules in this section; and k. For a parent incarcerated at a Washington state correctional facility whose child lives with them at the facility, DCYF counts the parent and child as their own household. 2. When the household consists of the consumer’s own child and another child identified in subsection (1)(f) of this section, the household may be combined into one household or kept as distinct households for the benefit of the consumer. WAC 110-15-0040 – Approved activities for applicants and consumers participating in WorkFirst, states: 1. Applicants and consumers who participate in WorkFirst activities may be eligible for WCCC benefits for the following approved activities in their individual responsibility plans (IRPs), for up to a maximum of sixteen hours per day, including: a. An approved WorkFirst activity under WAC 388-310-0200, with the following exception: In-home/relative providers who are paid child care subsidies to care for children receiving WCCC benefits may not receive those benefits for their own children during the hours in which they provide subsidized child care. These consumers may be eligible for other approved activities in their IRPs; b. Employment as defined in WAC 110-15-0003; c. Self-employment as defined in WAC 110-15-0003 and as described in the consumer's current WorkFirst IRP; d. Travel time between the child care location and the consumer’s place of employment or approved activity; e. Up to ten hours per week of study time for approved classes; f. Up to eight hours of sleep time before or after a night shift; and g. Any activity approved by tribal TANF. 2. WorkFirst consumers participating in approved activities for at least one hundred ten hours per month as described in WAC 110-15-0190 are considered to have a schedule of Monday through Friday, 8:00 a.m. to 5:00 p.m., except when: a. The consumer’s IRP specifies a different schedule; or b. Verified differently by the consumer. WAC 110-15-0045 – Approved activities for applicants and consumers not participating in WorkFirst, states: 1. Applicants and consumers not participating in WorkFirst activities may be eligible for WCCC benefits for the following approved activities: a. Employment; b. Self-employment; c. Supplemental nutrition assistance program employment and training (SNAP E&T); or d. The following education programs: i. High school or working towards a high school equivalency certificate for consumers under 22 years of age; ii. Part-time enrollment in a vocational education, adult basic education (ABE), high school equivalency certificate for consumers 22 years of age and older, or English as a second language (ESL) program combined with an average of 20 or more employment hours per week or 16 more work-study hours per week; or iii. For full-time students of a community, technical, or tribal college, enrollment in: A. A vocational education program that leads to a degree or certificate in a specific occupation; B. An associate degree program; or C. A registered apprenticeship program. iv. “Full-time student” for the purpose of this subsection means a consumer attends a community, technical, or tribal college and meets its definition of full-time student. (e) Applicants and consumers who meet the requirements of (c) of this subsection are eligible to receive subsidy payment for up to 10 hours per week of study time for approved classes. 2.Applicants and consumers who are eligible for WCCC benefits under the terms of this section are eligible to receive subsidy payment for: a. Transportation time between the child care location and the consumer’s place of employment or approved activity; and Up to eight hours of sleep time before or after a night shift.

2023-060 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with matching, level of effort, and earmarking requirements for the Child Care and Development Fund Cluster. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2203WACCDF; 2203WACCDD; 2303WACCDF; 2303WACCDD; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Matching, Level of Effort, Earmarking Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-042 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2023, the Department spent about $547.2 million in federal funding. The CCDF consists of three distinct funding sources: Discretionary Fund, Mandatory Fund, and Matching Fund. Additionally, under the Temporary Assistance for Needy Families (TANF) program, the Department may transfer TANF funds to the CCDF, which are then treated as Discretionary Funds. The Department is instructed how to spend this federal money. For the Department to receive its allotted share of the Matching Fund, it must meet the Maintenance of Effort (MOE) requirement and match the federal Matching Fund claimed with state expenditures at the Federal Medical Assistance Percentage rate for the applicable fiscal year. The Department must also meet earmarking requirements for expenditures for administrative and quality activities. The U.S. Department of Health and Human Services (HHS), which oversees the CCDF program at the federal level, requires recipients have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Department staff run monthly and quarterly expenditure reports from the accounting system to track requirements over matching, level of effort, and earmarking for each open grant award. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over matching, level of effort, and earmarking requirements for the CCDF Cluster programs. The prior audit finding numbers were 2022-042, 2021-036, and 2020-040. Description of Condition The Department did not have adequate internal controls over and did not comply with matching, level of effort, and earmarking requirements for the CCDF programs. The Department’s accounting records should be used to verify it has met matching, level of effort, and earmarking requirements. In fiscal year 2021, management informed us that the Department changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditure coding in the payment system inaccurate and unreliable for testing. Without identifying which expenditures it transferred, the Department’s monitoring is insufficient for properly managing matching, level of effort, and earmarking requirements. Our Office could not rely on the data supporting the Department’s expenditures or verify that the accounting records were accurate. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent CCDF funds in accordance with federal and state regulations. Further, this meant we could not test the Department’s payments for compliance with matching, level of effort, and earmarking requirements. By processing these adjustments at the fund level, the Department invalidated the transaction-level documentation of the original child care expenditure in the payment system, and did not identify the new allocation at the payment level. Additionally, the Department transferred some of these child care expenditures more than once at the fund level, making the underlying data increasingly unreliable with each transfer. This condition is also referenced in audit finding 2023-058. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. The Department’s accounting practices prevent it from meeting this requirement. In fiscal year 2021, the Department informed our Office that it had implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions in the payment system that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition By not complying with requirements in federal law to maintain adequate supporting documentation for expenditures the Department created a condition that made it impossible for our Office to determine if it had met matching, level of effort, and earmarking requirements. Recommendations We recommend the Department: • Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules • Develop effective ongoing monitoring procedures Department’s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department’s grant adjustments were processed based on eligible clients and allowable activities and did not include child-level data as required by SAO. The Department held an informal meeting on February 23, 2022, with HHS representative, the State Auditor’s Office and the Office of Financial Management. The intent was to obtain the grantor’s perspective in whether proper grant accounting required the use of child-level data. HHS stated they would not offer an opinion until they received the completed finding from the state. However, the Cause of Condition of finding 2021-033 stated, “HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant.” The Department does not agree with SAO’s interpretation of the meeting outcome. In the area of CCDF eligibility, for state fiscal year 2021, the SAO also issued finding 2021-035, with questioned cost of $32 and in state fiscal year 2022, finding 2022-008 (temporary number) with no questioned costs. There were no other findings or exit items in the area of eligibility determination or the cost allocation of funds. Given that eligibility or cost allocation is not an area of concern and transfers were processed between CCDF source of funds with the same eligibility requirements, the Department is confident CCDF funding was spent appropriately within federal regulations. The Department received a management decision letter dated October 3, 2023, from HHS for finding 2021-033 (2020-038) which states: “the ACF noted that the auditor raised concern about the Department’s accounting procedures and efforts made to trace expenditures at the transaction-level. As the basis for the finding, the auditor used CFRs (200.53, 200.303, 200.403, 200.410) that do not apply to CCDF. Federal regulations allow Lead Agencies to expend and account for CCDF funds in accordance with their own procedures.” In addition, ACF did not sustain the disallowance of questioned costs and stated: “Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” The management decision letter also conveyed the following determination by HHS for finding 2021-035, 2020-039 on eligibility compliance: “The ACF believes the corrective actions taken or planned, as stated above, should prevent recurrence of this finding in the future. In addition, we recognize the continuous progression of the State’s actions to fully resolve this finding as the number of error cases and the amount of questioned costs have both significantly declined over the last 3 years. Therefore, the ACF will not pursue the questioned costs of $32 since the state has taken corrective actions that appear to have resulted in an amount of questioned costs that are immaterial.” The ACF recommended, “that the Department work with the auditors to determine an appropriate methodology that can be tested to ensure child care payments comply with Federal regulations.” The Department met with ACF and SAO on November 8, 2023, to discuss the ACF decision at which time ACF upheld the above statements that the finding was not substantiated. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. The SAO maintained that the program is not auditable without child-level data. The Department does not currently have the staff and resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the auditor’s recommendations, the Department has submitted a budget request for the 2024 supplemental budget. If the request is funded, it would allow adjustments to include child-level data. Auditor’s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. During the February 2022 meeting with HHS that the Department referenced in its response, the grantor stated the specific federal law the Department’s accounting procedures were noncompliant with was 45 CFR 98.67. We agree with the HHS management decision that our references to 2 CFR 200.53, 200.303, 200.403 and 200.410 in the prior finding were not correct. However, HHS adopted these same requirements in 45 CFR 75.2, 75.303, 75.403 and 75.410, respectfully. These requirements were all in place during the audit period. The proper references are included in this finding. In its response, the Department references previous findings related to the eligibility compliance requirement as a basis for asserting federal funds were spent properly. The requirements to determine whether a client is eligible to receive subsidized child care are different than the requirements to ensure the payments for those services are allowable, fall within each award’s period of performance and adequately supported. Without adequate transactional level payment data, our Office is unable to perform tests to verify the Department met these requirements. In addition, we also are unable to verify whether the Department complied with matching, level of effort and earmarking requirements, or that required financial information reported to the federal government was accurate. These matters are referenced in separate findings in our report. We disagree with the Department’s description of the meeting held with HHS program staff on November 8, 2023. The Department states HHS “upheld the above statements that the finding was not substantiated.” This is not accurate. During this meeting, HHS representatives conveyed the same message that they did in the management decision issued October 3, 2023. The finding was partially substantiated because the questioned costs identified in the audit would not be disallowed. The management decision states: “The ACF partially sustains the finding and recommendation. The ACF agrees with the auditor that the Department should strengthen internal controls to ensure payments to child care providers are allowable and properly supported.” “The ACF does not sustain a disallowance for the questioned costs in the amount of $271,353,409 representing the entire amount of the CCDF grant award. Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” We are not aware of what procedures ACF performed to conclude expenditures reported by the Department for fiscal year 2022 were spent only for allowable activities, were for allowable costs and met federal cost principles. We questioned all expenditures because, in our judgment, they were unauditable. Lastly, when the Washington State Legislature approved the Department’s 2023-25 biennial budget, it specified: “Funding in this subsection must be expended with internal controls that provide child-level detail for all transactions.” We reaffirm our finding and hope additional resources from the Legislature, to get down to child-level detail for all transactions, will resolve the auditing problems existing at the Department. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 98.67 – Fiscal requirements, states: (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-061 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with period of performance requirements for the Child Care and Development Fund Cluster. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2203WACCDF; 2203WACCDD; 2303WACCDF; 2303WACCDD; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Period of Performance Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-043 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2023, the Department spent about $547.2 million in federal funding. Each federal grant specifies a performance period during which recipients must obligate and liquidate program costs. These periods typically align with the federal fiscal year of October 1 through September 30. Payments for costs charged before a grant’s beginning date or after the ending date are not allowed without the grantor’s prior approval. The CCDF consists of three distinct funding sources: Discretionary Fund, Mandatory Fund, and Matching Fund. Each of these funds has specific period of performance requirements established in federal regulation (45 CFR § 98.60(d)): • Discretionary Funds must be obligated by the end of the succeeding fiscal year after award and expended by the end of the third fiscal year after award. • Mandatory Funds must be obligated by the end of the fiscal year in which they are awarded if the state also requests Matching Funds. If no Matching Funds are requested for the fiscal year, then the Mandatory Funds are available until liquidated. • Matching Funds must be obligated by the end of the fiscal year in which they are awarded and liquidated by the end of the succeeding fiscal year after award. During the audit period, the Department also received supplemental funds under the Coronavirus Aid, Relief, and Economic Security (CARES) and the Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Acts. These funds are treated as Discretionary Funds, however, they have their own specific obligation and liquidation timeframes. The U.S. Department of Health and Human Services (HHS), which oversees the CCDF at the federal level, requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over period of performance requirements for the CCDF program. The prior finding numbers were 2022-043, 2021-037, and 2020-041. Description of Condition The Department did not have adequate internal controls over and did not comply with period of performance requirements for the CCDF program. Our Office uses the Department’s accounting records to verify it has met the period of performance requirements. In fiscal year 2021, management informed us that the Department changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditures coded in the payment system inaccurate and unreliable for audit testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent CCDF funds in accordance with federal and state regulations. Further, this meant we could not test the Department’s payments for compliance with period of performance requirements. This condition is also referenced in audit finding 2023-058. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. The Department’s accounting practices prevent it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions in the payment system that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition By not complying with requirements in federal law to maintain adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to determine if it materially met the period of performance requirements. Furthermore, without adequate internal controls in place, the Department is at a higher risk of making improper payments with grant funds. Recommendations We recommend the Department: • Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules • Develop written policies and procedures over federal period of performance requirements Department’s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department’s grant adjustments were processed based on eligible clients and allowable activities and did not include child-level data as required by SAO. The Department held an informal meeting on February 23, 2022, with HHS representative, the State Auditor’s Office and the Office of Financial Management. The intent was to obtain the grantor’s perspective in whether proper grant accounting required the use of child-level data. HHS stated they would not offer an opinion until they received the completed finding from the state. However, the Cause of Condition of finding 2021-033 stated, “HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant.” The Department does not agree with SAO’s interpretation of the meeting outcome. In the area of CCDF eligibility, for state fiscal year 2021, the SAO also issued finding 2021-035, with questioned cost of $32 and in state fiscal year 2022, finding 2022-008 (temporary number) with no questioned costs. There were no other findings or exit items in the area of eligibility determination or the cost allocation of funds. Given that eligibility or cost allocation is not an area of concern and transfers were processed between CCDF source of funds with the same eligibility requirements, the Department is confident CCDF funding was spent appropriately within federal regulations. The Department received a management decision letter dated October 3, 2023, from HHS for finding 2021-033 (2020-038) which states: “the ACF noted that the auditor raised concern about the Department’s accounting procedures and efforts made to trace expenditures at the transaction-level. As the basis for the finding, the auditor used CFRs (200.53, 200.303, 200.403, 200.410) that do not apply to CCDF. Federal regulations allow Lead Agencies to expend and account for CCDF funds in accordance with their own procedures.” In addition, ACF did not sustain the disallowance of questioned costs and stated: “Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” The management decision letter also conveyed the following determination by HHS for finding 2021-035, 2020-039 on eligibility compliance: “The ACF believes the corrective actions taken or planned, as stated above, should prevent recurrence of this finding in the future. In addition, we recognize the continuous progression of the State’s actions to fully resolve this finding as the number of error cases and the amount of questioned costs have both significantly declined over the last 3 years. Therefore, the ACF will not pursue the questioned costs of $32 since the state has taken corrective actions that appear to have resulted in an amount of questioned costs that are immaterial.” The ACF recommended, “that the Department work with the auditors to determine an appropriate methodology that can be tested to ensure child care payments comply with Federal regulations.” The Department met with ACF and SAO on November 8, 2023, to discuss the ACF decision at which time ACF upheld the above statements that the finding was not substantiated. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. The SAO maintained that the program is not auditable without child-level data. The Department does not currently have the staff and resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the auditor’s recommendations, the Department has submitted a budget request for the 2024 supplemental budget. If the request is funded, it would allow adjustments to include child-level data. Auditor’s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. During the February 2022 meeting with HHS that the Department referenced in its response, the grantor stated the specific federal law the Department’s accounting procedures were noncompliant with was 45 CFR 98.67. We agree with the HHS management decision that our references to 2 CFR 200.53, 200.303, 200.403 and 200.410 in the prior finding were not correct. However, HHS adopted these same requirements in 45 CFR 75.2, 75.303, 75.403 and 75.410, respectfully. These requirements were all in place during the audit period. The proper references are included in this finding. In its response, the Department references previous findings related to the eligibility compliance requirement as a basis for asserting federal funds were spent properly. The requirements to determine whether a client is eligible to receive subsidized child care are different than the requirements to ensure the payments for those services are allowable, fall within each award’s period of performance and adequately supported. Without adequate transactional level payment data, our Office is unable to perform tests to verify the Department met these requirements. In addition, we also are unable to verify whether the Department complied with matching, level of effort and earmarking requirements, or that required financial information reported to the federal government was accurate. These matters are referenced in separate findings in our report. We disagree with the Department’s description of the meeting held with HHS program staff on November 8, 2023. The Department states HHS “upheld the above statements that the finding was not substantiated.” This is not accurate. During this meeting, HHS representatives conveyed the same message that they did in the management decision issued October 3, 2023. The finding was partially substantiated because the questioned costs identified in the audit would not be disallowed. The management decision states: “The ACF partially sustains the finding and recommendation. The ACF agrees with the auditor that the Department should strengthen internal controls to ensure payments to child care providers are allowable and properly supported.” “The ACF does not sustain a disallowance for the questioned costs in the amount of $271,353,409 representing the entire amount of the CCDF grant award. Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” We are not aware of what procedures ACF performed to conclude expenditures reported by the Department for fiscal year 2022 were spent only for allowable activities, were for allowable costs and met federal cost principles. We questioned all expenditures because, in our judgment, they were unauditable. Lastly, when the Washington State Legislature approved the Department’s 2023-25 biennial budget, it specified: “Funding in this subsection must be expended with internal controls that provide child-level detail for all transactions.” We reaffirm our finding and hope additional resources from the Legislature, to get down to child-level detail for all transactions, will resolve the auditing problems existing at the Department. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 98.66 – Availability of funds, states in part: (d) The following obligation and liquidation provisions apply to States and Territories: (1) Discretionary Fund allotments shall be obligated in the fiscal year in which funds are awarded or in the succeeding fiscal year. Unliquidated obligations as of the end of the succeeding fiscal year shall be liquidated within one year. (2) (i) Mandatory Funds for States requesting Matching Funds per § 98.55 shall be obligated in the fiscal year in which the funds are granted and are available until expended. (ii) Mandatory Funds for States that do not request Matching Funds are available until expended. (3) Both the Federal and non-Federal share of the Matching Fund shall be obligated in the fiscal year in which the funds are granted and liquidated no later than the end of the succeeding fiscal year. Title 45 CFR, Section 98.67 – Fiscal requirements, states: (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-062 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with financial reporting requirements for the Child Care and Development Fund Cluster. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Service Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2203WACCDF; 2203WACCDD; 2303WACCDF; 2303WACCDD; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-044 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2023, the Department spent about $547.2 million in federal funding. The Department is required to submit a quarterly ACF-696 financial report for each open grant. These reports contain information on expenditures for three CCDF funding sources: the Mandatory Fund, the Matching Fund, and the Discretionary Fund. The Department uses CCDF expenditures recorded in the state’s accounting system to compile and support the ACF-696 report. The U.S. Department of Health and Human Services (HHS), which oversees the CCDF program at the federal level, requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over financial reporting requirements for the CCDF program. The prior finding numbers were 2022-044 and 2021-038. Description of Condition The Department did not have adequate internal controls over and did not comply with financial reporting requirements for the CCDF program. The Department’s accounting records must provide and support the financial information reported on ACF-696 reports. During the audit period, the Department’s grant management practice was to process expenditure transfers at the fund level without identifying which expenditures it transferred. Therefore, we could not rely on the data supporting the Department’s reported ACF-696 expenditures and could not test whether the reports were accurate and complete. This condition is also referenced in audit finding 2023-058. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes using federal dollars. The Department’s accounting practices prevent it from meeting this requirement. In fiscal year 2021, the Department informed our Office that it had implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions in the payment system that supported them. This affected all populations of childcare expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition By not complying with requirements in federal law to maintain adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit the CCDF program expenditures reported on the ACF-696 financial report. Recommendations We recommend the Department design and implement internal controls to ensure the ACF-696 report is supported with transaction-level data that is sufficient to comply with federal law and state rules. Department’s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department’s grant adjustments were processed based on eligible clients and allowable activities and did not include child-level data as required by SAO. The Department held an informal meeting on February 23, 2022, with HHS representative, the State Auditor’s Office and the Office of Financial Management. The intent was to obtain the grantor’s perspective in whether proper grant accounting required the use of child-level data. HHS stated they would not offer an opinion until they received the completed finding from the state. However, the Cause of Condition of finding 2021-033 stated, “HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant.” The Department does not agree with SAO’s interpretation of the meeting outcome. In the area of CCDF eligibility, for state fiscal year 2021, the SAO also issued finding 2021-035, with questioned cost of $32 and in state fiscal year 2022, finding 2022-008 (temporary number) with no questioned costs. There were no other findings or exit items in the area of eligibility determination or the cost allocation of funds. Given that eligibility or cost allocation is not an area of concern and transfers were processed between CCDF source of funds with the same eligibility requirements, the Department is confident CCDF funding was spent appropriately within federal regulations. The Department received a management decision letter dated October 3, 2023, from HHS for finding 2021-033 (2020-038) which states: “the ACF noted that the auditor raised concern about the Department’s accounting procedures and efforts made to trace expenditures at the transaction-level. As the basis for the finding, the auditor used CFRs (200.53, 200.303, 200.403, 200.410) that do not apply to CCDF. Federal regulations allow Lead Agencies to expend and account for CCDF funds in accordance with their own procedures.” In addition, ACF did not sustain the disallowance of questioned costs and stated: “Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” The management decision letter also conveyed the following determination by HHS for finding 2021-035, 2020-039 on eligibility compliance: “The ACF believes the corrective actions taken or planned, as stated above, should prevent recurrence of this finding in the future. In addition, we recognize the continuous progression of the State’s actions to fully resolve this finding as the number of error cases and the number of questioned costs have both significantly declined over the last 3 years. Therefore, the ACF will not pursue the questioned costs of $32 since the state has taken corrective actions that appear to have resulted in an amount of questioned costs that are immaterial.” The ACF recommended, “that the Department work with the auditors to determine an appropriate methodology that can be tested to ensure childcare payments comply with Federal regulations.” The Department met with ACF and SAO on November 8, 2023, to discuss the ACF decision at which time ACF upheld the above statements that the finding was not substantiated. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. The SAO maintained that the program is not auditable without child-level data. The Department does not currently have the staff and resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the auditor’s recommendations, the Department has submitted a budget request for the 2024 supplemental budget. If the request is funded, it would allow adjustments to include child-level data. Auditor’s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. During the February 2022 meeting with HHS that the Department referenced in its response, the grantor stated the specific federal law the Department’s accounting procedures were noncompliant with was 45 CFR 98.67. We agree with the HHS management decision that our references to 2 CFR 200.53, 200.303, 200.403 and 200.410 in the prior finding were not correct. However, HHS adopted these same requirements in 45 CFR 75.2, 75.303, 75.403 and 75.410, respectfully. These requirements were all in place during the audit period. The proper references are included in this finding. In its response, the Department references previous findings related to the eligibility compliance requirement as a basis for asserting federal funds were spent properly. The requirements to determine whether a client is eligible to receive subsidized child care are different than the requirements to ensure the payments for those services are allowable, fall within each award’s period of performance and adequately supported. Without adequate transactional level payment data, our Office is unable to perform tests to verify the Department met these requirements. In addition, we also are unable to verify whether the Department complied with matching, level of effort and earmarking requirements, or that required financial information reported to the federal government was accurate. These matters are referenced in separate findings in our report. We disagree with the Department’s description of the meeting held with HHS program staff on November 8, 2023. The Department states HHS “upheld the above statements that the finding was not substantiated.” This is not accurate. During this meeting, HHS representatives conveyed the same message that they did in the management decision issued October 3, 2023. The finding was partially substantiated because the questioned costs identified in the audit would not be disallowed. The management decision states: “The ACF partially sustains the finding and recommendation. The ACF agrees with the auditor that the Department should strengthen internal controls to ensure payments to child care providers are allowable and properly supported.” “The ACF does not sustain a disallowance for the questioned costs in the amount of $271,353,409 representing the entire amount of the CCDF grant award. Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” We are not aware of what procedures ACF performed to conclude expenditures reported by the Department for fiscal year 2022 were spent only for allowable activities, were for allowable costs and met federal cost principles. We questioned all expenditures because, in our judgment, they were unauditable. Lastly, when the Washington State Legislature approved the Department’s 2023-25 biennial budget, it specified: “Funding in this subsection must be expended with internal controls that provide child-level detail for all transactions.” We reaffirm our finding and hope additional resources from the Legislature, to get down to child-level detail for all transactions, will resolve the auditing problems existing at the Department. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 98.67 – Fiscal requirements, states: (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-063 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act for the Child Care and Development Fund. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2203WACCDF; 2203WACCDD; 2303WACCDF; 2303WACCDD; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. The Department subawards federal funds to the program’s only subrecipient, Washington State Child Care Resources – Child Care Aware. In fiscal year 2023, the Department spent $547.2 million in CCDF federal funding, including about $17.8 million paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Department must report subawards by the end of the month following the month in which it made a subaward or subaward amendment. The intent of the Act is to empower the public with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. Each month, a designated employee uses the Contracts and Procurement System to run a report to view open federal grants. The Department uses this system to manage all early learning contracts, both for contractors and subrecipients. Once the preparer has obtained the grant information, they enter all eligible subawards for the reporting month, including all the subaward key elements into FSRS. Before submitting the report, a designated manager reviews and approves it. There were 12 CCDF subawards and amendments that were required to be reported in fiscal year 2023, totaling $20.2 million. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act for the CCDF program. During the audit period, the Department was required to report about $20.2 million of program funds that it awarded to its subrecipient through 12 new and amended subawards. We examined all 12 subawards and found that nine (75 percent), totaling $1.6 million, were not reported in FSRS. Additionally, for the three reports that were filed, we found that two (16.7 percent) misreported the subaward amount. Specifically, one subaward amount was overstated, and the other subaward amount was understated. The total amount under/overreported was $41,480. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department has written procedures in place to ensure the required reports are submitted, but staff did not file all of them during the audit period. Additionally, management did not review the reports before or after submitting them to ensure they were accurate and complete. Effect of Condition Filing inaccurate reports or failing to submit them when required diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Department: • Establish effective internal controls to ensure it submits all required reports • Follow its own policies and procedures for filing required reports • Ensure management monitors to ensure future reports required by the Act are submitted accurately and completely Department’s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor’s Office’s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. During the audit period, the Department experienced a high level of staff turnover and vacancy rates resulting in missed and inaccurate Federal Funding Accountability and Transparency Act reporting. The Department is committed to strengthening internal controls and complying with federal requirements and will review written policies and procedures with cost allocation and grant management staff. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2020.) 3.What to report. You must report the information about each obligating action that the submission instructions posted at https://www.fsrs.gov specify. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-064 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with health and safety requirements for the Child Care and Development Fund program. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2103WACCDF; 2103WACCDD; 2203WACCDF; 2203WACCDD; 2303WACCDF; 2303WACCDD; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Health and Safety Requirements Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-045 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2023, the Department spent about $547.2 million in CCDF federal funding. The Department oversees two types of providers: licensed providers and license-exempt Family, Friend, and Neighbor (FFN) providers. The Department is responsible for ensuring all these providers meet health and safety standards. The monitoring activity varies for licensed and FFN providers. The Department has an approved CCDF State Plan for federal fiscal year 2022–2024 that outlines how it will meet the health and safety requirements for licensed and FFN providers. Licensed providers Department licensors conduct annual monitoring visits of licensed providers. During visits, they use a monitoring checklist to verify whether providers have met required health and safety standards. The licensors use the WA Compass system to document their activities. The system allows licensing staff to monitor the completion of visits, make timely updates and streamline their processes. When licensors identify health and safety violations during a monitoring visit, they document them on an inspection report. The inspection report contains the areas of provider noncompliance and establishes deadlines for correcting them. The Department is required to conduct timely follow-up visits on noncompliance issues to ensure providers correct them. Depending on the severity of the noncompliance, the Department has five, 10 or 15 business days to verify the noncompliance has been corrected. FFN providers Washington’s CCDF State Plan and a state rule (WAC 110-16-0025) require non–relative FFN providers to complete health and safety training within 90 days of their subsidy payment start date. They also must complete ongoing health and safety training. The Department conducts an annual health and safety visit to ensure providers are following health and safety rules. The Department adopted a rule (WAC 110-16-0030) that states it must conduct annual technical assistance visits for non-relative FFN providers within a year of subsidy approval. During these visits, an FFN specialist reviews health and safety requirements and conducts the ongoing training requirements with the provider. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the eight prior audits, we reported that the Department did not have adequate internal controls over and did not comply with health and safety requirements. The previous finding numbers were 2022-045, 2021-039, 2020-042, 2019-039, 2018-035, 2017-025, 2016-022, and 2015–024. Description of Condition The Department did not have adequate internal controls over and did not comply with health and safety requirements for the CCDF program. Licensed provider annual monitoring and noncompliance follow-ups We used a statistical sampling method to randomly select 59 out of a total population of 6,358 licensed providers. We examined this sample of licensed providers to determine if they received an annual monitoring visit and that the Department performed timely, appropriate follow-ups when they found noncompliance issues. We identified 14 instances (24 percent) where providers did not receive their required annual monitoring visit. Of the remaining 45 providers that did receive a monitoring visit, we identified 13 instances (29 percent) where the licensor did not conduct the appropriate follow-up visit on noncompliance issues. Non-relative FFN provider initial training The Department was not able to identify complete populations of FFN providers for the purposes of our initial training testing. We randomly selected 21 out of 197 FFN providers that Department officials said were required to complete initial training. Of those reviewed, we determined nine of the providers did not meet the criteria for testing because they were not subject to initial training. After testing, the Department acknowledged that it cannot identify complete populations due to system limitations. Non-relative FFN provider ongoing training and annual technical visits The Department was not able to identify complete populations of FFN providers for the purposes of our ongoing training and technical visit testing. We randomly selected 11 out of 53 FFN providers that Department officials said were required to complete ongoing training and have a technical visit. Of those reviewed, we determined one of the providers did not meet the criteria for testing because they were not subject to ongoing training or annual technical visits since they were relative providers. Of the remaining providers that were applicable to our testing, we found one instance where the provider did not complete their technical visit, but they did receive ongoing training. After testing, the Department acknowledged that it cannot identify complete populations due to system limitations. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Licensed provider annual monitoring and noncompliance follow-ups Department officials said the agency did not conduct 14 of the 59 monitoring visits we reviewed because it was unable to maintain the necessary level of staffing. Additionally, management did not ensure monitoring visits and follow-up visits on identified noncompliance occurred, as the CCDF program requires. Non-relative FFN provider initial training, ongoing training, and annual technical visits Management did not monitor sufficiently to ensure that staff completed technical visits. Further, due to system limitations, the Department did not effectively identify during the audit period which providers were subject to training and technical visit requirements. Effect of Condition Licensed provider annual monitoring and noncompliance follow-ups By not completing monitoring visits or following up on noncompliance in a timely manner, the Department did not have assurance that providers met health and safety requirements. Further, not following up on noncompliance violations in a timely manner can put children in jeopardy of harm, neglect, and unhealthy environments. Non-relative FFN provider initial training, ongoing training, and technical visits By not conducting all required technical visits, the Department did not have assurance that providers met health and safety requirements. System limitations and the inability to obtain a complete population for sampling and testing created a condition that prevented our Office from fully auditing the Department’s compliance with these requirements. Recommendations We recommend the Department: • Strengthen internal controls to ensure it sufficiently monitors all health and safety requirements • Ensure management follows established policies and procedures to ensure licensors complete all monitoring visits and conduct thorough, timely follow-ups on any identified noncompliance issues • Ensure management follows established policies and procedures to ensure non-relative FFN providers complete their required initial training, ongoing training, and receive technical visits Department’s Response The Department is strongly committed to ensuring the health, safety, and well-being of all children in care. As to the Auditor’s specific findings, the Department concurs and offers the following detail: Licensed provider annual monitoring and noncompliance follow-ups Due to the COVID-19 pandemic, the Department experienced a high level of child care licensor turnover. The Department focused available resources on assisting new and current providers to ensure access to child care for families, first responders, and health care workers. Given the Department’s limited staffing resources and high volume of providers, the Department was unable to complete all monitoring visits and was unable to send licensing staff to assist other offices with this work. Starting in fall 2022, the Department began work to recruit new staff and train them on child care licensing rules and regulations to address turnover; however, this effort takes time, due to the extensive training we give our staff. These efforts are demonstrating strong commitments to improvements in the health and safety compliance for child care providers. As of November 2023, the Department is on target for 100% compliance with monitoring visits even with a 4.1% increase in child care providers during federal fiscal year 2023. As part of its quality improvement initiates, the Department has implementing data driven decisions to assist providers and their staff to meet health and safety requirements and prioritized monitoring visits to come back into compliance. In addition, the Department has implemented new recruitment and training plans for child care licensors. In November 2022, the Department added a new position to assist supervisors with onboarding and training of all new staff hired. The Department concurs that health and safety monitoring visits were not properly completed during the audit period and is confident that corrective actions taken will improve this area moving forward. The Department is focusing resources to strengthening internal controls around all health and safety requirements. Non-relative FFN provider initial training, ongoing training, and annual technical visits The Department tracks health and safety requirements for FFN providers using the limited tools and fields currently available in WA Compass. The WA Compass system was implemented for licensed child care providers and has not been fully developed for the FFN provider type. The State Auditor’s Office requested data from the WA Compass system for their audit testing in a format the system does not currently support. Due to the fluid nature of the FFN providers, and their payment start dates, the Department was unable to pull data that reflected only providers with open authorizations during the audit period. Further, WA Compass does not currently include all health and safety requirements for FFN providers. The Department has dedicated staff resources to update WA Compass to include all health and safety requirements for FFNs and address data format issues. Staff will continue to track and monitor FFN health and safety requirements with available tools until all system development is completed. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 98.41, Health and safety requirements, states: a. Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements, which are subject to monitoring pursuant to § 98.42, shall: 1. Include health and safety topics consisting of, at a minimum: i. The prevention and control of infectious diseases (including immunizations); with respect to immunizations, the following provisions apply: A. As part of their health and safety provisions in this area, Lead Agencies shall assure that children receiving services under the CCDF are age-appropriately immunized. Those health and safety provisions shall incorporate (by reference or otherwise) the latest recommendation for childhood immunizations of the respective State, territorial, or tribal public health agency. B. Notwithstanding this paragraph (a)(1)(i), Lead Agencies may exempt: 1. Children who are cared for by relatives (defined as grandparents, great grandparents, siblings (if living in a separate residence), aunts, and uncles), provided there are no other unrelated children who are cared for in the same setting. 2. Children who receive care in their own homes, provided there are no other unrelated children who are cared for in the home. 3. Children whose parents object to immunization on religious grounds. 4. Children whose medical condition contraindicates immunization. C. Lead Agencies shall establish a grace period that allows children experiencing homelessness and children in foster care to receive services under this part while providing their families (including foster families) a reasonable time to take any necessary action to comply with immunization and other health and safety requirements. 1. The length of such grace period shall be established in consultation with the State, Territorial or Tribal health agency. 2. Any payment for such child during the grace period shall not be considered an error or improper payment under subpart K of this part. 3. The Lead Agency may also, at its option, establish grace periods for other children who are not experiencing homelessness or in foster care. 4. Lead Agencies must coordinate with licensing agencies and other relevant State, Territorial, Tribal, and local agencies to provide referrals and support to help families of children receiving services during a grace period comply with immunization and other health and safety requirements; ii. Prevention of sudden infant death syndrome and use of safe sleeping practices; iii. Administration of medication, consistent with standards for parental consent; iv. Prevention and response to emergencies due to food and allergic reactions; v. and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; vi. Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; vii. Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man- caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; viii. Handling and storage of hazardous materials and the appropriate disposal of biocontaminants; ix. Appropriate precautions in transporting children, if applicable; x. Pediatric first aid and cardiopulmonary resuscitation; xi. Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph(e) of this section; and xii. May include requirements relating to: A. Nutrition (including age-appropriate feeding); B. Access to physical activity; C. Caring for children with special needs; or D. Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children’s health and safety. 2. Include minimum health and safety training on the topics above, as described in § 98.44. b. Lead Agencies may not set health and safety standards and requirements other than those required in paragraph (a) of this section that are inconsistent with the parental choice safeguards in § 98.30(f). c. The requirements in paragraph (a) of this section shall apply to all providers of child care services for which assistance is provided under this part, within the area served by the Lead Agency, except the relatives specified at §98.42(c). d. Lead Agencies shall describe in the Plan standards for child care services for which assistance is provided under this part, appropriate to strengthening the adult and child relationship in the type of child care setting involved, to provide for the safety and developmental needs of the children served, that address: 1. Group size limits for specific age populations; 2. The appropriate ratio between the number of children and the number of caregivers, in terms of age of children in child care; and 3. Required qualifications for caregivers in child care settings as described at §98.44(a)(4). e. Lead Agencies shall certify that caregivers, teachers, and directors of child care providers within the State or service area will comply with the State’s, Territory’s, or Tribe’s child abuse reporting requirements as required by section 106(b)(2)(B)(i) of the Child Abuse and Prevention and Treatment Act (42 U.S.C. 5106a(b)(2)(B)(i)) or other child abuse reporting procedures and laws in the service area. Washington Administrative Code (WAC) 110-16-0025 Health and safety training: 1.A provider described in WAC 110-16-0015(4)(b) or (c) must complete the following training within ninety calendar days of the subsidy payment begin date: a. Infant, child, and adult first aid and cardiopulmonary resuscitation (CPR): i. This training must be taken in person and the provider must demonstrate learned skills to the instructor. ii. The instructor must be certified by the American Red Cross, American Heart Association, American Safety and Health Institute, or other nationally recognized certification program. b. Prevention of sudden infant death syndrome and safe sleep practices when caring for infants; and c. Department approved health and safety training which includes the following topic areas: i. Prevention and control of infectious diseases; ii. Administration of medication; iii. Prevention of, and response to, emergencies due to food and allergic reactions; iv. Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; v. Prevention of shaken baby syndrome, abuse head trauma, and child maltreatment; vi. Emergency preparedness and response planning for natural disasters and human-caused events; vii. Handling and storage of hazardous materials and the appropriate disposal of bio contaminants; viii. Appropriate precautions in transporting children; ix. Recognition and reporting of child abuse and neglect, including the prevention of child abuse and neglect as defined in RCW 26.44.020 and mandatory reporting requirements under RCW 26.44.030; and x. Other topic areas as determined by the department. 2. A provider described in WAC 110-16-0015(4)(b) or (c) can meet the health and safety training in subsection (1)(c) of this section if the department verifies that the provider has completed any of the following either prior to or within ninety calendar days of the subsidy payment begin date: a. Child care basics, a department approved thirty-hour health and safety training. b. Washington state early childhood education initial certificate (twelve credits) that includes early childhood education and development 105 health, safety, and nutrition. 3. A provider described in WAC 110-16-0015(4)(b) or (c) must complete a minimum of two hours of health and safety training annually, using the subsidy payment begin date. The training must include, but is not limited to, one or more of the following: c. Prevention and control of infectious diseases; d. Emergency preparedness and response planning for natural disasters and human-caused events; e. Recognizing and prevention of shaken baby syndrome, head trauma abuse, neglect, and child maltreatment; and f. Prevention of sudden infant death syndrome and safe sleep practices, if caring for an infant or toddler. WAC 110-16-0030 Health and safety activities: (1) A provider described in WAC 110-16-0015(4)(b) or (c), must participate in an annual, scheduled visit conducted by department staff in the home where care is provided. (2) The purpose of the visit is to: (a) Provide technical assistance to the provider regarding the health and safety requirements described in this chapter; (b) Observe the provider’s interactions with the child, and discuss health and safety practices; (c) Provide written information and local resources about child development to include the major domains of cognitive, social, emotional, physical development, and approaches to learning; and (d) Provide regional contact information for FFN child care services and resources. (3) A provider will be considered out of compliance with the requirements of this chapter if, after three attempts, the department is not able to complete an annual, scheduled visit in the home where care is provided. (4) At the annual, scheduled visit, the provider must show, unless previously provided to the department: (a) Proof of identity; (b) Proof of current certification for first aid and cardiopulmonary resuscitation (CPR) in the form of a card, certificate, or instructor letter; (c) Proof of vaccination against or acquired immunity for vaccine-preventable diseases for all children in care, if the provider’s children are on-site at any time with the eligible children. Proof can include: i. A current and complete department of health (DOH) certificate of immunization status (CIS) or certificate of exemption (COE) or other DOH approved form; or ii. A current immunization record from the Washington state immunization information system (WA IIS). (d) Written permission from the parent to: i. Allow children to use a swimming pool; ii. Administer medication for treatment of illnesses and allergies of the children in care; iii. Provide for and accommodate developmental and special needs; and iv. Provide transportation for care, activities, and school when applicable. (e) The written emergency preparedness and response plan required in WAC 110-16-0035(8)(c).

2023-065 The Department of Children, Youth, and Families did not have adequate controls over and did not comply with certain requirements of its Public Assistance Cost Allocation Plan. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2303WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-047 Background As a condition of receiving federal grant funds, the Department of Children, Youth, and Families must submit a Public Assistance Cost Allocation Plan (PACAP) to the U.S. Department of Health and Human Services each state fiscal year. The PACAP describes how the Department is authorized to allocate indirect costs like overhead and general administrative expenses to all funding sources, including federal grants. The Department uses the Cost Allocation System (CAS), a subsystem of the Agency Financial Reporting System (AFRS), to execute its PACAP. The Department develops appropriate methodologies and updates cost allocation base input tables that contain cost objectives, which automatically distribute the cost of payments to either state, local or federal funding sources. The tables in CAS can be added, deleted, changed, or inactivated each calendar month. As part of its cost allocation process, the Department establishes bases that are used to distribute costs to multiple funding sources. Each base consists of elements that are assigned a percentage that dictates how much of the original payment is allocated to it. For example, a base could be made up of three elements that allocate 35 percent, 25 percent, and 40 percent, respectively, that will total 100 percent. Records of these bases are kept in workbooks that management reviews and approves before they are uploaded or keyed into AFRS for use. In fiscal year 2023, the Department allocated about $18 million in indirect costs to the Foster Care grant. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate controls over and did not comply with certain requirements of its PACAP. The prior finding number was 2022-047. Description of Condition The Department did not have adequate controls over and did not comply with certain requirements of its PACAP. According to the Department’s PACAP, Base 100, which are charges for administrative costs, should be updated monthly with full-time equivalents disbursed to reflect the work that agency staff have performed. This method allows the Department to allocate administrative charges proportionately to the staffing level required to meet the program’s needs. We examined five monthly workbooks completed during the audit period. We found the Department did not complete a workbook for one month of the audit period (September 2022). We determined this internal control deficiency to be a material weakness that led to material noncompliance. Cause of Condition Management did not assign sufficient staffing resources to ensure all monthly workbooks were completed in accordance with the Department’s approved PACAP. Effect of Condition The Department’s inadequate internal controls affected the accuracy of the indirect costs charged to the Foster Care grant. When workbooks are not updated, the Department increases its risk of undercharging or improperly allocating indirect costs to the Foster Care program. Recommendation We recommend the Department strengthen internal controls to ensure that monthly workbooks are properly updated in accordance with the approved PACAP. Department’s Response The Department concurs with the finding. The Department did not have adequate staffing levels to maintain the business processes for one workbook for the Public Assistance Cost Allocation Plan (PACAP) cost base 100 for the administrative charges during the state and federal fiscal year close deadlines. Available staff were focused on grant reconciliations and closing out the prior fiscal year financial transactions. The Department is committed to improving our internal controls and has reviewed the base edit form written procedures with staff and added monthly reminders for the Cost Allocation and Grants Management Unit. In addition, the Department has confirmed that all cost base 100 workbooks have been properly completed for state fiscal year 2024. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 95, Subpart E – Cost Allocation Plans, section 95.501, Purpose, states: (a) Preparation, submission, and approval of State agency cost allocation plans for public assistance programs; and (b) Adherence to approved cost allocation plans in computing claims for Federal financial participation. Public Assistance Cost Allocation Plan – Appendix 3 Administrative Costs, Base 100, states in part: FTEs are based on actual months and are reported by funding source. This information is obtained on a monthly basis from the Enterprise Reporting system at DCYF and is used on a rolling period with a one-month lag. For example, the FTEs for July would be used in the September plan.

2023-066 The Department of Children, Youth, and Families did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 – Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2303WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-048 Background The federal Foster Care Title IV-E program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state’s child welfare agency until they are returned home, placed with adoptive families, or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for adults who are involved in the program, including state agency staff, foster parents and certain private agency staff. In Washington, the Department of Children, Youth, and Families administers the Foster Care program. During fiscal year 2023, the Department spent about $140.5 million in federal grant funds, including about $11.6 million for travel and family visits. Parent-child visits are a key strategy for minimizing a child’s time in out-of-home care and working toward family reunification. The Department creates a visit plan based on dependency court order visit requirements and other information to ensure the child’s safety. This visit plan is created and saved in a system called FamLink. When the Department needs contracted family time services, it sends a visit plan/referral through a FamLink-Sprout interface. Visit coordinators send this referral to the most appropriate contracted service provider through the Sprout system. These referrals authorize the contracted provider to provide the needed services. After the visit, contracted service providers complete visit reports, which include travel mileage and travel time. Based on these reports and information the contractor enters into the Sprout system, the system creates an invoice based on billable services and rates. To catch errors and ensure quality assurance, Sprout reports and invoices are reviewed and approved by the contracted service provider administrator or manager. The Department pays the provider solely based on the summary-level information entered into Sprout. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls to ensure payments to providers for family visits were allowable and adequately supported for the Foster Care program. The prior finding numbers were 2022-048 and 2021-040. Description of Condition The Department did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. The Department did not follow its procedures for performing fiscal monitoring of contracted service providers to ensure federally funded payments for travel and family visits were adequately supported and only for allowable activities. We consider this internal control deficiency to be a significant deficiency. Cause of Condition In response to the prior audit finding, the Department developed a corrective action plan to address the internal control deficiencies. However, the Department was unable to fully implement the corrective action plan during the audit period. Effect of Condition By not performing adequate fiscal monitoring, the Department cannot ensure payments for travel and family visits are allowable and adequately supported. Recommendation We recommend the Department follow its fiscal monitoring procedures to ensure payments to providers for travel and family visits are allowable and adequately supported. Department’s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor’s Office’s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. The Department is committed to strengthening internal controls and complying with grant requirements. As stated in the Cause of Condition, the Department did not have the opportunity to fully implement the corrective action plan during the audit period. Due to the timing and frequency of the statewide single audits, the Department is not made aware of a finding until months after the state fiscal year (SFY) concludes. It is not always feasible to correct audit issues before a new audit cycle begins. There by the previous year’s audit issues will remain outstanding up to nine months of the current audit period. For this reason, the Department anticipates receiving repeat findings for consecutive years. In April 2023, the Fiscal Integrity Unit, within the Financial and Business Services Division (FBSD), worked with the Child Welfare and Information Technology Divisions to implement the following internal controls: • Utilized algorithms in the Sprout system to identify reimbursement requests outside of a reasonable amount. • Required providers to submit additional documentation or explanation for those identified amounts. • Implemented a re-run process for prior billing periods to eliminate potential double billings by providers. • Trained headquarters and field office accounting staff to utilize the new algorithms and review additional documentation prior to processing payments. In August 2023, the Contracts Compliance Team, within the FBSD, hired one new staff dedicated to reviewing all regional client service child welfare contracts including family time visit payments and will hire an additional staff in December 2023. The Contracts Compliance Team developed compliance audit plans for child welfare contracts and began fiscal monitoring of family time visit payments in November 2023. The Department also required additional review and approvals by program staff for the Network Administrator in Eastern Washington for invoices prior to release of payment. The Department continues to identify and implement regional program approvals for Western Washington providers and implement fiscal monitoring controls to ensure payments to providers for travel and family visits are allowable and adequately supported. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-067 The Department of Children, Youth, and Families did not have adequate internal controls to ensure monthly foster care maintenance payments to children’s caregivers were adequate and accurate for the Foster Care program. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 – Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2303WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The federal Foster Care Title IV-E program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state’s child welfare agency until they are returned home, placed with adoptive families, or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for adults who are involved in the Foster Care program, including state agency staff, foster parents and certain private agency staff. In Washington, the Department of Children, Youth, and Families administers the Foster Care program. During fiscal year 2023, the Department spent about $140.5 million in federal grant funds, including about $8.6 million for foster care maintenance payments to family foster homes. These monthly maintenance payments help licensed caregivers (foster parents and licensed kinship caregivers) meet the needs of children and youth experiencing foster care. The Department’s Federal Funding Unit manages each of its Title IV-E foster care cases. Title IV-E Specialists are stationed throughout the state and screen all new foster care cases for Title IV-E Eligibility. When children or youth are placed in foster care homes, specialists meet with caregivers to discuss the amount of time they spend meeting a child’s needs. To ensure maintenance payments are accurate and allowable, the specialists enter the caregivers’ answers into the Foster Care Rate Assessment tool, which calculates the appropriate reimbursement rate for caregivers’ time spent meeting a child’s needs. Prior to payment, a Department supervisor reviews the rate in a system called FamLink. These reimbursement rates must be reassessed every six months. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure monthly foster care maintenance payments to children’s caregivers were adequate and accurate for the Foster Care program. We used a statistical sampling method to randomly select and examine 59 foster care maintenance payments out of a total population of 22,538 made during the audit period. We found that the Department did not perform six-month reviews of the reimbursement rates for five payments. We consider this internal control deficiency to be a significant deficiency. This issue was not reported as a finding in the prior audit. Cause of Condition Management said limitations with the FamLink system prevented the Department from running reports to verify that rate assessments were reviewed timely. Additionally, management did not establish another method to monitor these requirements. Effect of Condition By not performing six-month reviews of all reimbursement rates, the Department cannot ensure it provided accurate monthly maintenance payments to help caregivers meet the needs of every child or youth in foster care. Recommendation We recommend the Department establish adequate internal controls to ensure it performs all six-month reviews of caregivers’ reimbursement rates for the Foster Care program. Department’s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor’s Office’s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. The Department is committed to strengthening internal controls and complying with grant requirements. As stated in the Cause of Condition, the Department utilizes FamLink as the case management system for Foster Care which due to system limitations did not have the reporting capabilities to track rate setting reviews during the audit period. The Department created a report in FamLink to assist rate assesors in identifying six-month reviews that had not been performed timely. This tool has helped supervisors identify late rate assessments but has not helped them track six-month rate assessment due dates. A request has been submitted to the Department’s Office of Innovation, Alignment, and Accountability to update the report to show when the next rate assessment is due. Until this report update is completed, the supervisors will be performing monthly tracking to assist with internal controls and compliance with reviews. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington Administrative Code 110-50-0490, How often do the foster parent and caseworker meet to complete the rate assessment?, states: The caseworker or designated rate assessment specialist will meet with the foster parent in person or telephonically to complete the assessment: 1.Within thirty days of the child’s placement in the foster parent’s home; 2.At least every six months after the first assessment, except under limited circumstances that serve the best interest of the child; and When there is a significant change in circumstances for the child or in the foster parent’s ability or time required to meet the child’s needs.

2023-068 The Department of Children, Youth, and Families did not have adequate internal controls to ensure group care facility employees and adults residing in prospective caregivers’ households had cleared background checks before having unsupervised access to children. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2303WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-050 Background The federal Foster Care Title IV-E program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state’s child welfare agency until they are returned to home, placed with adoptive families, or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for the adults in the Foster Care program, including state agency staff, foster parents and certain private agency staff. Prospective foster parents and other out-of-home caregivers, as well as any adults residing in the prospective caregivers' households must pass the background check. During an emergency situation when a child must be placed in out-of-home care due to the absence of appropriate parents or custodians, the Department shall request a federal name-based criminal history record check of each adult residing in the home of the potential placement resource. Upon receipt of the results of the name-based check, the Department shall provide a complete set of each adult resident's fingerprints to the Washington state patrol for submission to the federal bureau of investigation within 15 calendar days from the date the name search was conducted. The child shall be removed from the home immediately if any adult resident fails to provide fingerprints and written permission to perform a federal criminal history record check when requested. In Washington, the Department of Children, Youth, and Families administers the Foster Care program. During fiscal year 2023, the Department spent about $140.5 million in federal grant funds. This included about $33.3 million for payments to providers for direct client services, with $1.4 million paid to licensed group care facilities and $13.3 million paid to foster family homes. State and federal law require background checks for foster family homes and licensed group care facilities. Licensed group care facilities Licensed group care facilities are maintained and operated for groups of children on a 24-hour basis to provide safe, healthy living environments that meet the developmental needs of the children in care. These facilities are not permanent homes, but they provide a higher level of care for the foster children who are in them. Before a facility becomes licensed, it must complete an application that the Department reviews to ensure the facility is compliant with licensing requirements. This includes ensuring all people working in the facility have cleared background checks, which is a requirement in state and federal law. After the initial application, the Department requests the group care facility to provide quarterly reports of new and existing employees to ensure all have cleared background checks before they are allowed unsupervised access to children. To track this, the Department enters employees’ information and the facilities they work at into the FamLink system. FamLink is a service delivery and support system the Department uses to track clients statewide, and management uses it to track service performance and outcomes. Foster family homes Prospective foster parents, as well as any adults residing in prospective caregivers’ households, must have satisfactorily met background checks. These checks, including state and federal criminal records and child abuse and neglect central registries, are part of the process of assessing the suitability of these caregivers to provide a safe home for children placed in their care. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls to ensure group care facility employees had cleared background checks before having unsupervised access to children. The prior finding number was 2022-050. Description of Condition The Department did not have adequate internal controls to ensure group care facility employees and adults residing in prospective caregivers’ households had cleared background checks before having unsupervised access to children. Licensed group care facilities In the prior audit, we found that the Department did not effectively monitor when employees started working in facilities. Without documenting employees’ start date of employment, the Department cannot ensure they had cleared background checks before having unsupervised access to children. We found this internal control weakness still existed in the current audit because the Department was not able to fully implement its corrective action plan during the audit period. We tested a sample of background checks for facility staff to ensure they were performed properly and determined they were. Foster family homes We used a statistical sampling method to randomly select and examine 56 out of 493 households whose adult residents required background checks to ensure they were performed properly. We found the Department placed one child in emergent care with two adults who did not receive timely fingerprint checks within the required timeline of 15 calendar days. The adults in the household had their fingerprint checks at 17 days and were determined eligible for foster child placement. We consider this internal control deficiency to be a material weakness. Cause of Condition In response to the prior audit finding, the Department developed a corrective action plan to address the internal control deficiencies, but did not fully implement it during the current audit period. Further, the Department provided a complete set of each adult resident’s fingerprints to the Washington State Patrol two days late. Effect of Condition Without documenting employees’ start dates, the Department cannot ensure they have cleared background checks before beginning work. By not adequately monitoring group care facility employees’ start dates, ineligible employees could have unsupervised access to foster care children before they have cleared the required background checks. In addition, by not obtaining timely fingerprint background checks for emergent placements, children may be in unsafe environments that affect their health and safety. Recommendations We recommend the Department: • Strengthen its internal controls and ensure all group care facility employees have cleared background checks before beginning work • Ensure it provides the Washington State Patrol with all fingerprint background checks for emergent placements within 15 calendar days from the date the name search was conducted Department’s Response The Department is committed to ensuring the health, safety, and well-being of all children in our care. As to the Auditor’s specific findings, the Department partially concurs and offers the following detail: Licensed group care facilities As stated in the audit finding section, Description of Condition, all group care facility staff sampled during the audit had a cleared background check prior to working in the facility. While we agree the use of definitions such as “effective date” and “start date” could be misleading, we do not concur the Department did not have adequate internal controls to ensure group care facility employees had cleared background checks before having unsupervised access to children. We are confident that staff who work with children and youth have a cleared background check. The Department concurs we do not document staff members’ start dates in FamLink. FamLink is used to document background clearance information, but it only allows for one date to be entered as the “effective date.” This “effective date” is imported to the Background Check System as the “start date.” The Department’s Licensing Division enters the “effective date” as the date that the background check paperwork on an applicant/staff member is received from the facility, this is to verify the correct applicant/staff member whose background check is being processed. The data pulled as part of the audit referenced the “start date” from the Background Check System, which the auditor’s office interpreted as hire date or first date they began work in the facility, which was not accurate. As stated in the Cause of Condition, the Department did not fully implement the corrective action plan during the audit period. Due to the timing and frequency of the statewide single audits, the Department is not made aware of a finding until months after the state fiscal year (SFY) concludes. It is not always feasible to correct audit issues before a new audit cycle begins. Thereby, the previous year’s audit issues will remain outstanding up to nine months of the current audit period. For this reason, the Department anticipates receiving repeat findings for consecutive years. To strengthen internal controls and documentation, effective April 1, 2023, the Department implemented a corrective action plan for processing background checks for group care facilities in response to the prior audit. Applicant/staff member background check request forms are submitted directly to the Background Check Unit by the facility. The Background Check Unit processes a fingerprint background check, a child abuse/neglect history check, and if applicable, a suitability assessment. The results are then provided to the Licensing Division and the group care facility. If the applicant is cleared, the Licensing Division staff adds the staff member to the group care facility in FamLink. The new “effective date” in FamLink is the final approval from the Background Check Unit. In addition, regional licensors continue to conduct yearly health and safety monitoring visits, which includes a random sample review of personnel files containing background check information. Foster family homes As noted in the Background Section of the finding, RCW 26.44.240 does state the Department must immediately remove a child, but the Department is required to recommend removal of the child to the court and receive approval prior to taking action. The court does not always rule in the Department’s favor and the child remains in the placement. As to the specific exceptions identified, the household that completed fingerprints two days after the required 15 calendar day period was delayed due to one of the applicants last name being misspelled in the system. The applicant was turned away at their fingerprint appointment due to the misspelling causing the delay in the timeline for both members of the household. The applicant notified the Department and once the name was corrected the applicant was able to fingerprint and both applicants in the household received a “no record” result as was reported on their initial National Crime Information Center (NCIC) Code X checks prior to the emergent placement. Auditor’s Remarks We appreciate the Department’s commitment to resolving these matters. The purpose of our testing was to ensure employees had a clear background check prior to them working at the group home facility. We knew that the “start date” from the Background Check System was not the first date an employee began working in the facility. During our review, we did not use the start dates in the system, but instead reviewed supporting documentation to identify the actual start dates when possible. However, the Department was unable to demonstrate whether some employees had clear background checks before working because they did not have the start date of their employment. We reaffirm our finding and will follow up on the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 U.S. Code § 671 - State plan for foster care and adoption assistance, specifies the federal requirements for background checks. RCW 43.43.837, Fingerprint-based checks—Requirements for applicants and service providers—Shared background checks—Fees—Rules to establish financial responsibility. RCW 26.44.240, Out-of-home care—Emergency placement—Criminal history record check. Department of Children, Youth, and Families, Policies and Procedures 6800 – Background Checks

2023-069 The Department of Children, Youth, and Families did not have adequate internal controls over reporting requirements for the Foster Care program. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 – Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2303WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Requirement: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-051 Background The purpose of the Foster Care program is to provide safe and stable out-of-home care for children under placement and care authority of state welfare agencies. To accomplish this, the Administration for Children and Families (ACF) in the U.S. Department of Health and Human Services (HHS) offers financial support to states to offset the cost of foster care maintenance for eligible children, administrative costs to manage the program, and training for state agency staff, foster parents and qualified private agency staff. As of June 2023, about 8,000 children were in Washington’s foster care system. In fiscal year 2023, the Department spent almost $140.5 million in federal program funds. Within 30 days after each fiscal quarter, the Department of Children, Youth, and Families is required to file the CB-496: Title IV-E Programs Quarterly Financial Report with HHS. This report identifies the Department’s Foster Care program expenditures, and the number of children it has served. The ACF relies on the information reported to award funds, determine the allowability of the reported expenditures, and provide reports to Congress. To complete the CB-496, Department management creates a crosswalk by examining the Department’s chart of accounts and expenditure-codes in relation to HHS’s published CB-496 instructions. This ensures that the reports ran will produce the required information for each line of the CB-496. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with reporting requirements for the Foster Care program. The prior finding number was 2022-051. Description of Condition The Department did not have adequate internal controls over reporting requirements for the Foster Care program. During our review of all four quarterly crosswalks, we found the Department did not have the correct account coding to report fields correctly. Out of the four quarterly crosswalks, the Department had 117 lines in aggregate, and 12 (10 percent) of the lines were incorrect. We also reviewed all four reports the Department submitted during the audit period, and we found that all of them contained inaccuracies. In total, the Department overreported its program expenditures by a total of $571,586. The Department also overstated the total number of children receiving foster care benefits by 153. We consider these internal control deficiencies to be a material weakness. Cause of Condition When completing the quarterly reports, the Department did not follow HHS’s published instructions. It was found that the Department did not create accurate crosswalks to ensure reports were run properly, and although there was an established review process, the reviews performed were insufficient to detect errors in the reports. Management advised that due to competing priorities and staffing shortages, the Department had limited capacity to thoroughly review the reports before submitting them to HHS. Effect of Condition Because HHS uses these reports to determine award amounts and whether reported expenditures are allowable, it may have relied on inaccurate data to make these determinations for the Department. The grant agreement also allows HHS to take action for the Department’s noncompliance, which can include temporarily withholding funds, wholly or partly suspending or terminating the award, and withholding further program awards. Recommendations We recommend the Department: • Follow HHS’s published instructions when completing the quarterly CB-496 reports • Strengthen its review processes to ensure the reports are accurate and supported before submitting them to HHS Department’s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor’s Office’s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. During the audit period, the Department acknowledges errors were made in the quarterly reports and crosswalks. The Department partially concurs with the SAO findings. As to the Auditor’s specific findings, the Department offers the following detail: Quarterly Crosswalks The Department provided electronic copies of the quarterly crosswalks to SAO for the reporting period being reviewed. During a previous audit SAO recommended that the Department maintain paper copies of the crosswalks and reports to show review and approvals. The paper copies of the crosswalks notated the changes made during the review and approval process for the quarterly reports. Due to staffing and limited time available the paper copies were not reviewed and provided to SAO to clear the exceptions identified above. The incorrect crosswalk information did not have an impact on the accuracy of the data reported. Inaccurate Reports SAO stated the Department over reported its program expenditures by a total of $571,586. The Department does not concur with the total amount determine. The FFY22 Quarter 4 report was noted as overstated by $254,721, but the expenditures were correctly reported; however the crosswalk used as reference was documented incorrectly. As stated above the incorrect crosswalk information did not have an impact on the expenditure data reported. As to the FFY23 Quarter 3 report, the Department has reconciled the data and determined that we over reported by $237,212. The Department will submit a correction to the federal partner during the next reporting period. The Department will review and strengthen our internal processes in order to complete the quarterly reports accurately. Auditor’s Remarks We appreciate the Department’s commitment to strengthening its internal processes to complete the quarterly reports accurately. Quarterly Crosswalks Based on our understanding of the process, obtained from the Department, the purpose of the Crosswalks is to create guidelines for accurately completing the CB-496 reports and is one of the key internal controls the Department asserted ensured accuracy of the CB-496 reports. This key internal control was confirmed by the Department on July 26, 2023. During our compliance testing, we noted several exceptions that resulted from the inaccuracy of the crosswalks. Inaccurate Reports The instructions on the Crosswalk indicate certain line items should be subtracted to determine the amount to be reported. The instructions provided by the Federal Government for line 7a, In-Placement Administrative Costs – Provider and Agency Management, indicate lines 11a through 14b need to be subtracted. In the crosswalks the Department stated that only Line 13a was subtracted. Therefore, $254,721 more was reported on the CB-496 than instructions indicated. We reaffirm our finding, and we will follow up on the status of the Department’s corrective action during our next audit period. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 201, Grants to States for Public Assistance Programs, establishes applicable requirements for form and manner of submittal of the estimates for public assistance grants. Section 201.5 Grants, states in part: (a) Form and manner of submittal. 1. Time and place: The estimates for public assistance grants for each quarterly period must be forwarded to the regional office 45 days prior to the period of the estimate. They include a certification of State funds available and a justification statement in support of the estimates. A statement of quarterly expenditures and any necessary supporting schedules must be forwarded to the Department of Health and Human Services, Family Support Administration, not later than 30 days after the end of the quarter. 2. Description of forms: “State Agency Expenditure Projection – Quarterly Projection by Program” represents the State agency’s estimate of the total amount and the Federal share of expenditures for assistance, services, training, and administration to be made during the quarter for each of the public assistance programs under the Act. From these estimates the State and Federal shares of the total expenditures are computed. The State’s computed share of total estimated expenditures is the amount of State and local funds necessary for the quarter. The federal share is the basis for the funds to be advanced for the quarter. The State agency must also certify, on this form or otherwise, the amount of State funds (exclusive of any balance of advances received from the Federal Government) actually on hand and available for expenditure; this certification must be signed by the executive officer of the State agency submitting the estimate or a person officially designated by him, or by a fiscal officer of the State if required by State law or regulation. (A form “Certificate of Availability of State Funds for Assistance and Administration during Quarter” is available for submitting this information, but its use is optional.) If the amount of State funds (or State and local funds if localities participate in the program), shown as available for expenditures is not sufficient to cover the State’s proportionate share of the amount estimated to be expended, the certification must contain a statement showing the source from which the amount of the deficiency is expected to be derived and the time when this amount is expected to be made available. The State agency must also submit a quarterly statement of expenditures for each of the public assistance programs under the Act. This is an accounting statement of the disposition of the Federal funds granted for past periods and provides the basis for making the adjustments necessary when the State’s estimate for any prior quarter was greater or less than the amount the State actually expended in that quarter. The statement of expenditures also shows the share of the Federal Government in any recoupment, from whatever source, including for title IV-A the appropriate share of child support collections made by the State, of expenditures claimed in a prior period, and also in expenditures not properly subject to Federal financial participation which are acknowledged by the State agency, including the share of the Federal Government for uncashed and cancelled checks as described at 45 CFR 201.67 and replacement checks as described at 45 CFR 201.70 in this part, or which have been revealed in the course of an audit.

2023-070 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable and properly supported for the Social Services Block Grant. Assistance Listing Number and Title: 93.667 Social Services Block Grant Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2202WASOSR; 2302WASOSR Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: $8,518,020 Prior Year Audit Finding: No Background The Department of Children, Youth, and Families administers the Social Services Block Grant (SSBG) program to provide services to children, youth, and young adults for case management, foster care, protective services, transportation, childcare and other services, such as child welfare services, intake and assessment, crisis counseling, family reconciliation, and licensing staff. In fiscal year 2023, the Department spent about $45.8 million in federal funding. Of this amount, the Department paid about $19.8 million to providers for direct client services. SSBG gave the Department broad flexibility to design and administer the program based on its approved plan. The Department used the SSBG Pre-Expenditure Report and Intended Use Plan approved by the federal partner to identify activities eligible for the SSBG program. Payments to the providers were initially incurred for other programs and then transferred to the SSBG program to align with the amounts allocated in the Pre-Expenditure Report. The Department periodically processed journal vouchers to make these transfers. Federal law requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable and properly supported for the SSBG. Department management said it used the approved SSBG Pre-Expenditure Report and Intended Use Plan to identify eligible activities initially charged to the Foster Care program, then periodically transferred them to the SSBG grant to align with the Pre-Expenditure Report. The Department also said management performed a monthly reconciliation to verify the expenditures were for allowable activities and within the period of performance. During our testing, we found the Department used the Pre-Expenditure report to identify eligible activities for the SSBG program and transferred funds accordingly. However, we found the Department did not perform monthly reconciliations to verify these expenditures were for allowable activities and within the period of performance. We examined the Department’s accounting records to determine if payments the Department transferred to the SSBG program were for activities that were allowable, authorized, accurate and supported. We identified total provider payments of $19,767,744 that were transferred to the SSBG program during fiscal year 2023. We analyzed provider payments and requested the Department verify whether it could provide adequate level of expenditure so we could determine whether payments were allowable and supported. Based on our analysis and confirmation from the Department, we categorized the total expenditures into two categories, which are identified in the table below. Provider payments for which the Department provided an adequate level of support We used a statistical sampling method to randomly select and examine 118 out of a total sampling population of 16,006 payments. We also selected and examined two individually significant items. We reviewed the supporting documentation, description of activities, and payment approvals. We found the payments were for activities that were supported, allowable, authorized and accurate. Provider payments for which the Department could not provide an adequate level of support We were unable to perform testing on 1,102 payments totaling $8,518,020 because the Department was only able to provide summary level information. The Department was unable to provide an adequate level of support for us to determine whether the costs were for activities that were allowable, authorized, and within the period of performance. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Due to staffing vacancies during the fiscal year, the Department did not perform monthly reconciliations to verify the expenditures were for allowable activities and within the period of performance. In addition, the Department processed expenditure transfers at the grant level. As a result, the Department could not provide adequate level of expenditure for 43 percent of payments to providers charged to the SSBG program. Therefore, we could not determine whether the payments transferred to SSBG were accurate, for allowable activities, and incurred during the period of performance. Effect of Condition and Questioned Costs By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit some of the federal dollars it transferred to SSBG. We are questioning $8,518,020 in federal program costs the Department charged to the SSBG program during the audit period. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Design and implement internal controls to ensure the funds it transfers to SSBG are supported by transaction-level support sufficient to comply with federal law • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Department utilizes grant-level management for all federal funds, including the SSBG grant. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements are met. The Department allocated the SSBG grants to eligible clients and allowable activities in compliance with 45 CFR 98.67 but did not include the level of data recommended by the State Auditor’s Office (SAO) for some transfers. The SAO maintained that the program is not auditable without transaction level data. The Department maintains that funds were not improperly charged to the SSBG grant. This is a two-year grant that the Department spends down in one fiscal year. The expenditures were allowable and within the period of performance. Cost objectives within the accounting system are used to track SSBG funding. Expenditures eligible for the SSBG grant are transferred at the cost objective level and not the transaction level. The SAO tested a sample of 16,006 payments which totaled 94% of total provider payments charged to the grant. SAO found that all payments were for activities that were supported, allowable, authorized, and accurate. SAO did not test the remaining payments, which totaled 6% of the total provider payment charged to the grant, because the transfer of expenditures were not complete at the transaction level for those payments. Those remaining payments were transferred from eligible and allowable expenditures for the SSBG grant. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. In response to the auditor’s recommendations related to fiscal year 2023 Child Care and Development Fund findings, the Department submitted a budget request for the 2024 supplemental budget. Funding was provided effective July 2024 to develop and maintain the business process that would allow adjustments to include transaction level data. Auditor’s Remarks The Department stated that we tested 94 percent of total provider payments charged to the grant. However, this is not accurate. We randomly selected 118 provider payments, using a statistical sampling method, that came from a population that made up 57 percent of the total amount paid to providers. We were not able to perform testing for 43 percent of the total amount paid to providers because the Department could not provide an adequate level of support for the payments. The level of documentation needed to support grant expenditures is not established by our office but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. Without adequate transactional level payment data, our Office is unable to perform tests to verify the remaining payments were transferred from eligible and allowable expenditures for the SSBG grant. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 96.30 – Fiscal and administrative requirements, states in part: a. Fiscal Control and accounting procedures. Except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures appliable to the obligation and expenditure of its own funds. Fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibition of the statute authorizing the block grant. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-071 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure cash draws for the Social Services Block Grant were properly supported. Assistance Listing Number and Title: 93.667 Social Services Block Grant Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2022WASOSR; 2302WASOSR Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Cash Management Known Questioned Cost Amount: $1,504,566 Prior Year Audit Finding: No Background The Department of Children, Youth, and Families administers the Social Services Block Grant (SSBG) program to provide services to children, youth, and young adults for case management, foster care, protective services, transportation, childcare and other services, such as child welfare services, intake and assessment, crisis counseling, family reconciliation, and licensing staff. In fiscal year 2023, the Department spent about $45.8 million in federal funding. SSBG gave the Department broad flexibility to design and administer the program based on its approved SSBG Pre-Expenditure Report and Intended Use Plan. Expenditures the Department charged to SSBG during the audit period were activities initially incurred for other programs and transferred to the SSBG program to align with the amounts allocated in the Pre-Expenditure Report. The Department uses the Grant Management System (GMS) to calculate draws for SSBG. GMS automatically uploads federal grant expenditures and revenues nightly from the Agency Financial Reporting System (AFRS), and it calculates cash draws on a semi-monthly basis, or as needed. GMS automatically calculates the federal grant cash draw amount by deducting revenues drawn to date from year-to-date expenditures. The Department periodically processed journal vouchers to transfer eligible expenditures to SSBG. In fiscal year 2023, the Department prepared draws twice per month on a reimbursement basis. Federal law requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure cash draws for the SSBG were properly supported. Department management said a supervisor reviewed expenditure reports from AFRS and the GMS system to ensure the cash draw for the period was supported, accurate and included expenditures incurred year to date. Management then reviewed the cash draw to ensure it was supported and accurate before requesting it. We used a non-statistical sampling method to randomly select and examine five out of a total population of 10 cash draws to determine if they were supported by accounting records. We found one cash draw that the Department made on January 10, 2023, where the GMS-calculated draw amount was negative $4,495,434. Instead of returning the overdrawn funds, the Department made a drawdown for $1,504,566 by manually adjusting the current draw amount to be $6 million in GMS. This draw was based on the Department’s estimate that it had sufficient eligible expenditures. However, the Department did not identify eligible expenditures, and did not process an accounting adjustment to transfer eligible expenditures into SSBG until February 9, 2023, one month after the cash draw was made. We determined that management had reviewed and approved this draw, but it was not supported or accurate. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department identified $4,495,434 in costs that had been improperly charged to the SSBG grant, and then moved them to a different funding source in the accounting system on December 13, 2022, and December 22, 2022. Management estimated the Department had sufficient eligible expenditures in the accounting system to support the overdrawn amount, as well as an additional $1,504,566 cash draw. However, due to competing priorities and staffing issues, the Department did not identify eligible expenditures and transfer them to SSBG before making the draw. Effect of Condition and Questioned Costs By not reviewing expenditure reports, the Department could not verify whether it had sufficient eligible expenditures in the accounting system to support the draw. In addition, by not transferring eligible expenditures to the SSBG program timely, the cash drawdown was not supported by expenditures in the accounting system. We are questioning the $1,504,566 cash draw because we cannot determine whether the manual adjustment of $6 million was for eligible costs for the SSBG program, as the Department was unable to provide an adequate level of expenditure to determine whether the costs were supported. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: • Strengthen internal controls to ensure it only draws federal funds if they are supported in the accounting system • Ensure management does not bypass established internal controls • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department’s Response The Department utilizes grant-level management for all federal funds, including the SSBG grant. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements are met. The Department allocated the SSBG grants to eligible clients and allowable activities in compliance with 45 CFR 98.67 but did not include the level of data recommended by the State Auditor’s Office (SAO) for some transfers. The SAO maintained that the program is not auditable without transaction level data. The Department maintains that funds were not improperly charged or overdrawn for the SSBG grant. This is a two-year grant that the Department spends down in one fiscal year. The expenditures drawn were allowable and within the period of performance. Cost objectives within the accounting system are used to track SSBG funding and then allowable charges are transferred to a different accounting code prior to the draws. The unit supervisor reviewed the cost objectives to verify available expenditures had been charged to support the grant draw. For the one draw in question the grant analyst was out of the office and due to a staffing shortage the transfer of expenditures was completed after the draw. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. In response to the auditor’s recommendations related to fiscal year 2023 Child Care and Development Fund findings, the Department submitted a budget request for the 2024 supplemental budget. Funding was provided effective July 2024 to develop and maintain the business process that would allow adjustments to include transaction level data. Auditor’s Remarks We thank the Department for acknowledging the reconciliation of the draw amount questioned was not performed timely. The level of documentation needed to support grant expenditures is not established by our office but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. Without adequate transactional level payment data, our Office is unable to verify whether the $6 million transfer to the SSBG grant was allowable and supported. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR, Section 96.30 – Fiscal and administrative requirements, states in part: a. Fiscal Control and accounting procedures. Except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures appliable to the obligation and expenditure of its own funds. Fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibition of the statute authorizing the block grant. Title 45 CFR Part 96.32, Financial Settlement, states: The State must repay to the Department amounts found after audit resolution to have been expended improperly. In the event that repayment is not made voluntarily, the Department will undertake recovery. Title 31 CFR Part 205.33, How are funds transfers processed?, states in part: a. A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State’s actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A–102 (For availability, see 5 CFR 1310.3.). The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-072 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with reporting requirements to ensure reports were complete and accurate for the Social Services Block Grant program. Assistance Listing Number and Title: 93.667 Social Services Block Grant Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: 2202WASOSR; 2302WASOSR Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Department of Children, Youth, and Families administers the Social Services Block Grant (SSBG) program to provide services to children, youth, and young adults for case management, foster care, protective services, transportation, childcare and other services, such as child welfare services, intake and assessment, crisis counseling, family reconciliation, and licensing staff. In fiscal year 2023, the Department spent about $45.8 million in federal funding. The Department is required to submit annual SF-425 financial reports for each open SSBG grant. These reports contain information such as the federal grant number, the recipient organization, grant period, reporting period end date, and a summary of expenditures and revenues related to the grant during the reporting period. The Department is also required to submit annual SSBG Post-Expenditure reports that describe how the Department expended its SSBG grant for each fiscal year. These reports include information such as: 1. The number of eligible people who received services that were fully or partially paid for with SSBG funds. 2. The amount of SSBG funds spent on providing each service. 3. The method(s) by which each service was provided, showing separately for each service provided by public agencies, private agencies, or both. 4. The criteria applied in determining eligibility for each service, such as income eligibility guidelines, sliding fee scales, the effect of public assistance benefits, and any requirements for enrollment in school or training programs. 5. The state’s definition of “child,” “adult,” and “family.” 6. Temporary Assistance for Needy Families funds transferred into SSBG In its approved state plan, the Department has broad flexibility to design and administer the SSBG program. The Department used the SSBG Pre-Expenditure Report and Intended Use Plan approved by the federal partner to identify activities eligible for the SSBG program. Most of the expenditures charged to the SSBG program were initially incurred for other programs and transferred to the SSBG program. The Department periodically processed accounting adjustments to make these transfers. Federal law requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements to ensure reports were complete and accurate for the SSBG program. Financial Reporting – SF-425 We selected and examined the two SF-425 reports that the Department was required to submit in state fiscal year 2023. During the audit period, the Department processed expenditure transfers at the grant level. As a result, the Department did not identify the specific transactions, or provide the required level of supporting documentation, for 43 percent of payments to providers that were charged to the SSBG program. These transactions represented 18 percent of total SSBG expenditures. Therefore, we could not rely on the data supporting the Department’s reported SF-425 expenditures and could not determine if the reports were accurate and complete. This condition is also referenced in audit finding 2023-070. Performance Reporting – Post-Expenditure Report Department personnel said they reviewed and approved the Post-Expenditure Report workbook before the information was uploaded into the SSBG portal to ensure the data was complete and accurate. Department personnel then reviewed and approved the Post-Expenditure Report in the SSBG portal to ensure it was complete and accurate before management performed a final review, certified the report, and submitted it. We selected and examined the only SSBG Post-Expenditure Report that the Department was required to submit during the audit period. We found no documented evidence that the appropriate Department personnel reviewed the Post-Expenditure Report Workbook and the SSBG Post-Expenditure Report for accuracy and completeness before management completed the final review and certification of the report. The unsupported SF-425 expenditures identified above were also included in this report. Therefore, we could not rely on the data supporting the expenditures reported in the Department’s SSBG Post-Expenditure report and could not determine if it was accurate and complete. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management said it did not review the Post-Expenditure Report Workbook and SSBG Post-Expenditure Report due to a lack of staffing. The Department processed expenditure transfers at the grant level and made accounting adjustments without identifying the actual payments that were used to support those adjustments. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure that expenditure amounts reported to the grantor are complete and accurate. By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible to audit some of the federal dollars it transferred to SSBG and reported on the SF-425 financial report and the SSBG Post-Expenditure report. Recommendations We recommend the Department: • Improve internal controls to ensure that management reviews reports along with supporting expenditure and revenue data to ensure completeness and accuracy • Design and implement internal controls to ensure financial and program reports are supported with an adequate level of detail Department’s Response The Department utilizes grant-level management for all federal funds, including the SSBG grant. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements are met. The Department allocated the SSBG grants to eligible clients and allowable activities in compliance with 45 CFR 98.67 but did not include the level of data recommended by the State Auditor’s Office (SAO) for some transfers. The SAO maintained that the program is not auditable without transaction level data. The Department maintains that funds were not improperly charged to the SSBG grant. This is a two-year grant that the Department spends down in one fiscal year. The Department provided the SAO with detailed expenditure data reports and email documentation of management reviews of the expenditures being charged to the SSBG grant and changes being requested prior to submission. Management reviewed the expenditure data prior to certifying and submitting the reports in the federal reporting system verifying the requested changes were made. The federal reporting system creates an email after certification which the Department shared with the SAO. The Department was unable to provide email communication between staff and management related to the approval of the changes requested as documentation of the final approval prior to management certifying the report in the federal system as requested by SAO. SAO stated in the cause of condition that the Department processed expenditure transfers at the grant level and made accounting adjustments without identifying the actual payments. The SAO tested a sample of 16,006 payments which totaled 94% of total provider payments charged to the grant. SAO found that all payments were for activities that were supported, allowable, authorized, and accurate. SAO did not test the remaining payments, which totaled 6% of the total provider payment charged to the grant, because the transfer of expenditures were not complete at the transaction level for those payments. Those remaining payments were transferred from eligible and allowable expenditures for the SSBG grant. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. In response to the auditor’s recommendations related to fiscal year 2023 Child Care and Development Fund findings, the Department submitted a budget request for the 2024 supplemental budget. Funding was provided effective July 2024 to develop and maintain the business process that would allow adjustments to include transaction level data. Auditor’s Remarks The Department stated that we tested 94 percent of total provider payments charged to the grant. However, this is not accurate. We randomly selected 118 provider payments, using a statistical sampling method, that came from a population that made up 57 percent of the total amount paid to providers. We were not able to perform testing for 43 percent of the total amount paid to providers because the Department could not provide an adequate level of support for the payments. The level of documentation needed to support grant expenditures is not established by our office but in title 45 of the U.S. Code of Federal Regulations and the state’s grant award. Without adequate transactional level payment data, our Office is unable to perform tests to verify the remaining payments were transferred from eligible and allowable expenditures for the SSBG grant. We reaffirm our finding and will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR, Section 96.30 – Fiscal and administrative requirements, states in part: A. Fiscal Control and accounting procedures. Except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures appliable to the obligation and expenditure of its own funds. Fiscal control and accounting procedures must be sufficient to (a) permit preparation of reports required by the statute authorizing the block grant and (b) permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibition of the statute authorizing the block grant. Title 45 CFR Part 96.74, Annual Reporting Requirements, establishes the reporting requirements for the Pre-Expenditure and Post-Expenditure program reports. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-073 The Health Care Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. Assistance Listing Number and Title: 93.767 Children’s Health Insurance Program 93.767 COVID-19 Children’s Health Insurance Program 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2205WA5021; 2305WA3002; 2305WA5021; 2205WA5MAP; 2205WA5ADM; 2205WAIMPL; 2305WA5MAP; 2305WA5ADM; 2305WAIMPL Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Managed Care Financial Audit Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-054 Background The Health Care Authority administers both the Medicaid and the Children’s Health Insurance Program (CHIP). Medicaid is a jointly funded state and federal partnership providing coverage for about 2.4 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. CHIP provides health coverage for more than 106,000 children and pregnant people in families with incomes too high to qualify for Medicaid. During fiscal year 2023, the Medicaid program spent about $19.6 billion in federal and state funds, and CHIP spent nearly $224.3 million in federal and state funds. Managed Care Organizations (MCOs) contract with the Authority under a comprehensive risk contract to provide prepaid health care services to eligible enrollees under their managed care programs. In fiscal year 2023, the Authority contracted with five MCOs and paid them more than $9.9 billion for Medicaid and CHIP services. Under federal regulations, contracts between states and MCOs must include a requirement that MCOs annually submit an audited financial report to the state. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. At least once every three years, the Authority must conduct or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data each MCO submits. The Authority must also post these audit results on its website. These requirements went into effect for contract years starting after July 1, 2017. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. The prior finding numbers were 2022-054 and 2021-048. Description of Condition The Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. Audited financial reports During the audit period, the Authority took steps toward updating the MCO contract language to include the audited financial report requirements. However, the changes included the option for MCOs to submit audited financial reports in accordance with statutory accounting principles (SAP), which is not an acceptable accounting method under federal regulations. As a result, the Authority accepted audited financial reports in accordance with SAP from all five MCOs. Periodic audits The Authority did not establish internal controls to ensure it complied with the periodic audit requirements of MCO encounter and financial data. To meet the periodic audit requirements, the Authority would have needed to complete MCO audits of both the encounter and financial data within the last three years. Though the Authority completed encounter data audits in July 2021, it did not complete any financial data audits within the last three years. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Audited financial reports Officials said the Authority allowed MCOs to submit audited financial reports in accordance with SAP so they were consistent with the Washington State Office of the Insurance Commissioner. The Office of the Insurance Commissioner considers SAP an acceptable accounting method for determining and reporting the financial condition and the results of operations of an insurance company, and determining its solvency under Washington insurance law. However, this accounting method does not comply with the federal requirements. Periodic audits Authority officials interpreted the compliance requirements on conducting periodic audits to mean that the agency is compliant if an audit is in progress—rather than being fully completed—at least every three years. Because of this interpretation, the Authority has not implemented internal controls to prescribe how and when to perform periodic audits of the MCOs for both the encounter and financial data. Effect of Condition By not collecting proper audited financial reports and conducting periodic audits, the Authority increases its risk of relying on inaccurate or incomplete information. This could lead to an increased risk of making improper payments and reduced public transparency. The Authority could also be subject to sanction by the federal grantor for not meeting Medicaid and CHIP requirements. Recommendations We recommend the Authority: • Implement policies and procedures over obtaining properly audited financial reports • Update MCO contracts to require audits of financial statements that are conducted in accordance with generally accepted accounting principles and generally accepted auditing standards • Implement policies and procedures over conducting required periodic audits • Establish a process to conduct and fully complete audits of encounter data and financial data at least once every three years Authority’s Response The Authority partially concurs with the finding. The Authority does not concur with the auditor’s conclusion that the Authority lacks adequate internal controls to ensure periodic audit requirements of MCO encounter and financial data are met. The Authority has established internal controls to ensure encounter and financial audits are conducted as required by CMS. The Authority’s internal controls include MCO contract requirements specific to the MCO encounter and financial audits, and an overarching audit policy and process, as well as detailed audit plans that include scheduled MCO audits for each state fiscal year. The Authority concurs that the MCO financial audit has not concluded within the 3-year timeframe, however the financial data review has been completed for 2021 dates of service and is in the final review phase of the audit. The next MCO financial audit will be scheduled for 2023 dates of service, to be conducted in 2025. The Authority concurs that it allowed MCOs to submit audited financial reports in accordance with statutory accounting principles (SAP) so they were consistent with the Washington State Office of the Insurance Commissioner and acknowledges that this accounting method does not comply with the federal requirements. The Authority will amend contract language to require MCOs to submit audited financial reports using generally accepted accounting principles and generally accepted auditing standards. Auditor’s Remarks As stated in its response, the Authority concurs it did not complete required periodic audits and accepted financial reports that were not compliant with federal law. The combination of these facts, along with the Authority’s lack of policies and procedures, was the basis for us to assess a material weakness in internal controls exists over the Medicaid special test requirement. We reaffirm our finding and will follow up on the status of the Authority’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 42 CFR Part 438, Managed Care, establishes the following applicable requirements: Section 438.3 Standard Contract Requirements states in part: (m) Audited financial reports. The contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section 438.600 Statutory basis, basic rule, and applicability states in part: (c) Applicability. States will not be held out of compliance with the following requirements of this subpart prior to the dates noted below so long as they comply with the corresponding standard(s) in 42 CFR part 438 contained in the CFR, parts 430 to 481, edition revised as of October 1, 2015: (1) States must comply with §438.602(a), 438.602(c) through (h), 438.604, 438.606, 438.608(a), and 438.608(c) and (d), no later than the rating period for contracts starting on or after July 1, 2017. (2) States must comply with §438.602(b) and § 438.608(b) no later than the rating period for contracts beginning on or after July 1, 2018. Section 438.602 State responsibilities states in part: (e) Periodic audits. The State must periodically, but no less frequently than once every 3years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP. (g) Transparency. The State must post on its Web site, as required in §438.10(c)(3), the following documents and reports: (1) The MCO, PIHP, PAHP, or PCCM entity contract. (2) The data at §438.604(a)(5). (3) The name and title of individuals included in §438.604(a)(6). (4) The results of any audits under paragraph (e) of this section. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-074 The Health Care Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and Children’s Health Insurance Program. Assistance Listing Number and Title: 93.767 Children’s Health Insurance Program 93.767 COVID-19 Children’s Health Insurance Program 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2205WA5MAP; 2205WA5ADM, 2205WAIMPL; 2305WA5MAP; 2305WA5ADM; 2305WAIMPL; 2205WA5021; 2305WA3002; 2305WA5021 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions – Provider Eligibility (Screening and Enrollment) Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-055 Background The Health Care Authority administers both Medicaid and the Children’s Health Insurance Program (CHIP). Medicaid is a jointly funded state and federal partnership providing coverage for about 2.4 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the State’s federal expenditures. CHIP provides health coverage for more than 106,000 children and pregnant people in families with incomes too high to qualify for Medicaid. During fiscal year 2023, the Medicaid program spent more than $19.6 billion in federal and state funds, and CHIP spent nearly $224.3 million in federal and state funds. The Authority ensures medical providers for both programs are eligible to provide services for clients. Providers must continue to meet eligibility requirements to receive payments under the programs. Washington had more than 135,000 participating providers in fiscal year 2023. During that time, the Authority paid more than $11.7 billion to providers for direct client services under the programs. The Authority is responsible for performing screening measures appropriate for the provider type at application and initial enrollment. Federal Regulations require that the state Medicaid agency determine the exclusion status of providers through the Social Security Administration’s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities, the System for Award Management, and any other databases as the State or Secretary may prescribe. All providers in a Medicaid program must have a valid National Provider Indicator (NPI) provided through the NPPES system before enrollment. Without passing these database checks, providers cannot be enrolled in Medicaid. The state Medicaid agency must also revalidate the enrollment of all Medicaid and CHIP providers at least every five years. To meet this requirement, the Authority has implemented an automated revalidation notification process that is supposed to send a letter to providers in time for them to be revalidated before the end of the five-year period. Federal law also requires state Medicaid agencies to check federal databases at least monthly to confirm the identity and exclusion status of providers, as well as any person with ownership, controlling interest, or acting as an agent or managing employee of the provider. The provider enrollment and revalidation processes are similar. The first step in both processes is to determine the providers’ screening risk level. A provider can be designated as one of three risk levels: limited, moderate, or high. Each risk level requires progressively greater scrutiny of the provider before it can be enrolled or revalidated. For providers enrolled with both Medicare and Medicaid, state Medicaid agencies must assign them to the same or higher risk category applicable under Medicare. Additionally, certain provider behaviors require them to be moved to a higher screening level. The following are the required screening procedures for all risk types: • Verify that the provider meets applicable federal regulations or state requirements for the provider type before making an enrollment determination • Conduct license verifications, including for licenses in states other than where the provider is enrolling • Conduct database checks to ensure providers continue to meet the enrollment criteria for their provider type. Such database checks include the NPPES, List of Excluded Individuals/Entities, Excluded Parties List System, and Death Master File Index If state Medicaid agencies assess providers at a moderate or high risk, they are required to conduct onsite visits for those that did not have one as part of their Medicare enrollment. Federal regulations require a high-risk provider, or a person with a 5 percent or more direct or indirect ownership in the provider, to receive a fingerprint-based criminal background check. The deadline to fully implement a fingerprint-based criminal background check was July 1, 2018. The Authority is also responsible for ensuring that providers obtain the proper signed attestations and disclosures. For servicing only providers, a direct link must be made to a billing provider that has an active Core Provider Agreement (CPA) on file. A CPA contains the required attestation and disclosures of the billing provider to allow for the payment of medical claims. To ensure the Authority has completed all applicable screening and enrollment or revalidation steps before enrolling or revalidating providers, staff members use checklists for each enrollment and revalidation. The staff member signs and dates the checklist to indicate the provider is eligible to render services and receive payments. In response to the COVID-19 pandemic, the Authority obtained flexibilities under blanket waivers approved by the Centers for Medicare and Medicaid Services (CMS), which were effective March 1, 2020, through the end of the emergency declaration period. These included the waiving of provider application fees and fingerprint-based criminal background checks. The CMS waivers also allowed for expedited processing of any new or pending provider application, as well as the postponement of all revalidation actions until the end of the emergency declaration which ended in March 2023 for the Medicaid and CHIP programs. While CMS waived the requirement for HCA to perform revalidations during the public health emergency, HCA management determined that HCA would perform revalidation work beginning October 2020 and throughout the audit period. Also in response to the COVID-19 pandemic, the Authority’s Chief Medical Officer approved a blanket waiver for the backdating of all provider’s effective dates, as allowed by CMS and Washington Administrative Code. This waiver allows all providers to submit claims for services provided before their enrollment and revalidation applications are approved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it revalidated providers every five years and met screening requirements. The prior finding numbers were 2022-055, 2021-047, 2020-046, 2019-048, 2018-042, 2017-033, and 2016-035. Description of Condition The Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and CHIP programs. During the audit period, the Authority processed 12,185 new provider enrollments and was required to perform ongoing eligibility determinations for 123,405 active providers. We used a statistical sampling method to randomly select and examine 59 newly enrolled providers and 59 active providers to determine if the Authority properly screened them based on their enrollment status and correctly determined their eligibility status. Of the 118 providers examined, we found 11 instances (over 9 percent) when the Authority did not take the appropriate actions to ensure providers met eligibility requirements. Specifically we found: • Staff enrolled two new providers and did not terminate three active providers without a valid CPA on file. Because the providers were not covered by a valid CPA, they were improperly enrolled and not eligible to provide services. • Staff did not properly screen a provider based on risk. No risk level indicator was associated with the provider within the ProviderOne system. • Staff did not conduct a proper license check on four active providers, who had invalid or expired licenses and should have been terminated from the system. • Staff backdated one provider’s effective date to before they had a valid NPI, which is required before participating in the Medicaid program. To determine if the Authority had revalidated providers every five years or had taken actions to deactivate providers, we used computer assisted audit techniques to analyze the entire population of 347 providers that should have been revalidated or deactivated after the emergency declaration ended in March 2023. We found the Authority’s internal controls were insufficient and resulted in none of the 347 providers (100 percent) being revalidated before the due date. We determined 28 providers were subsequently revalidated, and the Authority backdated them. We used non-statistical sampling to randomly select and examine 11 of the 28 providers who were revalidated late and backdated. We identified no exceptions. We also determined 192 providers were deactivated, but the Authority did not process the deactivation until at least 30 days after the eligibility end date. There were an additional 127 providers that should have been deactivated, but the Authority did not take actions to deactivate or revalidate them during the audit period. Federal law requires the Authority to check federal databases at least monthly to confirm the identity and exclusion status of providers. However, the automated system that performs these checks and notifies the Authority of possible problems with providers was not operating correctly, and it frequently provided incorrect information. Management decided to ignore this information and stopped performing the monthly database checks for the majority of the audit period. The monthly automated system checks were re-enabled and the Authority started the process again in March 2023. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Although the Authority has established internal controls over screening and enrolling providers, they were ineffective for preventing or detecting noncompliance. Management also did not ensure staff consistently followed the procedures in place. Additionally, the automated revalidation notification was inadequate for ensuring the Authority complied with the five-year revalidation requirement. To comply with this requirement, the Authority should notify providers about their revalidations and ensure they are started and completed before the due date. Our audit found that the Authority’s automated system is designed to notify providers of their revalidations one day after the due date. We formally notified the Authority of this weakness in the automated system in April 2022 during the fiscal year 2021 audit. The Authority has not implemented manual processes to ensure compliance with the revalidation requirement. Due to this inadequate system design and the lack of manual processes, all provider revalidations were completed after their due dates. Although management directed staff to stop performing the monthly database checks because of issues with the automated system, they did not reinstate the procedures used before the system was implemented so staff could continue verifying providers’ identity and exclusion status. Effect of Condition By not conducting required licensing, screening, and enrollment processes in a timely manner, the Authority is at risk of not detecting or preventing ineligible providers from providing services to clients and receiving federal Medicaid and CHIP funds. Payments to providers who are ineligible are unallowable, and the Authority could be required to repay the grantor for these payments. We identified over $3.9 million in costs at risk for the 347 providers who were not revalidated or deactivated timely. Recommendations We recommend the Authority: • Strengthen internal controls to ensure providers are adequately screened, licensed, enrolled, and eligible to provide and bill for services • Implement internal controls designed to bring it into material compliance with the provider revalidation process Authority’s Response The Authority partially concurs with the finding. The Authority concurs with the two new providers and three active providers that were not deactivated without a valid CPA, and the provider that did not have a risk level assigned in the ProviderOne system. The Authority does not concur that four providers did not receive a proper license check, or the backdated provider prior to receiving an NPI. When a provider’s license expires, the Authority enters an end date for the provider taxonomy, preventing any further payments. This is compliant with requirements. Regarding the backdated NPI, 42 CFR 455.440 only requires that Medicaid claims contain an NPI to be paid. The NPI was valid at the time the provider was screened, and no claims were paid without an NPI attached. Corrective action has been in process to address the revalidation issues, and as of January 1, 2024 the Authority implemented a system change moving the revalidation date to 90 days before the end of the five year period. Auditor’s Remarks The four providers that did not receive proper license checks are still active in ProviderOne and should have been deactivated when the licenses expired. For the provider with the NPI issue, the NPI was valid at the time that the provider was screened, however the Authority backdated the provider’s start date to before the NPI was valid. We reaffirm our finding and will review the Authority’s corrective actions during the next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 U.S. Code of Federal Regulations (CFR) Part 433, State Fiscal Administration, Subpart F – Refunding of Federal Share of Medicaid Overpayments to Providers, describes the requirements for identifying, reporting, collecting, and remitting Medicaid overpayments. Title 42 CFR section 438 subpart H - Additional Program Integrity Safeguards, states in part: Section 438.602 State responsibilities. b. Screening and enrollment and revalidation of providers. 1. The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PHIPs, and PAHPs, in accordance with the requirement of part 455 subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. 2. MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section of up to 120 days, but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120 day period without enrollment of the provider, and notify affected enrollees. c. Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM, or PCCM entity, and any subcontractors as required in § 438.608(c). d. Federal database checks. Consistent with the requirements at § 455.436 of this chapter, the State must confirm the identity and determine the exclusion status of MCO, PIHP, PAHP, PCCM, or PCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM, or PCCM entity through routine checks of Federal databases. This includes the Social Security Administration’s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with § 438.610(c). Title 42 CFR section 455 subpart B – Disclosure of Information by Providers and Fiscal Agents, states in part: Section 455.104 Disclosure by Medicaid providers and fiscal agents: Information on ownership and control. a) Who must provide disclosures. The Medicaid agency must obtain disclosures from disclosing entities, fiscal agents, and managed care entities. b) When disclosures must be provided. The Medicaid agency must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: (1) I. The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agency, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location and P.O. Box address. II. Date of birth and Social Security Number (in the case of an individual). III. Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. 2. Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in an subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. 3. The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. 4. The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). c. When the disclosures must be provided – 1. Disclosures from providers or disclosing entities. Disclosures from any provider or disclosing entity is due at any of the following times: I. Upon the provider or disclosing entity submitting the provider application. II. Upon the provider or disclosing entity executing the provider agreement. III. Upon request of the Medicaid agency during the re-validation of enrollment process under § 455.414. IV. Within 35 days after any change in ownership of the disclosing entity. 2. Disclosures from fiscal agents. Disclosures from fiscal agents are due at any of the following times: I. Upon the fiscal agent submitting the proposal in accordance with the State’s procurement process. II. Upon the fiscal agent executing the contract with the State. III. Upon the renewal or extension of the contract. IV. Within 35 days after any change in ownership of the fiscal agent. 3. Disclosures from managed care entities. Disclosures from managed care entities (MCOs, PIHPs, PAHPs, and HIOs), except PCCMs are due at any of the following times: I. Upon the managed care entity submitting the proposal in accordance with the State’s procurement process. II. Upon the managed care entity executing the contract with the State. III. Upon renewal of the contract. IV. Within 35 days after any change in ownership of the managed care entity. 4. Disclosures from PCCMs. PCCMs will comply with disclosure requirements under paragraph (c)(1) of this section. d. To whom must the disclosures be provided. All disclosures must be provided to the Medicaid agency. e. Consequences for failure to provide required disclosures. Federal financial participation (FFP) is not available in payments made to a disclosing entity that fails to disclose ownership or control information as required by this section. Title 42 CFR section 455 Subpart E – Provider Screening and Enrollment, states in part: Section 455.410 Enrollment and screening of providers a) The State Medicaid agency must require all enrolled providers to be screened under to this subpart. b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. c) The State Medicaid may rely on the results of the provider screening performed by any of the following: 1. Medicare contractors 2. Medicaid agencies or Children’s Health Insurance Programs of other States. Section 455.412 Verification of provider licenses The State Medicaid agency must – a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. b) Confirm that the provider’s license has not expired and that there are no current limitations on the provider’s license. Section 455.414 Revalidation of enrollment The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years. Section 455.436 Federal database checks The State Medicaid agency must do all of the following: a. Confirm the identity and determine the exclusion status of any providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. b. Check the Social Security Administration’s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. c. 1. Consult appropriate databases to confirm identity upon enrollment and reenrollment; and 2. Check the LEIE and EPLS no less frequently than monthly. Section 455.450 Screening levels for Medicaid providers. A State Medicaid agency must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation or enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. a. Screening for providers designated as limited categorical risk. When the State Medicaid agency designated a provider as a limited categorical risk, the State Medicaid agency must do all of the following: 1. Verify that a provider meets any applicable Federal regulations, or State requirements for the provider type prior to making an enrollment determination. 2. Conduct license verifications, including State licensure verifications in States other than where the provider is enrolling, in accordance with § 455.412. 3. Conduct database checks on a pre- and post-enrollment basis to ensure that providers continue to meet the enrollment criteria for their provider type, in accordance with § 455.436. b. Screening for providers designated as moderate categorical risk. When the State Medicaid agency designates a provider as a “moderate” categorical risk, a State Medicaid Agency must do both of the following: 1. Perform the “limited” screening requirements described in paragraph (a) of this section. 2. Conduct on-site visits in accordance with § 455.432. c. Screening for providers designated as high categorical risk. When the State Medicaid agency designated a provider as a “high” categorical risk, a State Medicaid agency must do both of the following: 1. Perform the “limited” and “moderate” screening requirements described in paragraphs (a) and (b) of this section. 2. i. Conduct a criminal background check; and ii. Require the submission of a set of fingerprints in accordance with § 455.434. d. Denial or termination of enrollment. A provider, or any person with 5 percent or greater direct or indirect ownership in the providers, who is required by the State Medicaid agency or CMS to submit a set of fingerprints and fails to do so may have its – 1. Application denied under § 455.434; or 2. Enrollment reminder under § 455.416 e. Adjustment of risk level. The State agency must adjust the categorical risk level from “limited” or “moderate” to “high” when any of the following occurs: 1. The State Medicaid agency imposes a payment suspension on a provider based on credible allegation of fraud, waste or abuse, the provider has an existing Medicaid overpayment, or the provider has been excluded by the OIG or another State’s Medicaid program within the previous 10 years. 2. The State Medicaid agency of CMS in the previous 6 months lifted a temporary moratorium for the particular provider type and a provider that was prevented from enrolling based on the moratorium applies for enrollment as a provider at any time within 6 months from the date the moratorium was lifted. Medicaid Provider Enrollment Compendium (MPEC) B. Enrolled Provider’s Payment Eligibility for Retroactive Dates of Service The practice of “backdating” enrollment involves approving an enrollment with a retroactive billing date. This practice allows a provider, once enrolled, to submit claims for services dated prior to the date upon which the SMA approved the enrollment. As discussed earlier, provider screening enables states to identify ineligible parties before they are able to enroll and start billing. Components of provider screening include database and licensure checks, and may also include site visits and FCBCs. To the extent a SMA approves the enrollment of a new provider and permits the provider to bill for services dated prior to applicable screening(s), this practice creates risk. For example, if a newly enrolling provider is subject to a site visit, and the SMA completes a site visit for the provider but nonetheless permits the provider to bill for services dated prior to the date on which the site visit occurred, there is risk the provider was not present at the site on the date of service for which the provider is subsequently approved to bill. It is incumbent upon the SMA to mitigate risk of improper payments as it determines a provider’s eligibility for enrollment, including the date upon which a provider is deemed eligible to service Medicaid beneficiaries. The SMA should have a process to determine whether and when it is appropriate to approve an enrollment with a retroactive billing date, as doing so represents the SMA’s determination of prior compliance. This process should be designed to mitigate risk. Factors the SMA must take into consideration when approving a retrospective billing date include, but may not be limited to: • Survey or certification requirements that supersede a state’s ability to determine prior compliance Factors the SMA might take into consideration when approving a retrospective billing date may include, but are not limited to: • Emergency access • Pre-authorization • Whether a provider is enrolled in Medicare or another state’s Medicaid Program CMS recommends documenting the basis for establishing an enrollment with a retroactive billing eligibility date. Medicaid payment issued to a provider prior to the SMA’s screening and enrollment of the provider is an improper payment, unless an exception applies as described under Section 1.5.1. Washington Administrative Code AC – 182-502-0005 Core provider agreement (CPA), states: 1. The agency only pays claims submitted by or on behalf of a health care professional, health care entity, supplier or contractor of service that has an approved core provider agreement (CPA) with the agency, is a performing provider on an approved CPA with the agency, or has an approved agreement with the agency as a nonbilling provider in accordance with WAC 182-502-0006. 2. Performing providers of services to a medical assistance client must be enrolled under the billing providers’ CPA. 3. Any ordering, prescribing, or referring providers must be enrolled in the agency’s claims payments system in order for any services or supplied ordered, prescribed, or referred by them to be paid. The national providers identifier (NPI) of any referring, prescribing, or ordering provider must be included on the claim form. Refer to WAC 182-502-0005 for enrollment as a nonbilling provider. 4. For services provided out-of-state, refer to WAC 182-501-0180, 182-501-0182 and 182-501-0184. 5. The agency does not pay for services provided to clients during the CPA application process or application for nonbilling provider process, regardless of whether the agency later approves or denies the application, except as provided in subsection (6) of this section or WAC 182-502-0006(5). 6. Enrollment of a provider applicant is effective on the date the agency approves the provider application. a. A provider applicant may ask for an effective date earlier than the agency’s approval of the provider application by submitting a written request to the agency’s chief medical officer. The request must specify the requested effective date and include an explanation justifying the earlier effective date. The chief medical officer will not authorize an effective date that is: i. Earlier than the effective date of any required license or certification; or ii. More than three hundred sixty-five prior to the agency’s approval of the provider application. b. The chief medical officer or designee may approve exceptions as follows: i. Emergency services; ii. Agency-approved out-of-state services; iii. Medicaid provider entities that are subject to survey and certification by CMS or the state survey agency; iv. Retroactive client eligibility; or v. Other critical agency need as determine by the agency’s chief medical officer or designee. c. For federal qualified health centers (FQHCs), see WAC 182-548-1200. For rural health clinics (RHCs), see WAC 182-549-1200. d. Exceptions granted under this subsection (6) do not supersede or otherwise change the agencies timely billing requirements under WAC 182-502-0150.

2023-075 The Health Care Authority improperly charged $3,491 to the Medicaid program. Assistance Listing Number and Title: 93.778 COVID-19 Medical Assistance Program 93.778 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2205WA5MAP; 2205WA5ADM; 2205WAIMPL; 2305WA5MAP; 2305WA5ADM; 2305WAIMPL Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: $3,491 Prior Year Audit Finding: No Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.4 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid, administered by the Health Care Authority, is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. During fiscal year 2023, the program spent about $19.6 billion in federal and state funds. The Affordable Care Act established a methodology for determining income eligibility for Medicaid, which is based on modified adjusted gross income (MAGI). MAGI is used to determine financial eligibility for Medicaid, premium tax credits, and cost sharing reductions available through the health insurance marketplace. By using one set of income counting rules and a single application across programs, the Affordable Care Act made it easier for people to apply and enroll in the appropriate program. Federal law requires that certain types of information be collected during the application process. As a condition of eligibility, each person seeking Medicaid must provide their Social Security number (SSN), as described in 42 CFR § 435.910. If applicants do not know their SSN or have not been issued an SSN, states must help them obtain or apply for one. States may choose to accept self-attestations of the information needed to determine or renew eligibility except with respect to income, SSN, and citizenship or immigration status. Description of Condition The Authority improperly charged $3,491 to the Medicaid program. Under federal law, clients must have an SSN for the Authority to determine or renew their eligibility for services. Those responsible for newborn clients are allowed one full year from the newborn’s date of birth to obtain and inform the Authority of an SSN. During the COVID-19 public health emergency, the Authority, under federal guidance, was not required to reevaluate clients’ eligibility for services. However, federal law still required clients over the age of one to have an SSN. We found the Authority had adequate internal controls to ensure material compliance with eligibility requirements. However, we identified instances where the Authority paid benefits on behalf of people who did not provide an SSN as required. We used a statistical sampling method to randomly select and examine 45 clients out of a total population of 44,497 who were coded as newborns. We found four clients of the 45 we examined did not meet the eligibility requirements. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a single audit exceed $25,000. We are issuing this finding because, as stated in the Effect of Condition and Questioned Costs section of this finding, the estimated questioned costs exceed that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition The Families First Coronavirus Response Act specifies that all Medicaid recipients will maintain eligibility through the end of the public health emergency, unless they move out of state, die, request to be removed from the program, or are not eligible due to immigration status. Because the Authority was not reevaluating clients’ eligibility, staff did not identify clients who did not have SSNs as required. Authority officials said that due to the Families First Coronavirus Response Act, they were unable to remove clients from Medicaid, even if they did not have the required SSN. Effect of Condition and Questioned Costs The Authority improperly charged the Medicaid program for costs, as outlined in the table below. Projection to population Known Questioned Costs Likely Questioned Costs [Estimate] Federal expenditures $3,491 $3,451,692 State expenditures $2,746 $2,714,891 Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a moderate level of assurance, with a 90 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our “best estimate of total questioned costs,” as required by 45 CFR § 75.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Authority consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Authority’s Response The Authority partially concurs with the finding. In accordance with Families First Coronavirus Response Act, the Authority maintained coverage for cases where the household did not provide an SSN for their newborn until the end of the public health emergency. As normal operations resume, any newborns that do not have an SSN at the age of one will be reviewed at their next renewal. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority’s corrective action during our next audit. Applicable Laws and Regulations Title 42 U.S. Code of Federal Regulations (CFR) Part 433, State Fiscal Administration, Subpart F – Refunding of Federal Share of Medicaid Overpayments to Providers, describes the requirements for identifying, reporting, collecting, and remitting Medicaid overpayments. Title 42 CFR Subpart J, Part 435 – Eligibility in the States, states in part: Section 910, Use of social security number, states in part: (a) Except as provided in paragraph (h) of this section, the agency must require, as a condition of eligibility, that each individual (including children) seeking Medicaid furnish each of his or her Social Security numbers (SSN). (e) If an applicant cannot recall his SSN or SSNs or has not been issued a SSN the agency must— (1) Assist the applicant in completing an application for an SSN; (2) Obtain evidence required under SSA regulations to establish the age, the citizenship or alien status, and the true identity of the applicant; and (3) Either send the application to SSA or, if there is evidence that the applicant has previously been issued a SSN, request SSA to furnish the number. (g) The agency must verify the SSN furnished by an applicant or beneficiary with SSA to ensure the SSN was issued to that individual, and to determine whether any other SSNs were issued to that individual. (h) Exception. (1) The requirement of paragraph (a) of this section does not apply and a State may give a Medicaid identification number to an individual who— (i) Is not eligible to receive an SSN Section 956, Verification of other non-financial information, states in part: (a) Citizenship and immigration status. (1) (i) The agency must— (A) Verify citizenship status (4) (i) The agency must maintain a record of having verified citizenship or immigration status for each individual, in a case record or electronic database in accordance with the State's record retention policies (5) If the agency cannot promptly verify the citizenship or satisfactory immigration status of an individual the agency— (i) Must provide a reasonable opportunity in accordance with paragraph (b) of this section; (b) Reasonable opportunity period. (1) The agency must provide a reasonable opportunity period to individuals who have made a declaration of citizenship or satisfactory immigration status in accordance with § 435.406(a), and for whom the agency is unable to verify citizenship or satisfactory immigration status in accordance with paragraph (a) of this section. During the reasonable opportunity period, the agency must continue efforts to complete verification of the individual's citizenship or satisfactory immigration status, or request documentation if necessary. The agency must provide notice of such opportunity that is accessible to persons who have limited English proficiency and individuals with disabilities, consistent with § 435.905(b). During such reasonable opportunity period, the agency must, if relevant to verification of the individual's citizenship or satisfactory immigration status— (i) In the case of individuals declaring citizenship who do not have an SSN at the time of such declaration, assist the individual in obtaining an SSN, and attempt to verify the individual's citizenship in accordance with paragraph (a)(1) of this section once an SSN has been obtained and verified; (iii) Provide the individual with an opportunity to provide other documentation of citizenship or satisfactory immigration status. (3) If, by the end of the reasonable opportunity period, the individual's citizenship or satisfactory immigration status has not been verified in accordance with paragraph (a) of this section, the agency must take action within 30 days to terminate eligibility in accordance with part 431 subpart E … (d) Social Security numbers. The agency must verify Social Security numbers (SSNs) in accordance with § 435.910 of this subpart. Title 45 CFR Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 410, establishes requirements for the collection of unallowable costs.

2023-076 The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure timely review of hospital complaints. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2205WA5MAP; 2205WA5ADM; 2205WAIMPL; 2305WA5MAP; 2305WA5ADM; 2305WAIMPL Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Provider Health and Safety Standards Known Questioned Cost Amount: None Prior Year Audit Finding: No Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.4 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. During fiscal year 2023, the program spent about $19.6 billion in federal and state funds. The Centers for Medicare and Medicaid Services (CMS), which administers the program at the federal level, relies on states to regulate and license hospitals that serve Medicaid clients. Medicaid coverage for hospitals is authorized only when services are provided in a facility that is licensed and certified by the state survey agency (for non-deemed hospitals) or an accrediting organization (for deemed hospitals). The term “deemed” means the facility has voluntarily requested and received permission from CMS to be certified by an accrediting organization, while hospitals that are “non-deemed” have not. The Department of Health is Washington’s state licensing agency, and it is also responsible for investigating hospital complaints. The Department’s Office of Investigation and Legal Services (OILS) is the front-line response system for providing the intake and assignment functions for complaints from staff, patients, accrediting organizations and the public. The Department’s Office of Health Systems Oversight is responsible for coordinating and performing investigation surveys. Deemed hospitals are surveyed for CMS certification by their accrediting organizations. However, the Department performs an investigation survey for complaints that meet the federal prioritization level. People can submit complaints to OILS online or by mail, email, or telephone. OILS uses the Integrated Licensing and Regulatory System (ILRS) to input and track complaints. OILS intake staff review all report types regardless of delivery method before entering them into ILRS. Intake staff check for possible imminent danger and then deliver the complaint to the Department’s Office of Health Systems Oversight, as well as upload an electronic copy to a secure drive. The CMS State Operations Manual, which is binding on Medicare-certified and Medicare-Medicaid-certified providers, provides state agencies with procedural guidelines for surveying and managing complaints and incidents. Hospitals are responsible for following the provider health and safety standards that are mandated by state and federal regulations. When the Department receives hospital complaints, state regulations require staff to perform an initial assessment of the reports within 21 days. In addition, staff must review the reports for possible imminent danger within two working days of receiving them. If staff identify imminent danger, they must immediately forward the report for processing. The following two tables outline the federal requirements for response times that the Department must follow for deemed hospitals and non-deemed hospitals. Priority levels and response times for non-deemed hospitals Priority levels and response times for deemed hospitals The CMS State Operations Manual requires people with certain qualifications to assess each hospital complaint. These people must be professionally qualified to evaluate the nature of the problem based on their knowledge and experience of current clinical standards of practice and federal requirements. If OILS determined possible imminent danger, the case manager and survey manager review the complaints for immediate jeopardy. If they determine there is possible imminent danger, then an Expedited Case Management Team is designated. If they do not identify immediate jeopardy, they prioritize the complaint at the next weekly case management meeting. Once case managers decide that a complaint at a non-deemed hospital meets the state and federal prioritization level for investigation, they assign it to field staff. For complaints at deemed hospitals that meet the federal prioritization level for investigation, case managers request authorization from the CMS regional office through the Aspen Complaint Tracking System to initiate an investigation. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure timely review of hospital complaints. The Department received 1,698 hospital complaints during state fiscal year 2023. We evaluated all of them to ensure the Department performed an initial assessment and review of the complaints for imminent danger within the required timelines. We found the Department did not review 1,297 complaints (76 percent) for imminent danger within two working days of receiving them. The review time for these complaints ranged between three and 66 days. In addition, the Department did not review eight complaints (0.5 percent) within the 21-day basic assessment period. The review time for these complaints ranged between 23 and 71 days. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not implement adequate internal controls to ensure staff reviewed the complaints within the required timeframe. Management acknowledged the Department was understaffed, which contributed to the lack of timely reviews for the complaints. Effect of Condition When the Department does not prioritize and perform a prompt initial assessment of complaints, vulnerable patients are at higher risk of abuse, neglect and substandard care. The delays in reviewing these complaints also affect the Department’s ability to initiate timely investigations of issues concerning providers. Further, when the Department does not promptly follow up on a complaint, the state also runs the risk of paying Medicaid funding to a noncompliant facility. Recommendation We recommend the Department implement internal controls to ensure it reviews complaints for imminent danger within two working days of receiving them, as state regulations and the State Operations Manual require. Department’s Response We appreciate the State Auditor’s Office audit of the Medicaid Special Tests Health and Safety Standards grant requirement. DOH is committed to ensuring our programs comply with federal regulations and concurs generally with the finding. The Department asserts that it has a process to screen complaints for possible imminent danger so that a potential investigation can be initiated in a timely manner. However, we acknowledge that our current system lacks the internal controls necessary to demonstrate compliance. Moving forward, the Department will evaluate system controls in order to properly reflect the accurate date of initial screening then subsequent assessment and review. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington Administrative Code 246-14-040 Uniform Procedures For Complaint Resolution, states: Initial assessment of reports. 1. Initial assessment is the process of determining whether a report warrants an investigation and becomes a complaint. The complainant and credential holder or applicant will be notified as soon as possible after the initial assessment is complete. 2. The basic time period for initial assessment is twenty-one days. 3. All reports will be reviewed for imminent danger within two working days. If imminent danger is identified, the report will be immediately forwarded for processing. The Centers for Medicare and Medicaid Services, State Operations Manual, Chapter 5 – Complaint Procedures, states in part: Section 5010 –General Intake Process A complaint is an allegation of noncompliance with Federal and/or State requirements. If the SA determines that the allegation(s) falls within the authority of the SA, the SA determines the severity and urgency of the allegations, so that appropriate and timely action can be pursued. Each SA is expected to have written policies and procedures to ensure that the appropriate response is taken for all allegations and is consistent with Federal requirements as well as with procedures in the Sate Operations Manual. This structure needs to include response timelines and a process to document actions taken by the SA in response to allegations. If a state’s time frames for the investigation of a complaint/incident are more stringent than the Federal time frames, the intake is prioritized using the State’s timeframes. The SA is expected to be able to share the logic and rationale that was utilized in prioritizing the complaint/incident for investigation. The SA response must be designed to protect the health and safety of all residents, patients, and clients. Section 5070 –Priority Assignment for Nursing Homes, Deemed and Non-Deemed Non-Long Term Care Providers/ Suppliers, and EMTALA An assessment of each complaint or incident intake must be made by an individual who is professionally qualified to evaluate the nature of the problem based upon his/her knowledge of Federal requirements and his/her knowledge of current clinical standards of practice. For non-long term care providers/suppliers, in situations where a determination is made that immediate jeopardy may be present and ongoing, the SA is required to start the on site investigation within two business days of receipt of the complaint or incident report, or, in the case of a deemed provider or supplier, within two business days of RO authorization for investigation. The same process applies to EMT ALA complaints or a survey related to a report of a hospital or CAH Distinct Part Unit patient death associated with the use of restraint or seclusion. The SA’s investigation must be initiated within two business days of RO authorization for investigation. CMS expects SAs to prioritize complaints at the appropriate level that is warranted. The timeframes in Section 5075 below represent maximum timeframes for investigation; the SA is not precluded from investigating complaints and facility-reported incidents within a shorter timeframe. In addition, the SA is not precluded from taking other factors into consideration in its triage decision. For example, the SA may identify a trend in allegations that indicates an increased risk of harm to residents or the SA may receive corroborating information from other complainants regarding the allegation. Section 5075.9 – Maximum Time Frames Related to the Federal Onsite Investigation of Complaints/Incidents

2023-077 The Department of Social and Health Services did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid Program. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 – State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 – Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2205WA5MAP; 2205WA5ADM; 2205WAIMPL; 2305WA5MAP; 2305WA5ADM; 2305WAIMPL Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Test and Provisions – Provider Eligibility Known Questioned Cost Amount: $576,072 Prior Year Audit Finding: Yes, Finding 2022-059 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.4 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. During fiscal year 2023, the program spent about $19.6 billion in federal and state funds. The Department of Social and Health Services is responsible for ensuring Medicaid social service providers are eligible to render services to program recipients. Providers must remain in good standing with eligibility requirements in order to continue receiving payments under the program. The Department is responsible for performing measures appropriate for the provider type at application and initial enrollment. Federal regulations require state Medicaid agencies to revalidate the enrollment of all Medicaid providers at least every five years. Washington had more than 50,000 active providers during fiscal year 2023. During that time, the Department paid about $3.4 billion to providers for direct client services. Nursing facility contracts have no end date, because the Centers for Medicare and Medicaid Services expects these contracts to be open-ended. However, these facilities are revalidated every five years. At the time of revalidation, nursing facilities must submit a signed and dated Medicaid Provider Disclosure Statement (MPDS). Nursing facilities must have a valid MPDS form on file with the Department to be eligible to charge Medicaid for client services. After enrollment, staff in the Department’s Contract Unit create a file for each provider in the Agency Contracts Database. Once entered, the Automated Provider Screening (APS) system within ProviderOne automatically screens each provider monthly for exceptions from the following federal databases: • List of Excluded Individuals/Entities (LEIE) • Excluded Parties List System, now called the System for Award Management (SAM) • SSA Limited Access Death Master File Contract staff are notified by email if the screening resulted in a match, and staff then manually verify if it was legitimate. In between revalidation periods, federal law requires state Medicaid agencies to check LEIE and SAM at least monthly to determine the exclusion status of providers, including any person with ownership, controlling interest, or acting as an agent or managing employee of the provider. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid Program. The prior finding number was 2022-059. Description of Condition The Department did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid Program. Nursing Facility Revalidations The Department is required to revalidate nursing facilities on a five-year cycle. During state fiscal year 2023, 19 facilities required revalidation, which included providing an updated MPDS. We used a non-statistical sampling method to randomly select and examine seven out of a total population of 19 facilities. We found that out of the seven sampled facilities, six (86 percent) did not provide a signed and dated MPDS form during the revalidation period. These providers were therefore not eligible to provide services for part of the audit period, during which they were paid $576,072 in federal Medicaid funds. Monthly APS Screenings Federal law requires the Department to check federal databases at least monthly to confirm the identity and exclusion status of providers. However, the automated system that performs these checks and notifies the Department of possible problems with providers was not operating correctly and frequently provided incorrect information. Department management decided to only screen all providers on an annual basis. In September 2022, the Department manually screened all providers against the federal databases. For all other months, only newly populated providers from the APS system received a screening for the month. This policy was in place until March 2023, at which point the Department restarted the normal monthly screening of all providers. At that time, the APS system continued to frequently produce incorrect information. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Nursing Facility Revalidations Management did not have a procedure or internal control in place to ensure it terminated nursing facility providers that did not reenroll by the five-year mark. Monthly APS Screenings Because of issues with the APS system, Department officials said they did not have the time or resources to manually perform database checks of all providers each month. Effect of Condition and Questioned Costs Monthly APS Screenings By not reviewing the exclusion status of all providers in a timely and routine manner, the Department was noncompliant with federal requirements to check LEIE and SAM at least monthly. As a result, the Department is at risk of not properly identifying any newly excluded or sanctioned providers. Nursing Facility Revalidations By not updating the MPDS of nursing facilities during revalidation, the Department was noncompliant with federal regulations requiring Medicaid agencies to revalidate the enrollment of all Medicaid providers at least every five years. The Department is also at risk of disbursing Medicaid payments to nursing facilities that have not properly revalidated their enrollment and, therefore, not eligible to receive Medicaid payments. The table below identifies the known and estimated likely questioned costs for the Department’s federal and state Medicaid expenditures. Projection to population Known Questioned Costs Likely Questioned Costs [Estimate] Federal expenditures $576,072 $1,563,625 State expenditures $471,332 $1,279,329 We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department implement internal controls sufficient to ensure it: • Complies with monthly provider screening requirements • Revalidates nursing facilities timely • Terminates nursing facilities that do not reenroll within five years • Does not make payments to inactive nursing facilities We also recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department’s Response The Department partially agrees with the finding. We agree that we did not obtain the Medicaid Provider Disclosure Statement (MPDS) forms for the identified exceptions within the five-year revalidation timeline due to residual effects of increased workload during the public health emergency, however we do not agree that all the exceptions should result in questioned costs. For Quality Health Care of Bothell LLC, the nursing home was still validated within the last five years because there were no changes to ownership or the managing employees since the previous MPDS form was received. We are disputing the questioned costs related to the Quality Health Care of Bothell LLC totaling $231,809.60. The existing nursing home revalidation process was modified March 2024 to include more detail about what to do when the nursing home is not providing the MPDS form by the 5-year deadline. The process includes the steps that must be taken prior to termination of the Medicaid contract to ensure resident safety and choice, as well as when to notify rates to stop payment to the nursing home. Effective March 2023 Automated Provider Screening is being completed monthly for all providers as required. Auditor’s Remarks The MPDS for Quality Health Care of Bothell LLC expired in 2017, we therefore questioned the associated costs as specified above. We reaffirm the finding and questioned costs. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75.2 establishes definitions for questioned costs. Title 45 CFR Part 75, section 410 establishes requirements for the collection of unallowable costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR Part 433, State Fiscal Administration, Subpart F – Refunding of Federal Share of Medicaid Overpayments to Providers, describes the requirements for identifying, reporting, collecting, and remitting Medicaid overpayments. Title 42 CFR section 455 Subpart E – Provider Screening and Enrollment, states in part: Section 455.410 Enrollment and screening of providers (a) The State Medicaid agency must require all enrolled providers to be screened under to this subpart. (b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. (c) The State Medicaid agency may rely on the results of the provider screening performed by any of the following: (1) Medicare contractors. (2) Medicaid agencies or Children’s Health Insurance Programs of other States. Section 455.414 Revalidation of enrollment The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years. Section 455.436 Federal database checks The State Medicaid agency must do all of the following: (a) Confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. (b) Check the Social Security Administration’s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. (c) (1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and (2) Check the LEIE and EPLS no less frequently than monthly. Section 455.450 Screening levels for Medicaid providers. A State Medicaid agency must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. (a) Screening for providers designated as limited categorical risk. When the State Medicaid agency designates a provider as a limited categorical risk, the State Medicaid agency must do all of the following: (1) Verify that a provider meets any applicable Federal regulations, or State requirements for the provider type prior to making an enrollment determination. (2) Conduct license verifications, including State licensure verifications in States other than where the provider is enrolling, in accordance with § 455.412. (3) Conduct database checks on a pre- and post-enrollment basis to ensure that providers continue to meet the enrollment criteria for their provider type, in accordance with § 455.436. (b) Screening for providers designated as moderate categorical risk. When the State Medicaid agency designates a provider as a “moderate” categorical risk, a State Medicaid agency must do both of the following: (1) Perform the “limited” screening requirements described in paragraph (a) of this section. (2) Conduct on-site visits in accordance with § 455.432. (c) Screening for providers designated as high categorical risk. When the State Medicaid agency designates a provider as a “high” categorical risk, a State Medicaid agency must do both of the following: (1) Perform the “limited” and “moderate” screening requirements described in paragraphs (a) and (b) of this section. (2) (i) Conduct a criminal background check; and (ii) Require the submission of a set of fingerprints in accordance with § 455.434. (d) Denial or termination of enrollment. A provider, or any person with 5 percent or greater direct or indirect ownership in the provider, who is required by the State Medicaid agency or CMS to submit a set of fingerprints and fails to do so may have its - (1) Application denied under § 455.434; or (2) Enrollment terminated under § 455.416. (e) Adjustment of risk level. The State agency must adjust the categorical risk level from “limited” or “moderate” to “high” when any of the following occurs: (1) The State Medicaid agency imposes a payment suspension on a provider based on credible allegation of fraud, waste or abuse, the provider has an existing Medicaid overpayment, or the provider has been excluded by the OIG or another State’s Medicaid program within the previous 10 years. (2) The State Medicaid agency or CMS in the previous 6 months lifted a temporary moratorium for the particular provider type and a provider that was prevented from enrolling based on the moratorium applies for enrollment as a provider at any time within 6 months from the date the moratorium was lifted.

2023-078 The Department of Social and Health Services, Aging and Long-Term Support Administration, did not have adequate internal controls over and did not comply with survey requirements for Medicaid intermediate care facilities. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare 93.777 COVID-19 – State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program (Medicaid; Title XIX) 93.778 COVID-19 – Medical Assistance Program Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: 2205WA5MAP; 2205WA5ADM; 2205WAIMPL; 2305WA5MAP; 2305WA5ADM; 2305WAIMPL Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Test and Provisions – Provider Health and Safety Standards Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2020-053 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.4 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. During fiscal year 2023, the program spent about $19.6 billion in federal and state funds and had three ICF/IID facilities that were Medicaid certified. Residential Care Services (RCS), under the Department of Social and Health Services, Aging and Long-Term Support Administration, is the State’s Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICF/IID) survey agency. An ICF/IID is an institution with the primary purpose of providing health or rehabilitation services to people with intellectual disabilities or related conditions who receive care and services under Medicaid. The Department must perform a federal certification survey of each ICF/IID. The certification survey is a resident-centered inspection that gathers information about the quality of service provided in a facility to determine compliance with the participation requirements. The survey focuses on the facility’s administration and patient services, as well as the outcome of the facility’s implementation of ICF/IID active treatment services. The survey also assesses compliance with federal health, safety, and quality standards designed to ensure patients receive safe and quality care services. The State must complete a standard survey for each ICF/IID facility within 15.9 months after the previous survey, and the statewide average for all ICF/IID facilities must not exceed 12.9 months for all ICF/IID facilities, as required by Centers for Medicare and Medicaid Services (CMS). All staff surveyors are required to receive specific RCS training in order to be qualified to conduct surveys. If a survey uncovers deficiencies, the Department must mail a Statement of Deficiency (SOD) to the facility within 10 working days of the survey date. The facility must submit a Plan of Correction (POC) that the Department determines is acceptable within 10 calendar days of receipt of the SOD. The facility has a total of 60 days to be back in compliance or risk forfeiting its Medicaid certification. In addition to federal requirements, the Department has established its own policies and procedures requiring that it review a submitted POC within five working days after receiving it. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls to ensure it conducted timely surveys and followed up on deficiencies. The prior finding numbers were 2020-053, 2019-061, 2018–052, 2017-042, 2016-037, 2015-045, and 2014-046. Description of Condition The Department did not have adequate internal controls over and did not comply with survey requirements for Medicaid intermediate care facilities. The Department uses a tracking spreadsheet as an internal control to monitor and track the survey frequencies as well as the statewide average frequency to ensure it meets the mandated 15.9 month survey frequency, and the statewide average of 12.9 months between surveys for each facility. The Department uses a separate tracking spreadsheet to track individual surveys for SOD and POC due dates and approaching deadlines. We found the Department did not ensure that all recertification surveys were completed promptly. The Department did not adequately monitor the tracking sheet and complete surveys for all three of the ICF/IIDs within the required 15.9 months and 12.9 month statewide average. While assessing the Departments compliance with these requirements, we considered the time period where survey activities were suspended due to the Covid-19 pandemic and did not include that period of suspended activities in our calculation between survey dates. The statewide average is calculated on the federal fiscal year. For federal fiscal year 2023, the statewide average for the three surveys was 22.1 months. Additionally, both POCs for the two surveys conducted during the fiscal year were reviewed after the five day period required by the Department. We also reviewed staff training for the three new hires conducting surveys at ICF/IIDs during the fiscal year. We found that the Department did not have record of the required RCS training for one of the newly hired surveyors. The Department had records of other required trainings, however there was no record of the staff receiving the RCS surveyor training. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition As a result of the public health emergency, the Department had an extensive backlog of complaints and recertification surveys. While trying to address the backlog there were new complaints that also had to be prioritized. Although there are only three facilities, there is only one team that handles the surveys, complaints, and revisits for this provider type across the entire state. For the late reviews of the POCs, the Department needed to meet with one facility and explain why they were rejecting their POC, which did not occur within the 5-day period. In the other instance, the POC was sent to the team for review and there was a lack of response, which the Department believes is due to having three new team members still learning the survey process. Management did not monitor its survey schedules adequately to ensure compliance in meeting the survey timeline. Effect of Condition Without conducting recertification surveys timely, the State is at risk of paying facilities for services provided to Medicaid clients without assurance the facilities are complying with federal and state health standards and regulations. Clients residing in facilities that do not meet federal health and safety requirements for participating in the Medicaid program could be at increased risk of abuse, mistreatment, neglect or substandard care. By not meeting the statewide average requirement for recertification surveys, the Department has not met federal Medicaid requirements and could be subject to sanctions by the grantor. Recommendations We recommend the Department: • Establish adequate internal controls to ensure compliance with facility survey timeliness requirements • Ensure it completes recertification surveys within 15.9 months and within the 12.9 month state-wide average • Ensure all staff receive required survey training • Ensure all POCs are reviewed timely Department’s Response The Department partially agrees with the Finding. While we do agree that we did not meet the Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICF-IID) Survey requirements, due to the backlog created by the public health emergency and a 20% staff vacancy rate, we do not agree that it was due to lack of internal controls. It was through applied internal controls that we identified concerns and allocated resources as we were able to meet the most serious concerns. Based on the FY2022 and FY2023 State Performance Standards System review completed by Centers for Medicare and Medicaid Services, we met the recertification standard because the recertification backlog was accounted for in the standards and the expectation was for a reduction in the backlog, not a complete elimination of the backlog. For FY2023 the expectation was to decrease the recertification backlog by 50% from the previous year. We decreased the backlog by 100% and as of March 2024 we are meeting our ICF-IID recertification timelines. Because the 12.9 month average is based on the overall average of the months for all ICF-IID surveys, and some of those surveys were in a significant backlog due to the pandemic, statistically it would be expected that even when the state is meeting the 15.9 month timeframe for each home and lowering the number of months between surveys for some homes to lower the average, it will take time for the bell curve average to shift toward 12.9 months. We have now created a SOD/POC tracking tool in Smart Sheet that each team in RCS is using to track deadlines. This system sends email alerts to key staff when deadlines are approaching or have arrived. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards,section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR, Part 442, Standards for Payment to Nursing Facilities and Intermediate Care Facilities for Individuals with Intellectual Disabilities, states in part: Section 442.109 – Certification period for ICF/IIDs: General Provisions (a) A survey agency may certify a facility that fully meets applicable requirements. The State Survey Agency must conduct a survey of each ICF/IID not later than 15 months after the last day of the previous survey. (b) The statewide average interval between surveys must be 12 months or less, computed in accordance with paragraph (c) of this section. Title 42 U.S. Code of Federal Regulations, Part 488, Survey, Certification, and Enforcement Procedures, states in part: Section 488.28 – Providers or suppliers, other than Skilled Nursing Facilities (SNFs), Nursing Facilities (NFs), and Home Health Agencies (HHAs) with deficiencies (a) If a provider or supplier is found to be deficient in one or more of the standards in the conditions of participation, conditions for coverage, or conditions for certification or requirements, it may participate in, or be covered under, the Medicare program only if the provider or supplier has submitted an acceptable plan of correction for achieving compliance within a reasonable period of time acceptable to CMS. In the case of an immediate jeopardy situation, CMS may require a shorter time period for achieving compliance. (b) The existing deficiencies noted either individually or in combination neither jeopardize the health and safety of patients or are of such character as to seriously limit the provider's capacity to render adequate care. (c) (1) If it is determined during a survey that a provider or supplier is not in compliance with one or more of the standards, it is granted a reasonable time to achieve compliance. (2) The amount of time depends upon the - (i) Nature of the deficiency; and (ii) State survey agency's judgment as to the capabilities of the facility to provide adequate and safe care. (d) Ordinarily a provider or supplier is expected to take the steps needed to achieve compliance within 60 days of being notified of the deficiencies but the State survey agency may recommend that additional time be granted by the Secretary in individual situations, if in its judgment, it is not reasonable to expect compliance within 60 days, for example, a facility must obtain the approval of its governing body, or engage in competitive bidding. The Centers for Medicare and Medicaid Services, State Operations Manual, Chapter 2 – The Certification Process, states in part: 2138G – Schedule for Recertification (Rev. 91, Issued: 09-27-13, Effective: 09-27-13, Implementation: 09-27-13) The SA completes a recertification survey an average of every 12 months and at least once every 15 months (see §2141). 2141 – Recertification – ICFs/IID (Rev. 91, Issued: 09-27-13, Effective: 09-27-13, Implementation: 09-27-13) • The regulation at §442.15 provides that provider agreements for ICF/IID’s would remain in effect as long as the facility remains in compliance with the Conditions of Participation (COP’s). Regulations at §442.109 through §442.111. • Beginning on May 16, 2012, ICF/IID’s are no longer subject to time-limited agreements. However, they are to be surveyed for re-certification an average of every 12 months and at least once every 15 months. • If during a survey the survey agency finds a facility does not meet the standards for participation the facility may remain certified if the survey agency makes two determinations – The facility may maintain its certification if the survey agency finds Immediate Jeopardy doesn’t exist, and if the facility provides an acceptable plan of correction. • An ICF/IID may be decertified under procedures outlined in Section 3012 of the State Operations Manual. More specifically, a facility may be decertified if an immediate jeopardy finding remains unabated after 23 days or if it fails to regain compliance with conditions of participation after 90 days. ICF/IID’s will be subject to survey an average of every 12 months and at least every 15 months, the same period that is applied to Nursing Homes. The Department of Social and Health Services, Residential Care Services Standard Operating Procedure: Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICF/IID), Chapter 16C2 – ICF/IID Plan of Correction (PoC) states in part: Overview Following the survey process and upon receipt of the SOD, the facility must develop a Plan of Correction (PoC) to address all stated deficiencies outlined in the SOD within 10 calendar days of receipt of the SOD. Regulations allow certification of ICF/IID facilities with deficiencies at the standard level “only if the facility has submitted an acceptable PoC for achieving compliance within a reasonable period of time acceptable to the Secretary.” Failure to submit a PoC could result in termination of the facility agreement. Decisions on acceptance of the PoC by the survey team must occur within 5 working days of receipt by RCS. The facility has no longer, than 60 calendar days to implement the PoC and correct the deficiency. The correction date for a specific deficiency may be less depending on the circumstances of the deficiency. Procedure Surveyor/Complaint Investigator will: 1. Review the PoC within 5 working days of receipt of the PoC. 2. An acceptable PoC must contain the following elements: • The plan for correcting the specific deficiency cited. The plan should address the internal facility processes that lead to the deficiency being cited; • The procedures for implementing the PoC for the specific deficiency cited; • The monitoring procedure to ensure that the PoC is effective and that specific deficiency cited remains corrected and in compliance with the regulatory requirements; • The title of the person responsible for implementing the PoC. 3. PoCs must be specific and realistic, stating exactly how the correction to the deficiency occurred. The administrator, or other authorized official, must sign and date the PoC. Additional documentation attached to CMS Form 2567 is acceptable. All deficiencies corrected since the survey, must have the corrected date on the form. 4. Do not routinely accept dates for correction at 60 calendar days. If a corrected deficiency is possible well before 60 calendar days, then the correction date should reflect that. 5. Discuss the decision with the Field Manager. Determine possible revisits as needed. 6. If the PoC is acceptable (depending on a paper review and/or onsite revisit if needed), complete the CMS Form 2567B in ASPEN. 7. If the PoC is not acceptable, see Chapter 16C3: Unacceptable PoC for procedures. 8. Report the decision to the Administrative Assistant 3 (AA3) for documentation.

2023-079 The Department of Social and Health Services, Aging and Long-Term Support Administration, did not have adequate internal controls over and did not comply with survey requirements for Medicaid nursing homes. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 – State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 – Medical Assistance Program Federal Grantor Name: U.S Department of Health and Human Services Federal Award/Contract Number: 2205WA5MAP;2205WA5ADM;2205WAIMPL; 2305WA5MAP;2305WA5ADM;2305WAIMPL Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Test and Provisions – Provider Health and Safety Standards Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2020-054 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.4 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. During fiscal year 2023, the program spent about $19.6 billion in federal and state funds and had 207 Medicaid certified nursing homes. Residential Care Services (RCS), under the Department of Social and Health Services, Aging and Long-Term Support Administration, is the State’s nursing home survey agency. A nursing home facility is an institution with the primary purpose of providing 24-hour supervised nursing care, personal care, therapy, nutrition management, organized activities, social services, room, board and laundry to people who receive care and services under Medicaid. The Department must perform a federal certification or recertification survey of each nursing home. The certification survey is a resident-centered inspection that gathers information about the quality of service provided in a facility to determine compliance with the participation requirements. The survey focuses on the facility’s administration and patient services. The survey also assesses compliance with federal health, safety, and quality standards designed to ensure patients receive safe and quality care services.   The State must complete a standard survey for each nursing home facility within 15.9 months after the previous survey, and the statewide average for all nursing homes must not exceed 12.9 months for all nursing homes, as required by Centers for Medicare and Medicaid Services (CMS). All staff surveyors are required to receive specific RCS training in order to be qualified to conduct surveys. If a survey uncovers deficiencies, the Department must mail a Statement of Deficiency (SOD) to the facility within 10 working days of the survey date. The facility must submit a Plan of Correction (POC) that the Department determines is acceptable within 10 calendar days of receipt of the SOD. The facility has a total of 60 days to be back in compliance or risk forfeiting its Medicaid certification. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls to ensure it conducted timely surveys and followed up on deficiencies. The prior finding number was 2020-054. Description of Condition The Department did not have adequate internal controls over and did not comply with survey requirements for Medicaid nursing home facilities. The Department uses a tracking spreadsheet as an internal control to monitor and track the survey frequencies as well as the statewide average frequency to ensure it meets the mandated 15.9 month survey frequency, and the statewide average of 12.9 months between surveys for each facility.   We found the Department did not ensure that all recertification surveys were completed promptly. The Department did not adequately monitor the tracking sheet and complete surveys for 141 nursing homes in fiscal year 2023 within the required 15.9 months and did not meet the 12.9 month statewide average. While assessing the Department’s compliance with these requirements, we considered the time period where survey activities were suspended due to the COVID-19 pandemic and did not include that period of suspended activities in our calculation between survey dates. The statewide average is calculated on the federal fiscal year. For federal fiscal year 2023, the statewide average for nursing home surveys was 19.8 months. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The public health emergency created a backlog of recertification surveys that needed to be completed and the Department had a shortage of trained employees able to perform surveys which extended the survey timelines. In addition, management did not monitor its survey schedules adequately to ensure compliance in meeting the survey timeline. Effect of Condition Without conducting recertification surveys timely, the State is at risk of paying facilities for services provided to Medicaid clients without assurance the facilities are complying with federal and state health standards and regulations. Clients residing in facilities that do not meet federal health and safety requirements for participating in the Medicaid program could be at increased risk of abuse, mistreatment, neglect or substandard care. By not meeting the statewide average requirement for recertification surveys, the Department has not met federal Medicaid requirements and could be subject to sanctions by the grantor. Recommendations We recommend the Department: • Establish adequate internal controls to ensure compliance with facility survey timeliness requirements • Ensure it completes recertification surveys within 15.9 months and meets the 12.9 month state-wide average Department’s Response The Department partially agrees with the finding. While we agree that we did not meet the Nursing Home Recertification Survey requirements, due to the backlog created by the public health emergency and a 20% staff vacancy rate, we do not agree that it was due to lack of internal controls. It was through applied internal controls that we identified the need to hire a contractor to assist with the recertification backlog to meet compliance requirements. Based on the FFY2022 and FFY2023 State Performance Standards System review completed by Centers for Medicare and Medicaid Services, we met the standard because the recertification backlog was accounted for in the standards and the expectation was for a reduction in the backlog, not a complete elimination of the backlog. For FFY2023 the expectation was to decrease the recertification backlog by 50% from the previous year. We decreased the backlog by 98% and as of March 2024 we are meeting our nursing home recertification timelines. Because the 12.9 month average is based on the overall average of the months for all nursing home surveys, and those surveys were in a significant backlog due to the pandemic, statistically it would be expected that even when the state is meeting the 15.9 month timeframe for each nursing home and working toward lowering the number of months between surveys for some nursing homes to lower the average, it will take time for the bell curve average to shift toward 12.9 months. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards,section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR, Part 488 Subpart E, Survey and Certification of Long-Term Care Facilities, states in part: Section 488.308 Survey frequency. (a) Basic period. The survey agency must conduct a standard survey of each SNF and NF not later than 15 months after the last day of the previous standard survey. (b) Statewide average interval. (1) The statewide average interval between standard surveys must be 12 months or less, computed in accordance with paragraph (d) of this section. (2) CMS takes corrective action in accordance with the nature of the State survey agency's failure to ensure that the 12-month statewide average interval requirement is met. CMS's corrective action is in accordance with § 488.320. (d) Computation of statewide average interval. The statewide average interval is computed at the end of each Federal fiscal year by comparing the last day of the most recent standard survey for each participating facility to the last day of each facility's previous standard survey. The Centers for Medicare and Medicaid Services, State Operations Manual, Chapter 2 – The Certification Process, states in part: 2138G – Schedule for Recertification The SA completes a recertification survey an average of every 12 months and at least once every 15 months (see Section 2141) 2728 – Statement of Deficiencies and Plan of Correction, Form-2567 The SA mails the provider/supplier a copy of form CMS-2567 within 10 working days after the survey. If there are deficiencies, the SA allows the provider/supplier 10 calendar days to complete and return the PoC. Requirements pertaining to submittal of the PoC can be found in subsection B. The Department of Social and Health Services, Residential Care Services Division Standard Operating Procedure: Enforcement Chapter 7B3, states in part: Background The Department will review the ePOC within 5 working days of receipt and will verify that it is acceptable. The NH may specify in the ePOC that they are not in agreement with the findings within the SOD report but this does not alter the NH’s responsibility to submit an acceptable ePOC. Off-site POC Review The Surveyor will: 1. Review the ePOC within five (5) working days of receipt and confirm that the POC for each deficiency includes: a. How the NH will correct the deficiency for each numbered resident; b. How the NH will protect residents from similar situations; c. Measures the NH will take or the systems it will change to ensure that the problem does not recur; d. How the NH plans to monitor its ongoing performance to sustain compliance; e. Dates corrective action will be completed; and f. Title of person responsible for correction

2023-080 The Department of Social and Health Services’ Aging and Long-Term Support Administration did not have adequate internal controls over and did not comply with requirements to ensure timely investigation of complaints of client abuse and neglect at Medicaid residential facilities. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 – State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 – Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2205WA5MAP;2205WA5ADM;2205WAIMPL; 2305WA5MAP;2305WA5ADM;2305WAIMPL Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Test and Provisions – Provider Health and Safety Standards Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-057 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.4 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the State’s federal expenditures. During fiscal year 2023, the program spent about $19.6 billion in federal and state funds. The Centers for Medicare and Medicaid Services (CMS), which administers the program at the federal level, allows states to provide long-term care services to Medicaid clients that require daily nursing services. Medicaid coverage for nursing homes and intermediate care facilities for intellectually disabled clients is only authorized when services are provided in a residential facility licensed and certified by the state survey agency. The state survey agency is also responsible for investigating complaints and allegations of abuse, neglect, or misappropriation. Residential Care Services, under the Department of Social and Health Services’ Aging and Long-Term Support Administration, is the state’s long-term care facility survey agency. Residential Care Services manages the Complaint Resolution Unit (Unit), which is the frontline response system for providing the intake and assignment functions for complaints from staff, residents, families, and the public. The Unit receives two types of complaints, also known as reports: 1) complaints from Department staff, the public, government agencies, or law enforcement and 2) reports from facilities. People can submit complaints to the Unit by phone, mail, email, fax or online. The Unit responds to complaints received on holidays and after hours on the next business day. The Department uses the Secure Tracking and Reporting System (STARS) case management system to input, prioritize and track complaints. Unit intake staff perform an initial review of complaints before entering them into STARS. Clinical triage nurses determine the final priority assignment of all nursing home and intermediate care facility complaints. According to state law (RCW 74.34.063), a complaint of suspected abandonment, abuse, financial exploitation, neglect, or self-neglect of a vulnerable adult must be responded to no later than 24 hours after knowledge of the report. The following table lists the five different priority levels for new complaints and the respective response times. During the COVID-19 pandemic, CMS guidance allowed states to work only on complaints with Immediate Jeopardy and Nonimmediate Jeopardy-High Priority levels. This guidance ended on June 30, 2021, after which all complaints required investigation. The CMS State Operations Manual requires each complaint to be triaged by someone who is professionally qualified to evaluate the nature of the problem based on their experience and knowledge of current clinical standards of practice and federal requirements. Unit intake staff review, research, and prioritize complaints to ensure the level of response corresponds to the severity of the allegation. If necessary, the Unit assigns complaints to the Department’s field unit offices within two working days of knowledge of the complaint. Field staff investigate the complaints and follow up on them within the specified time frame as determined by the severity of the concerns noted. In fiscal year 2023, the Department received 48,841 complaints. Of these, 15,599 were related to nursing homes and 713 were related to intermediate care facilities for intellectually disabled people. The following table shows the number of Immediate Jeopardy and Nonimmediate Jeopardy complaints for both provider types: Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure timely investigation of complaints of client abuse and neglect at Medicaid residential facilities. The prior finding numbers were 2022-057 and 2021-054. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure timely investigation of complaints of client abuse and neglect at Medicaid residential facilities. We evaluated all 48,841 complaints that occurred during fiscal year 2023 to ensure the Department performed an initial assessment and review of the complaints for imminent danger within the required timelines. We found the Department did not review three complaints within the required 24 hour time period, one of which involved an allegation of resident/patient/client abuse that was reviewed eight days late. The other two complaints were one day and 19 days late. We also evaluated all Immediate Jeopardy and Nonimmediate Jeopardy complaints, included in the table above, that occurred during fiscal year 2023 to ensure they met the required timelines for initiating an investigation. We found the Department did not initiate investigations timely for two of the Immediate Jeopardy complaints (0.96 percent) and 793 of the Nonimmediate Jeopardy complaints (10.8 percent). The table below shows the results of the testing: For the Immediate Jeopardy complaints, the Department initiated an investigation four days after receipt of one of the complaints and 15 days after receipt of the other. For the Nonimmediate Jeopardy complaints, the Department initiated investigations between 11 to 126 days after receipt. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department had limited staffing resources and received a large increase of COVID-19 related complaints. As a result, staff were unable to follow up on all complaints by the required response times. In additional, management did not effectively allocate resources to ensure all complaints were followed up on timely. Effect of Condition When the Department does not prioritize and investigate complaints timely, vulnerable residents at nursing homes and intermediate care facilities are at a higher risk of abuse, neglect, and financial exploitation. In addition, when the Department does not promptly follow up on a complaint, the state also runs the risk of paying Medicaid funding to a noncompliant facility. Because this finding reports non-compliance with state law, the Office of Financial Management is required by RCW 43.09.312 (1) to submit the agency’s response and plan for remediation to the Governor, the Joint Legislative Audit and Review Committee, and the relevant fiscal and policy committees of the Senate and House of Representatives. Recommendation We recommend the Department strengthen its internal controls to ensure it responds to and investigates complaints timely, as federal and state regulations require. Department’s Response The Department partially agrees with the Finding. While we agree that we did not meet the Immediate Jeopardy and Non-Immediate Jeopardy complaint timelines, due to the backlog created by the public health emergency and a 20% staff vacancy rate, we do not agree that it was due to lack of internal controls. Due to the vacancy rate, we had 30 new staff who were not certified to complete investigations independently and only three available trainers that spent the majority of 2022 and early 2023 addressing training needs. Once staff completed the training and applied to get certified, testing sites were limited, resulting in our staff having difficulty finding available testing slots. In late 2022, this process transitioned from in-person to virtual, which provided greater opportunity for timelier certification. Effective March 31, 2023, the training backlog was caught up and staff now have the required certification. As of February 2024, there were no Immediate Jeopardy (2 days) complaints overdue and for Non-Immediate Jeopardy there were two high priority (10 day), five medium priority (20 day), and one low priority (45 day) complaint past due. The Department has implemented a practice of reviewing the status of intakes at the regional level monthly to ensure timelines continue to remain compliant for Immediate Jeopardy complaints and the expectation is to be in compliance with Non-Immediate Jeopardy complaints by June 2024. Auditor’s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department’s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR Part 488 Subpart E, Survey and Certification of Long-Term Care Facilities, section 335, Action on complaints of resident neglect and abuse, and misappropriation of resident property, states in part: (a) Investigation. (1) The State must review all allegations of resident neglect and abuse, and misappropriation of resident property and follow procedures specified in § 488.332. (2) If there is reason to believe, either through oral or written evidence that an individual used by a facility to provide services to residents could have abused or neglected a resident or misappropriated a resident's property, the State must investigate the allegation. (3) The State must have written procedures for the timely review and investigation of allegations of resident abuse and neglect, and misappropriation of resident property. (b) Source of complaints. The State must review all allegations regardless of the source. The Centers for Medicare and Medicaid Services, State Operations Manual Chapter 5 – Complaint Procedures, states in part: Section 5010 –General Intake Process A complaint is an allegation of noncompliance with Federal and/or State requirements. If the SA determines that the allegation(s) falls within the authority of the SA, the SA determines the severity and urgency of the allegations, so that appropriate and timely action can be pursued. Each SA is expected to have written policies and procedures to ensure that the appropriate response is taken for all allegations and is consistent with Federal requirements as well as with procedures in the State Operations Manual. This structure needs to include response timelines and a process to document actions taken by the SA in response to allegations. If a State’s time frames for the investigation of a complaint/incident are more stringent than the Federal time frames, the intake is prioritized using the State’s timeframes. The SA is expected to be able to share the logic and rationale that was utilized in prioritizing the complaint/incident for investigation. The SA response must be designed to protect the health and safety of all residents, patients, and clients. Section 5070 – Priority Assignment for Nursing Homes, Deemed and Non-Deemed Non-Long Term Care Providers/Suppliers, and EMTALA An assessment of each complaint or incident intake must be made by an individual who is professionally qualified to evaluate the nature of the problem based upon his/her knowledge of Federal requirements and his/her knowledge of current clinical standards of practice. For non-long term care providers/suppliers, in situations where a determination is made that immediate jeopardy may be present and ongoing, the SA is required to start the onsite investigation within two business days of receipt of the complaint or incident report, or, in the case of a deemed provider or supplier, within two business days of RO authorization for investigation. Section 5075.2 – Non-Immediate Jeopardy - High Priority for Nursing Homes and Deemed and Non-Deemed Non-Long Term Care Providers/Suppliers, and EMTALA Intakes are assigned a “high” priority if the alleged noncompliance with one or more requirements may have caused harm that negatively impacts the individual’s mental, physical and/or psychosocial status and are of such consequence to the person’s wellbeing that a rapid response by the SA is indicated. Usually, specific rather than general information (such as: descriptive identifiers, individual names, date/time/location of occurrence, description of harm, etc.) factors into the assignment of this level of priority. Section 5075.3 – Non-Immediate Jeopardy - Medium Priority for Nursing Homes and Deemed and Non-Deemed Non-Long Term Care Providers/Suppliers Complaints are assigned a “medium” priority if the alleged noncompliance with one or more requirements caused no actual physical and/or psychosocial harm but there is the potential for more than minimal harm to the resident(s) (Severity Level 2). Facility reported incidents are assigned a “medium” priority if the alleged noncompliance with one or more requirements caused no actual physical and/or psychosocial harm but there is the potential for more than minimal harm to the resident(s) (Severity Level 2) and the facility has not provided an adequate response to the allegation or it is not known whether the facility provided an adequate response. For complaints and facility-reported incidents that are assigned a “medium” priority, the SA must initiate an onsite survey within 45 calendar days of receipt of the initial report. Section 5075.4 – Non-Immediate Jeopardy – Low Priority for Nursing Homes and Deemed and Non-Deemed Non-Long Term Care Providers/Suppliers Nursing Homes Intakes are assigned a “low” priority if the alleged noncompliance with one or more requirements may have caused no actual harm with a potential for minimal harm (Severity Level 1). The investigation is to be initiated in accordance with section 5075.9. Revised Code of Washington (RCW) 74.34 Abuse of Vulnerable Adults states in part: Section 063 Response to reports—Timing—Reports to law enforcement agencies—Notification to licensing authority (1) The department shall initiate a response to a report, no later than twenty-four hours after knowledge of the report, of suspected abandonment, abuse, financial exploitation, neglect, or self-neglect of a vulnerable adult. (2) When the initial report or investigation by the department indicates that the alleged abandonment, abuse, financial exploitation, or neglect may be criminal, the department shall make an immediate report to the appropriate law enforcement agency. The department and law enforcement will coordinate in investigating reports made under this chapter. The department may provide protective services and other remedies as specified in this chapter. (3) The law enforcement agency or the department shall report the incident in writing to the proper county prosecutor or city attorney for appropriate action whenever the investigation reveals that a crime may have been committed. (4) The department and law enforcement may share information contained in reports and findings of abandonment, abuse, financial exploitation, and neglect of vulnerable adults, consistent with RCW 74.04.060, chapter 42.56 RCW, and other applicable confidentiality laws. (5) Unless prohibited by federal law, the department of social and health services may share with the department of children, youth, and families information contained in reports and findings of abandonment, abuse, financial exploitation, and neglect of vulnerable adults. (6) The department shall notify the proper licensing authority concerning any report received under this chapter that alleges that a person who is professionally licensed, certified, or registered under Title 18 RCW has abandoned, abused, financially exploited, or neglected a vulnerable adult. The Department of Social and Health Services, Residential Care Services Division Standard Operation Procedure: Complaint Resolution Unit Chapter 4A20, states in part: Procedure A. CRU staff will prioritize complaint intakes using the following guidelines: 1. 2 working days (Immediate Jeopardy) - A situation in which the provider’s noncompliance with one or more requirements of participation has caused, or is likely to cause, serious injury, harm, impairment, or death to a resident. Immediate corrective action is necessary. 2. 10 working days (Non-Immediate Jeopardy-High) - The alleged noncompliance may have caused harm that negatively impacts the individual’s mental, physical and/or psychosocial status and are of such consequence to the person’s well-being, the SA conducts a rapid response. Usually, specific rather than general information (such as, descriptive identifiers, individual names, date/time/location of occurrence, description of harm, etc.) factors into the assignment of this level of priority. Complaint and incident investigations must be initiated within 10 working days of linking the intake to the RCS Field Unit 3. 20 working days (Non-Immediate Jeopardy-Medium) - The alleged noncompliance caused or may cause harm that is of limited consequence and does not significantly impair the individual’s mental, physical and/or psychosocial status or function. Complaint and incident investigations must be initiated within 20 working days of linking the intake to the RCS Field Unit. 4. 45 working days (Non-Immediate Jeopardy-Low) - The alleged noncompliance may have caused physical, mental and/or psychosocial discomfort that does not constitute injury or damage. In most cases, an investigation of the allegation can wait until the next onsite survey. Complaint and incident investigations must be initiated within 45 working days of linking the intake to the RCS Field Unit.

2023-081 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited cost report data for rate setting, hospital billings, and other financial and statistical records for inpatient hospital services. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2205WA5MAP; 2205WA5ADM; 2205WAIMPL; 2305WA5MAP; 2305WA5ADM; 2305WAIMPL Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Inpatient Hospital and Long-Term Care Facility Audits Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-060 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.4 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. During fiscal year 2023, the program spent about $19.6 billion in federal and state funds, including more than $475 million to hospitals for inpatient services. The Health Care Authority, the state Medicaid agency, pays for inpatient services to hospitals by using rates that are economic, efficient, and in accordance with the state plan. Federal law requires the Authority to periodically audit the financial and statistical records of participating providers, as established in the state plan. The Medicaid State Plan, Attachment 4.19, lists the financial audit requirements for establishing payment rates for inpatient hospital services. Prior to October 1, 2021, the plan stated that cost report data used for rate setting, hospital billings, and other financial and statistical records will be periodically audited. Beginning October 1, 2021, the plan was amended and now states that cost report data used for rate setting may be periodically audited, and hospital billings and other financial and statistical records will be periodically audited. Washington Administrative Code also states that the agency will periodically audit cost report data used for rate setting, hospital billings, and other financial and statistical records. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited cost report data for rate setting, hospital billings, and other financial and statistical records for inpatient hospital services. The prior finding numbers were 2022-060, 2021-051 and 2020-049. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited cost report data for rate setting, hospital billings, and other financial and statistical records for inpatient hospital services. During the audit period, the Authority reconciled amounts paid to hospitals for inpatient services based on the amounts that facilities reported. However, it did not periodically audit cost report data used for rate setting, hospital billings, or other financial and statistical records, which federal law, state regulations and the state plan require. Additionally, the Authority does not have documented methodology, policies or procedures that describe when and how the audits will be performed. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Authority did not establish policies and procedures to ensure it periodically audited cost report data, hospital billings, and other financial and statistical records for inpatient hospital services. Effect of Condition By not ensuring that it periodically audits cost report data, hospital billings, and other financial and statistical records, the Authority increases its risk of improperly paying for inpatient hospital services. Recommendation We recommend the Authority establish and implement adequate internal controls to ensure it meets federal inpatient hospital audit requirements. Authority’s Response The Authority does not concur with the finding. CFR requires the Authority provide for the uniform filing of cost reports. The Authority meets this requirement and provided the auditor with its tracking report showing the cost reports were obtained by the Authority from all inpatient hospitals during the audit period. Separately, CFR requires the Authority to periodically audit financial and statistical records. The Authority sought guidance from CMS regarding the definition of “other financial and statistical records” and CMS responded it “does not have any established guidance and would defer to the states on how they review.” Yet the auditor takes exception to the federal agency’s guidance by stating a review is not an audit. Additionally, the auditor discounts the Authority’s engagement of an external public accounting firm to audit other financial and statistical records as required by 42 CFR Part 455 Subpart D, and its robust audit process that regularly audits hospital billings and statistical records through its program integrity function. Documented methodology, policies, and procedures that describe when and how the Authority’s program integrity audits will be performed already exist and have been previously provided to the auditor. These include clinical reviews to ensure the accuracy of hospital billings which directly affect a hospital’s financial and statistical records related to the Medicaid program. A hospital’s submitted claim and MMIS data are records of financial transactions. Verifying the accuracy of the transaction is auditing but the auditor disregards this process, indicating it does not satisfy the requirements of an audit. The Authority asked the auditor for specific CFR or other references supporting what is acceptable or unacceptable for the audits, but it did not receive a response. CFR also requires the Authority to pay for services using rates determined in accordance with methods and standards specified in its approved State plan. Washington’s approved State plan outlines the Uniform Cost Reporting Requirements it uses to set rates. For those programs that are paid cost-based rates and required to be reconciled to cost, the Authority performs detailed reconciliations under both an interim and final cost settlement process, as outlined in the State plan. The critical access hospital cost settlement process uses information from the CMS hospital cost reports which are subject to desk reviews and audits by CMS and their Medicare Administrative Contractors. The Certified Public Expenditure cost settlement process includes a review of Medicaid cost reports submitted by hospitals for accuracy and completeness. It also incorporates a clinical review process to ensure hospital billings were appropriate for the level of service provided. The State plan also describes Washington’s Financial Audit Requirements and states that cost report data used for rate setting may be periodically audited. The auditor was provided with the Authority’s procedure that describes when it will audit cost report data. The State plan also states that hospital billings and other financial and statistical records will be periodically audited by the agency. As previously discussed, the Authority conducts these audits through its program integrity function as well as through its engagement of a public accounting firm. Finally, Washington Administrative Code (WAC) states Medicaid cost report schedules and supporting documentation are subject to audit and that the agency will periodically audit cost report data, hospital billings and other financial and statistical records. As discussed previously, the Authority has audit processes, procedures, and policies in place to ensure the integrity of the data it uses to establish payment rates for inpatient hospital services. HCA’s scope of authority for hospital financial and statistical records does not extend beyond the Medicaid program and does not extend to other hospital financial and statistical records unrelated to the Apple Health program. Authority extending beyond the Apple Health program is in the purview of the State Auditor’s Office for public hospital districts, the Washington State Department of Health for licensing purposes, the Office of the Inspector General, the Centers for Medicare and Medicaid Services, and Medicare Administrative Contractors. This audit prompted the Authority to again review all regulations relating to the periodic audits of cost report data used for rate setting, hospital billings, and other financial and statistical records. In the Authority’s review, it determined that not all rules and regulations align. The discrepancies must be rectified to prevent further misinterpretation. The Authority has initiated the processes necessary to ensure the rules and regulations are parallel and comply with federal regulation. The Authority does have adequate internal controls over and complies with requirements to ensure it meets federal inpatient hospital requirements. CMS has provided the Authority with broad leeway to define the audits of “hospital financial and statistical records” for the integrity of the Medicaid program. The Authority’s range of external audits and internal program integrity audits meet the requirements of CFR, the State plan, and WAC. Auditor’s Remarks The Authority does track and obtain cost reports and we did not take exception to that. However, it does not audit the cost reports as required. The agency has not requested any source documentation from hospitals to use when reviewing the cost reports during at least the past three years. We reviewed the Authority’s program integrity function and the separate engagement audit performed by the external public accounting firm. In our judgment, these processes do not meet the specified requirements. The Authority does not have policies or procedures outlining how or when periodic audits will be performed and these processes do not periodically audit cost report data, hospital billings or other financial and statistical records for inpatient hospital services to adequately meet these requirements. The Authority refers to program integrity “audits”; however, these are queries of very specific transactions with narrow clinical focus, do not include all facilities, are not performed on any kind of schedule and are not associated with cost reports. The engagement audit performed by the external public accounting firm is a separate audit required by CMS on the disproportionate share hospitals. This audit does not examine cost report data and does not include a majority of inpatient facilities that receive Medicaid funding. The Authority states they perform detailed reconciliations for programs that are paid cost based rates. Effective reconciliations compare two sets of records to ensure accuracy by tracing totals back to source documents. Authority employees only compare amounts reported by hospitals to other amounts reported by hospitals. No source documents are requested or reviewed. The Authority states, “The Authority does have adequate internal controls over and complies with requirements to ensure it meets federal inpatient hospital requirements. ….” The Authority’s range of external audits and internal program integrity audits meet the requirements of CFR, the State plan, and WAC.”This statement is inaccurate. Federal regulations require the Authority to have internal controls in place to meet Medicaid requirements and CMS provides states with flexibility to define how they meet this audit requirement. In the prior two audits, we have reported a material weakness in internal controls over this requirements - both findings were affirmed by CMS. CMS has also specified that audits it conducts do not fulfill this state audit requirement. When we requested the internal controls the Authority has implemented to meet this compliance requirement, we were provided with a brief summary of processes used by HCA staff, but not the internal controls. We met with Authority staff to review all of the processes they specified they had in place to meet this compliance requirement. In our judgment, the processes were inadequate to comply with this compliance requirement. The Authority confirmed that it had not implemented any new internal controls during this audit period to address the weaknesses identified in the prior two audits. The Authority has not outlined in the state plan or in policies and procedures or documented methodology, how it meets this specific audit requirement either. We reaffirm our finding and will review the status of the Authority's corrective actions in the next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR Part 447, Payments for Services, section 447.253, Other requirements, states in part: (a) State assurances. In order to receive CMS approval of a State plan change in payment methods and standards, the Medicaid agency must make assurances satisfactory to CMS that the requirements set forth in paragraphs (b) through (i) of this section are being met, must submit the related information required by § 447.255 of this subpart, and must comply with all other requirements of this subpart. (f) Uniform cost reporting. The Medicaid agency must provide for the filling of uniform cost reports by each participating provider. (g) Audit requirements. The Medicaid agency must provide for periodic audits of the financial and statistical records of participating providers. (i) Rates paid. The Medicaid agency must pay for inpatient hospital and long-term care services using rates determined in accordance with methods and standards specified in an approved State plan. Medicaid State Plan, Attachment 4.19-A Part I Methods and Standards for Establishing Payment Rates for Inpatient Hospital Services, page 60 states in part: 3. Financial Audit Requirements Cost report data used for rate setting may be periodically audited. Hospital billings and other financial and statistical records will be periodically audited by the agency. Washington Administrative Code (WAC) 182-550 – Hospital services specifies requirements for the Authority regarding hospitals providing Medicaid services. WAC 182-550-5410 – CPE Medicaid cost report and settlements, states in part: (4) The medicaid cost report schedules and supporting documentation are subject to audit by the agency or its designee to verify that claimed costs qualify under federal and state rules governing the CPE payment program. The documentation required includes, but is not limited to: (a) The revenue codes assigned to specific cost centers on the medicaid cost report schedules. (b) The inpatient charges by revenue codes for uninsured patients and medicaid clients enrolled in an MCO plan. (c) The outpatient charges by revenue codes for uninsured patients and Medicaid clients enrolled in an MCO plan. (d) All payments received for the inpatient and outpatient charges in (b) and (c) of this subsection including, but not limited to, payments for third party liability, uninsured patients, and medicaid clients enrolled in an MCO plan. WAC 182-550-5700 Hospital reports and audits, states in part: (4) The agency will periodically audit: (a) Cost report data used for rate setting; (b) Hospital billings; and (c) Other financial and statistical records.

2023-082 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2205WA5MAP; 2205WA5ADM; 2205WAIMPL; 2305WA5MAP; 2305WA5ADM; 2305WAIMPL Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Utilization Control Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-061 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.4 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington’s largest public assistance program and usually accounts for about one-third of the state’s federal expenditures. During fiscal year 2023, the program spent about $19.6 billion in federal and state funds. Under federal regulations, Medicaid state plans must include methods and procedures to safeguard against unnecessary utilization of care and services. The regulations require states to implement a statewide surveillance and utilization control program that: • Safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments; • Assesses the quality of those services; • Provides for the control of the utilization of all services provided under the plan; and • Provides for the control of the utilization of inpatient services. Multiple state agencies in Washington manage aspects of the Medicaid program. The agencies include the Health Care Authority, Department of Social and Health Services, Department of Health, Office of the Attorney General, and Department of Children, Youth, and Families. The Centers for Medicare and Medicaid Services (CMS) considers the Authority to be Washington’s official Medicaid agency. Federal regulations require the Medicaid agency to: (1) Monitor the statewide utilization control program; (2) Take all necessary corrective action to ensure the effectiveness of the program; (3) Establish methods and procedures to implement this section; (4) Keep copies of these methods and procedures on file; and (5) Give copies of these methods and procedures to all staff involved in carrying out the utilization control program. Federal regulations also require the Medicaid agency to have procedures for the ongoing evaluation, on a sample basis, of the need for, quality and timeliness of Medicaid services. These reviews must occur on a post-payment basis so that the state can review beneficiary utilization and provider service profiles, as well as identify exceptions so that the Authority can correct misutilization practices of beneficiaries and providers. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate control over and did not comply with utilization requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. The prior finding numbers were 2022-061, 2021-050, 2020-047, 2020-048, 2019-052, 2019-053, and 2018-047. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. Washington’s Medicaid state plan does not include all methods and procedures to safeguard against unnecessary utilization of care and services. The Authority also did not implement and monitor a statewide surveillance and utilization control program. We found that the Authority performs various types of program integrity and control utilization reviews, but in our judgment, these efforts did not meet requirements of evaluating the appropriateness and quality of Medicaid services on a post-payment basis. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Authority has a Program Integrity unit that is responsible for safeguarding against unnecessary utilization of care and services for the Medicaid program. However, the Program Integrity unit does not have policies and procedures to adequately ensure the Authority has met all the compliance requirements for which it is responsible. These requirements include implementing and monitoring the statewide utilization control program, which includes overseeing and monitoring the activities of other state agencies. Additionally, the Program Integrity unit’s scope of reviews does not include post-payment review, on a sample basis, of the need for, quality and timeliness of Medicaid services. Effect of Condition By not establishing methods and procedures to safeguard against unnecessary utilization of care and services, there is an increased risk of unnecessary or inappropriate use of Medicaid services and payments. Furthermore, the Authority did not meet federal program integrity requirements, and it could be subject to federal sanctions because it has not established a statewide surveillance and utilization program and does not describe its safeguarding methods and procedures in the Medicaid state plan. Recommendations We recommend the Authority: • Update the Medicaid state plan to include all the methods and procedures it uses to safeguard against unnecessary utilization of care and services • Implement and monitor a statewide surveillance and utilization control program • Implement adequate internal controls to ensure it complies with utilization control requirements Authority’s Response The Authority partially concurs with the finding. Update the Medicaid state plan to include all the methods and procedures it uses to safeguard against unnecessary utilization of care and services. The Authority does not concur. The auditor believes the State Plan should specifically list each method and procedure it employs to safeguard against unnecessary utilization of care and services. 42 CFR 456.1(b) cross references 1902(a)(30) of the Social Security Act. Under the Act, the language indicates methods and procedures are needed “under” the State Plan, not “in” the plan. 42 CFR 456.2 states the required components in the State Plan. Washington’s approved State Plan includes these components. Because the auditor does not believe Washington’s plan meets federal requirements, the Authority reached out to CMS regarding the auditor’s interpretation of 42 CFR 456.1(b)(1). CMS responded that the state did not need to list its individual methods but rather ensure the provided template was complete and accurate. The auditor disagreed with CMS and stated, “Although CMS guidance HCA received stated that this [specifying methods and procedures] was not required, the guidance contradicts federal regulation 42 CFR 456.1(b)(1), which requires these methods and procedures to be included in the State Plan.” The Authority disagrees with the auditor’s interpretation. During CMS’ review of the Authority’s plan, it found the state had not completed the template in its entirety and the Authority submitted a state plan amendment in the spring of 2023, correcting the omissions. The amendment was approved by CMS and went into effect July 1. 2023. The approved plan was provided to the auditor at the beginning of the audit. Implement and monitor a statewide surveillance and utilization control program The Authority partially concurs. HCA has a statewide surveillance and utilization control program in place and policies and procedures are available. The Authority recently updated its Fraud and Detection system (FADS) and is in the process of updating its policies and procedures related to FADS operation and its statewide surveillance and utilization control program. Implement adequate internal controls to ensure it complies with utilization control requirements The Authority partially concurs. The authority complies with all requirements outlined in the regulation. The FADS system triggers alerts on all paid Medicaid claims and the system prioritizes the alerts. The Authority uses judgmental sampling on the population of alerts and reviews providers who have higher aberrancies in relation to their peers and overall services provided. Because the FADS system is in its early implementation phase, the Authority is still in the process of establishing its written criteria. Auditor’s Remarks Update the Medicaid state plan to include all the methods and procedures it uses to safeguard against unnecessary utilization of care and services 42 CFR 456.1(b)(1) states that "Section 1902(a)(30) requires that the State plan provide methods and procedures to safeguard against unnecessary utilization of care and services." While we recognize that 1902(a)(30) of the Social Security Act states that a State plan for medical assistance must "provide such methods and procedures relating to the utilization of, and the payment for, care and services available under the plan", the direction of the federal regulation does not change that the State plan must provide these methods and procedures, which it did not provide during the audit period. Since the primary user of the Single Audit report and resulting findings are the federal granting agencies, management decisions are a critical part of the audit resolution process. We have requested the CMS management decision for the prior three audit findings for this compliance requirement from the Authority and Office of Financial Management, but have not received copies. We are not aware if formal decisions have been issued. If decisions have not been received by the state, we encourage the Authority to contact CMS and request them. We will use these formal decisions in planning future audits. The Authority's updates to the State Plan that became effective July 1, 2023 do not apply to the period under audit. Implement and monitor a statewide surveillance and utilization control program While we acknowledge that the Authority does have some policies and procedures, but it did not meet all compliance requirements to ensure the agency properly safeguarded against unnecessary utilization of care and services for the Medicaid program, including oversight and monitoring of other state agencies. Implement adequate internal controls to ensure it complies with utilization control requirements As stated in the finding, the Authority did not perform provider reviews on a sample basis, as required. We reaffirm our finding and will review the status of the Authority's corrective actions in the next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR Subchapter C Medical Assistance Programs Part 456, Utilization Control, Subpart A, General Provisions states in part: Section 456.1 Basis and purpose of part. (a) This part prescribes requirements concerning control of the utilization of Medicaid services including – (1) A statewide program of control of the utilization of all Medicaid services; … (b) The requirements in this part are based on the following sections of the Act. Table 1 shows the relationship between these sections of the Act and the requirements in this part. (1) Methods and procedures to safeguard against unnecessary utilization of care and services. Section 1902(a)(30) requires that the State plan provide methods and procedures to safeguard against unnecessary utilization of care and services. … Section 456.2 State plan requirements. (a) A State plan must provide that the requirements of this part are met. (b) These requirements may be met by the agency by: (1) Assuming direct responsibility for assuring that the requirements of this part are met; or (2) Deeming of medical and utilization review requirements if the agency contracts with a QIO to perform that review, which in the case of inpatient acute care review will also serve as the initial determination for QIO medical necessity and appropriateness review for patients who are dually entitled to benefits under Medicare and Medicaid. … Section 456.3 Statewide surveillance and utilization control program. The Medicaid agency must implement a statewide surveillance and utilization control program that – (a) Safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments; (b) Assesses the quality of those services; (c) Provides for the control of the utilization of all services provided under the plan in accordance with subpart B of this part; and (d) Provides for the control of the utilization of inpatient services in accordance with subparts C through I of this part. Section 456.4 Responsibility for monitoring the utilization control program. (a) The agency must – (1) Monitor the statewide utilization control program; (2) Take all necessary corrective action to ensure the effectiveness of the program; (3) Establish methods and procedures to implement this section; (4) Keep copies of these methods and procedures on file; and (5) Give copies of these methods and procedures to all staff involved in carrying out the utilization control program. Section 456.5 Evaluation criteria. The agency must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. This section does not apply to services in hospitals and mental hospitals. For these facilities, see the following sections: §§ 456.122 and 456.132 of subpart C; and § 456.232 of subpart D. Title 42 CFR Subchapter C Medical Assistance Programs Part 456, Utilization Control, Subpart B, Utilization Control: All Medicaid Services states in part: Section 456.21 Scope. This subpart prescribes utilization control requirements applicable to all services provided under a State plan. Section 456.22 Sample basis evaluation of services. To promote the most effective and appropriate use of available services and facilities the Medicaid agency must have procedures for the on-going evaluation, on a sample basis, of the need for and the quality and timeliness of Medicaid services. Section 456.23 Post-payment review process. The agency must have a post-payment review process that – (a) Allows State personnel to develop and review – (1) Beneficiary utilization profiles; (2) Provider service profiles; and (3) Exceptions criteria; and (b) Identifies exceptions so that the agency can correct misutilization practices of beneficiaries and providers.

2023-083 The Department of Social and Health Services did not have adequate internal controls to ensure individuals are eligible to receive benefits for the Money Follows the Person program. Assistance Listing Number and Title: 93.791 Money Follows the Person Rebalancing Demonstration Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 1LICMS300141-01-23 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: None Prior Year Audit Finding: No Background The Money Follows the Person (MFP) Rebalancing Demonstration program supports state strategies to rebalance their long-term services and supports systems from institutional to community-based care. The Roads to Community Living demonstration project is Washinton’s application of MFP. Originally funded in 2007, the program is currently projected to continue through 2027. The program is jointly administered by the Department’s Aging and Long-Term Support Administration (ALTSA) and Developmental Disabilities Administration (DDA) both serving MFP beneficiaries. Additionally, in 2013, Washington was one of five states awarded funding to participate in an MFP Tribal Initiative to work with qualified Tribes and/or Tribal Organizations to develop culturally responsive home and community-based services and to implement strategies to reduce the use of institutional care for Tribal members. The Department must ensure that benefits are paid to, or on behalf of, individuals eligible for the program and ensure benefits are discontinued when the period of eligibility expires. Eligible individuals include those receiving Medicaid inpatient services who are interested in moving from a state institutional setting, such as a hospital, nursing home, or intermediate care facility to a qualified community setting, including an adult family home, assisted living facility, or enhanced adult residential care facility. The Department uses a combination of monthly reports, annual assessments, and internal communication forms to ensure only eligible individuals receive paid benefits on the program. Specifically, the Department’s ALTSA Long-Term Care Manual, Chapter 29; Roads to Community Living, specifies that Department staff are required to complete a Financial and Social Services Communication form 14-443, or form 15-345 if the individual is enrolled in a DDA program, to communicate the individual’s eligibility status for various program services. The Department utilizes these forms to document the commencement and discontinuation of an individual’s benefits. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure individuals are eligible to receive benefits for the MFP program. We used a statistical sampling method to randomly select and review 58 out of 2,249 individuals determined eligible to receive program benefits during the audit period. We identified four instances (7 percent) where the Department did not complete a form 14-443 or 15-345 to inform appropriate personnel of the individual’s eligibility status, and terminate the individual’s enrollment, if required. We consider this internal control deficiency to be a significant deficiency. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not effectively monitor case managers to ensure that Forms 14-443 and 15-345 were completed when clients were determined eligible, or ineligible to receive assistance under the program. Department staff responsible for submitting the forms did not follow the guidance in the ALTSA Long-Term Care Manual. Effect of Condition By not following prescribed internal controls, the Department is at a higher risk of authorizing benefits to individuals that do not meet all eligibility requirements. Recommendation We recommend that the Department improve its internal controls to ensure all eligibility determinations are documented using the Department’s approved forms, in accordance with the Manual. Department’s Response The Department partially agrees with the finding. We agree 14-443s were not provided to terminate the individuals’ enrollment. However, in all exceptions identified, the 14-443 Communication was made in accordance with existing Nursing Facility Case Management policy as defined in Chapter 10 of the Long-Term Care manual. In addition, all clients met eligibility criteria for Roads to Community Living (RCL) services or converted to another Home and Community Based program within the 365-day RCL demonstration year limitation, despite the RCL disenrollment date’s absence on the 14-443 communication. In these cases, the client converted to a state plan or waiver and this new program’s start date was provided on the 14-443. For Modified Adjusted Grose Income (MAGI) participants, 14-443 Communications are not required, as this form is a communication tool for Public Benefit Specialists. MAGI enrolled Medicaid participants’ benefits are managed by the Health Care Authority, and therefore a 14-443 Communication detailing the RCL Demonstration start, and projected end date is not managed or worked by a Public Benefits Specialist. This MAGI beneficiary communication detail was not articulated in the Roads to Community Living chapter of the LTC Manual. Effective April 30, 2024, Chapter 29 of the Long-Term Care Manual will be updated to clarify instructions related to when a 14-443 must be completed as it relates to MAGI participants and what needs to be included on the form when the 14-443 is required. Auditor’s Remarks Prior to performing our testing, we held meetings with the Department to gain an understanding of their internal controls regarding eligibility for the MFP program. The Department provided documentation of policies and procedures that they determined were applicable to eligibility for the program, but did not include Chapter 10 of the Long-Term Care manual. Based on the information and documentation that the Department provided, we identified their key internal controls related to program eligibility. The Department confirmed the controls we identified were correct, and they stated, in part, that form 14-443 must be completed at the time of transition to a community setting and disenrollment. The confirmed key controls did not include alternative methods for MAGI participants. We reaffirm our finding and appreciate the Department's commitment to resolving this matter. We will review the status of the Department's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The Department of Social and Health Services, Aging and Long-Term Support Administration (ALTSA) Long-Term Care Manual, Chapter 29 – Roads to Community Living, states in part: Authorizing RCL Services for HCS clients As soon as the participant transitions from the institution: 9. Using the 14-443, notify the Public Benefits Specialist of the discharge date from the nursing facility and complete the RCL portions of 14-443, including the RCL 365 day end date, which is located in the RCL Enroll/Disenroll screen. (Reminder: the RCL 365 day end date needs to match the RCL RAC end date) At the conclusion of the participant’s 365 day demonstration period, the Case Manager/Case Resource Manager: 5. Notify the PBS on a DSHS 14-443 (for HCS/AAA) or a DSHS 15-345 (for DDA) in Barcode and include: a. The date of the disenrollment from RCL services. b. The program the participant is functionally eligible for (state plan/Medicaid waiver). c. The setting of the services (in-home, AFH, etc.) d. Update the address, if necessary. Authorizing RCL Services for Individuals Enrolled in DDA When the participant is approaching discharge from the facility, the DDA Case Resource Manager (CRM) shall: • Notify the financial worker that the individual is an RCL participant on the RCL version of the DSHS 15-345 in Barcode and include the following: a. The date of discharge from the institutional setting onto RCL services b. The setting that RCL services will take place (in-home, AFH, etc.) c. The new address d. A request to complete the Authorized Representative (AREP) screen in ACES per normal procedures so the CRM can receive the financial letters. 2. A request that the financial worker open a waiver program in ACES. What Are the Case Worker’s Responsibilities With the RCL Program? RCL services for all participants must end by day 366 (on or before day 365). At that time, they must be transitioned to the waiver or state plan services available to them based on their financial and functional eligibility. How Do I Disenroll an RCL Participant? 4. Notify the Public Benefits Specialist using Form 14-443 (HCS/AAA) or a DSHS 15-345 (DDA) in Barcode and include: a. The date of the disenrollment from RCL services. Which program the participant is functionally eligible for (state plan/waiver) and the start date for this new program (if applicable).

2023-084 The Health Care Authority did not have adequate internal controls to ensure payments to providers for the Block Grants for Prevention and Treatment of Substance Abuse program were allowable and met period of performance requirements. Assistance Listing Number and Title: 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 COVID-19 Block Grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 6B08TI083486-01M002, 6B08TI083486-01M003, 6B08TI083486-01M004, 1B08TI083977-01, 1B08TI083519-01, 6B08TI083519-01M001, 1B08TI084681-01, 6B08TI084681-01M001, 6B08TI084681-01M002, 1B08TI085843-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/ Cost Principles Period of Performance Known Questioned Cost Amount: $3,447,346 Prior Year Audit Finding: Yes, Finding 2022-067 Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse (SABG). The Authority subawards federal funds to counties, tribes, and nonprofit organizations to develop substance abuse prevention programs and provide treatment and support services. In fiscal year 2023, the Authority spent about $70.1 million in federal program funds, $58 million of which it paid to subrecipients. The Authority can use grant funds only for costs that are allowable and incurred during the period of performance, as specified in the grant’s terms and conditions. At the beginning of each federal fiscal year, and whenever the Authority receives a new federal grant, it establishes new cost objectives and allocation codes to ensure expenditures are charged to the proper grants. When the Authority receives reimbursement requests, program managers are responsible for reviewing supporting documentation to determine if the services billed meet the period of performance requirements under the grant. Fiscal managers are also responsible for ensuring that payments are coded to the correct period. The Authority follows the accrual basis of accounting and uses the Agency Financial Reporting System (AFRS), which is the state’s central accounting system, to record federal expenditures. At the end of the fiscal year, the Authority’s federal financial reporting (FFR) unit estimates the amount of outstanding obligations to providers. These amounts are recorded in AFRS as an accrued expenditure for SABG and subsequently reported to the Office of Financial Management for the compilation of the Schedule of Expenditures of Federal Awards. The FFR unit has written procedures for calculating its estimated accruals. The calculation begins by using a spreadsheet that tracks all active contractual obligations to SABG subrecipients and vendors. These amounts are then prorated to include only obligations that are expected during the state fiscal year. Obligations for agency salaries and benefits, interagency agreements, direct purchases, state universities, and travel are removed from this total. The remaining total is then reduced by the amount of accruals already recorded and actual payments already made to the subrecipients and vendors. The remaining total is recorded as an estimated accrual for the fiscal year. In the following fiscal year and up to two years after, the Authority liquidates program expenditures associated with the estimated accrual. The liquidations associated to a prior fiscal year estimated accrual do not tie directly to an estimated accrual, instead it is applied to the program as a whole for that period. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In fiscal year 2022, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure payments to providers for the SABG program were allowable and met period of performance requirements. The prior finding number was 2022-067. Additionally, in the fiscal year 2020 and 2021 audits, we reported the Authority did not have adequate internal controls to ensure payments made under the SABG program met the period of performance requirements. The prior finding numbers were 2020-059 and 2021-057. Description of Condition The Authority did not have adequate internal controls to ensure payments to providers for the SABG program were allowable and met period of performance requirements. Year-end Estimated Accruals During the audit period, the FFR unit recorded three state fiscal year-end estimated accruals totaling $19,885,335. We determined the process to estimate the year-end accruals is reasonable and included only subrecipient obligations for the state fiscal year. To determine if actual expenditures associated with these accruals are for allowable activities and within the period of performance, we tested $16,438,274 in liquidations processed after the state fiscal year close. We used a statistical sampling method and randomly selected and examined 54 out of a total population of 360 including three individually significant items. There were no issues identified. However, the remaining non-liquidated year-end estimated accruals could not be tested for compliance. Transaction Testing We judgmentally selected and examined three out of a total population of 16 expenditures made during the SABG federal fiscal year 2021 award liquidation period. We found one (33 percent) estimated accrual that was partially unsupported to ensure the award’s period of performance requirements were met. We consider these internal control deficiencies to be a material weakness. Cause of Condition While the Authority has a process to determine the year-end estimated accruals, management allows for the liquidation of these accruals to be processed over as many as three years after the end of the audit period. In addition, Authority officials said that the large amount of year-end estimated accruals is due to a significant lag between when services are provided and reimbursement requests are received. Additionally, the Authority did not properly monitor to ensure accrual charges occurred within the award’s period of performance. Effect of Condition and Questioned Costs Without having actual expenditures with supporting documentation to account for the amount in the year-end estimated accruals, the Authority cannot reasonably ensure that SABG expenditures reported on the Schedule of Expenditures of Federal Awards are for allowable activities and within the period of performance. We identified $3,447,061 in known questioned costs related to estimated year-end accruals. For the federal fiscal year 2021 award that closed during the audit period, we identified questioned costs totaling $285 for an accrued expenditure that did not have documented support showing they occurred within the award’s period of performance. In total, we identified $3,447,346 in known federal questioned costs. Without establishing adequate internal controls, the Authority cannot reasonably ensure it is using federal funds for allowable purposes and that spending occurs within the allowed period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: • Improve its internal controls to ensure estimated accruals are reasonable and supported • Establish process to associate liquated provider payments to specific year-end estimated accruals • Improve its internal controls to ensure payments are within the award’s period of performance • Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Authority’s Response The Authority does not concur with the finding. The auditors are questioning $3,447,061 of unliquidated accruals. This amount does not reflect funds that have been paid or drawn from the grantor, but rather the Authority’s best estimate of FY 23 expenditures for which invoices have not been received. There are no funds associated with the $3.4 million to return to the grantor. As the auditor notes in the finding above, “the process to estimate the year-end accruals is reasonable and included only subrecipient obligations for the state fiscal year.” Further, the auditors tested a statistical sample of liquidations made against the accruals without error. All reviewed liquidations were for allowable program costs within the grant period of performance, and for activities occurring during the state fiscal year. The Authority has additional controls to review expenditures at the end of each grant to ensure expenditures were within the allowed period of performance. Any liquidations made against the grant can be reviewed through the end of the grant period, and no payments would be liquidated against the accruals that were not for allowable services provided during FY 23. The Authority partially concurs with the unsupported $285 portion of an accrual. Due to human error when reversing an accrual, the full amount was not completely removed leaving a difference of $285. However, this was limited to an accrual transaction, no funds would have been drawn and this remained an error in the accounting system. There are no funds to return to the grantor. By questioning unliquidated expenditures based on a reasonable accrual methodology, the auditor is taking issue with the Authority’s operations rather than identifying noncompliant grant practices. The implication from the auditor’s recommendations and referenced laws and regulations is that the $3.4 million should not have been reported on the Schedule of Expenditures of Federal Awards (SEFA). However, there is no evidence these expenditures were unallowable, drawn erroneously from the grantor, or outside the period of performance. Removing the $3.4 million would result in a significant misstatement on the SEFA and provide inaccurate information to the grantor. To provide assurance over activities allowed, cost principles, and period of performance the auditors tested three samples: • A sample of 58 transactions recording expenditures on the SEFA which had been paid during FY 23 • A sample of 57 liquidation transactions made against the estimated FY 23 SEFA accruals • A judgmental sample of three transactions recorded against the 2021 SABG award The first two samples consisted of 115 transactions and $11,662,297 and all tested without error. The third sample contained three transactions totaling $73,761 judgmentally selected from a population of 16 transactions and contained one error of $285. The Authority stands by its accrual methodology and its controls over activities allowed and period of performance requirements. Auditor’s Remarks The Authority reports cash and accrued expenditures on the Schedule of Expenditures of Federal Awards and, as such, the accruals are required to be audited. We therefore tested the liquidations associated with these accruals. While we did not find noncompliance with the samples selected and tested, we cannot determine if the remaining year end estimated accruals that have not been liquidated are for allowable activities and within their period of performance. We reaffirm our finding and will follow up on the status of the Authority’s corrective action during our next audit period. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 502, Basis for determining federal awards expended, states in part: a. Determining Federal awards expended. The determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs. Generally, the activity pertains to events that require the non-Federal entity to comply with Federal statutes, regulations, and the terms and conditions of Federal awards, such as: expenditure/expense transactions associated with awards including grants, cost-reimbursement contracts under the FAR, compacts with Indian Tribes, cooperative agreements, and direct appropriations; the disbursement of funds to subrecipients; the use of loan proceeds under loan and loan guarantee programs; the receipt of property; the receipt of surplus property; the receipt or use of program income; the distribution or use of food commodities; the disbursement of amounts entitling the non-Federal entity to an interest subsidy; and the period when insurance is in force. Title 45 CFR Part 75, section 510, Financial statements, states in part: b. Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with § 75.502. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Behavioral Health Grant Unit Year-End Accrual Procedure, states in part: WHAT IS ACCRUAL: Accruals are accounting entries done to record actual or estimated expenditures incurred but not paid. PURPOSE: When done during year-end close, accruals record actual and/or estimated amounts incurred in the closing year that will not be paid until the subsequent year. Within the Federal Financial Reporting (FFR), Behavioral Health (BH) grants staff prepare year-end accruals of contract costs that the Accounting Section does not. The BH supervisor will notify unit staff of the timeline for this process as it may differ from year to year. BACKGROUND: The Accounting Section reviews accruals and liquidations at a high-level (Program, Fund, and Fund Source) to ensure the agency has not exceeded its authority. While some year-end accruals are based on actual billings/claims, many are based on estimates due to the lag time of billings. Estimates are also used due to the number of contracts per grants (typically the Block Grants and the State Opioid Response (SOR) grants). BLOCK GRANT PROCESS: 1. BH Grants staff creates a SFY Accrual workbook using the JV workbook template. 2. BH Grants staff saves a copy of the obligations from DBHR’s tracking workbook and places it in the BH Accrual Folder for the SFY. Copy the relevant data from the DBHR workbook into the SFY workbook created for accrual development. Obligation amounts may differ as DBHR is not necessarily recording obligations for a single state fiscal year. 3. BH Grants staff, on the SFY Obligation tab, removes the following obligations from the accrual process: a. Interagency agreements b. State universities c. Direct purchases d. Agency salaries and benefits e. Travel Note: a. If a contract has not started and has no expenditures, verify if an accrual is needed or the obligation amount should be removed. b. Pro-rate contracts that include month of service for the prior or next SFY year, so as to not over accrue. c. If a project is listed, but no contract agreement number has been verified, double check with DBHR program and if not, remove amount from obligation. The workbook will include the revised obligations. 4. BH Grants staff pulls grant direct expenditure data from the beginning of the fiscal year to the end of the fiscal year to include (99 and 25) depending on which fiscal year it is in the biennium. a. First SFY of the biennium include FM01 through FM99 b. Second SFY of the biennium include FM13 through FM25 c. Include GL Account: (6510) cash expenditures and (6505) accruals d. Use grant specific Webi criteria e. Note – Accruals (GL 6505) are included to determine what has already been recorded by AP to ensure total accruals are not overstated. f. Filter out interagency and state universities amounts as well as objects A (salaries), B (benefits), and G (travel) data from original data pull and save this data to another tab g. Use the data, minus interagency and objects that were removed, to prepare pivot tables. h. Input the obligation amount on the pivot tab from the SFY obligation tab. i. Run each pivot table using the data minus interagency & object tab (see #6 – #10 below). j. Reminder – DO NOT accrue salaries/benefits/travel/direct purchases. 5. Using the revised obligations tab – complete the below pivots. • NOTE: See item #2 - For auditing purposes, place a copy of the original obligation spreadsheet in the accrual folder, date the spreadsheet, so you have backup data to the obligation total you are now using. • Using the tab with our own tracking for the prior state fiscal year (SFYXX). See item #3 - Review contracts to see if they were executed, if not an accrual is not needed. We are ONLY accruing for CONTRACTS. Accruals are booked against the award we are actively spending on. We are not accruing on the award that is spent out. a. First pivot – identifies total expenditures and accruals for SFY being processed. Use the expenditure amount (GL 6510) for the second pivot table. b. Second pivot – establish the most used subobject; allows for the distribution of expenditures between ER and NB as they are the most common. c. Third and Fourth pivots – determines the most common PI each of the subobjects identified in Second pivot. d. Fifth pivot – identifies most common org index. e. Sixth pivot – (SABG only) identifies the ER and NB expenditures by allocation. This allows for the accrual to be prepared as a percentage to each allocation code based on the total expenditures. Not needed for MHBG. 6. BH Grants staff calculate percentages to spread the accrual across ER and/or NB in allocations, per grant (ex. 82** for SABG, and 20** for MHBG). 7. BH Grants staff complete the remainder of the workbook following the established JV process: a. Obtain JV number from log b. Add an explanation/purpose for the JV c. Include backup data for the upload and release tab. d. Use the correct transaction codes (TC) for accruals i. TC 736 RCRD ACCT/VOU PAY-NO ENCUMBRANCE 1. GL 6505 – Debit – Accrued Expenditures/Expenses 2. GL 5111 – Credit – Short Term Payables ii. TC 736R RCRD ACCT/VOU PAY-NO ENCUMBRANCE 1. GL 5111 – Debit – Short Term Payables 2. GL 6505 – Credit – Accrued Expenditures/Expenses 8. Upload the JV using the OFM Toolbox and email JV workbook to BH Grants Supervisor and Lead. 9. BH Grants Supervisor and/or Lead reviews, approves, and releases the JV.

2023-085 The Health Care Authority did not have adequate internal controls over earmarking requirements for the Block Grants for Prevention and Treatment of Substance Abuse. Assistance Listing Number and Title: 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 COVID-19 Block Grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 6B08TI083486-01M002, 6B08TI083486-01M003, 6B08TI083486-01M004, 1B08TI083977-01, 1B08TI083519-01, 6B08TI083519-01M001, 1B08TI084681-01, 6B08TI084681-01M001, 6B08TI084681-01M002, 1B08TI085843-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Earmarking Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-068 Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse. The Authority subawards federal funds to counties, tribes, and nonprofit organizations to develop substance abuse prevention programs and provide treatment and support services. In fiscal year 2023, the Authority spent about $70.1 million in federal program funds. Of this amount, the Authority passed about $58 million to subrecipients. Federal regulations require the Authority to spend no more than 5 percent of the federal program funds on administrative costs of the grant, as well as a minimum of 20 percent of total grant funds on primary prevention programs for people who do not require treatment. The Authority has written procedures in place to ensure it meets earmarking requirements. Authority staff run monthly reports from the agency’s accounting system to track expenditures for these requirements to ensure they are met at the time the grant closes. These reports, along with calculations to monitor these requirements, are maintained in a monthly tracking workbook. Management reviews these workbooks and sends an email to program staff to document the review. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls and did not comply with earmarking requirements for the program. The prior finding numbers were 2022-068 and 2021-056. Description of Condition The Authority did not have adequate internal controls over earmarking requirements for the Block Grants for Prevention and Treatment of Substance Abuse. We used a non-statistical sampling method to randomly select and examine 10 monthly tracking workbooks out of a total population of 45. We found that for six of the samples (60 percent), the workbooks were completed, but were missing the manager email confirming that they had been reviewed to ensure the tracking was being correctly calculated and monitored. We consider this internal control deficiency to be a material weakness. Cause of Condition The Authority implemented new procedures to ensure tracking workbooks were reviewed monthly by management. However, written documentation of this review was not maintained. Effect of Condition By not establishing adequate internal controls, the Authority cannot ensure it meets earmarking requirements. Recommendation We recommend the Authority improve internal controls to ensure that management review is documented and retained. Authority’s Response The Authority concurs with the finding. However, the Authority does not concur that the condition identified by the auditor posed a material risk to the program. Tracking workbooks were completed and reviewed throughout the entire fiscal year, however documentation of review was not maintained until December. Beginning December 2022, documentation of review was available for the remainder of the fiscal year. Any potential material noncompliance should have been detected. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 75, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2023-086 The Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Federal Funding Accountability and Transparency Act for the Block Grants for Prevention and Treatment of Substance Abuse. Assistance Listing Number and Title: 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 COVID-19 Block Grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 6B08TI083486-01M002,6B08TI083486-01M003, 6B08TI083486-01M004, 1B08TI083977-01, 1B08TI083519-01, 6B08TI083519-01M001, 1B08TI084681-01, 6B08TI084681-01M001, 6B08TI084681-01M002, 1B08TI085843-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Components: Reporting Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-069 Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse (SABG). The Authority subawards federal funds to counties, tribes, and nonprofit organizations to develop prevention programs and provide treatment and support services. In fiscal year 2023, the Authority spent about $70.1 million in federal program funds, including about $58 million paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Authority is required to collect and report information on each subaward of federal funds more than $30,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). The Authority must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower the public with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. A subaward identification form, which contains all the required reporting information, is included when the Authority creates a new SABG subaward or amendment. After it is signed by all parties, contract unit staff sends the subaward identification form through email to the behavioral health unit. Behavioral health staff review these emails and complete the report as required. There were 85 SABG subawards and amendments that were required to be reported in fiscal year 2023, totaling $45,362,623. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act for the SABG program. The prior finding numbers were 2022-069 and 2021-058. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Act. During the audit period, the Authority was required to report about $45.4 million of program funds that it awarded to subrecipients through 85 new and amended subawards for the primary SABG awards. We used a non-statistical sampling method to randomly select and examine 14 of the 85 subawards and amendments, and found that four (29 percent), totaling $1.45 million, were not reported in FSRS. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Authority is in the process of developing written procedures to ensure the reports are submitted as required, but they were not fully implemented during the audit period. For the subawards not reported, the contract unit did not send the subaward identification form to the behavioral health staff, so the subawards were not reported in FSRS. Effect of Condition Failing to submit the required reports diminishes the federal government’s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Authority: • Establish effective internal controls to ensure it submits all required reports • Establish policies and procedures for filing required reports • Provide training for employees who oversee reporting and who verify the submission and accuracy of the reports • Ensure management monitors reporting of this information so future reports are submitted completely and timely Authority’s Response HCA concurs with the findings. HCA did not have an established process to ensure that HCA’s Federal Financial Reporting section received executed subawards for FFATA reporting from HCA’s Office of Contracts and Procurement for the entirety of fiscal year 2023. The process was established in July 2022 and is currently operational. However, some subawards with a July 1 start date had been executed in the prior fiscal year before the process was established. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 – Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to https://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2020. What to report. You must report the information about each obligating action that the submission instructions posted at https://www.fsrs.gov specify.

2023-087 The Health Care Authority did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Block Grants for Prevention and Treatment of Substance Abuse program received required single audits, and that it appropriately followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 COVID-19 Block Grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 6B08TI083486-01M002, 6B08TI083486-01M003, 6B08TI083486-01M004, 1B08TI083977-01, 1B08TI083519-01, 6B08TI083519-01M001, 1B08TI084681-01, 6B08TI084681-01M001, 6B08TI084681-01M002, 1B08TI085843-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Prior Year Audit Finding: Yes, Finding 2022-066 Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse (SABG) program. The Authority subawards federal funds to counties, tribes, and nonprofit organizations to develop substance abuse prevention programs and provide treatment and support services. In fiscal year 2023, the Authority spent about $70.1 million in federal SABG funds. Of this amount, the Authority passed about $58 million to 126 SABG subrecipients. Federal regulations require the Authority to monitor its subrecipients’ activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor’s report or nine months after the end of the subrecipient’s audit period, whichever is earlier. Additionally, for the awards it passes to subrecipients, the Authority must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for an Authority-funded program, federal law requires the Authority to issue a management decision to the subrecipient within six months of the audit report’s acceptance by the Federal Audit Clearinghouse. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. To monitor its compliance with these requirements, the Authority uses Excel workbooks to track subrecipients’ single audits. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Authority did not have adequate controls over and did not comply with requirements to ensure subrecipients of the SABG program received required single audits, and that it appropriately followed up on findings and issued management decisions. The prior finding number was 2022-066. Description of Condition The Authority did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the SABG program received required single audits, and that it appropriately followed up on findings and issued management decisions. The Authority did not have written policies or procedures over its process for tracking subrecipients’ single audits. Furthermore, the Authority chose not to provide the tracking workbooks that we requested so we could develop and complete our compliance tests with the federal requirements. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition As stated above, Authority management chose not to provide documentation to demonstrate that the agency was compliant with federal requirements. Effect of Condition Without establishing adequate internal controls, the Authority cannot ensure all subrecipients received single audits when they were required. Furthermore, the Authority cannot ensure it is following up on subrecipient single audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and that management monitors them for effectiveness, the Authority cannot determine whether its subrecipients have sufficiently corrected issues identified in audit findings. In addition, because the Authority chose to not provide documentation needed for testing, we were unable to determine if it was compliant with federal regulations. Recommendations We recommend the Authority: • Establish and follow policies and procedures to ensure subrecipients obtain required single audits • Establish and follow effective internal controls to ensure it issues management decisions by the due date and follows up on all subrecipient audit findings related to the SABG program • Ensure subrecipients develop and take acceptable corrective actions to adequately address all audit recommendations • Provide requested documentation to auditors Authority’s Response Authority concurs that it needs to improve internal controls and did not fully comply federal requirements relating to single audit tracking. HCA does not concur with the other conditions noted. Auditor’s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority's corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations (CFR) Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 516, Audit findings, establishes reporting requirements for audit findings. Title 45 CFR Part 75, section 303, Internal Controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 75, Section 352, Requirements for pass-through entities states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 75.521. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 75.501. (h) Consider taking enforcement action against noncompliant subrecipients as described in § 75.371 and in program regulations.

2022-002 The University of Washington did not have adequate internal controls to ensure key personnel commitments specified in grant proposals or awards were met. Assistance Listing Number and Title: Various, Research and Development Cluster ? University of Washington Federal Grantor Name: Various Federal Award/Contract Number: Various Pass-through Entity Name: Various Pass-through Award/Contract Number: Various Applicable Compliance Component: Special Tests and Provisions: Key Personnel Known Questioned Cost Amount: None Background The federal government sponsors research and development (R&D) activities under a variety of types of awards. Most commonly, these are grants, cooperative agreements, and contracts to achieve objectives agreed upon between the federal awarding agency and the non-federal entity. The types of R&D conducted under these awards vary widely. Grants for R&D are awarded to non-federal entities on the basis of applications or proposals submitted to federal agencies or pass-through entities. An award is then negotiated that will include the purpose of the project, the amount of the award and the terms and conditions. R&D awards may include staffing proposals that specify key personnel who will work on the project, as well as the extent of their planned involvement. One of these key personnel is typically a principal investigator (PI) who contributes to the scientific development or execution of a project in a substantive, measurable way. The non-federal entity is required to meet key personnel commitments specified in the award and may be required to obtain approval from the grantor for certain types of changes. The University of Washington (University) is the largest recipient of federal R&D awards in the state of Washington. The University expended funds from 2,396 separate awards for the R&D grants, with expenditures totaling approximately $1.02 billion of the almost $1.17 billion expended statewide during the audit period. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure key personnel commitments specified in grant proposals or awards were met. To determine if the University complied with key personnel requirements, we reviewed the University?s internal controls over monitoring key personnel time and effort and also examined grant awards to determine if key personnel identified in the application/proposal and award were involved in the project as required. We used a statistical sampling method to randomly select and examine 59 unique budget numbers assigned to R&D programs out of a total population of 7,486. We examined these samples and found: ? Four instances where we could not determine whether the University properly monitored key personnel time and effort to ensure that they met award requirements identified in the grant application/proposal and award were involved in the project as required. ? Two instances where key personnel were not involved in the project as required. Specifically, we found: o One award for which the PI was required to spend approximately 16 percent of their time on the award, but spent less than 5 percent o One award where the PI was required to spend 2 percent of their time on the award, but only spent .67 percent We consider these internal control deficiencies to be a significant deficiency. This issue was not reported as a finding in the prior audit. Cause of Condition While we determined the University had policies and procedures to ensure that key personnel are involved in the grant projects as required, there were not policies or procedures to ensure that there was sufficient University level oversight to ensure key personnel commitments were met. Effect of Condition By not establishing adequate internal controls, the University cannot reasonably ensure it meets the key personnel requirement. Recommendation We recommend the University improve its internal controls to ensure key personnel identified in the application/proposal and award were involved in the project as required. In addition, if the University identifies key personnel commitments are not going to meet required levels, ensure that federal awarding agency approval is obtained when required. University?s Response The University has established internal controls to ensure compliance with program requirements through the effort certification and project reporting processes, and budget reconciliation requirements. However, we agree there are areas for improvement int terms of staff and PI training, and available resources to monitor contribution and documentation of committed levels of effort. The University will implement the following improvements: ? The University offers multiple training courses to research administrators and principal investigators on management of sponsored awards. We will update our training materials and provide additional training on documentation of effort for PIs and key personnel, and prior approval requirements for reductions in effort. ? Update guidance and instructions for effort certifications to ensure all devoted effort is properly accounted for during the effort certification process. ? Develop exception reports to provide additional oversight to monitor deviations from committed effort for PIs and key personnel. Auditor?s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 308, Revision of budget and program plans, states in part: (a) The approved budget for the Federal award summarizes the financial aspects of the project or program as approved during the Federal award process. It may include either the Federal and non-Federal share (see definition for Federal share in ? 200.1) or only the Federal share, depending upon Federal awarding agency requirements. The budget and program plans include considerations for performance and program evaluation purposes whenever required in accordance with the terms and conditions of the award. (b) Recipients are required to report deviations from budget or project scope or objective, and request prior approvals from Federal awarding agencies for budget and program plan revisions, in accordance with this section. (c) For non-construction Federal awards, recipients must request prior approvals from Federal awarding agencies for the following program or budget-related reasons: (1) Change in the scope or the objective of the project or program (even if there is no associated budget revision requiring prior written approval). (2) Change in a key person specified in the application or the Federal award. (3) The disengagement from the project for more than three months, or a 25 percent reduction in time devoted to the project, by the approved project director or principal investigator. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2022-003 The Office of Superintendent of Public Instruction did not have adequate internal controls over accountability for USDA-donated foods. Assistance Listing Number and Title: 10.553 School Breakfast Program 10.555 National School Lunch Program 10.555 COVID-19 National School Lunch Program 10.556 Special Milk Program for Children 10.559 Summer Food Service Program for Children 10.582 Fresh Fruits and Vegetable Program Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 217WAWA3N1099; 217WAWA3N1199; 217WAWA1L1603; 227WAWA3N1099; 227WAWAN119; 227WAWA1L1603 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Accountability for USDA-Donated Foods Known Questioned Cost Amount: None Background The Child Nutrition Cluster programs help states administer food services that provide healthy and nutritious meals to eligible children in public and nonprofit private schools, residential care institutions and summer programs, as well as encourages the domestic consumption of nutritious agricultural commodities. The Office of Superintendent of Public Instruction (Office) administers the state?s Child Nutrition Cluster programs. The Office spent about $578 million, including non-cash assistance, in federal funds on eligible child nutrition meals during fiscal year 2022. The Office passed through most of the assistance to school food authorities (SFA) and other sponsors as subawards. The United States Department of Agriculture (USDA) makes donated agricultural commodities available for use in operating all child nutrition programs, except the Special Milk Program for Children. The Office contracts with four warehouses to perform its storage and distribution duties. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Office did not have adequate internal controls over accountability for USDA-donated foods. The prior finding numbers were 2021-003, 2020-004 and 2019-005. Description of Condition The Office did not have adequate internal controls over accountability for USDA-donated foods. We conducted an inventory reconciliation using the Office?s state fiscal year physical inventory records from 2021 and 2022, USDA food order records, and distribution records. We determined the Office performed an annual physical inventory for all four warehouses. However, we found the Office: ? Did not perform monthly reconciliations between the federal government distribution report, the Office?s internal inventory tracking spreadsheet and the warehouse documentation ? Did not keep supporting records for inventory loss adjustments We identified 91 food items with negative adjustments. We reviewed 14 adjustments and found five were not supported and five were only partially supported. We also found that four out of the 239 food items we examined contained discrepancies. We noted a total variance of four (quantity in cases) out of 32,491 cases. The Office undercounted by three cases and overcounted by one case. We consider these internal control deficiencies to be a significant deficiency. Cause of Condition In response to the prior audit finding, the Office developed a corrective action plan that included procuring a new or updated electronic food distribution system. However, at the time of the audit, the Office was still in the process of procuring a new or updated electronic food distribution system that includes tracking and reporting capabilities to assist with the reconciliation process. Effect of Condition Without proper reconciliation between physical inventories and inventory records, the Office cannot ensure it identifies inventory discrepancies and properly accounts for the loss of donated foods. Additionally, failure to maintain records required by federal law may require the Office to pay USDA the value of the food or replace it in kind. Recommendations We recommend the Office: ? Strengthen established internal controls to ensure it reconciles physical inventory with inventory records on a monthly basis ? Follow up on the inventory discrepancies identified Office?s Response OSPI concurs with this finding. We have implemented internal policies and procedures for the reconciliation of USDA Foods on an annual basis, meeting USDA requirements for state agencies operating this program. We will review our current process for monthly inventory review and explore the opportunities to strengthen internal controls around reconciling physical inventory with inventory records, and additionally, to follow up on any inventory discrepancies that are identified. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 7 CFR Part 250, Donation of Foods for Use in the United States, Its Territories and Possessions and Areas Under Its Jurisdictions, section 12, Storage and inventory management at the distributing agency level, describes storage and inventory management requirements for state distributing agencies. Title 7 CFR Part 250, Donation of Foods for Use in the United States, Its Territories and Possessions and Areas Under Its Jurisdictions, section 16, Claims and restitution for donated food losses, describes the distributing agency?s responsibilities for identifying and seeking restitution from responsible parties for the loss of donated foods. Title 7 CFR Part 250, Donation of Foods for Use in the United States, Its Territories and Possessions and Areas Under Its Jurisdictions, section 19, Recordkeeping requirements, describes the distributing agency?s requirements for maintaining donated food distribution records and the period of retention of records. Title 7 CFR Part 250, Donation of Foods for Use in the United States, Its Territories and Possessions and Areas Under Its Jurisdictions, section 21, Distributing agency reviews, describes the distributing agency?s scope of review requirements for on-site review and identification and correction of deficiencies identified in its reviews.

2022-004 The Department of Health did not have adequate internal controls to ensure payments to providers were allowable, met cost principles, and were within the period of performance for the Special Supplemental Nutrition Program for Women, Infants, and Children. Assistance Listing Number and Title: 10.557 Special Supplemental Nutrition Program for Women, Infants, and Children 10.557 COVID-19 Special Supplemental Nutrition Program for Women, Infants, and Children Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 217WAWA7W6003; 217WAWA7W6006; 217WAWA7W7003; 217WAWA7W1003; 217WAWA7W1006; 227WAWA7W1003; 227WAWA7W1006; 227WAWA1W5003 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Department of Health operates the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC). WIC is funded exclusively with federal grants from the U.S. Department of Agriculture. WIC serves pregnant women, new and breastfeeding moms, and children younger than 5 years old who are at or below 185 percent of the federal poverty level. WIC provides: ? Nutrition ideas and tips on how to eat well and be more active ? Breastfeeding support, such as access to a peer counselor and breast pumps (varies by clinic) ? Health screenings and referrals ? Monthly benefits for healthy food, such as milk, cereal, fruits and vegetables In fiscal year 2022, the Department spent more than $106.2 million in federal program funds, about $29.8 million of which it disbursed to subrecipients. To help carry out the program?s objectives, the Department issues consolidated contracts to Local Health Jurisdictions that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate, and high-risk subrecipients for each of the following expense categories: ? Salaries and benefits ? Equipment ($5,000 or more) ? Materials, supplies, and other ? Travel (in-state and out-of-state) ? Contracts and sub-subrecipients ? Administrative/indirect costs The Department?s Fiscal Monitoring Unit (FMU) also conducts fiscal reviews of each subrecipient to review source documentation to ensure payments are for allowable activities and within the period of performance. During the audit period, subrecipients submitted invoices to the Department?s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The emails were sent to Department program staff requesting review to ensure the payment was allowable and within the period of performance. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. The accounting unit considered each invoice listed in the email as approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure provider payments were allowable and met cost principles for the WIC program. The issue was reported as a finding in the prior audit. The prior finding number was 2021-004. Description of Condition The Department did not have adequate internal controls to ensure payments to providers were allowable, met cost principles, and were within the program?s period of performance. Department program staff were required to use the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, were within the period of performance and included required supporting documentation. However, program staff did not communicate their approval to the accounting unit that issues payment. As a result, the Department paid the subrecipients without knowing whether these expenditures had been reviewed and approved by the program staff. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Management did not establish sufficient internal controls to ensure payments to subrecipients were reviewed and approved prior to paying them. The Department?s established procedures allowed for the accounting unit to pay providers without evidence the program staff reviewed and determined the payment was allowable, within the grant?s period of performance, and adequately supported. Effect of Condition Without establishing adequate internal controls that require program staff to communicate approval to the accounting unit prior to payment, the Department cannot reasonably ensure it is using federal funds for allowable purposes and within the period of performance. Recommendation We recommend the Department improve internal controls to ensure program staff document and communicate approval to the accounting unit to ensure expenditures are for allowable activities and within the period of performance prior to payment. Department?s Response We appreciate the State Auditor?s Office (SAO) audit of the Women, Infants and Children Special Supplemental (WIC) grant. The Department is committed to ensuring our programs comply with federal regulations and understand that it is SAO?s point of view that we did not have adequate controls over consolidated contract provider payments to ensure allowability in meeting cost principles and period of performance. The Department respectfully disagrees with SAO?s assessment of a significant deficiency in internal controls over the consolidated contract provider payment process to ensure allowability in meeting cost principles and meeting period of performance with our WIC program. When accounting staff send the A19 consolidated contract invoices to the applicable programs WIC quality assurance (QA) program staff review invoice support for allowability and period of performance and keep a log with a breakdown of the total payment requested for WIC. If the payment has no issues or concerns, it is logged in the log and staff initial the entry to denote no issues and that full payment can be made. If there is a question on allowable cost, period of performance, a need for additional backup documentation or an error program QA staff will log the issue and amount/s in question and escalate the log to the WIC Deputy Program Director in accordance with the WIC programs escalation policy. Program will then communicate with the LHJ and document the correspondence. If the issues remain by the end of the ten day window, WIC Program Staff will contact the accounting consolidated contract payment desk to withhold the specific amount of payment until the issue is resolved. Once resolved staff initial and date the log to denote the issue has been resolved and email accounting to release the payment amount in question. It should be noted that the current process over provider payments at the Department of Health has been in place for well over a decade and has been through several annual audits by the State Auditor?s Office and separate federal reviews of the program by our federal funders without issue. The defined process of consolidated contract payments was in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions for state and federal programs in order to serve the citizens of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the Local Health Jurisdictions (LHJs). This, along with the following additional overall internal monitoring and policy processes support our overall assurance of the allowability of payments: ? Detailed budgets for WIC are submitted by the subrecipient, by project, reviewed and approved by Program staff annually and as A19?s are submitted program fiscal staff keep updated budget to actual spreadsheets, and while they review the support provided by the subrecipient, they ensure amounts submitted by project are reasonable and are in alignment with expectations for the budget period submitted. ? The WIC program has an allowable cost policy chapter, purchase and procurement chapter, that is provided to the subrecipients. ? Program staff regularly provide technical assistance, policies, and training to WIC subrecipients related to both allowability and compliance as it relates to programmatic processes. Each of the subrecipients of funds receives a monitoring visit from our Fiscal Monitoring Unit (FMU) once every two years. During the course of these visits monitoring staff perform walk-throughs and assessments of the internal controls surrounding the A19 payments process and typically select the most recent three A19?s submitted for funding and agree all charges to the source documentation from the subrecipient for allowability using the costs principles and criteria as a basis. ? WIC program monitoring staff also perform biannual monitoring visits at a minimum and perform critical reviews of program activities to ensure WIC processes and costs charged to the program are for allowable purposes and are in alignment with programmatic rules related to the Women, Infants and Children Program. ? The agency?s Fiscal Monitoring Unit (FMU) regularly provides technical assistance and training, not only to WIC fiscal program staff, but to the subrecipients while onsite and at the request of the entities receiving WIC funding. Auditor?s Remarks In its response, the Department acknowledges the accounting unit issues payments to subrecipients without receiving an approval from program staff that the payment is allowable and met period of performance requirements. This is a weakness in the design of internal controls and, in our judgement, increases the risk that payments are made without assurance a program level review of the supporting documentation occurred. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2022-005 The Employment Security Department did not have adequate internal controls to ensure it submitted accurate monthly reports for the Unemployment Insurance program. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: UI-34528-20-60-A-53; UI-34748-20-55-A-53 UI-34890-20-55-A-53; UI-35682-21-55-A-53 UI-35737-21-55-A-53; UI-35977-21-60-A-53 UI-37098-21-55-A-53; UI-37256-22-55-A-53 UI-37313-22-55-A-53; UI-38013-22-60-A-53 UI-38163-22-55-A-53; UI-38511-22-55-A-53 UI-38580-22-75-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Unemployment Insurance (UI) program was created by the Social Security Act, and provides benefits under the Unemployment Compensation program to unemployed workers for periods of involuntary unemployment. It provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Employment Security Department administers the state?s UI program. During fiscal year 2022, the Department paid more than $2.8 billion dollars in unemployment insurance benefits to more than 454,000 people. The Unemployment Insurance Reports Handbook No. 401?published by the U.S. Department of Labor (DOL), Employment and Training Administration, Office of Unemployment Insurance?outlines the requirements for states to submit financial and performance reports to the federal government so it can evaluate their UI programs. The ETA 9055 ? Appeals Case Aging ? Lower and Higher Authority Appeals report (OMB No. 1205-0359) is submitted monthly, and it provides information on the inventory of lower and higher-authority single claimant appeals cases that have been filed in court but not yet decided. These reports provide the federal government with information about the number of days from the date an appeal was filed through the end of the month covered by the report, as well as the average and median age of the pending appeals cases. The Department prepares this report using data obtained through interagency data-sharing agreements with the Washington State Office of Administrative Hearings and the Washington State Administrative Office of the Courts. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. This issue was not reported as a finding in the prior audit. Description of Condition The Department did not have adequate internal controls to ensure it submitted accurate monthly reports for the UI program. During fiscal year 2022, the Department was required to submit monthly ETA 9055 performance reports to DOL. The Department did not require or perform a secondary review of the reports before submitting them. A single Department employee manually prepared the information contained in the reports and submitted them to the federal grantor, and no one verified they were accurate and complete before submission. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Management did not monitor the completion of these reports to determine whether internal controls would be sufficient to detect and correct any potential data entry errors. In addition, management relied on staff knowledge and information received directly from other agencies being accurate and complete. Effect of Condition By not establishing adequate internal controls to ensure monthly performance reports are complete and accurate, the Department is at an increased risk of inaccurately reporting data to the federal grantor. Recommendation We recommend the Department implement internal controls to ensure it has an effective review process in place before submitting monthly reports to the federal grantor. Department?s Response The Department concurs with this finding. The Department will implement a secondary review of these reports to verify the data pulled from relevant sources is accurately represented prior to submitting to the federal reporting system. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The U.S. Department of Labor, Employment and Training Administration, Office of Unemployment Insurance, Unemployment Insurance Reports Handbook No. 401, Section V: Benefits Time Lapse and Quality, states in part: ETA 9055 ? APPEALS CASE AGING Section V-5 D. General Reporting Instructions Appeals Case Aging measures require states to report data on the universe of all single claimant appeals cases that have not been decided prior to the end of the reporting period. Edit checks can be found in Handbook 402, Unemployment Insurance Required Reports User?s Manual, Appendix C. 4. Pending Lower Authority Single Claimant Appeals Case Aging. a. Includes all lower authority single claimant appeals cases, including those remanded by the higher authority for a hearing and decision reopened appeals cases not decided at the end of the month. 5. Pending Higher Authority Single Claimant Appeals Case Aging. a. Includes all higher authority single claimant appeals cases, including remanded and reopened appeals cases, not decided at the end of the month. An appeals case that has been remanded to the lower authority for additional evidence and will be returned to the higher authority for a decision is reported in this inventory. An appeals case that has been remanded to the lower authority for a new hearing and decision is not a pending higher authority appeals case and should not be counted as such. Office of Management and Budget, 2 CFR Part 200, Appendix XI, Compliance Supplement, Unemployment Insurance, states in part: L. Reporting 2. Performance Reporting States are required to submit periodic reporting to evaluate the performance of the states? UI programs. The auditor should test the information included in the key reports included below that ensure the timeliness of benefits paid. Detailed information on these reports can be accessed under: https://wdr.doleta.gov/directives/attach/ETAH/ETHand401_5th.pdf Report Name Frequency of Submission Reference Core Measure Sections for Test ETA 9050 ? Time Lapse of All First Payments except Workshare Monthly First Payment Time Lapse 14/21 days, Interstate and Intrastate UI, UCFE, and UCX, full and partial weeks Section A. Do not include Workshare ETA 9052 ? Nonmonetary Determination Time Lapse Detection Monthly Nonmonetary Determinations 21-Day Timeliness Sections A, B and C ETA 9055 ? Appeals Case Aging ? Lower and Higher Authority Appeals Monthly Average Age of Pending Lower and Higher Authority Appeals Section A. Exclude the test for states that do not have Higher Authority Appeals.

2022-006 The Employment Security Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the Benefit Accuracy Measurement program of the Unemployment Insurance program in a timely manner. Assistance Listing Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: UI-34528-20-60-A-53; UI-34748-20-55-A-53; UI-34890-20-55-A-53; UI-35682-21-55-A-53; UI-35737-21-55-A-53; UI-35977-21-60-A-53; UI-37098-21-55-A-53; UI-37256-22-55-A53; UI-37313-22-55-A53; UI-38013-22-60-A-53; UI-38163-22-55-A-53; UI-38511-22-55-A-53; UI-38580-22-75-A-5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: UI Benefit Payments Known Questioned Cost Amount: None Background The Unemployment Insurance program was created by the Social Security Act, and it provides benefits under the Unemployment Compensation program to unemployed workers for periods of involuntary unemployment. The program provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Improper Payment Elimination and Recovery Act of 2010 requires the state workforce agencies to maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is the U.S. Department of Labor?s quality control system designed to assess the accuracy of unemployment insurance benefit payments and denied claims in separation status. The program estimates error rates and dollar amounts of benefits improperly paid or denied by projecting the results from investigations in a state. The Employment Security Department administers the state?s Unemployment Insurance program. During fiscal year 2022, the Department paid more than $2.8 billion dollars in unemployment insurance benefits to more than 457,000 people. Under the BAM program, the Department is required to draw a weekly sample of payments and denied claims. The Department must complete this sampling promptly and conduct an in-depth investigation of the claims to determine the degree of accuracy in administering the state?s Unemployment Compensation program and compliance with federal law (20 CFR ? 602.21(d)). The Department has established a dedicated BAM unit to meet these requirements. The Benefit Accuracy Measurement State Operations Handbook, which is published by the U.S. Department of Labor?s Employment and Training Administration, indicates the time frame and requirements for conducting BAM program case sampling for paid claims. States must complete reviews of: ? 70 percent of the sampled cases within 60 days of the week ending date of the batch; and ? 95 percent of the sampled cases within 90 days of the week ending date of the batch; and ? 98 percent of sampled cases within 120 days of the ending date of the annual report period. In addition, states must sample denied claims and review: ? 60 percent of the sampled cases within 60 days of the week ending date of the batch; ? 85 percent of the sampled cases within 90 days of the week ending date of the batch; and ? 98 percent of the sampled cases within 120 days of the end of the calendar year. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported that the Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the BAM program of the Unemployment Insurance program in a timely manner. The prior finding numbers were 2021-005 and 2020-011. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to operate a BAM program and assess the accuracy of unemployment insurance benefit payments. The Department did not effectively recruit, develop and retain staff to ensure it materially complied with the BAM program?s case review requirements. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not adequately staff its BAM unit with resources sufficient to meet BAM program requirements. Management said the BAM unit has struggled to maintain adequate staffing due to attrition and funding. Also, once staff are hired into the unit, it takes considerable time to train new employees to effectively complete case sampling. Staff appointed to assist the Department?s BAM unit in response to the prior audit findings left employment during the current audit period, making it more difficult for the Department to complete investigations in a timely manner. The Department was unable to fill these vacant positions during the audit period. Effect of Condition The Department did not comply with the federally required timelines for completing its case sampling. We performed testing to determine whether the Department complied with federal requirements for investigating paid claims and denied claims in a timely manner. For paid claims, we found the Department: ? Completed only 198 (45 percent) of its 440 sampled cases within 60 days of the week ending date of the batch, failing to meet the federal requirement of 70 percent ? Completed only 294 (67 percent) of its 440 sampled cases within 90 days of the week ending date of the batch, failing to meet the federal requirement of 95 percent ? Completed only 319 (73 percent) of its 440 sampled cases within 120 days of the ending date of the annual report period, failing to meet the federal requirement of 98 percent ? Failed to complete investigations for the remaining 29 (seven percent) of its 440 sampled cases during the audit period We also found the Department completed only 91 of its 109 (83.5 percent) sampled cases of denied claims in separation within 90 days of the week ending date of the batch, failing to meet the federal requirement of 85 percent. By not complying with the federally required timelines for completing case sampling, the Department cannot fully evaluate the accuracy of its claim decisions and is less likely to detect fraudulent payments. Recommendation We recommend the Department allocate the necessary staffing resources to ensure it complies with the U.S. Department of Labor?s timelines for BAM case sampling. Department?s Response The Department concurs with this finding and recommendation. The BAM unit has, since 2019, continued to improve on the staffing model within the unit and ensure compliance is met through training, sufficient staffing, and contingency planning. The BAM Unit currently has one vacancy and is expected to have further challenges with upcoming retirements. The Agency is currently in a hiring pause for UI Administrative funding, furthering the challenge to fully staff the unit and meet requirements. The unit anticipates if fully staffed, this capacity would ensure the USDOL Acceptable Levels of Performance (ALPs) are met. ESD continues to partner and frequently communicate with USDOL Regional Offices to discuss staffing and training models. The Quality Assurance Manager and the Case Review Supervisor are committed to routinely monitor caseload, workload, and the overall assurance of meeting the BAM operations performance goals and measures as set forth by USDOL. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 20 CFR Part 602, Quality Control in the Federal-State Unemployment Insurance System, section 21, Standard methods and procedures, establishes the requirements for states to conduct representative case sampling for quality control study of unemployment benefit claims, which state in part: ?602.21 Standard methods and procedures. Each State shall: a. Perform the requirements of this section in accordance with instructions issued by the Department, pursuant to 602.30(a) of this part, to ensure standardization of methods and procedures in a manner consistent with this part; b. Select representative samples for QC study of at least a minimum size specified by the Department to ensure statistical validity (for benefit payments, a minimum of 400 cases of week paid per State per year); c. Complete prompt and in-depth case investigations to determine the degree of accuracy and timeliness in the administration of the State UC law and Federal programs with respect to benefit determinations, benefit payments, and revenue collections; and conduct other measurements and studies necessary or appropriate for carrying out the purposes of this part; f. Furnish information and reports to the Department, including weekly transmissions of case data entered into the automated QC system and annual reports, without, in any manner, identifying individuals to whom such data pertain; The U.S. Department of Labor, Employment and Training Administration Benefit Accuracy Measurement State Operations Handbook ? ET Handbook No. 395, 5th Edition, Chapter VI ? Investigative Procedures, Section 13: Completion of Cases and Timely Data Entry, states in part: The following time limits are established for completion of all cases for the year. (The ?year? includes all batches of weeks ending in the calendar year.): ? a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch, and 95 percent of cases must be completed within 90 days of the week ending date of the batch; and ? a minimum of 98 percent of cases for the year must be completed within 120 days of the week ending date of the calendar year. The U.S. Department of Labor, Employment and Training Administration Benefit Accuracy Measurement State Operations Handbook ? ET Handbook No. 395, 5th Edition, Chapter VIII ? Denied Claims Accuracy (DCA), Section 7: Completion of DCA Cases and Timely Data Entry, states in part: As in paid claims, prompt completion of investigations is important to ensure the integrity of the information being collected by questioning claimant and employers before the passage of time adversely affects recollections. However, due to the fact that contacting the claimant and obtaining claimant information is more difficult than in paid claims, the timeliness standards differ as the following indicates: ? a minimum of 60 percent of cases must be completed within 60 days of the week ending date of the batch, and 85 percent of cases must be completed within 90 days of the week ending date of the batch; and ? A minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the Calendar Year.

2022-007 The Employment Security Department did not have adequate internal controls over and did not comply with requirements to ensure it submitted complete and accurate quarterly performance reports for the Workforce Innovation and Opportunity grant. Assistance Listing Number and Title: 17.258 Workforce Innovation and Opportunity Adult Program 17.259 Workforce Innovation and Opportunity Youth Activities 17.278 Workforce Innovation and Opportunity Dislocated Worker Formula Grants Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: AA-33263-19-55-A-53; AA-34801-20-55-A-53; AA-36352-21-55-A-53; AA-33263-19-55-A-53; AA-34801-20-55-A-53; AA-36352-21-55-A-53; AA-33263-19-55-A-53; AA-34801-20-55-A-53; AA-36352-21-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Employment Security Department (Department) receives federal funding for the Workforce Innovation and Opportunity Act (WIOA) grant from the U.S. Department of Labor (DOL). WIOA authorizes formula grant programs to states to help job seekers access employment, education, training and support services to succeed in the labor market. WIOA provides employment and training programs for adults, dislocated workers, youth, and Wagner-Peyser Act employment services administered by DOL. DOL requires that the Department complete performance reports using a standardized Participant Individual Record Layout (PIRL). The Department must file the PIRL every quarter using DOL?s Workforce Integrated Performance System. DOL also requires that states develop data validation procedures related to the PIRL that include: ? Written description of the process for identifying and correcting errors or missing data, which may include electronic data checks; ? Regular data validation training for appropriate program staff; ? Monitoring protocols, consistent with 2 CFR ? 200.328; ? A regular review of program data for errors, missing data, out-of-range values and anomalies; ? Documentation that missing and erroneous data identified during the review process have been corrected; and ? Regular assessment of the effectiveness of the data validation process and revisions to the process as needed. The Department uses the Efforts to Outcome (ETO) system to determine if participants are eligible for programs under the WIOA grant. Local Workforce Development Boards (LWDBs) enter participant information into ETO, and DOL requires the Department to perform validation procedures to ensure participant data is accurate and complete. Additionally, ETO tracks participants? progress while in the program and upon completion. The Department uses data captured in ETO to compile the data elements reported on the PIRL. In state fiscal year 2022, the Department spent about $66 million in federal WIOA grant funds. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it submitted complete and accurate quarterly performance reports for the WIOA grant. The prior audit finding numbers were 2021-007 and 2020-012. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it submitted complete and accurate quarterly performance reports for the WIOA grant. The Department did not establish an effective review process to ensure data elements of the PIRL quarterly reports were accurate and complete before submitting them to DOL. The Department also did not have adequate written data validation procedures for the PIRL report, as DOL requires. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition A contracted vendor extracts participant data from a large database and then uses customized code to transform it to produce the data the Department uses to create the PIRL reports. The Department did not review the changes applied to the data extraction process to ensure accurate reporting of WIOA participant information. Effect of Condition We verified the Department submitted all four quarterly PIRL reports to the DOL, as required during fiscal year 2022. We obtained and examined all four reports to determine if the Department accurately prepared them. To identify a population of WIOA participants, data elements 903, 904, and 905 are critical because they represent whether a client participated in the program. Each data element must be completed with one of the following allowable coding options: ? 0 ? Participant did not receive services ? 1 ? Yes, Local Formula ? 2 ? Yes, Statewide ? 3 ? Yes, Both Local Formula and State ? 4 ? Reportable Individual We found participants listed in the quarter one report were missing one or more data elements for 903, 904 and 905. The following tables show the proportion of the fields that were blank compared to the total number of fields. Data Element 903 Quarter Blanks Total Percent 1 167,035 336,693 49.61% 2 0 322,723 0.00% 3 0 316,816 0.00% 4 0 303,472 0.00% Data Element 904 Quarter Blanks Total Percent 1 167,189 336,693 49.66% 2 0 322,723 0.00% 3 0 316,816 0.00% 4 0 303,472 0.00% Data Element 905 Quarter Blanks Total Percent 1 167,200 336,693 49.66% 2 0 322,723 0.00% 3 0 316,816 0.00% 4 0 303,472 0.00% We could not determine the total population of WIOA participants for testing for quarter one because these data elements were incomplete and inaccurate. Further, we could not complete testing over the quarter two, three and four PIRL reports. When we attempted to design our testing over the key data elements, Department management said they could not ensure the that participant information reported would be materially accurate and complete due to the complexity of information that flows into data elements 903, 904 and 905, and due to the Department not validating the changes it made to the ETO data extraction process for effectiveness. Therefore, we could not perform further testing to determine whether the reports were accurate and complete. Since the key data elements were incomplete and inaccurate, we could not test to determine the level of material noncompliance. Without complete data, the Department cannot demonstrate compliance with reporting requirements nor accurately inform its federal grantor of its current level of program participation. Recommendations We recommend the Department: ? Update its written validation procedures for the PIRL report to meet DOL requirements ? Provide training and technical assistance to LWDBs on PIRL data element reporting requirements to ensure they enter all required information into ETO ? Establish a review process to ensure it submits complete and accurate quarterly PIRL reports Department?s Response The Department concurs with the finding. We would like to thank the Office of the State Auditor (SAO) for their work on this area to ensure job seekers in Washington state can access employment, education, training, and support services to succeed in the labor market. We have outlined our response below with respect to the recommendations made by SAO. The Department is conducting a balance of performing and implementing these recommendations concurrently with the WIT replacement project, which is estimated for completion in December 2024. SAO recommendation: Update written validation procedures for the PIRL report to meet DOL requirements. The Data Integrity, Policy and Monitoring teams have completed their Data Element Validation (DEV) policy update, submitted it to DOL and are actively executing DEV per DOL expectations. DOL has not provided guidance or definitions through a Training Employment Guidance Letter or Training Employment Notice related to the designation of a reportable individual. Once issued, we can more effectively train stakeholders, update policy, and hold local areas accountable to what a reportable individual count would be. We will also work with our vendors who provide the data extract from Efforts to Outcome to ensure scripting produces the required outcome. SAO recommendation: Provide training and technical assistance to LWDB?s on PIRL data element reporting requirements to ensure they enter all required information into ETO. ESD?s Data Integrity team has established a technical assistance PIRL reporting process focused on continuous improvement practices including data analysis training efforts. This process has been in place since Q2 2021. ESD will direct stakeholders to the current training processes and procedures which are shared on the Workforce Professional Center website. The agency is already working on a project to create an ETO Registration 101. This work will create a process that will add consistency and a more complete approach to the pre-requisite requirements of our customers as they are added to ETO. This is estimated to be complete in March 2023. The Data Integrity team will also be available for 1:1 specialized technical assistance, regarding their continuous improvement practices and pertinent data analysis, as requested by local areas and one-stop centers. SAO recommendation: Establish a review process to ensure it submits complete and accurate quarterly PIRL reports. The Data Integrity team is heavily involved in the automation and standardization of the Quarterly Report Analysis (QRA) process. Thus far, we have concentrated on setting up a sustainable process and we are working on evaluating all defined areas in the most recent QRAs provided to date. In addition, the Data Integrity team will continue to identify and fix issues when using WIPS and Performance Measure Analysis (for credentials and measurable skill gains). The QRA is in its pilot phase with DOL, and Washington State has proactively established a system and reporting structure prior to it being formally required by DOL. We are seeking and receiving technical assistance with DOL as it relates to the PIRL to further establish internal controls and effectively manage data validation, quality, and integrity. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Training and Employment Guidance Letter (TEGL) WIOA No. 07-18, dated December 19, 2018 -Operating Guidance for the Workforce Innovation and Opportunity Act, states in part: Guidance for Validating Jointly Required Performance Data Submitted under the Workforce Innovation and Opportunity Act (WIOA) 4. Joint Data Validation Framework. Data validation is a series of internal controls or quality assurance techniques established to verify the accuracy, validity, and reliability of data. Establishing a joint data validation framework based on a consistent approach shared by the Departments will ensure that all program data are consistent and accurately reflect the performance of each core program in each State. To that end, the purposes of validation procedures for jointly required performance data are to: ? Verify that the performance data reported by States to the Departments are valid, accurate, reliable, and comparable across programs; ? Identify anomalies in the data and resolve issues that may cause inaccurate reporting; ? Outline source documentation required for common data elements; and ? Improve program performance accountability through the results of data validation efforts. While States must utilize a data validation strategy, the specific design, implementation, and periodic evaluation of that strategy is left to the discretion of the State so long as those strategies or procedures are consistent with these guidelines. Data validation helps ensure the accuracy of the annual statewide performance reports, safeguards data integrity, and promotes the timely resolution of data anomalies and inaccuracies. As such, it is recommended that States incorporate their data validation procedures into their internal controls procedures, which are required by 2 Code of Federal Regulations (CFR) ?200.303. State VR agencies should also consider related guidance issued in Rehabilitative Services Administration (RSA) Policy Directive 16-04. Each State must develop data validation procedures that include: ? Written procedures for data validation that contain a description of the process for identifying and correcting errors or missing data, which may include electronic data checks; ? Regular data validation training for appropriate program staff (e.g., at least annually); ? Monitoring protocols, consistent with 2 CFR ?200.328, to ensure that program staff are following the written data validation procedures and take appropriate corrective action if those procedures are not being followed; ? A regular review of program data (e.g., quarterly) for errors, missing data, out of-range values, and anomalies; ? Documentation that missing and erroneous data identified during the review process have been corrected; and ? Regular assessment of the effectiveness of the data validation process (e.g., at least annually) and revisions to that process as needed. Performance Accountability, Information, and Reporting System ? OMB Control No.1205-0526, can be found at https:www.dol.gov/agencies/eta/performance/reporting

2022-008 The Washington State Department of Transportation did not have adequate internal controls to ensure supervisors reviewed and approved payroll journals for the Highway Planning and Construction Cluster. Assistance Listing Number and Title: 20.205 Highway Planning and Construction 20.205 COVID-19 Highway Planning and Construction 20.219 Recreational Trails Program 20.224 Federal Lands Access Program Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: None Background The Washington State Department of Transportation, Payments & Deductions Unit, administers federal funding under the Highway Planning and Construction Cluster for employee payroll related to state highway construction projects. The Department spent about $614 million on highway projects during fiscal year 2022. Of that amount, the Department used about $68 million for employee payroll. As part of the Highway Planning and Construction Cluster, the Department is allowed to request federal reimbursement for salaries and benefits for program activities. The Department defines its labor and payroll reporting requirements in its Payroll Manual. Employees? time and effort are tracked in the DOTtime timekeeping system, which allows the Department to charge hours worked and wages paid to the appropriate federal project. The Unit creates payroll journals twice monthly, and emails them to the Department?s regional timekeepers. The journals are sent prior to payroll processing; supervisors must sign the journals, and timekeepers are required to return them to the Unit within two weeks after they are initially sent. The Unit is responsible for maintaining a payroll calendar, which is sent to the timekeepers to document the due dates. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure supervisors reviewed and approved payroll journals for the Highway Planning and Construction Cluster. During the audit period, the Department issued 1,056 payroll journals for staff participating in federal projects. We used a statistical sampling method, and randomly selected and examined 57 journals to determine whether an appropriate supervisor reviewed and approved them. We found 11 payroll journals (19 percent) were not approved and returned timely to the Unit during payroll processing. These approvals were between one and 54 days overdue. We also found seven journals (12 percent) were not approved by the assigned supervisor during the audit period. All seven journals were not approved until after we requested the documentation, and they were at least six months overdue. We consider this internal control deficiency to be a significant deficiency. This issue was not reported as a finding in the prior audit Cause of Condition Management did not monitor to ensure that supervisors reviewed, approved and returned payroll journals to the Unit, as Department policy requires. In addition, regional management did not consistently follow up on requests from the Unit to begin reviewing payroll journals, and Department management did not implement internal controls to ensure supervisors performed the required approvals timely. Effect of Condition By not establishing effective internal controls to ensure payroll transactions are reviewed for appropriateness in a timely manner, the Department does not have adequate assurance that its payroll distributions are accurate. Recommendations We recommend the Department: ? Improve internal controls to ensure supervisors review, approve and return payroll journals to the Unit, as policy requires ? Consider updating its existing policies to include provisions for when supervisors must review, approve and return payroll journals for payroll processing ? Monitor the review of payroll journals to ensure supervisors provide the required responses Department?s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor?s Office (SAO) audit of the Highway Planning and Construction Cluster and values the Auditor?s assessment regarding the Description and Effects of Condition as they pertain to Payroll Journals. The Department is committed to ensuring that we have adequate internal controls established to ensure payroll journals are reviewed and returned in a timely manner. WSDOT?s current process was developed to ensure that payroll distributions are certified in a timely manner. Payroll journals are generated and sent to the designated signers using a link to Adobe Acrobat Sign, via email on Day 4 of payroll processing. The signer will receive an automated follow-up email each day that the document remains unsigned. Once signed the document is routed back to Payroll via Adobe Acrobat Sign. Payroll staff responsible for the journals also have an audit system in place, where they monitor the return of signed documents. Each signed document also contains an audit report that identifies the sender and the signer, the time and date the original email request was sent, the date and time the document was signed, and when the document workflow has been completed. In an effort to ensure increased compliance with this policy, we will review existing controls and evaluate the current audit process of monitoring the review and return of the payroll journals. We will also review the Payroll Manual to ensure directions, guidelines, and expectations around the signing of the payroll journals is clearly defined and determine whether provisions for when managers must sign and return the journals for payroll processing is appropriate for reducing the risk to payroll distributions within the Highway Planning and Construction Cluster. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington State Department of Transportation, Payroll Manual (M 13-08.06), April 2021 version, states in part: Chapter 2 Roles and Responsibilities 2-4 Timekeepers It is the responsibility of the timekeeper to: 12. Be the point of contact and provide payroll and labor documentation as requested. 13. Ensure Payroll Journals have the appropriate signatures and are returned to HQ Payroll Office. 2-5 Supervisors It is the responsibility of the employee?s supervisor/org manager to: 6. Review the payroll journal. 7. Approve by signing the Payroll Journal that it is correct to the best of your knowledge.

2022-009 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to conduct program monitoring of subrecipients of the Highway Planning and Construction Cluster. Assistance Listing Number and Title: 20.205 Highway Planning and Construction 20.205 COVID-19 Highway Planning and Construction 20.219 Recreational Trails Program 20.224 Federal Lands Access Program Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Washington State Department of Transportation (Department), Local Programs Office, administers federal funding under the Highway Planning and Construction Cluster to local agencies throughout the state for highway construction projects. The Department spent about $614 million on highway projects during fiscal year 2022. Of that amount, it passed through about $248 million to local agencies through subawards. Federal regulations require the Department to monitor the activities of its subrecipients to ensure they use subawards for authorized purposes and that activities comply with terms and conditions of the subaward and achieve performance goals. Specifically, monitoring efforts must include reviewing financial and programmatic reports required by the pass-through entity. The Department also maintains its own requirements for subawards of federal funds, published in the Local Agency Guidelines (LAG) Manual. This manual outlines additional requirements the Department imposes on all subrecipients, including the requirement to undergo project audits, documentation reviews during the project period of performance, and project management reviews (PMRs) prior to closure of each federally funded construction project. The Department revised the LAG Manual in June 2021 to provide for the selection of PMRs using a risk-based approach. The Department selects PMRs from ongoing projects it believes are at the highest risk of noncompliance. However, the U.S. Department of Transportation, Federal Highway Administration (FHWA), has stipulated in its Stewardship and Oversight Agreement (Agreement) with the Department that a PMR is conducted at least once every three years for each subrecipient. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with federal requirements to conduct program and fiscal monitoring of subrecipients for the Highway Planning and Construction Cluster. The previous finding numbers were 2021-008, 2020-016 and 2019-015. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to conduct program monitoring of subrecipients for the Highway Planning and Construction Cluster. The Department did not ensure it completed PMRs for every subrecipient every three years, as required by the Agreement. During the audit period, the Department was required to complete PMRs for 12 of its subrecipients. We found the Department did not perform any of the required PMRs for these subrecipients during the audit period. The Department suspended all PMRs scheduled during state fiscal year 2022 and reinstated its review schedule in September 2022, which was after the audit period. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Department worked with FHWA to switch to a risk-based PMR scheduling approach, but did not receive official concurrence to change this approach during the audit period. Department management made a conscious decision to switch to the risk-based approach before receiving official approval from FHWA to allow for a different selection methodology than the one outlined in the Agreement signed by the Department and FHWA. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are using federal funds for allowable purposes. Additionally, without monitoring each subrecipient?s use of federal funds, the Department does not have reasonable assurance that the subrecipient has complied with the terms and conditions of the subaward. Failure to monitor each subrecipient?s use of federal grant funds also violates the terms and conditions of the Agreement, which could result in the termination or suspension of the federal grant award. Recommendations We recommend the Department: ? Update its policies and procedures for subrecipient monitoring to comply with FHWA regulations ? Improve internal controls to ensure it completes project management reviews for every active subrecipient at least once every three years, as required under the Agreement Department?s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor?s Office audit of the Federal Highway Program. WSDOT is committed to ensuring our programs comply with federal regulations. The Department appreciates the Auditor?s perspective on the Description of Condition and Effects of Condition in the finding. Technically, the finding is correct for fiscal year 2022 based on the language in the Stewardship Agreement with FHWA. FHWA is reluctant to formally open the Stewardship and Oversight Agreement for revisions, as a new nationwide ?template? is under development. During fiscal year 2022, the Department executed a memo agreement with FHWA to update our PMR process to a leading practice. This new process includes a ?risk-based approach? which will improve the effectiveness of our subrecipient monitoring efforts. As a result, the reviews and resources will be focused on the high-risk agencies or projects rather than a three-year review cycle. Our risk-based program approach began in calendar year 2021 via an initial memo agreement with FHWA, and was approved for use going forward via the July 2022 memo agreement with FHWA. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will follow up on the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 23 CFR, Chapter 1 ? Federal-Aid Highways, Section 106: Project approval and oversight, states in part: (g) Oversight Program.? 4) Responsibility of the states.? (A) In general.?The States shall be responsible for determining that subrecipients of Federal funds under this title have? (i) adequate project delivery systems for projects approved under this section; and (ii) sufficient accounting controls to properly manage such Federal funds. Title 23 CFR, Part 635 ? Construction and Maintenance ? Contract Procedures states in part: ? 635.102 Definitions. As used in this subpart: Local public agency means any city, county, township, municipality, or other political subdivision that may be empowered to cooperate with the State transportation department in highway matters. State department of transportation (State DOT) means that department, commission, board, or official of any State charged by its laws with the responsibility for highway construction. The term ?State? should be considered equivalent to State DOT if the context so implies. In addition, State Highway Agency (SHA), State Transportation Agency (STA), State Transportation Department, or other similar terms should be considered equivalent to State DOT if the context so implies. ? 635.105 Supervising agency. (a) The State DOT has responsibility for the construction of all Federal-aid projects, and is not relieved of such responsibility by authorizing performance of the work by a local public agency or other Federal agency. The State DOT shall be responsible for insuring that such projects receive adequate supervision and inspection to insure that projects are completed in conformance with approved plans and specifications. The U.S. Department of Transportation?s Stewardship and Oversight Agreement On Project Assumption and Program Oversight By and Between the Federal Highway Administration (Washington Division) and the Washington State Department of Transportation, states in part: Section XI. State and Local Public Agency Oversight Requirements and Reporting Requirements B. State DOT Oversight of Locally Administered Projects WSDOT provides oversight through their Local Programs Division. This dedicated staff manages the program by providing guidance, training, and technical assistance to the Local Agencies. The Local Agency Guidelines (LAG) manual describes the processes, documents, and approvals necessary to administer federal-aid projects by local transportation agencies. The manual also outlines WSDOT?s oversight and review activities. The Division reviews and approves twice a year the LAG Manual to ensure it complies with FHWA Order 5020.2 (Stewardship and Oversight of Federal-Aid Projects Administered by Local Public Agencies, August 14. 2014). By agreeing to accept federal aid funds, the local agency understands its roles and responsibilities with respect to carrying out the federal aid program. WSDOT is permitted to delegate certain activities, under its supervision, to local agencies (cities, counties, private organizations, or other state agencies) under federal regulation 23 CFR 1.11 and 635.105; however, WSDOT accepts responsibility for delegated activities. WSDOT has a certification process that allows local agencies to administer a federal aid project based on past performance, current staffing, overall capability, and knowledge of FHWA and state requirements. The certification acceptance process is outlined in Chapter 13 of the Local Agency Guidelines Manual (LAG). WSDOT is also required to conduct verification activities to assure that local agency federal aid projects are implemented in conformance with federal aid requirements. WSDOT conducts Project Management Reviews (PMR) to assess whether the certified agency administered the project in accordance with federal aid requirements. A PMR reviews all phases of a project from environmental, consultant services, design, to construction. WSDOT and the Division jointly develop the checklists for the PMRs. The Division includes items identified as part of our risk assessment process and items listed as stewardship indicators. The PMR review is conducted at a minimum every three years on the local agency?s project with the most risk associated with it and the local agency?s certification acceptance is reevaluated. WSDOT has retained some project level approval actions and conducts various reviews such as, construction inspections, billing reviews, and work-zone traffic control reviews. In addition WSDOT conducts documentation and a final inspection on every local agency federal aid project. WSDOT submits annually a Stewardship Report that summaries their verification activities, PMRs, other reviews, and stewardship indicators. The annual Stewardship Report addresses any findings or issues, as well corrective action plans if needed. The Washington State Department of Transportation?s Local Agency Guidelines manual (M 36- 63.40 ? June 2021), Chapter 53 ? Project Closure, states in part: 53.3 Project Reviews In order to ensure that local agencies are administering FHWA funded projects in reasonable compliance with FHWA requirements and regulations and the Local Agency Guidelines manual, WSDOT will perform procedural reviews on federal funded local agency ad-and-award projects. Projects will be selected from the available projects awarded to the local agency based upon the assigned risk level documented in the risk assessments performed at the end of each project by the Region LPE. These reviews will be: ? Project Management Reviews (PMR) performed by HQ Local Programs ? CA Agencies must have a PMR performed every three years. (Meaning the HQ Local Program will select a qualifying project from the list of awarded federal projects. The project selection will occur near the beginning of third federal fiscal year cycle and with the actual review occurring near completion of construction.) ? PMRs will be performed in one of two ways, in person file reviews or electronic file reviews. ? Documentation Reviews are performed by the Region Local Programs Engineer with the frequencies of the reviews being based upon the risk assessment performed on each phase of the projects.

2022-010 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to issue management decisions for audit findings to subrecipients of the Highway Planning and Construction Cluster. Assistance Listing Number and Title: 20.205 Highway Planning and Construction 20.205 COVID-19 Highway Planning and Construction 20.219 Recreational Trails Program 20.224 Federal Lands Access Program Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Washington State Department of Transportation (Department), Local Programs Office, administers federal funding under the Highway Planning and Construction Cluster to local agencies throughout the state for highway construction projects. The Department spent about $614 million on highway projects during fiscal year 2022. Of that amount, it passed through about $248 million to local agencies through subawards. Federal regulations require the Department to monitor its subrecipients? activities. This includes verifying that subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 calendar days after receiving the auditor?s report(s), or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes on to subrecipients, the Department must follow up and ensure its subrecipients take timely and appropriate corrective action on all deficiencies detected through audits, onsite reviews and other means. Within six months of the Federal Audit Clearinghouse accepting the audit report, the Department must also issue a management decision for audit findings related to the federal award it provided to the subrecipient. These requirements help ensure the Department and its subrecipients use federal award funds for authorized purposes and within the provisions of contracts or grant agreements. The Local Programs Office communicates annually with all active subrecipients, informing them of the requirement to receive a single audit or program-specific audit in accordance with 2 CFR ? 200.501, and to ensure that they promptly transmit a copy of the audit report to the Department. The Local Programs Office also uses a tracking system to identify amounts passed through to subrecipients; to document audit activity for the subrecipients, including the date(s) on which audit reports were due and ultimately received by the Department; and to monitor if subrecipients received single audit findings. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure subrecipients received required single audits, findings related to federal program awards were followed up on, and management decisions were issued. The prior finding numbers were 2021-010, 2020-015 and 2019-017. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to issue management decisions for audit findings to subrecipients of the Highway Planning and Construction Cluster. The Department had five subrecipients that received single audits, which resulted in findings that the Department was required to issue management decisions for during the audit period. We used a non-statistical sampling method, and randomly selected and examined four of the five subrecipients. We examined the Department?s audit notes and records to determine if it had issued management decisions for these single audit findings. We found the Department did not issue management decisions for one of the subrecipients (25 percent) that received findings. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition Management did not ensure the Department met the federal requirement to issue management decisions for single audit findings to subrecipients. While the Department did review single audit reports filed for its subrecipients and internally communicated about them, the Local Programs Office did not correctly respond to all findings related to its programs that required management decisions. The subrecipient in question reported the noncompliance to the Local Programs Office prior to the audit finding being issued. Department staff discussed the issue internally and determined the subrecipient?s corrective actions already taken would have resolved the deficiency. While the Department appropriately reviewed the subrecipient?s response to the audit finding, it did not follow up and issue a formal, written management decision to the subrecipient upon receiving the auditor?s report, as required. Effect of Condition Not issuing a management decision when required means the Department did not determine the effect of noncompliance on the federal program and did not require subrecipients to correct the identified deficiencies. By failing to ensure subrecipients establish corrective actions and monitor those corrections for effectiveness, the Department cannot determine whether subrecipients have materially complied with all federal requirements that pertain to the subaward. Recommendations We recommend the Department: ? Review all subrecipient audit reports to determine if there are findings related to federal programs ? Follow up on and issue management decisions for all subrecipient audit findings related to the Highway Planning and Construction Cluster ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations Department?s Response We appreciate the State Auditor?s Office (SAO) audit of the Federal Highway Program. The Department is committed to ensuring our programs comply with federal regulations related to subrecipient monitoring. Our Local Programs Division had a different understanding of the requirement to issue Management Decision Letters (Decision Letters). We typically issue Decision Letters to all subrecipients that receive Single Audit findings related to WSDOT federal grant awards. For the subrecipient in question, the subrecipient had contacted Local Programs upon realizing a discrepancy in their advertisement practices, which was prior to the issuance of SAO?s audit report and finding. WSDOT evaluated their advertisement practice, reviewed and approved the county?s corrective action plan, and implemented a training plan with the county. Since these activities preceded the issuance of SAO?s report containing the audit finding, WSDOT elected to forgo a formal Decision Letter. We will continue to review all single audits issued for our subrecipient agencies and send Decision Letters based on SAO?s recommendation. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes requirements the pass-through entity must follow when issuing subawards to subrecipients. Title 2 CFR Part 200, Uniform Guidance, section 339, Remedies for noncompliance, describes remedial actions that the Federal awarding agency or pass-through entity may take if the non-federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award. Title 2 CFR Part 200, Uniform Guidance, section 521, Management decisions, establishes when a management decision must be issued in relation to audit findings relating to Federal awards.

2022-011 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with quality assurance program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed testing for projects funded by the Highway Planning and Construction Cluster. Assistance Listing Number and Title: 20.205 Highway Planning and Construction 20.205 COVID-19 Highway Planning and Construction 20.219 Recreational Trails Program 20.224 Federal Lands Access Program Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Quality Assurance Program Known Questioned Cost Amount: None Background The Washington State Department of Transportation administers federal funding under the Highway Planning and Construction Cluster to local agencies throughout the state for their highway construction projects. The Department spent about $614 million on highway projects during fiscal year 2022. Federal regulations require that the Department have a quality assurance (QA) program, approved by the Federal Highway Administration (FHWA), for construction projects on the National Highway System to ensure that materials and workmanship conform to approved plans and specifications. Verification sampling must be performed by qualified testing personnel employed by the Department or its designated agent, excluding the contractor. The Department?s QA program requirements are outlined in the Construction Manual, which is approved by the FHWA. This manual documents how materials are tested for acceptance before being incorporated into construction projects. Materials can be accepted in various ways, such as sample testing, a visual inspection documented by the Field Note Record or Inspector?s Daily Report, or a certification of compliance from the manufacturer. If a materials test is required, the Department must ensure that only qualified people perform the testing, including independent testers, consultants or certified Department employees. To ensure that materials incorporated into a project meet approved plans and specifications, the Department prepares a list of prescribed materials to be used on the project. The Department uploads this list to a program called the Record of Materials (ROM). The ROM sets forth the materials and quantities that are expected to be used on the project, and it documents the proper acceptance criteria, including any test(s) personnel are required to perform on a material. Once created, Project Engineers responsible for managing the construction project update the ROM to indicate the type and quantity of materials incorporated into the project so management can ensure the materials test(s) that are required for acceptance have occurred. To ensure that only qualified people perform the testing, testers must pass a certification exam, which consists of a written and performance exam. After passing both, the testers are entered into the Qualified Tester Database and are certified for five years, after which they must recertify by passing both exams again. There are two different types of tester qualifications: module and method. Module testers are proficient in multiple method tests that can encompass all method tests for a particular material, whereas method testers may only be proficient in particular tests for any given material. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with QA program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed materials testing for projects funded by the Highway Planning and Construction Cluster. The prior finding numbers were 2021-011, 2020-017 and 2019-019. Description of Condition The Department did not have adequate internal controls over and did not comply with QA program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed testing for projects funded by the Highway Planning and Construction Cluster. Project Engineers did not maintain the ROM for all materials used in projects We used a statistically valid sampling method to randomly select 57 out of the 1,091 materials that were used on federally funded projects during state fiscal year 2022. For each material, we reviewed the ROM to verify the assigned Project Engineer updated the quantity placed and paid in accordance with the Construction Manual. We found that Project Engineers did not maintain the ROM for 22 materials (39 percent) in accordance with the Construction Manual. Materials acceptance testing did not conform to standard specifications and the Construction Manual For the 57 randomly selected materials, we requested the supporting documentation for acceptance and/or testing of the material. We found one material (2 percent) where testing did not occur, and the Department was unable to provide documentation justifying the item did not require testing. Entry of tester certification into Qualified Tester Database We used a statistically valid sampling method to randomly select 55 of the 383 testers that became initially certified or recertified during the audit period to verify that the exam results of each tester were reviewed and approved prior to being entered into the qualified tester database. We found: ? Twelve exams were reviewed after the audit period. ? Four reviews were completed, but they lacked supervisor signatures. ? Two testers were missing exams. Ten of our samples were data entry errors, and the testers? tests occurred outside of the audit period. This was due to the Department not being able to provide us with a definitive population of testers certified or recertified during the audit period. Testing personnel were not properly certified We used a statistically valid sampling method to randomly select 58 out of 1,311 testers that were actively certified in the Department?s qualified tester database. We requested and reviewed test documentation to verify whether the testers had all required documents to support their certification. We found four testers (7 percent) did not have complete supporting documents. Specifically: ? One tester did not have evidence of completing a written and performance exam. ? Three testers had exams that did not indicate the date of completion; therefore, we could not confirm the exams occurred before or during the audit period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Project Engineers did not maintain the ROM for all materials used in projects Management did not ensure Project Engineers were adequately trained in maintaining the ROM and did not monitor to ensure it was properly maintained. Materials acceptance testing did not conform to standard specifications and the Construction Manual Management did not adequately monitor to ensure required materials testing and acceptance occurred in accordance with the Construction Manual. Testing personnel were not properly certified Project Engineers did not ensure tester qualifications were current, and management did not ensure they were properly entered into the database. Effect of Condition By not adequately monitoring project materials to ensure they conform to approved plans and specifications, the Department does not have reasonable assurance that materials incorporated into projects conform to standard specifications and the Construction Manual. By not properly verifying and documenting the testers? qualifications, the Department risks improper materials testing. This could result in the Department using materials that may not conform to approved plans and specifications. Recommendations We recommend the Department: ? Improve internal controls to ensure materials incorporated into federal aid projects conform to standard specifications and the requirements outlined in the Construction Manual ? Strengthen its monitoring to ensure Project Engineers accurately and completely maintain the ROM for each project ? Strengthen internal controls to ensure testers have completed all required exams?and that they have proper documentation of passing these exams?before entering them into the Qualified Tester Database ? Continue to review all testers in the Qualified Tester Database to ensure they meet the minimum requirements Department?s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor?s Office (SAO) audit of the Federal Highway Program and the federally required Quality Assurance (QA) program. The Department is committed to ensuring our programs continue to comply with federal regulations and recognizes that there are always opportunities for improvement to its QA program. Exceptions noted in the audit reflect the importance of documentation in our QA program. Our response to each type of exception follows: Maintenance of the Record of Materials (ROM) The construction contracts awarded in FY22 utilizing federal funding contained more the 4,900 materials, with almost 1,100 of them requiring testing. The State Auditor tested 57 materials and initially found 22 where the Department did not maintain aspects of the ROM. The Department agrees that there is always room for improvement in its processes; however, for the majority of the 22 instances where the ROM was not updated timely, the project offices were able to provide documentation to support the proper approval, acceptance, and field verification of the materials tested or that materials testing was not required, and one material (2%) was identified where testing did not occur. Materials Acceptance The State Auditor tested 57 materials of the approximately 1,100 requiring testing for FY22 and found one material (2.0%) that the Department could not provide documentation to support that testing occurred or was not required. Testing Personnel Certifications The State Auditor reviewed 55 of 383 testers for entry of data into the qualified tester database and 58 testers out of 1,311 testers actively certified in the qualified tester database. For two (3.6%) of the materials testers for entry of data into the qualified tester database the exams could not be located and one (1.7%) of the materials testers for actively certified testers in the qualified tester database did not have a written and performance exam. Other noted exceptions included lack of signatures, missing dates of completion and data entry errors. The Department continues to work closely with the Federal Highway Administration (FHWA) on our QA program and has received positive feedback from them on the strength of our program. The Department is working towards replacing its ROM legacy system. The new system will automate many processes and should help to strengthen controls over the QA program. The Department will continue to put improvements in place for the QA program based on the SAO audit recommendations for documenting materials testing and tester certifications. We recently delivered training to Project Engineering staff on material documentation and the single audit issues, and will continue to offer training, in-person, remotely, and through the monthly Material QA Section newsletter, to emphasize QA program requirements. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. While we agree with the Department that the materials for the 22 instances when the ROM was not maintained by the Project Engineer ultimately met acceptance criteria for payment, without monitoring project offices to ensure the ROM is updated as required, management does not have assurance that materials incorporated into federal projects have met acceptance criteria. We reaffirm our finding, and we will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 23 U.S. Code of Federal Regulations (CFR) Part 637, Construction Inspection and Approval establishes the following applicable requirements: Section 637.201 Purpose To prescribe policies, procedures, and guidelines to assure the quality of materials and construction in all Federal-aid highway projects on the National Highway System. Section 637.205 Policy (a) Quality assurance program. Each STD shall develop a quality assurance program which will assure that the materials and workmanship incorporated into each Federal-aid highway construction project on the NHS are in conformity with the requirements of the approved plans and specifications, including approved changes. The program must meet criteria in (Section 637.207) and be approved by the FHWA. (b) STD capabilities. The STD shall maintain an adequate, qualified staff to administer the quality assurance program. The State shall also maintain a central laboratory. The State?s central laboratory shall meet requirements in (Section 637.209(a)(2)). (c) Verification sampling and testing. The verification sampling and testing are to be performed by qualified testing personnel employed by the STD or its designated agent, excluding the contractor and vendor. (d) Random samples. All samples used for quality control and verification sampling and testing shall be random samples. Section 637.207 Quality assurance program (a) Each STD?s quality assurance program shall provide for an acceptance program and an independent assurance (IA) program consisting of the following: (1) Acceptance program. i. Each STD?s acceptance program shall consist of the following: A. Frequency guide schedules for verification sampling and testing which will give general guidance to personnel responsible for the program and allow adaptation to specific project conditions and needs. B. Identification of the specific location in the construction or production operation at which verification sampling and testing is to be accomplished. C. Identification of the specific attributes to be inspected which reflect the quality of the finished product. ii. Quality control sampling and testing results may be used as part of the acceptance decision provided that: A. The sampling and testing has been performed by qualified laboratories and qualified sampling and testing personnel. B. The quality of the material has been validated by the verification sampling and testing. The verification testing shall be performed on samples that are taken independently of the quality control samples. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The Department of Transportation Construction Manual (M41-01), Chapter 9: Materials, states in part: 9-1 General The quality of materials used on the project will be evaluated and accepted in various ways, whether by testing of samples, visual inspection, or certification of compliance. This chapter details the manner in which these materials can be accepted. Requirements for materials are described in Standard Specifications for Road, Bridge, and Municipal Construction M 41-10 Section 1-06 and Division 9. It is the Project Engineer?s responsibility to accept materials in accordance with this chapter. For materials tests that do not meet specification requirements, the Project Engineer shall contact the State Construction Office which will coordinate with the State Materials Engineer or Assistant State Materials Engineer to determine the appropriate action. 9-1.2C Record of Materials The Record of Materials (ROM) is used to track material type, make/model, approval, acceptance, field verification documentation, Certificate of Materials Origin, and other materials documentation. The Project Office utilizes the ROM program to track all permanently incorporated materials that are placed in on the Contract. Temporary materials are also tracked in the ROM when the contract documents contain temporary material requirements. The Project Engineer is responsible for the accuracy of the ROM, other documentation methods used, and Certification of Materials. Acceptance requirements shown in the ROM can be modified by referencing the properly submitted QPL page or the approved Request for Approval of Materials. Reviewing the contract plans and provisions may identify additional materials documentation requirements as well as construction items that shall be added to the ROM and tracked for completion throughout the course of the project work. In order to ensure clarity upon completion of the work and to allow for easy certification of the project by both the Project Engineer and the Region, the ROM needs to be maintained throughout the course of the project. "Maintained" and "maintain" means the ROM is updated to reflect materials placed within 30 calendar days of the material payment. This includes material type, make/model, approval, acceptance, field verification documentation, Certificate of Materials Origin and other materials documentation. For materials used in the Contract, the Project Office is required to maintain the Status Work Completed (WC)/Documentation Complete (DC) / Not Used (NU) fields in the ROM. The Project Office is required to maintain quantities paid, quantities placed, quantities field verified for materials that have sampling frequencies, WSDOT Fabrications Inspection items, where the Acceptance Criteria requires quantities such as Manufacturer Certificate of Compliance, or when quantities are noted in the initial materials and acceptance criteria. 9-5.3 WAQTC Testing Technician Qualification Program The Region Independent Assurance Inspectors are responsible for maintaining the Tester Qualification database information for their Region WAQTC Testers as well as maintaining the WAQTC internal certifications and records (physical and digital).

2022-012 The Washington State Department of Transportation did not have adequate controls over and did not comply with requirements to perform risk assessments for subrecipients of the Formula Grants for Rural Areas program. Assistance Listing Number and Title: 20.509 Formula Grants for Rural Areas 20.509 COVID-19 Formula Grants for Rural Areas Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: WA-2017-66-00; WA-2018-77-00; WA-2018-77-01; WA-2019-901-00; WA-2020-038-00; WA-2020-132-01; WA-2021-052-00; WA-2021-130-00; WA-2021-022-00_SF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Washington State Department of Transportation administers the Section 5311 program?Formula Grants for Rural Areas?to rural transportation areas by providing financial assistance for operating, planning, administrative expenses, and the acquisition, construction, and improvement of facilities and equipment. In addition, Section 5311 specifically provides for the support of rural intercity bus services, as well as funding for training, technical assistance, research, and related services to support the rural transit service. The Department spent about $82 million in program funds during fiscal year 2022. Of that amount, it passed through about $39.5 million to subrecipients through subawards. Pass-through entities are required to monitor subrecipients? activities to ensure they are properly using federal funding. To determine the appropriate level of monitoring, federal regulations require the Department to perform risk assessments to determine each subrecipient?s risk of noncompliance with federal statutes and regulations, and the subaward?s terms and conditions. During fiscal year 2022, the Department awarded about $69 million in new subawards to 27 subrecipients for Section 5311 rural routes and services throughout the state. The Department?s Public Transportation Division is responsible for issuing subawards to rural transit subrecipients and completing risk assessments for those receiving Section 5311 funding. The Department?s Consolidated Grant Guidebook communicates the requirements for conducting assessments of each subrecipient?s risk of noncompliance. In March 2022, the Department updated the guidebook to require risk assessments to be conducted at least every two years. The Public Transportation Division maintains a tracking spreadsheet to monitor active subrecipients and related information, such as subawards issued, progress reporting, risk assessments and other monitoring information. Subawards containing federal funds are normally awarded to subrecipients at the start of each fiscal biennium. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate controls over and did not comply with requirements to perform risk assessments for subrecipients of the Formula Grants for Rural Areas program. We randomly selected and reviewed eight of the 27 subrecipients awarded funding during the audit period to verify the Department performed a risk assessment to determine the appropriate level of monitoring for each subrecipient. We found the Department did not perform a risk assessment for two subrecipients (25 percent). We also reviewed the Department?s tracking spreadsheet and found it did not include nine subrecipients (33 percent) that received funding during the audit period, including the two previously identified. All nine of these subrecipients received their subawards after the Department?s normal process of subawarding at the start of the fiscal biennium had already occurred. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not ensure the Department met the federal requirement to perform risk evaluations for subrecipients. It also did not have a process in place for performing risk assessments for subrecipients when executing subawards after the start of the fiscal biennium. Effect of Condition By not performing risk assessments, the Department is less likely to detect subrecipients? noncompliance with federal regulations and the grant?s terms and conditions. Further, without consistently performing risk assessments for all subrecipients, the Department cannot ensure it using the proper criteria to determine the appropriate level of monitoring required for each subrecipient. Recommendations We recommend the Department: ? Ensure it performs and documents the required risk assessments, which would allow management to evaluate the results and demonstrate compliance with federal requirements ? Modify its risk assessment process to ensure it performs risk assessments for every subrecipient regardless of when the subaward is granted Department?s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor?s Office audit of the Formula Grants for Rural Areas and COVID-19 Formula Grants for Rural Areas. WSDOT is committed to ensuring our programs comply with federal regulations. WSDOT concurs with the finding and plans to implement the recommendations. Specifically, our Public Transportation Division will ensure that it performs risk assessments for all subrecipients receiving federal subawards regardless of when WSDOT executes the related contract. As of February 2023, the Public Transportation Division is currently updating its risk assessment process that it plans to implement in Spring 2023. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, describes the requirement to evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Frequently Asked Questions, states in part: Are pass-through entities required to assess the risk of non-compliance for each applicant prior to making a subaward? Section 200.332(b) requires risk assessments of subrecipients. While there is no requirement for pass-through entities to perform these assessments before making subawards, pass-through entities are encouraged to conduct the risk assessments prior to making subawards. Doing so before making the subaward helps determine the appropriate monitoring tools pass-through entities should use for their subrecipients. Pass-through entities may use their own judgment regarding the most appropriate timing for the assessments. Regardless of the timing chosen, the pass-through entity should document its procedures for assessing risk. The Washington State Department of Transportation Consolidated Grant Guidebook (M130 (March 2022 version)), Chapter 1 ? Requirements and guidelines for all projects, states in part: Program compliance and project reporting Risk assessments Every two years and in accordance with 2 CFR 200.332(b)(1-4), WSDOT conducts risk assessments to evaluate each grantee?s risk of noncompliance with the grant requirements. We use the risk assessment results to determine how much technical assistance and oversight may be necessary to help organizations comply with grant requirements.

2022-013 The Department of Corrections improperly charged $37,392 to the Coronavirus Relief Fund. Assistance Listing Number and Title: 21.019 COVID-19 Coronavirus Relief Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $37,392 Background In March 2020, Congress passed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which authorized the spending of $2.2 trillion in federal funds to respond to the COVID-19 pandemic. The CARES Act established the Coronavirus Relief Fund (CRF), which authorized $150 billion in federal financial assistance for state, territorial, tribal, and certain eligible local governments. Through the CARES Act, Washington was awarded about $2.95 billion of CRF money to help fund the state?s response to the COVID-19 pandemic. Of this amount, the Office of financial Management allocated approximately $2.2 billion to state agencies for various programs. In fiscal year 2022, state agencies spent approximately $345 million in CRF funds. The CARES Act requires recipients to only use CRF payments to cover: ? Necessary expenditures incurred due to the public health emergency (COVID-19) ? Costs that were not accounted for in the government?s most recently approved budget as of March 27, 2020 ? Costs that were incurred during the period that begins March 1, 2020, and ends December 31, 2021 In fiscal year 2022, the Department of Corrections spent $240 million in CRF funds. The Department used the funds to cover payroll costs for employees who were substantially dedicated to responding to the COVID-19 public health emergency. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department improperly charged $37,392 to the CRF. We found the Department had adequate internal controls to ensure it materially complied with activities allowed or unallowed and allowable costs/cost principles requirements. We used a statistical sampling method and randomly selected and examined 59 monthly payments out of a total population of 29,459. In addition to the 59 payments, we judgmentally picked two individually significant items. We examined the supporting documentation for each monthly payment and found one instance where an employee?s payroll overpayment totaling $37,392 was identified and referred to collections by the Department, but was inadvertently charged to the CRF. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a single audit exceed $25,000. We are issuing this finding because, as stated in the Effect of Condition and Questioned Costs section of this finding, the actual questioned costs exceed that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition The Department followed procedures for approving payroll costs. However, multiple reviews did not prevent the overpayment made to an employee from being charged to the CRF. Effect of Condition and Questioned Costs The Department improperly charged the CRF for payroll costs totaling $37,392. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department?s Response The Department of Corrections (DOC) would like to thank the State Auditor?s Office (SAO) for the audit of the Coronavirus Relief Fund (CRF) grant. The Department agrees that questioned costs were charged to the grant due to an employee?s overpayment. While the SAO has complimented our internal controls and processes for being able to track each line item in the CRF, we also know that internal controls can always be improved. The Department has additional allowable costs that were not charged to the grant which should compensate for the questioned costs identified and intends to discuss this change with the funder. The Department appreciated the patience of the SAO in obtaining supporting documentation and having clarifying conversations during the audit. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs.

2022-014 The Department of Social and Health Services improperly charged $390 to the Coronavirus Relief Fund. Assistance Listing Number and Title: 21.019 COVID-19 Coronavirus Relief Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $390 Background In March 2020, Congress passed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which authorized the spending of $2.2 trillion in federal funds to respond to the COVID-19 pandemic. The CARES Act established the Coronavirus Relief Fund (CRF), which authorized $150 billion in federal financial assistance for state, territorial, tribal, and certain eligible local governments. Through the CARES Act, Washington was awarded about $2.95 billion of CRF money to help fund the state?s response to the COVID-19 pandemic. Of this amount, the Office of Financial Management allocated about $2.2 billion to state agencies for various programs. In fiscal year 2022, state agencies spent about $345 million in CRF funds. The CARES Act requires recipients to only use CRF payments to cover: ? Necessary expenditures incurred due to the public health emergency (COVID-19) ? Costs that were not accounted for in the government?s most recently approved budget as of March 27, 2020 ? Costs that were incurred during the period that begins March 1, 2020, and ends December 31, 2021 In fiscal year 2022, the Department of Social and Health Services spent $40 million in CRF funds. The Department used the funds to cover payroll costs for employees who were substantially dedicated to responding to the COVID-19 public health emergency. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department improperly charged $390 to the CRF. We found the Department had adequate internal controls to ensure it materially complied with activities allowed or unallowed and allowable costs/cost principles requirements. We used a statistical sampling method to randomly select and examine 83 monthly payments out of a total population of 9,415. We reviewed the supporting documentation for each monthly payment and found: ? One overpayment for four hours overtime and overtime shift totaling $208. ? One payment where there was no supporting documentation for an employee?s shift differential pay of $7.50. ? One overpayment for call-back pay totaling $174.23. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a single audit exceed $25,000. We are issuing this finding because, as stated in the Effect of Condition and Questioned Costs section of this finding, the estimated questioned costs exceed that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition The Department followed procedures for approving payroll costs. However, multiple reviews did not prevent the unsupported shift differential pay and the two overpayments from being charged to the CRF. Effect of Condition and Questioned Costs The Department improperly charged the CRF for payroll costs totaling $390. Based on the unallowable payments, we estimate the likely questioned costs for this grant to be $45,266. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs? as required by 2 CFR ? 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department?s Response The Department concurs with the audit finding. If the grantor contacts the Department regarding the questioned costs, the Department will discuss the way we used the funds and will take additional action if appropriate. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs.

2022-015 The Office of Financial Management did not have adequate internal controls over and did not comply with reporting requirements for the Coronavirus Relief Fund. Assistance Listing Number and Title: 21.019 COVID-19 Coronavirus Relief Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background In March 2020, Congress passed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which authorized the spending of $2.2 trillion in federal funds to respond to the COVID-19 pandemic. The CARES Act established the Coronavirus Relief Fund (CRF), which authorized $150 billion in federal financial assistance for state, territorial, tribal, and certain eligible local governments. Through the CARES Act, Washington was awarded about $2.95 billion of CRF money to help fund the state?s response to the COVID-19 pandemic. The Office of Financial Management (Office) is the prime recipient and allocated $2.2 billion to state agencies for various programs. In fiscal year 2022, the state spent about $345 million in CRF funds, with the Department of Social and Health Services (DSHS) and the Department of Corrections (DOC) accounting for more than $280 million (81 percent) of these expenditures. The Office was required to submit quarterly Financial Progress Reports (FPR) that contained COVID-19-related costs incurred during the covered period of March 1, 2020, to December 31, 2021. During fiscal year 2022, the FPRs were due no later than 10 days after each calendar quarter. The FPR submissions should be supported by the data in the state?s accounting system. The federal grantor specified there were four key line items on FPRs that contained critical information: 1) The total amount of CRF payments received from the U.S. Department of the Treasury. 2) The amount of funds received that were expended or obligated for each project or activity. 3) A detailed list of all projects or activities for which funds were expended or obligated. 4) Detailed information on any loans issued, contracts and grants awarded, transfers made to other government entities, and direct payments made by the prime recipient that are greater than $50,000. For amounts less than $50,000, the prime recipient must report in the aggregate for these expenditure categories. For direct payments to people, the prime recipient must report in the aggregate regardless of the amount. The Office was responsible for compiling this information from state agencies that spent CRF funds during the reporting period. Federal regulations require the Office to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding reporting requirements, retaining source data, and monitoring the effectiveness of established controls. In the prior audit, we reported the Office did not have adequate internal controls over and did not comply with reporting requirements for the CRF. The prior finding number was 2021-014. Description of Condition The Office did not have adequate internal controls over and did not comply with reporting requirements for the CRF. During the audit period, the Office submitted four FPRs. It also submitted a fifth FPR shortly after the end of the audit period, which reported on activity during the audit period. At the end of each quarter, Office staff sent an Excel template to state agencies to report CRF expenditures for key line items for the reporting period. The agencies completed and sent the template back to the Office along with detailed expenditure reports from their accounting systems to support the information they provided in the template. Office staff reviewed and consolidated it into one state-level template to complete the FPR submission. We examined all five FPRs the Office submitted. Our examination focused on DSHS and DOC expenditures because they accounted for more than 81 percent of CRF expenditures. To examine the accuracy of the FPRs, we reviewed the agency and state-level templates and accounting records provided by the Office. We found that the templates and accounting records did not adequately support and align with information the Office reported on the FPRs. We also found that when the amounts reported on the FPR differed from the state-level templates or accounting records, the Office could not provide documentation supporting the change. Finally, we could not determine that staff responsible for certifying the FPRs reviewed the supporting documentation, but a review should have identified differences between the source data and submitted reports. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition During the audit period, management transferred responsibility for reporting from the fiscal and operations division to the statewide accounting division. However, during this process, management did not ensure that all records necessary to support the reports submitted by the fiscal and operations division were retained and reviewed for completeness. In addition, the employee responsible for preparing these first two reports left the Office, and management did not ensure that complete supporting documentation was retained. Effect of Condition Because the Office did not establish adequate internal controls to ensure staff retained the proper supporting documentation after submitting the reports, we cannot conclude whether the FPRs were accurate and complete. Since the Office could not provide complete supporting documentation for some reports, we contacted DSHS and DOC for supporting documentation and additional information. To determine whether the FPRs submitted were accurate and complete, we compared the Office?s consolidated templates and FPRs to expenditure reports and the information provided by DSHS and DOC. During our review of DSHS projects, we identified the following discrepancies: Reporting Cycle & Expenditure Type DSHS Reported Amount DSHS Accounting Record Amount DSHS Variance Details Cycle 6 ? Contracts >= $50,000 $10,220,300 $10,345,300 ($125,000) Underreported Cycle 7 ? Contracts >= $50,000 $120,000 $195,000 ($75,000) Underreported Cycle 7 ? Transfers >= $50,000 ($402,616,439) ($403,364,801) $748,362 Overreported Cycle 8 ? Transfers >= $50,000 $0 $7,382,000 ($7,382,000) Underreported During our review of DOC expenditures, we identified discrepancies totaling $246,550,000 in the final reporting cycle (Cycle 10). We determined that $240,000,000 in expenditures reported as aggregate payments to individuals was reported twice, once in Cycle 7 and again in Cycle 10. In addition, $6,550,000 of Coronavirus State and Local Fiscal Recovery Funds were incorrectly included in the report as CRF expenditures. Recommendations We recommend the Office: ? Improve internal controls to ensure reported amounts, including corrections or adjustments made during submission, are properly tracked and documented for subsequent reporting cycles ? Ensure management reviews source data when certifying the report to ensure amounts reported reconcile to supporting documentation ? Retain all necessary documentation to support amounts reported to the federal grantor ? Consult with the federal grantor to determine if a revision and resubmission of the final FPR is required Office?s Response The Office had controls in place for the Coronavirus Relief Fund (CRF) reporting requirements to ensure reported amounts, including corrections or adjustments made during the reporting period, were properly tracked and documented for subsequent reporting cycles. The Office performed continual monitoring of CRF expenditures to ensure the total grant expenditures reported were complete and accurate. During the audit period, the Fiscal & Operations staff were responsible for uploading and certifying cycle 6 and 7 reports. Agencies were required to provide data on a report template designed to collect and compile statewide information. Since CRF reporting deadlines did not align with the state?s accounting fiscal month cut-off, agencies reported expenditure data up to the end of the last calendar month included in the reporting period instead of waiting until after the close of fiscal month. Staff entered agencies? data into the federal reporting system manually, while dealing with various challenges caused by system issues. During the process, staff communicated with agencies for questions and clarifications via emails or phone calls to ensure reporting was complete and accurate. With staff turnover, some of the email exchanges and telephone conversations could not be provided for audit purposes. Due to the cumulative reporting nature of CRF, it was our understanding that any corrections could be made in the subsequent reporting cycle. The Statewide Accounting staff, who took over the responsibility for reviewing and certifying cycle 8-10 reports, performed a review of each report prior to submission which was documented via emails. The review ensured amounts submitted on the reports reconciled to supporting documentation provided by agencies at the time the reports were prepared. In accordance with the CRF reporting guidance issued by Department of Treasury, specifically the FAQ?s published in March 2021 (OIG-CA-20-028R), the Office made necessary adjustments to reports to accurately reflect all expenditures in the appropriate categories. For the final cycle 10 report, the Office ensured the amounts on the CRF report were supported by the underlying accounting records and performed a complete reconciliation of expenditures to the totals reported for each expenditure category. All revisions and resubmissions of the final report was completed in cycle 10. No additional revisions are required as this time. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Office of Management and Budget, 2 CFR Part 200, Appendix XI, 2022 Compliance Supplement, for Assistance Listing 21.019 Coronavirus Relief Fund, states in part: L. Reporting 3. Special Reporting a. Each prime recipient of the Fund shall provide a quarterly Financial Progress Report that contains COVID-19 related costs incurred during the covered period (the period beginning on March 1, 2020; and ending on December 31, 2021) to Treasury OIG. Each prime recipient shall report this quarterly information mentioned above into the GrantSolutions portal. The prime recipient?s quarterly Financial Progress Report submissions should be supported by the data in the prime recipient?s accounting system. Key Line Items ? The following line items from the reporting contain critical information: (1) The total amount of payments from the Fund received from Treasury. (2) The amount of funds received that were expended or obligated for each project or activity. (3) A detailed list of all projects or activities for which funds were expended or obligated, including: a. The name of the project or activity b. A description of the project or activity (4) Detailed information on any loans issued; contracts and grants awarded; transfers made to other government entities; and direct payments made by the prime recipient that are greater than $50,000. For amounts less than $50,000, the prime recipient must report in the aggregate for these expenditure categories. For direct payments to individuals, aggregate reporting is required to be reported regardless of amount. Beginning September 21, 2020, prime recipients were required to submit via the GrantSolutions portal the first detailed quarterly Financial Progress Report, which cover the period March 1 through June 30, 2020 (with exception to the September 21 first quarter deadline and the October 13 second quarter reporting deadlines for those prime recipients using GrantSolutions? upload feature, which was available December 1, 2020). Thereafter, quarterly reporting will be due no later than ten days after each calendar quarter. If the 10th calendar day falls on a weekend or a federal holiday, the due date will be the next working day. Reporting shall end with either the calendar quarter after the COVID-19 related costs and expenditures have been liquidated and paid or the calendar quarter ending September 30, 2022, whichever comes first. The prime recipient?s quarterly Financial Progress Report submission should be supported by the data in the prime recipient?s accounting system.

2022-016 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to ensure payments to subrecipients of the Emergency Rental Assistance program were allowable and properly supported. Assistance Listing Number and Title: 21.023 COVID-19 Emergency Rental Assistance Program Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: N/A Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: $255,642,551 Background Congress passed two acts authorizing federal funds for the Emergency Rental Assistance (ERA) program to respond to the COVID-19 pandemic. The Consolidated Appropriations Act, 2021, enacted on December 27, 2020, provided $25 billion for ERA. These funds are known as ERA1. The American Rescue Plan Act of 2021, enacted on March 11, 2021, provided $21.55 billion in additional funding for ERA. These funds are known as ERA2. The funds are provided directly to states, U.S. territories, local governments and, in the case of ERA1, Indian tribes, to assist eligible households through existing or newly created rental assistance programs. The Department of Commerce administers the ERA program in Washington. The Department subawarded federal funds to subrecipients to provide financial assistance to households, landlords and utility providers. In fiscal year 2022, the Department spent about $450 million in ERA1 and ERA2 funds. During the audit period, the Department allocated program funds to 38 ERA1 subrecipients and 12 ERA2 subrecipients. Grant recipients may use ERA1 and ERA2 funds for administrative expenses, housing stability services, financial assistance, and other affordable rental housing and eviction prevention purposes. Most of the expenditures the Department spent were for financial assistance to eligible households, which included payment of rent, rental arrears, utilities and home energy costs, utilities and home energy costs arrears, housing stability services and other expenses related to housing. Under the ERA1 program, award funds used for ?other expenses? must be related to housing and ?incurred due, directly or indirectly, to the COVID-19 outbreak.? The amount for prospective rent cannot exceed three months under a single household application. Financial assistance arrears may only cover household expenses accrued on or after March 13, 2020, up to a maximum 15 months for ERA1 and a maximum of 18 months under ERA1 and ERA2 combined. There is no maximum dollar amount for the cumulative financial assistance that may be provided on behalf of an eligible household beyond the requirement that the amounts paid be based on documentation of household income, leases and equivalent forms. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments for the ERA program were allowable and properly supported. During the audit period, the Department only required high-level supporting documentation when approving subrecipient payments. Since detailed source documentation was not required at the time of the reimbursement payment, the Department implemented a fiscal review process for the ERA1 and ERA2 subrecipients. We reviewed the three fiscal reviews completed in the audit period and determined they were sufficient for ensuring payments to these subrecipients were allowable and adequately supported. However, we determined the Department did not complete fiscal reviews for 35 of the 38 ERA1 subrecipients (92 percent) and all 12 ERA2 subrecipients (100 percent) during the audit period. We used a statistical sampling method to randomly select and review 55 out of 369 payments. Additionally, we judgmentally reviewed one individually significant payment that exceeded $23 million. In total, we examined more than $258 million in provider payments as part of the audit. Of the 56 payments examined, we identified 54 payments (96 percent), including the individually significant payment, that did not have adequate documentation and for which the subrecipient did not receive a fiscal review to ensure the payment(s) was for allowable activities, met cost principles, and occurred within the award?s period of performance. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not ensure that proper internal controls were in place to oversee the ERA program. Department staff approved payments to subrecipients without adequate supporting documentation, and management relied on annual fiscal monitoring reviews to ensure subrecipients had proper support for reimbursement payments. However, management said that due to limited staffing and resources, they were only able to conduct monitoring for three subrecipients during the audit period. Effect of Condition and Questioned Costs We determined the Department did not receive adequate supporting documentation before paying subrecipients and did not perform fiscal reviews to ensure that expenditures were for allowable activities. As a result, we identified $255,642,551 in known federal questioned costs and $437,002,382 in likely federal questioned costs. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). To ensure a representative sample, we stratified the population by dollar amount. Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes and spending occurs within the allowed period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Implement additional monitoring procedures to ensure adequate review of each subrecipient?s use of the federal subaward ? Improve internal controls to ensure subrecipients provide adequate supporting documentation when requesting reimbursement ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response The Coronavirus pandemic created an unprecedented crisis of imminent evictions for an estimated 200,000 households who would face homelessness. Prompt program implementation was critical to reducing evictions as homelessness was shown to increase the spread of COVID-19 leading to death. Every week of delay would increase the number of people at risk of dying. During fiscal years 2021 through 2023, the department created the following programs with federal funding: ? Eviction Rent Assistance Program (ERAP) 1.0 and 2.0, with Coronavirus State Fiscal Recovery Funds allocated by the Washington State Legislature. ? Treasury Rent Assistance Program (T-RAP) 1.0 and 2.0, with funds awarded to the Department by the United States Department of Treasury. The Department endeavored to quickly deploy these programs either concurrently or on overlapping timelines, as the federal government doubled down on passing legislation to provide much needed assistance to the states. At the time the Department received the first ERAP funds for rental assistance, the Department had current contracts with grantees for the same activity and for whom monitoring plans had been completed. The vast majority of our grantees are local government entities, with whom the Department has a long history of contracting and partnering on delivering services. Local governments have controls in place and a proven track record of administering housing assistance funds, so the Department has an inherent trust and confidence in their administrative and fiscal control functions, including the detailed review of expenditures. When the Department received the first emergency rental assistance funds (August 2020) the funding for the program was set to expire just four months after the federal award, requiring the Department to lift bureaucratic barriers and issue funds quickly. It was not until late December 2020 that Congress extended the end date and we were informed we could continue to fund the program into 2021. The Department had started a fiscal review process for ERAP 1 and ERAP 2 programs following those awards. Upon receiving the results of the fiscal year 2021 emergency rental assistance audit, it was determined the fiscal review must be completed for all program reimbursements, even if the detail review of expenditures was completed at our subrecipient level. The initial fiscal monitoring was based on previously conducted risk assessments, so not all payees received a fiscal monitoring. The State Auditor?s Office identified this deficiency during fiscal year 2021. Following that, at the end of fiscal year 2022, the department began to review supporting backup documentation for all expenditures. Unfortunately this process had not been implemented in full to meet the second audit requirements for fiscal year 2022. The Department continues to complete reviews of supporting documentation for fiscal year 2023 expenditures and we strive to meet all other program requirements. We will continue to submit monthly and quarterly data and reconciliation reports to the United States Department of Treasury and work with the Washington State Auditor?s Office in response to any current or future audits. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs.

2022-017 The Department of Commerce did not have adequate internal controls over and did not comply with reporting requirements for the Emergency Rental Assistance program. Assistance Listing Number and Title: 21.023 COVID-19 Emergency Rental Assistance Program Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Special Tests and Provisions: ERA Funds Reallocation Known Questioned Cost Amount: None Background Congress passed two acts authorizing federal funds for the Emergency Rental Assistance (ERA) program to respond to the COVID-19 pandemic. The Consolidated Appropriations Act, 2021, enacted on December 27, 2020, provided $25 billion for ERA. These funds are known as ERA1. The American Rescue Plan Act of 2021, enacted on March 11, 2021, provided $21.55 billion in additional funding for ERA. These funds are known as ERA2. The funds are provided directly to states, U.S. territories, local governments and, in the case of ERA1, Indian tribes, to assist eligible households through existing or newly created rental assistance programs. The Department of Commerce administers the ERA program in Washington. The Department subawarded federal funds to subrecipients to provide financial assistance to households, landlords and utility providers. In fiscal year 2022, the Department spent about $450 million in ERA1 and ERA2 funds. During the audit period, the Department allocated program funds to 38 ERA1 subrecipients and 12 ERA2 subrecipients. Grant recipients may use ERA1 and ERA2 funds for administrative expenses, housing stability services, financial assistance, and other affordable rental housing and eviction prevention purposes. The Department is required to submit monthly and quarterly reports for ERA1 and ERA2. For monthly reports, the Department reports the total number of participating households that received ERA assistance and the total amount of ERA funds expended by the Department to or for participating households. For quarterly reports, the Department reports the cumulative amount obligated and expended. Additionally, before the federal government issued the full reporting requirements for the program, the Department submitted interim reports for the first quarter after each award opened. The Department collects data from each subrecipient and manually aggregates it together to determine the reported amounts. The U.S. Department of the Treasury uses these reports to make reallocation determinations to ensure ERA funds remain available to grantees in accordance with jurisdictional needs and demonstrated capacity to deliver assistance while the ERA appropriations remain available. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements for the ERA program. During the audit period, Department program staff asserted that all reports were reviewed and approved by appropriate staff before submission to Treasury. However, program staff did not document their review or approval, so we were unable to determine if the proper reviews occurred. For the monthly reports, we used a nonstatistical sampling method to randomly select and examine eight out of 24 reports. We identified one report (13 percent) that did not contain data for two subrecipients, resulting in an underreporting of 262 households and $1,720,736 in rental assistance. For the quarterly reports, we used a nonstatistical sampling method to randomly select and examine five out of 12 interim and quarterly reports. We identified two interim quarterly reports (40 percent) where the reported amounts were supported only by subrecipients? reported amounts with no detailed support. As a result, we could not verify that $55,139,970 in expenditures and obligations were accurate and complete. Furthermore, in reviewing the accuracy of the aggregated subrecipient data, one of these interim reports was overreported by $811,010. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not require management to document their reviews of reports and supporting documentation prior to submission. If reviews of the reports were performed, they were inadequate for detecting the identified errors. Additionally, for the interim quarterly reports, the Department did not require subrecipients to provide detailed data to support expenditure and obligation amounts submitted on the data-collection forms. Effect of Condition By not retaining adequate supporting documentation for the reports, management was unable to demonstrate that the amounts the Department reported were complete and accurate. As a result, Treasury may not be able to make accurate reallocation determinations. Without establishing adequate internal controls, the Department cannot reasonably ensure that the expenditure and obligation amounts reported to Treasury are complete and accurate. Recommendations We recommend the Department: ? Ensure that management perform and document an adequate review of the supporting documentation before submitting reports to the Department of the Treasury ? Ensure that data collected from subrecipients contains detailed information to support the amounts included in required reportsDepartment?s Response The Coronavirus pandemic created an unprecedented crisis of imminent evictions for an estimated 200,000 households who would face homelessness. During fiscal years 2021 through 2023, the Department managed the Treasury Rent Assistance Programs 1.0 and 2.0: ERA funds. The program included multiple funding allocations to fund the programs. The Department endeavored to quickly deploy these programs either concurrently or on overlapping timelines, as the federal government doubled down on passing legislation to provide much needed assistance to the states. At the time the Department received the Treasury Rent Assistance funds directly from the Department of Treasury (Treasury), the program was unaware of the 2 CFR 200 compliance requirements. The only program specific information provided for reporting was the basic outline of requirements from the statute authorizing the use of ERA funds. The Department?s Treasury Rent Assistance Program (T-RAP 1.0 and 2.0) launched in March of 2021. Reporting guidance specifically for Treasury Rent assistance programs was not released until June 30, 2021. While it was helpful to have more guidance on reporting, the guidance provided was confusing and difficult to understand. Accessing Treasury staff to provide additional guidance and answer questions was a challenge. Local governments also had a difficult time comprehending the guidance and were unable to get technical assistance from Treasury, which led the National Council of State Housing Agencies (NCSHA) to convene regular meetings with local government peers administering emergency rental assistance funds. The NCSHA assisted in understanding the guidance and advocated to Treasury to provide clear language and technical assistance on the guidance they issued. As the Department?s program ramped up over the summer of 2021, Treasury updated the reporting requirements adding a significant amount of new data elements and expenditure reporting. Between June 2021 and March of 2023, Treasury updated reporting guidance eight times. With each update and new requirements added, Department staff had to reconfigure their data collection methods to ensure they were able to collect the newly required information from subrecipients, and ultimately able to properly report it. The Department quickly realized that additional support was needed in order to ensure compliance with reporting requirements. The Department contracted with a vendor skilled in performing data analytics, FORWARD (formerly known as LiveStories), to help aggregate the data required in the monthly and quarterly reports. FORWARD began helping the Department with their reporting duties starting in January 2022. Program management acknowledges reporting approvals were not separately documented for signature of review and approvals. The Department?s Internal Control Officer has provided recommendations for the program to implement to ensure all reporting reviews and approvals are documented. The Department is currently evaluating how to implement the review and approval controls. We also acknowledge the under reporting deficiency which occurred on one of our monthly reports and the interim report. The Treasury reporting system did not allow the Department the ability to modify or change existing reports. The Department had no way of updating the reported information, the only method the program had to update reporting was to verify the final fiscal year figures were updated and reported accurately. The Department constantly strives to ensure we obtain detailed supporting documentation from subrecipients which support all amounts included in all Treasury required reports. The Department thanks SAO for this opportunity to provide a response to the deficiencies reported. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Section 501 of the Consolidated Appropriations Act, 2021 (d) Reallocation of unused funds. Beginning on September 30, 2021, the Secretary shall recapture excess funds, as determined by the Secretary, not obligated by a grantee for the purposes described under subsection (c) and the Secretary shall reallocate and repay such amounts to eligible grantees who, at the time of such reallocation, have obligated at least 65 percent of the amount originally allocated and paid to such grantee under subsection (b)(1), only for the allowable uses described under subsection (c). The amount of any such reallocation shall be determined based on demonstrated need within a grantee?s jurisdiction, as determined by the Secretary. Section 3201 of the American Recue Plan Act of 2021 (e) Reallocation of funds. (1) In General. Beginning March 31, 2022, the Secretary shall reallocate funds allocated to eligible grantees in accordance with subsection (c)(2) according to a procedure established by the Secretary.

2022-018 The Office of Financial Management did not have adequate internal controls over and did not comply with requirements to ensure Coronavirus State and Local Fiscal Recovery Funds were used only for allowable activities. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: $300,000,000 Background The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) provides direct payments to states to respond to the COVID-19 pandemic or its negative economic effects. Washington has received approximately $4.4 billion of SLFRF money from the U.S. Department of the Treasury (Department). Federal law stipulates that states may use SLFRF funds to: ? Support public health expenditures, including COVID-19 prevention and mitigation efforts ? Address negative economic impacts caused by the public health emergency ? Replace lost public sector revenue ? Provide premium pay for essential workers ? Invest in water, sewer, and broadband infrastructure States may only use funds to cover costs incurred during the period of performance, which began on March 3, 2021, and ends on December 31, 2024. Under the Department?s final rule, SLFRF recipients could use funds to replace lost public sector revenue to provide government services. Recipients could elect a one-time standard allowance of $10 million to spend on the provision of government services during the grant?s period of performance. Alternatively, SLFRF recipients could calculate lost revenue based on a formula established by the Department to determine the amount of SLFRF funds that can be used for the provision of government services. Washington chose to calculate its lost revenue rather than used the standard allowance. The calculated amount of revenue loss determines the limit of SLFRF funds that can be used to provide government services by a recipient. For reporting purposes on the Schedule of Expenditures of Federal Awards (SEFA), the aggregate expenditures for all eligible use categories must be reported, not the result of the revenue loss calculation or the standard allowance. Washington received the first half ($2.2 billion) of its total $4.4 billion SLFRF allocation in May of 2021. When received, the funds were accounted for in the state?s Coronavirus State Fiscal Recovery Fund (Fund 706). Washington State Substitute Senate Bill 5165, section 408, included distributions totaling $600 million from Fund 706 into various state transportation-related accounts. According to the Office, the purpose of these distributions was to compensate for revenue losses in state fiscal years 2020 and 2021 relative to revenues collected in state fiscal year 2019 and to be used to maintain government services. The Office attributed $300 million of this as SLFRF expenditures for transportation related accounts on the State?s fiscal year 2022 SEFA. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls and did not comply with requirements related to the SLFRF revenue loss provision. While SLFRF funds are allowed to replace lost public sector revenues, the State was required to identify actual expenditures that were provided for government services. At the time of audit, the State had not identified such expenditures. Rather, the state asserted that all expenditures in the Transportation accounts receiving the SLFRF funds were appropriated for government services and, therefore, there was no doubt as to the allowability of the use of funds. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Office does not believe federal requirements and the Department?s final rule required the State to separately identify actual expenditures that equal the amount of SLFRF expenditures claimed. It is the Office?s position that all expenditures in the Transportation related accounts were for government services and, therefore, the state had sufficient expenditures to meet the grant requirement. During the audit, the Office contacted the Department to obtain guidance on the matter. The Office cited the Department?s FAQ Question 13.15, which states in part, ?recipients should not deviate from their established practices and policies regarding the incurrence of costs, and that they should expend and account for the funds in accordance with laws and procedures for expending and accounting for the recipient?s own funds.? A Department representative acknowledged this FAQ and said the Department does not have additional specific requirements about how recipients should internally track their use of SLFRF funds used for revenue replacement. Effect of Condition and Questioned Costs Without a population of actual expenditures to audit, we could not design tests to verify costs charged to the grant were only for allowable activities, met cost principles, and were incurred during the grant?s period of performance. In our judgment, without identifying the specific expenditures charged to the SLFRF, the Office did not comply with federal requirements. Therefore, we are questioning $300 million in costs that were not supported by specifically identified expenditures for government services. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its federal expenditures. Recommendations We recommend the Office: ? Identify the actual government service expenditures that are the basis for the $300 million in SLFRF expenditures recorded on the State?s fiscal year 2022 SEFA ? Review the supporting documentation for the expenditures to ensure they meet compliance requirements for the SLFRF and are adequately documented, while also documenting the details of this review ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Office?s Response The Office does not concur with the audit finding. The state of Washington created a separate fund to track the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) expenditures. The state, through legislation, approved the transfer from the SLFRF account to various state transportation accounts. Each transportation account that received SLFRF funds was established in statute and is for a specific ?government service? purpose. Therefore, all payments from those accounts would be considered an actual government service expenditure. The U.S. Department of Treasury FAQ 3.2 states that ?Government services generally include any service traditionally provided by a government, unless Treasury has stated otherwise.? We reaffirm that all expenditures from the transportation accounts that received the SLFRF funds were used to maintain government services. The State Administrative and Accounting Manual requires all state agencies to establish internal controls over payments for goods and services, including ensuring payments are lawful and for proper purposes, reviewing payments to ensure they are supported, as well as documenting the review of all payments. State agencies continued to follow their established internal controls to ensure expenditures from the transportation accounts were proper and allowable. Additionally, the Office followed consistent policies and practices regarding the incurrence of costs in the transportation accounts for both non-SLFRF and SLFRF funds, which complied with federal guidance. We disagree that the total amount of lost revenue transferred to the transportation accounts should be considered questioned costs because the auditors were unable to design tests for compliance. The following table lists the accounts and the amounts received from SLFRF during fiscal year 2022. We know all expenditures in these accounts are for government services, and therefore are allowable costs for the program. Account Authority Amount transferred from Account 706 (CSLFRF) 1 Account 039 - Aeronautics Account RCW 82.42.090 $ 388,500.00 2 Account 081 - State Patrol Highway Account RCW 46.68.030 $ 6,179,000.00 3 Account 082 - Motorcycle Safety Education Account RCW 46.68.065 $ 9,000.00 4 Fund 099 - Puget Sound Capital Construction Account RCW 47.60.505 $ 1,446,000.00 5 Account 09H - Transportation Partnership Account RCW 46.68.290 $ 19,773,500.00 6 Account 102 - Rural Arterial Trust Account RCW 36.79.020 $ 1,546,000.00 7 Account 106 - Highway Safety Account RCW 46.68.060 $ 4,109,500.00 8 Account 108 - Motor Vehicle Account RCW 46.68.070 $ 49,708,000.00 9 Fund 109 - Puget Sound Ferry Operations Account RCW 47.60.530 $ 42,983,000.00 10 Fund 16J - State Route Number 520 Corridor Account RCW 47.56.875 $ 29,783,500.00 11 Account 17P - SR520 Civil Penalties Account RCW 47.56.876 $ 2,721,000.00 12 Account 144 - Transportation Improvement Account RCW 47.26.084 $ 7,922,000.00 13 Account 186 - County Arterial Preservation Acct RCW 46.68.090 $ 969,500.00 14 Account 20H - Connecting Washington Account RCW 46.68.395 $ 33,831,500.00 15 Account 215 - Special Category C Account RCW 46.68.090 $ 1,987,500.00 16 Account 218 - Multimodal Transportation Account RCW 47.66.070 $ 57,805,500.00 17 Account 511 - Tacoma Narrows Toll Bridge Account RCW 47.56.165 $ 7,853,500.00 18 Account 550 - Transportation 2003 Account RCW 46.68.280 $ 14,340,500.00 19 Account 595 - I-405 and SR-167 Express Toll Lanes Acct RCW 47.56.884 $ 16,446,500.00 20 Account 780 - School Zone Safety Account RCW 46.61.440 $ 196,500.00 $ 300,000,000.00 We requested that the auditors perform testing of the entire population of expenditures in the transportation accounts for compliance. Questioned costs, if any, could have been identified through relevant audit procedures. During multiple trainings offered by the U.S. Treasury, there has been communication that the grantor will be working with grant recipients through ongoing desk audits to ensure no questioned costs are required to be repaid. The Office will work with the legislature to ensure SLFRF funds can be tracked separately from other funds. Auditor?s Remarks We believe that the federal requirement is that SLFRF recipients must separately identify actual expenditures that equal the amount of SLFRF expenditures stated on the Schedule of Expenditures of Federal Awards. Furthermore, that is the practice used by the State for all other federal programs. We appreciate that the Office will make efforts to work with the Legislature to ensure future SLFRF funds can be tracked separately from other funds. We reaffirm our finding and will follow-up on the Office?s corrective actions in the next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 302, Financial management, states in part: The financial management system of each non-Federal entity must provide for the following (see also 200.334, 200.335, 200.336, and 200.337) (1) Identification, in its accounts, of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, federal award identification number and year, name of the Federal agency, and name of the pass-through entity, if any. (3) Records that identify adequately the source of the application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Title U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 403, Factors affecting allowability of costs, states in part: Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (g) Be adequately documented. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings.

2022-019 The Department of Commerce did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported, and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Subrecipient Monitoring Known Questioned Cost Amount: $28,886,606 Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the American Rescue Plan Act of 2021, delivered $350 billion to state, local, and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state?s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2022, state agencies spent more than $1.4 billion in SLFRF funds, $132 million of which was spent by the Department of Commerce. The Department used SLFRF funds to administer and provide economic assistance to households at risk of eviction and homelessness primarily through the Eviction Rental Assistance Program (ERAP 2.0), in addition to transportation, tourism, and other pandemic-recovery projects. During fiscal year 2022, the Department expended about $111 million on reimbursements and advance payments to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for making direct payments of rent and utilities for eligible low-income households with overdue rent payments dating as far back as March 2020. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported, and met period of performance requirements for the SLFRF program. During the audit period, the Department only required summary level supporting documentation when approving subrecipient payments. Since detailed source documentation was not required at the time of reimbursement, the Department implemented a fiscal review process for ERAP 2.0 subrecipients. We determined that the Department did not perform fiscal reviews or any program reviews for 20 of its 32 subrecipients (63 percent) during the audit period. We used a statistical sampling method to randomly select and review seven out of 12 subrecipients for which the Department completed monitoring during the audit period. We determined four of the seven fiscal reviews completed were insufficient for ensuring payments to these subrecipients were allowable and adequately supported, primarily because the support reviewed lacked enough detail to ensure the activities were allowable and within the period of performance. We also examined program monitoring documentation completed for these same seven subrecipients. The Department selected only one household from each subrecipient for eligibility verification. We determined these reviews did not provide reasonable assurance that payments to the subrecipients were made only on behalf of eligible households. We also used a statistical sampling method to randomly select and review 56 out of 627 payments. Additionally, we judgmentally selected and reviewed one individually significant payment of $6 million. In total, we examined 57 provider payments totaling $48.5 million. Of the 57 payments examined, we identified 37 (65 percent), including the individually significant payment, that did not have adequate documentation to ensure the payment was for allowable activities, met cost principles, and occurred within the award?s period of performance. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. The issue was not reported as a finding in the prior audit. Cause of Condition Management did not ensure that proper internal controls were in place to oversee ERAP 2.0 and the use of SLFRF funds. Department staff approved payments to subrecipients without reviewing adequate supporting documentation, and management relied on annual program and fiscal monitoring to ensure subrecipients had proper support and only served eligible households. However, management said that due to limited staffing and resources, they were only able to monitor 12 subrecipients during the audit period, wherein staff elected to review just one household payment for each subrecipient for appropriateness. Furthermore, the program did not have written policies and procedures in place documenting the programmatic and fiscal monitoring requirements for staff to follow. Therefore, management could not ensure that reviews were thorough and consistent, included a valid sample of subrecipient records, and required detailed source documentation, including accounting support. Effect of Condition and Questioned Costs We determined the Department did not review adequate supporting documentation before paying subrecipients, and it did not perform adequate fiscal reviews to ensure that expenditures were for allowable activities. As a result, we identified $28,886,606 in known federal questioned costs and $71,007,353 in likely federal questioned costs. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). To ensure a representative sample, we stratified the population by dollar amount. Without establishing adequate internal controls and reviewing detailed supporting documentation from subrecipients, the Department cannot reasonably ensure it is using federal funds for allowable purposes and that spending occurs within the allowed period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Implement written policies and monitoring procedures to ensure adequate review of each subrecipient?s use of federal funds ? Improve internal controls to ensure subrecipients provide adequate supporting documentation when requesting reimbursement ? Ensure it has sufficient staffing and resources to monitor each subrecipient, as required under Uniform Guidance ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response The Coronavirus pandemic created an unprecedented crisis of imminent evictions for an estimated 200,000 households who would face homelessness. Prompt program implementation was critical to reducing evictions as homelessness was shown to increase the spread of COVID-19 leading to death. In fiscal year 202, Commerce created the Eviction Rent Assistance Programs 1.0 and 2.0: Coronavirus State Fiscal Recovery Funds allocated by the Washington State legislature to fund the program. All of the rental assistance programs included multiple funding allocations. To provide much needed assistance to the state, the Department quickly deployed the programs either concurrently or on overlapping timelines. The vast majority of our grantees are local government entities with whom the Department has a long history of contracting and partnering with to deliver services. Federal requirements dictate local governments ensure their internal controls meet standards to comply with all compliance requirements. The Department used that expectation to rely on their administrative and fiscal control functions to ensure compliance. The Department received the first emergency rental assistance funds in August 2020 and the funding was set to expire four months after the award issuance. The Department moved quickly to relieve barriers to issue funding. In December 2020 Congress extended the end date to continue the funding for this program into 2021. As a result of the fiscal year 2021 audit, it was determined the fiscal review must be completed for all program reimbursements, even if the detail review of expenditures was completed at our subrecipient level. The initial fiscal monitoring was based on previously conducted risk assessments, so not all payees received a fiscal monitoring. As a result of the deficiencies reported in the fiscal year 2021 audit, the program deployed new subrecipient monitoring risk assessment processes, and now completes a new assessment for each award at the time of the award. Once the deficiency was identified, the Department began to review supporting backup documentation for all expenditures. The current finding also focused on specific sets of expenditures which were not reviewed in detail. As a result, the Department is currently evaluating the best approach to obtain and review supporting documentation at a detail level to ensure compliance with all requirements. The Department continues to complete reviews of supporting documentation for fiscal year 2023 expenditures and we strive to meet all other program requirements. We thank the State Auditor?s Office for identifying areas we could improve to meet all compliance requirements for federal funding. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs.

2022-020 The Office of Financial Management did not have adequate internal controls over and did not comply with reporting requirements for the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the American Rescue Plan Act of 2021, delivered $350 billion to state, local, and tribal governments to support the response to and recovery from the COVID-19 public health emergency. The program also provides resources to fight the pandemic, address economic impacts, maintain vital public services, and build a strong, resilient, and equitable recovery. Washington received about $4.4 billion of SLFRF money from the U.S. Department of the Treasury (Treasury), which the state?s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2022, the State spent more than $1.1 billion in federal program funds. Under the SLFRF program, recipients are required to submit Project and Expenditure Reports during the covered period which began March 3, 2021 and ends December 31, 2024. Treasury identified the following key line items that contain critical information: 1. Obligations and Expenditures ? Current period obligation ? Cumulative obligation ? Current period expenditure ? Cumulative expenditure 2. Subawards 3. Detailed information on any loans issued; contracts and grants awarded; transfers made to other government entities; and direct payments made by the recipient that are greater than $50,000. For amounts less than $50,000, the recipient must report in the aggregate for these same categories of loans issued; contracts and grants awarded; transfers made to other government entities; and direct payments made by the recipient. Recipients must submit the reports online using the Treasury Portal. Users had the option of manually entering data or providing information through a bulk upload using a Treasury template. The Office was responsible for compiling information from state agencies and submitting the reports no later than the last day of the month following the end of each reporting period. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant reporting requirements, retaining source data, and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and did not comply with reporting requirements for the SLFRF. During the audit period, the Office submitted three Project and Expenditure Reports: ? Report No. 1 (covering activity from March 3, 2021 to December 31, 2021) ? Report No. 2 (covering activity from January 1, 2022 to March 31, 2022) ? Report No. 3 (covering activity from April 1, 2022 to June 30, 2022) At the end of each reporting period, Office staff sent an Excel template to state agencies to report SLFRF expenditures. The agencies completed and returned the template along with supporting accounting records. Office staff reviewed and consolidated each agency template into one statewide template to prepare and submit the reports online via the Treasury Portal. We examined all three reports and the Office?s supporting documentation related to each. We found that each report was incomplete and inaccurate when compared to the supporting documentation and information submitted in the Treasury Portal. We consider these internal control deficiencies to be a material weakness that led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition During the audit period, the Office transitioned responsibility from its fiscal and operations division to the statewide accounting division. This change improved the Office?s reporting process, but did not ensure adequate documentation was retained. Multiple staff submitted reports during the audit period, causing a lack of familiarity with information submitted in previous reporting cycles. For Report No. 1, management did not ensure adequate separation of duties. Treasury?s new reporting system was implemented and updated during the audit period, and included safeguards intended to prevent the submission of incomplete information. However, the Office said these safeguards created system errors that caused it to have to manually input information for the report to be accepted. Office management also did not ensure manual entries and adjustments to draft uploads were documented and retained. Additionally, management did not adequately review and reconcile the information submitted in the Treasury Portal to ensure it was completely and accurately captured in the reports. Effect of Condition We examined each of the obligation and expenditure key line items and focused our review on agencies with project expenditures that were material to the overall report. We identified three instances of inaccurate or incomplete reporting, which include the following: Report Agency (Project ID) Reported Amount Expected Amount Variance Details Report No. 1 Health Care Authority (Project No. 5) $31,000,000 $30,985,791 $14,209 Overreported Report No. 1 Commerce (Project No. 11) $37,419,820 $31,116,860 $6,302,960 Overreported Report No. 3 Commerce (Project No. 11) $37,033,965 $36,805,037 $228,928 Overreported We also examined detailed expenditure information in each report, including subaward amounts, subaward IDs, subaward types, subrecipient names, and expenditure amounts. We identified 241 instances where required fields were left blank, or the information reported was inaccurate. Additionally, we examined the Office?s bulk upload templates and found 494 subawards and expenditures uploaded to the Treasury Portal that were omitted from the reports. These omissions included 124 subawards and expenditures for amounts totaling $102,952,311 that were included in Report No. 1, but subsequently omitted from the expenditures and subaward sections of Report Nos. 2 and 3 without a discernible cause. Because the Office did not maintain adequate documentation of manually entered expenditures, we could not determine whether the information entered was accurate. During the covered period for fiscal years 2021 and 2022, cumulative SLFRF expenditures totaled $818,297,395 in the reports and $1,230,743,420 in the state?s Schedule of Expenditures of Federal Awards (SEFA). We found the total expenditures in Report No. 3 did not account for $412,446,025 (33.5 percent) of expenditures that were reported on the SEFA for the same time period. By not establishing adequate internal controls, the Office cannot ensure that information reported to the federal grantor is complete and accurate. Recommendations We recommend the Office: ? Establish internal controls to ensure information is completely and accurately uploaded to the federal reporting system, supported by accounting records, and reviewed and reconciled prior to submission and certification of the report ? Provide training to increase staff familiarity with the federal reporting system ? Provide resources for staff to improve report preparation so that it complies with federal reporting guidance and system requirements ? Refer to Treasury?s Project and Expenditure Report User Guide for instructions on correcting the data. Office?s Response The Office has continued to improve internal controls for the Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) reporting requirements to ensure reported amounts, including corrections or adjustments made during the reporting period, were properly tracked and documented for the subsequent reporting cycles. The Office created a separate fund to track CSLFRF expenditures and performed continual monitoring to ensure the total grant expenditures reported were complete and accurate. The Office was proactive in strengthening controls and processes in CSLFRF reporting. Once the complexities of the federal reporting guidelines became apparent, an additional staff member was hired and dedicated to preparing and submitting the quarterly reports. Staff are familiar with Treasury?s Project and Expenditure (P&E) Report User Guide but had to deal with challenges due to guidance being issued late, changed multiple times, and containing complicated reporting requirements. The federal reporting system also does not allow the prior report to be edited after the reporting deadline. Per Treasury?s P&E Report User Guide, FAQ 1.11, any changes or revisions need to be reflected in the next quarterly report. The audit procedures did not take into consideration irregularities found in the Treasury reporting system. The auditors reviewed a pdf. version of the report located on the Treasury website to conduct audit testing. However, the information on that report did not tie to the actual information in the reporting portal. Additionally, the CSLFRF reporting deadlines did not align with the state?s accounting fiscal month and fiscal year cut-off dates. Agencies had to report expenditure data up to the end of the last calendar month included in the reporting period, but all expenditure activities could not be captured due to the short timeframe between fiscal month close and the report due date. Also, for this reason, the report for the quarter ending June 30, 2022 (due July 31st) did not tie to the FY22 Schedule of Expenditure of Federal Awards. The Office continues to improve the quarterly reporting template and assist state agencies during the reporting process to ensure compliance with federal reporting guidance and system requirements. The Office will continue to perform reconciliations of reported expenditures to ensure expenditures are accurately reflected in the appropriate projects and categories. Internal controls also include adequate reviews to ensure reported expenditures are accurate and adequately supported by accounting records before the information is uploaded to the federal reporting system. Internal procedures have been developed to formally document the reporting process. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Office of Management and Budget, 2 CFR Part 200, Appendix XI, 2022 Compliance Supplement, for Assistance Listing 21.027 Coronavirus State and Local Fiscal Recovery Funds, states in part: L. Reporting a. Special Reporting a. There are three types of reporting requirements for the CSLFRF program: i. Project and Expenditure Report: Report on financial data, projects funded, expenditures, and contracts and subawards over $50,000, and other information. Project and Expenditure Reports are due on a regular recurring basis after the Interim Reports. The reporting frequency and deadlines vary by type of recipient and total allocation amount. b. Key Line Items ? The following line items contain critical information for the Project and Expenditure Report: i. Obligations and Expenditures ? Current period obligation ? Cumulative obligation ? Current period expenditure ? Cumulative expenditure ii. Subawards iii. Detailed information on any loans issued; contracts and grants awarded; transfers made to other government entities; and direct payments made by the recipient that are greater than $50,000. For amounts less than $50,000, the recipient must report in the aggregate for these same categories of loans issued; contracts and grants awarded; transfers made to other government entities; and direct payments made by the recipient. Please see Treasury?s Compliance and Reporting Guidance at (https:home.treasury.gov/policy-issues/coronavirus/assistance-for-state-local-and-tribal-governments/state-and-local-fiscal-recovery-funds/recipient-compliance-and-reporting-responsibilities) for more information.

2022-021 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Funds. Assistance Listing Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Coronavirus State and Local Fiscal Recovery Funds (SLFRF), as part of the America Rescue Plan Act of 2021, delivered $350 billion to state, local, and tribal governments to support the response to and recovery from the COVID-19 public health emergency. Washington received $4.4 billion of SLFRF money from the U.S. Department of the Treasury, which the state?s Office of Financial Management allocated to state agencies for various programs. In fiscal year 2022, state agencies spent about $1.15 billion in SLFRF funds, $132 million of which was spent by the Department of Commerce. The Department used SLFRF funds to administer and provide economic assistance to households at risk of eviction and homelessness primarily through the Eviction Rental Assistance Program (ERAP 2.0), in addition to transportation, tourism, and other pandemic-recovery projects. During fiscal year 2022, the Department expended about $109 million on payments to local governments and nonprofit organizations as subrecipients. These subrecipients were responsible for making direct payments of rent and utilities for eligible low-income households with overdue rent payments dating as far back as March 2020. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using federal funds for allowable activities and expenditures. To determine the appropriate level of monitoring, federal regulations require the Department to evaluate each subrecipient?s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for SLFRF subrecipients. During the audit period, the Department awarded about $360 million in SLFRF funds to 37 subrecipients. The Department?s Office of Family and Adult Homelessness, which oversees multiple housing assistance programs, delegated responsibility to individual programs to complete risk assessments of various federal and state awards and grants. All risk assessments, including ERAP 2.0, were to be completed in January 2022 for active subrecipients. Management relies on the results of these risk assessments to prioritize program and fiscal monitoring of higher-risk subrecipients to ensure expenditures are allowable and rent and utility payments are made only to eligible households. We examined 12 of the 37 subrecipients awarded funding during the audit period to verify if the Department performed a risk assessment to determine the appropriate level of monitoring for each one. We found the Department did not perform a risk assessment for three subrecipients (25 percent). All three subrecipients received their ERAP 2.0 subawards after the Department conducted risk assessments for the subrecipients? other programs, and management did not ensure the required risk assessments were performed. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department?s subrecipient monitoring controls and processes were not well-defined or monitored for effectiveness. In addition, because the Department scheduled risk assessments to be performed annually rather than at the time of the award, management did not monitor to ensure subawards executed throughout the year were properly identified and that subrecipients receiving federal funds after January 2022 would undergo a risk assessment. Management also did not implement a formal tracking process to ensure risk assessments were reviewed for appropriateness and adequately documented. Effect of Condition Without performing risk assessments of subrecipients that received SLFRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients? noncompliance with federal regulations and the subaward?s terms and conditions. Recommendations We recommend the Department: ? Improve its internal controls to ensure it performs risk assessments for all subawards issued to subrecipients ? Ensure it performs and documents the required risk assessments sufficiently for management to evaluate the results and demonstrate compliance with federal requirements ? Update its risk assessment procedures to ensure factors related to potential noncompliance with ERAP requirements are incorporated into the overall risk assessment result Department?s Response The Department received a similar finding in the fiscal year 2021 Single Audit and has since implemented corrective action to ensure risk assessments for each program subrecipient is completed, even if a risk assessment for the same subrecipient was completed for a prior award. The program had two separate program awards from the United States Department of Treasury (Treasury) which funded the same program. The Department funded the same subrecipients with each award, therefore, we felt it was a duplication of efforts to create separate risk assessments for each of the awards. Specifically, we did not perform new risk assessments for the three Eviction Rent Assistance Program contracts (funded with Treasury Coronavirus State and Local Fiscal Recovery Funds) because we had already completed them for the Treasury Rent Assistance Program contracts (funded with Treasury Emergency Rental Assistance funds). Moving forward, we will complete a separate risk assessment for each award even if it is for the same program and sub recipient. We thank the State Auditor?s Office for providing this guidance so the Department can comply with all subrecipient monitoring requirements. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings.

2022-022 Washington State University did not ensure that returns of Title IV funds were accurate for the Student Financial Assistance programs. Assistance Listing Number and Title: 84.007 Federal Supplemental Educational Opportunity Grant 84.033 Federal Work-Study Program 84.038 Federal Perkins Loan Program 84.063 Federal Pell Grant Program 84.268 Federal Direct Student Loans 84.379 Teacher Education Assistance for College and Higher Education Grants Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: Various Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Return of Title IV Funds Known Questioned Cost Amount: $2,582 Background As amended, Title IV of the Higher Education Act authorizes programs that provide financial assistance to students to pursue postsecondary education at eligible institutions of higher education. When students who receive Title IV grant or loan assistance withdraw from an institution during a payment period or period of enrollment, the institution must determine the amount of Title IV aid the students have earned as of their withdrawal date. Schools calculate this by determining the percentage of program funds the students have earned and applying that percentage to the total amount of assistance that was or could have been disbursed to students for the payment period or period of enrollment as of their withdrawal date. If the total amount of Title IV assistance earned by students is less than the amount that was disbursed to them as of their withdrawal date, the institution is required to return the difference to the U.S. Department of Education (Department), and it cannot make any additional disbursements to students for the payment period or period of enrollment. In fiscal year 2022, Washington State University disbursed more than $205 million in Title IV funds to students. Description of Condition The University did not ensure that returns of Title IV funds were accurate for the Student Financial Assistance programs. We found the University had adequate internal controls over the return of Title IV funds, and it materially complied with the federal requirements. However, we identified questioned costs as the result of returns that were incorrectly calculated. We used a statistical sampling method to randomly select and examine 57 out of a total population of 873 students for which the University was required to calculate a return of Title IV funds. We found two students for whom the University incorrectly calculated the amount required to be returned to the Department. Specifically: ? One student had $489 returned to the Department. When recalculating the amount required to return, we found the University should have returned $2,801, resulting in a difference of $2,312. ? The second student had $2,590 returned to the Department. When recalculating the amount required to return, we found the University should have returned $2,860, resulting in a difference of $270. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a single audit exceed $25,000. We are issuing this finding because, as stated in the Effect of Condition and Questioned Costs section of this finding, the estimated questioned costs exceed that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition The University returned incorrect amounts because it did not verify that the students were eligible for all funds within their student accounts before calculating amounts and returning the Title IV funds to the Department. Staff responsible for calculating the amounts to return did not verify that loans that were never disbursed were excluded from the University?s calculation of unearned aid. Effect of Condition and Questioned Costs We identified $2,582 in known federal questioned costs and $39,550 in likely federal questioned costs. We consider the $2,582 difference for the two students to be questioned costs because they had unearned financial aid still owed to the Department. At the time of the audit, the University had not processed a corrected return of funds for the two students. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the University: ? Verify student eligibility for all disbursed Title IV funds before calculating the amount of unearned aid required to be returned for students who have withdrawn from school ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid University?s Response Washington State University takes very seriously its responsibilities to ensure compliance with federal requirements. The University appreciates the auditor acknowledgement that the University?s internal controls over the Return of Title IV funds are adequate. The two (out of 57) records with noted exception were isolated and should not be a reflection on the whole of the program or the University?s management of federal funds. These exceptions were identified by management when the records were pulled for auditor testing. Management had not made correction yet only because the audit was still in progress. Upon finding the isolated issues, management performed a review of all 873 students that fell in the audit population, performing calculations of each record to determine if there were any other errors. No errors that needed to be submitted to the Department of Education, other than the two in the test population, were noted. The University is working with the sponsor to ensure return of the known questioned costs can be properly facilitated. Internal processes have been further strengthened to provide for independent quality checks. A report was developed to identify and isolate anomalies, like returning more funds than were actually disbursed. The return to Title IV requirements are very complex and internal controls over compliance are regularly reviewed to ensure improvement and continued adherence to the requirements. The University thanks the State Auditor for bringing this issue to the University?s attention. Auditor?s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200.1, Uniform Guidance establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Title 34 CFR Part 668, Student Financial Assistance General Provisions, Section 668.14 Program participation agreement, states in part: (b) By entering into a program participation agreement, an institution agrees that ? (24) It will comply with the requirements of ?668.22; Title 34 CFR Part 668, Student Financial Assistance General Provisions, Section 668.22 Treatment of title IV funds when a student withdraws, states in part: (a) General. (1) When a recipient of title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of title IV grant or loan assistance that the student earned as of the student?s withdrawal date in accordance with paragraph e) of this section. (4) If the total amount of title IV grant or loan assistance, or both, that the student earned as calculated under paragraph (e)(1) of this section is less than the amount of title IV grant or loan assistance that was disbursed to the student or on behalf of the student in the case of a PLUS loan, as of the date of the institution?s determination that the student withdrew? (i) The difference between these amounts must be returned to the title IV programs in accordance with paragraphs (g) and (h) of this section in the order specified in paragraph (i) of this section; and (ii) No additional disbursements may be made to the student for the payment period or period of enrollment. (5) If the total amount of title IV grant or loan assistance, or both, that the student earned as calculated under paragraph (e)(1) of this section is greater than the total amount of title IV grant or loan assistance, or both, that was disbursed to the student or on behalf of the student in the case of a PLUS loan, as of the date of the institution?s determination that the student withdrew, the difference between these amounts must be treated as a post-withdrawal disbursement in accordance with paragraph (a)(6) of this section and ?668.164(i). (e) Calculation of the amount of title IV assistance earned by the student ? (1) General. The amount of title IV grant or loan assistance that is earned by the student is calculated by? (i) Determining the percentage of title IV grant or loan assistance that has been earned by the student, as described in paragraph (e)(2) of this section; and (ii) Applying this percentage to the total amount of title IV grant or loan assistance that was disbursed (and that could have been disbursed, as defined in paragraph (l)(1) of this section) to the student, or on the student?s behalf, for the payment period of period of enrollment as of the student?s withdrawal date. (2) Percentage earned. The percentage of title IV grant or loan assistance that has been earned by the student is? (iii) Equal to the percentage of the payment period or period of enrollment that the student completed (as determined in accordance with paragraph (f) of this section) as of the student?s withdrawal date, if this date occurs on or before? (A) Completion of 60 percent of the payment period or period of enrollment for a program that is measured in credit hours; or (B) Sixty percent of the clock hours scheduled to be completed for the payment period or period of enrollment for a program that is measured in clock hours; or (iv) 100 percent, if the student?s withdrawal date occurs after? (A) Completion of 60 percent of the payment period or period of enrollment for a program that is measured in credit hours; or (B) Sixty percent of the clock hours scheduled to be completed for the payment period or period of enrollment for a program measured in clock hours. (3) Percentage unearned. The percentage of title IV grant or loan assistance that has not been earned by the student is calculated by determining the complement of the percentage of title IV grant or loan assistance earned by the student as described in paragraph (e)(2) of this section. (4) Total amount of unearned title IV assistance to be returned. The unearned amount of title IV assistance to be returned is calculated by subtracting the amount of title IV assistance earned by the student as calculated under paragraph (e)(1) of this section from the amount of title IV aid that was disbursed to the student as of the date of the institution?s determination that the student withdrew. (g) Return of unearned aid, responsibility of the institution. (1) The institution must return, in the order specified in paragraph (i) of this section, the lesser of? (i) The total amount of unearned title IV assistance to be returned as calculated under paragraph (e)(4) of this section; or (ii) An amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of title IV grant or loan assistance that has not been earned by the student, as described in paragraph (e)(3) of this section.

2022-023 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with federal requirements to ensure Local Education Agencies implemented testing security measures. Assistance Listing Number and Title: 84.010 Title I Grants to Local Educational Agencies (Title I, Part A of the Every Student Succeeds Act) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: S101A190047?19A; S010A200047; S010A210047?21A Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Assessment System Security Known Questioned Cost Amount: None Background The Title I Grants to Local Educational Agencies (Title I, Part A) provides financial assistance to help improve the teaching and learning of children who are at risk of not meeting challenging academic standards and who reside in areas with high concentrations of children from low-income families. The Every Student Succeeds Act (ESSA) requires states to perform annual statewide assessments in reading, language arts and mathematics to all students in grades three through eight. The ESSA also requires states to administer assessments in reading, language arts and mathematics once in high school, as well as in science at least once in reach of the grades three through five, six through nine, and 10 through 12. The Office of Superintendent of Public Instruction (Office) administers the Title I, Part A program in Washington. The Office, in consultation with the Local Education Agencies (LEAs), establishes and maintains an assessment system that is valid, reliable and consistent with professional and technical standards. In its assessment system, the Office has policies and procedures to maintain test security and ensure that LEAs implement them. LEAs are required to complete a District Administration and Security Report (DASR) for each test administered. This report must be submitted to the Office no later than 10 business days after the test has been administered and the testing window has closed for the LEA. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Office did not have adequate internal controls and did not comply with federal requirements to ensure LEAs implemented testing security measures. The prior finding numbers were 2020-026 and 2021-021. Description of Condition The Office did not have adequate internal controls and did not comply with federal requirements to ensure LEAs implemented testing security measures. Through manuals, training modules, tools, templates and other documents, the Office provides guidance to LEAs on how they must manage and administer assessments in compliance with the law. The Office also requires LEAs submit a DASR at the end of each testing cycle to ensure they have implemented testing security measures. During the audit period, the Office did not address known instances of LEAs not submitting DASRs within 10 days after the testing window closed. The Office implemented new monitoring protocols in the spring of 2021. The new protocols included identifying a list of all LEAs that administered each state assessment and checking to ensure that DASRs were received for all assessments administered. During the audit, we randomly selected 58 assessments out of 1,216 tests administered by LEAs. The Office did not receive 33 DASRs (57 percent) within 10 business days of the testing window ending. The Office pursued these unsubmitted reports from the LEAs and received 25 of the late DASRs. At the time of our testing, the Office still had not received eight DASRs (14 percent). These unsubmitted DASRs are known instances of LEA noncompliance that the Office did not correct. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition While the Office developed and implemented new monitoring protocols to track DASR submissions, they did not address instances of LEA noncompliance. The Office routinely followed up with LEAs through various forms of communication, but continued to not receive the DASRs in a timely manner. Effect of Condition By not properly monitoring LEAs, the Office cannot ensure that the school districts are following testing security policies and procedures. Recommendation We recommend the Office address LEAs? test security noncompliance to ensure they have implemented testing security measures. Office?s Response The Office will continue to communicate with LEAs, as it has documented to the SAO. In addition, the Office will begin direct communication with every LEA once per week for four weeks leading up to the end of the test administration window and then once per week for three weeks after the end of the test administration window. This communication will remind each LEA to provide DASR reports for all tests administered in the spring. Once the Office receives the annual final list in August of all tests administered by each LEA, it will be able to narrow its focus and send out weekly reminders to LEAs beginning in mid-August. If the Office has not received completed DASRs by mid-September, a management decision has been established for non-compliance. This management decision is a letter that will be sent to each district Superintendent from the Office?s Assistant Superintendent of Assessment and Student information, informing them of their assessment office?s non-compliance. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 20 U.S. Code ?6311 ? State plans, states in part: (b) Challenging academic standards and academic assessments (2) ACADEMIC ASSESSMENTS.? (A) IN GENERAL.?Each State plan shall demonstrate that the State educational agency, in consultation with local educational agencies, has implemented a set of high-quality student academic assessments in mathematics, reading or language arts, and science. The State retains the right to implement such assessments in any other subject chosen by the State. (B) REQUIREMENTS ? The assessments under subparagraph (A) shall? (i) except as provided in subparagraph (D), be? (I) the same academic assessments used to measure the achievement of all public elementary school and secondary school students in the State; and (II) administered to all public elementary school and secondary school students in the State; (ii) be aligned with the challenging State academic standards, and provide coherent and timely information about student attainment of such standards and whether the student is performing at the student?s grade level; (iii) be used for purposes for which such assessments are valid and reliable, consistent with relevant, nationally recognized professional and technical testing standards, objectively measure academic achievement, knowledge, and skills, and be tests that do not evaluate or assess personal or family beliefs and attitudes, or publicly disclose personally identifiable information; (iv) be of adequate technical quality for each purpose required under this Act and consistent with the requirements of this section, the evidence of which shall be made public, including on the website of the State educational agency; (v)(I) in the case of mathematics and reading or language arts, be administered? (aa) in each of grades 3 through 8; and (bb) at least once in grades 9 through 12; (II) in the case of science, be administered not less than one time during? (aa) grades 3 through 5; (bb) grades 6 through 9; and (cc) grades 10 through 12; and (III) in the case of any other subject chosen by the State, be administered at the discretion of the State; (vi) involve multiple up-to-date measures of student academic achievement, including measures that assess higher-order thinking skills and understanding which may include measures of student academic growth and may be partially delivered in the form of portfolios, projects, or extended performance tasks; (vii) provide for? (I) the participation in such assessments of all students; (II)the appropriate accommodations, such as interoperability with, and ability to use, assistive technology, for children with disabilities (as defined in section 602(3) of the Individuals with Disabilities Education Act (20 U.S.C. 1401(3))), including students with the most significant cognitive disabilities, and students with a disability who are provided accommodations under an Act other than the Individuals with Disabilities Education Act (20 U.S.C. 1400 et seq.), necessary to measure the academic achievement of such children relative to the challenging State academic standards or alternate academic achievement standards described in paragraph (1)(E); and (III) the inclusion of English learners, who shall be assessed in a valid and reliable manner and provided appropriate accommodations on assessments administered to such students under this paragraph, including, to the extent practicable, assessments in the language and form most likely to yield accurate data on what such students know and can do in academic content areas, until such students have achieved English language proficiency, as determined under subparagraph (G); The Professional Standards and Security, Incident, and Reporting Guidelines (PIRG) established by the Office states in part: After testing, it is the LEA?s responsibility to complete a District Administration and Security Report for each test administration. This report has check boxes of responsibilities. Include an explanation of boxes checked ?no? and notation of any missing or damaged materials. As required, submit the report to OSPI through ARMS no later than five business days after completion of each test administration.

2022-024 The Charter School Commission did not have adequate internal controls over and did not comply with requirements to ensure charter schools with relationships to charter management organizations were monitored for conflicts of interest. Assistance Listing Number and Title: 84.010 Title I Grants to Local Educational Agencies (Title I, Part A of the Every Student Succeeds Act) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: S101A190047-19Al; S010A200047; S010A210047-21A Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Oversight and Monitoring Responsibilities with Respect to Charter Schools with Relationships with Charter Management Organizations Known Questioned Cost Amount: None Background The Title I Grants to Local Educational Agencies (Title I, Part A) provides financial assistance to help improve the teaching and learning of children who are at risk of not meeting challenging academic standards and who reside in areas with high concentrations of children from low-income families, The Washington State Charter School Commission (Commission) is the main authorizer of charter public schools in Washington. The Commission provides monitoring and oversight of charter schools, holding them accountable for administering education and use of funds. The Commission was formed following the passage of Initiative 1240 by state voters in 2012, which established the charter public school system in Washington. The Commission is responsible for overseeing and monitoring charter schools that have relationships with charter management organizations (CMOs) to ensure they comply with federal regulations and the terms and conditions of the subaward. There are two CMOs in Washington. Each CMO is comprised of three different charter schools and one charter board that oversees all charter schools collectively. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Commission did not have adequate internal controls over and did not comply with requirements to ensure charter schools with relationships to CMOs were monitored for conflicts of interest. The Commission provides guidance and oversight to charter schools in the state through the use of contracts, reporting requirements and charter board meeting review. Each board member of a charter school must submit an F-1 Personal Financial Affairs Disclosure form to the Public Disclosure Commission (PDC). During the audit period, the Commission did not review the F-1 forms that had been submitted to the PDC by charter board members for either of the charter management organizations. While the Commission informs charter schools of the requirement to submit F-1 forms to the PDC, and routinely attends board meetings of charter schools with CMOs to make note of conflicts of interest, they did not review each board member?s F-1 forms to determine whether conflicts of interest existed. We consider this internal control deficiency to be a material weakness which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Commission was unaware of the federal requirement to monitor charter schools for conflicts of interest and financial risks. Effect of Condition and Questioned Costs Without reviewing the financial disclosures of board members, the Commission cannot ensure they are aware of, and can address, any conflicts for a charter school with a relationship with a CMO in a timely manner. Recommendation We recommend the Commission review financial disclosures of charter board members to ensure that conflicts of interest can be monitored. Commission?s Response Thank you for giving the Commission the opportunity to respond to the proposed finding relating to the April 2022 Federal Compliance Supplement regarding Federal Title I funds. The Commission looks forward to implementing the changes recommended by the Auditor in order to strengthen and improve oversight of charter public schools. The Commission will reach out to OSPI regarding future information sharing regarding the federal funds that OSPI administers, and matters that may require additional action by the Commission. However, the Commission disagrees with the Auditor?s position that a finding is warranted for the 2021-2022 audit year for the reasons below. Under the Charter School Act (CSA), state and federal funds are received and distributed by OSPI to charter public schools, not the Commission. RCW 28A.710.220. OSPI is also required to ?adopt rules necessary for the distribution of funding required by this section and to comply with federal reporting requirements. RCW 28A.710.280. This is consistent with state law establishing OSPI as the state agency authorized to accept and administer federal education funds for Washington State. RCW 28A.300.070. See, for example: Title I, Part A Fiscal Requirements and Guidance OSPI (www.k12.wa.us). The Commission has no authority over or role in managing federal funds. In the April 2022 Federal Compliance Supplement, the guidance makes a distinction between a charter public school that is an LEA under a covered program or a charter public school that is within an LEA under a covered program. Compliance Supplement 2022, 4-84.000-25. Also see, 4-84.000-28 (?Auditors should also note that, depending upon state law, a public charter school may be its own LEA or a school that is part of a traditional LEA.?). The distinction impacts which entity is subject to the obligations, as does the entity that is responsible for allocating funds: If a state considers a charter school to be an LEA under a covered program, this requirement applies to the SEA or other state agency responsible for allocating funds under that program? either by formula or through a competition?to LEAs. If a state considers a charter school to be a public school within an LEA under a covered program, this requirement applies to the LEA. The requirements in this Supplement address an SEA?s responsibilities with respect to eligible charter school LEAs. An LEA that is responsible for providing funds under a covered program to eligible charter schools must comply with these requirements on the same basis as an SEA. Compliance Supplement 2022, 4-84.000-25 (emphasis added). Under the CSA, a charter school is an LEA for purposes of federal law (but not state law). RCW 28A.710.020(4) states that a charter public school: Functions as a local education agency under applicable federal laws and regulations and is responsible for meeting the requirements of local education agencies and public schools under those federal laws and regulations, including but not limited to compliance with the individuals with disabilities education improvement act (20 U.S.C. Sec. 1401 et seq.), the federal educational rights and privacy act (20 U.S.C. Sec. 1232g), the McKinney-Vento homeless assistance act of 1987 (42 U.S.C. Sec. 11431 et seq.), and the elementary and secondary education act (20 U.S.C. Sec.6301 et seq.). RCW 28A.710.020(4) (emphasis added). Based on the fact that charter public schools in Washington are LEAS for purposes of federal law, the requirements as written apply to the SEA responsible for allocating funds which would be OSPI. Because of the status of charter public school as an LEA for purposes of federal law, the ?Compliance Requirements? obligations fall to the SEA under the guidance, when the distinction between a charter school as an LEA under federal law (as in Washington) vs. a charter public school within an LEA are considered: Compliance Requirements As grantees, SEAs/LEAs are responsible for overseeing and monitoring subrecipients, including charter schools with relationships with Charter Management Organizations (CMOs). ...Compliance Supplement 2022, 4-84.000-28 (strikethrough added). Also see, 4-84.000-25, above. In addition, the CSA specifically addresses where charter public school boards are required to file their financial disclosure statements: (2) Members of a charter school board must file personal financial affairs statements with the public disclosure commission. RCW 28A.710.290(2) (emphasis added). The Commission is ready to implement the additional oversight requirements identified by the Auditor. However, the Commission believes that based on the analysis above, a finding against the Commission is not warranted. The April 2022 Federal Compliance Supplement, along with Washington law, indicate that the compliance obligations under these federal programs do not apply to the Commission given the status of charter public schools as LEAs for purposes of federal law, and OSPI?s authority over the receipt and distribution of federal funds. Moving forward, the Commission will add the review of the financial disclosure statements of school board members to its oversight process. Auditor?s Remarks The Commission asserts it does not have the responsibility to monitor the charter schools for this requirement and instead it is the responsibility of the SEA, which is OSPI. Our work in this area started with inquiry with OSPI, but we were directed to the Commission and reviewed RCW 28A.710.070 which states, in part: (1) The Washington state charter school commission is established as an independent state agency whose mission is to authorize high quality charter public schools throughout the state, especially schools that are designed to expand opportunities for at-risk students, and to ensure the highest standards of accountability and oversight for these schools. It is our opinion that the RCW established the Commission as an independent state agency whose scope of responsibility includes this requirement. The Commission also states that they have no authority or role in the management of federal funds. We agree with this assertion. However, this special test and provision does not require the Commission to administer Title I funds, but rather oversee the risk posed by charter schools with relationships to CMOs, pertaining specifically to conflict of interest, segregation of duties, and related party transactions. While the CSA specifically addresses where charter public school boards are required to file their financial disclosure statements, this special test and provision requires that the Commission, as the agency responsible for administering these requirements, review financial disclosures of charter board members to ensure that conflicts of interest can be monitored. We reaffirm our finding and will follow up on the status of the Commission?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 34 U.S. Code of Federal Regulations (CFR) Part 75 Subpart E-Conflict of Interest, 525 Conflict Of Interest: Participation in a Project states: (a) A grantee may not permit a person to participate in an administrative decision regarding a project if: (1) The decision is likely to benefit that person or a member of his or her immediate family; and (2) The person (i) Is a public official; or (ii) Has a family or business relationship with the grantee. (b) A grantee may not permit any person participating in the project to use his or her position for a purpose that is ? or gives the appearance of being ? motivated by a desire for a private financial gain for that person or others. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2022-025 The Office of Superintendent of Public Instruction did not have adequate controls over and did not comply with requirements to ensure it met the earmarking requirements for the Special Education program. Assistance Listing Number and Title: 84.027 Special Education Grants to States (IDEA, Part B) 84.027 COVID-19 Special Education Grants to States (IDEA, Part B) 84.173 Special Education-Preschool Grants (IDEA Preschool) 84.173 COVID-19 Special Education-Preschool Grants (IDEA Preschool) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: H027A190074 - 19A; H027A200074 - 20A; H027A210074 - 21A; H027X210074; H173A190074; H173A200074; H173A210074; H173X210074 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Earmarking Known Questioned Cost Amount: $188,873 Background The Individuals with Disabilities Education Act?s (IDEA) Special Education Grants to States program (IDEA, Part B) provides grants to states, and through them to local educational agencies (LEAs), to help provide special education and related services to eligible children with disabilities. IDEA?s Special Education Preschool Grants program (IDEA Preschool), also known as the ?619 program,? provides grants to states, and through them to LEAs, to assist with providing special education and related services to children with disabilities ages 3 through 5 and, at a state?s discretion, to 2-year-old children with disabilities who will turn 3 during the school year. The Office of Superintendent of Public Instruction administers the Special Education program in Washington and serves about 143,000 eligible students. The program provides specially designed instruction that addresses students? unique needs. The Office offers the program at no cost to parents, and it includes the related services students need to access their educational program. The Office spent about $264 million in federal IDEA grant funds during fiscal year 2022, and passed about $260 million of that funding through to LEAs and educational service districts (ESDs). IDEA, Part B identifies the amount of funds the Office must distribute to its LEAs on a formula basis, as well as the amount it can set aside for administration and other state-level activities. The Office was awarded $8,375,301 for the fiscal year 2020 IDEA Preschool Grant. From this award, $2,205,322 was earmarked to be spent on state-level activities. This state-level activity is split between administrative costs of up to $441,064 and other state-level activities for the remaining amount. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and did not comply with requirements to ensure it met the earmarking requirements for the program. During the audit period, the Office did not accurately track expenditures for administration and other state-level activities. For the life of the grant, the Office spent $156,773 on administrative costs, which allowed for a maximum of $2,048,548 to be spent on other state-level activities. The Office spent $2,237,421 on other state-level activities, which exceeded the maximum by $188,873. As a result, we are questioning the $188,873 as unallowable state-level costs. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The recommended earmarks were established, but the Office did not address identified variances in the spending plan for them. This was due in part to the program having changes in management that led to inconsistencies in tracking expenditures of the earmarked funds. Effect of Condition and Questioned Costs Without adequate internal controls, the Office cannot ensure that it meets the grant?s earmarking requirements. By not complying with the grant?s earmarking requirements, the Office improperly spent $188,873 on activities that exceeded the allowable earmarked amount. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Office: ? Improve internal controls to ensure it does not exceed the maximum allowable amounts that are earmarked for administration and other state-level activities ? Consult with the federal grantor to discuss whether the questioned costs identified in the audit should be repaid Office?s Response When special education fiscal leadership transitioned in 2021, the incoming director identified necessary changes in agency procedures for closing out the fiscal year for special education. Since that time, the following internal controls have been fully implemented to ensure spending plans do not exceed the maximum allowable amounts earmarked for administration and other state-level activities: 1. At the beginning of the fiscal year, the Director of Operations/Budget Analysis meet to review the criteria for spending plans. 2. Copies of GAN and Grants to States Summary Table and Preschool Grants to States Summary Table are shared with the Budget Analysis. 3. Director of Operations/Budget Analysis meet to review the GAN and Grants to States Summary Table and Preschool Grants to States Summary Table. 4. Director of Operations/Budget Analysis meet to review spending plan and update the maximum allowable amounts earmarked for administration and other state-level activities in the spending plan. 5. Maximum allowable amounts earmarked for administration and other state-level activities are reviewed throughout the fiscal year. 6. Director of Operations/Budget Analysis meet weekly to review spending plan. 7. Spending Plan updated as requests are received. 8. Monthly expenditure reports are produced and during weekly meetings, Director of Operations/Budget Analysis review expenditures. These internal controls have contributed to increased communication and partnership between the Director of Operations/Budget Analysis. With implementing these consistent controls, we can ensure that maximum allowable amounts that are earmarked for administration and other state-level activities will meet compliance. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 34 CFR Part 300, Assistance to States for the Education of Children with Disabilities, states in part: Section 300.812 Reservation for State activities, states: (a) Each State may reserve not more than the amount described in paragraph (b) of this section for administration and other State-level activities in accordance with ?? 300.813 and 300.814. (b) For each fiscal year, the Secretary determined and reports to the SEA an amount that is 25% of the amount the State received under section 619 of the Act for fiscal year 1997 cumulatively adjusted by the secretary for each succeeding fiscal year by the lesser of ? (1) The percentage increase, if any, from the preceding fiscal year in the State?s allocation under section 619 of the Act; or (2) The rate of inflation, as measured by the percentage increase, if any, from the preceding fiscal year in the Consumer Price Index for All Urban Consumers, published by the Bureau of Labor Statistics to the Department of Labor. Section 300.813 State administration, states: (a) For the purpose of administering section 619 of the Act (including the coordination of activities under Part B with the Act with, and providing technical assistance to, other programs that provide services to children with disabilities), a State may use not more than 20 percent of the maximum amount the State may reserve under ? 300.812 for any fiscal year. (b) Funds described in paragraph (a) of this section may also be used for the administration of Part C of the Act. Section 300.814 Other State-level activities. Each State must use any funds the State reserves under ? 300.812 and does not use for administration under ? 300.813 ? (a) For support services (including establishing and implementing the mediation process required by section 615? of the Act), which may benefit children with disabilities younger than three or older than five as long as those services also benefit children with disabilities aged three through five; (b) For direct services for children eligible for services under section 619 of the Act; (c) For activities at the State and local levels to meet the performance goals established by the State under section 612(a)(15) of the Act; (d) To supplement other funds used to develop and implement a statewide coordinated services system designed to improve results for children and families, including children with disabilities and their families, but not more than one percent of the amount received under section 619 of the Act for a fiscal year; (e) To provide early intervention services (which must include an educational component that promotes school readiness and incorporates preliteracy, language, and numeracy skills) in accordance with Part C of the Act to children with disabilities who are eligible for services under section 619 of the Act and who previously received services under Part C of the Act until such children enter, or are eligible under State law to enter, kindergarten; or (f) At the State's discretion, to continue service coordination or case management for families who receive services under Part C of the Act, consistent with ? 300.814(e).

2022-026 The Office of Superintendent of Public Instruction did not have adequate internal controls to ensure it performed risk assessments for subrecipients of the Special Education program. Assistance Listing Number and Title: 84.027 Special Education Grants to States (IDEA, Part B) 84.027 COVID-19 Special Education Grants to States (IDEA, Part B) 84.173 Special Education Preschool Grants (IDEA Preschool) 84.173 COVID-19 Special Education-Preschool Grants (IDEA Preschool) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: H027A190074 - 19A; H027A200074 - 20A; H027A210074 - 21A; H027X210074; H173A190074; H173A200074; H173A210074; H173X210074 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Individuals with Disabilities Education Act?s (IDEA) Special Education Grants to States program (IDEA, Part B) provides grants to states, and through them to local educational agencies (LEAs), to help provide special education and related services to eligible children with disabilities. IDEA?s Special Education Preschool Grants program (IDEA Preschool), also known as the ?619 program,? provides grants to states, and through them to LEAs, to assist with providing special education and related services to children with disabilities ages 3 through 5 and, at a state?s discretion, to 2-year-old children with disabilities who will turn 3 during the school year. The Office of Superintendent of Public Instruction administers the Special Education program in Washington and serves about 143,000 eligible students. The program provides specifically designed instruction that addresses a student?s unique needs. The Office offers the program at no cost to parents, and it includes the related services students need to access their educational program. The Office spent about $264 million in federal IDEA grant funds during fiscal year 2022, and it passed about $260 million of that funding through to LEAs and all nine educational service districts (ESDs). Federal law requires the Office to evaluate each subrecipient?s risk of noncompliance with federal statues, regulations, and the terms and conditions of the subaward for determining the appropriate amount and type of subrecipient monitoring. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Office did not have adequate internal controls over requirements to perform risk assessments for the program?s subrecipients. The prior finding number was 2021-023. Description of Condition The Office did not have adequate internal controls to ensure it performed risk assessments for subrecipients of the Special Education program. As a result, the Office did not perform risk assessments for the nine ESDs that received program funding during the audit period. We consider this internal control deficiency to be a significant deficiency. Cause of Condition In response to the prior year audit finding, the Office provided training to ESDs on how to submit monitoring documentation. It also updated the ESD contracts to reflect monitoring activities that would start during the 2022-23 school year. Since the Office did not plan to start monitoring until the following school year, it did not perform risk assessments of any ESDs that received program funding during the audit period. Effect of Condition Without conducting risk assessments, management cannot ensure the Office performs the appropriate amount of monitoring to ensure subrecipients comply with program requirements. Further, without appropriate levels of subrecipient monitoring, the Office cannot have reasonable assurance that federal requirements are being met. Recommendation We recommend the Office establish and follow adequate internal controls to ensure it performs the required risk assessments, which would allow management to evaluate the results, monitor subrecipients appropriately, and demonstrate compliance with federal requirements. Office?s Response Initial Implementation Actions Completed to Date: In April 2022 OSPI Special Education revised and expanded the form package submitted by Educational Service Districts (ESDs), including the required end of year reporting. ESDs are required to respond to the following questions, but are not limited to: a. Contracts/Procurement: Did the ESD/subrecipient contract for services? List the planned contractors and the services provided. Describe the procurement process implemented by the ESD. b. Time & Effort: Describe the ESD?s process to ensure payroll charges are accurate, allowable, and properly allocated to federal programs, and how the ESD ensures time and effort is received from employees in a timely manner. Provide a Payroll Distribution Report from which OSPI will request supporting documents for selected employees. c. Professional Development: Provide supporting evidence such as, agendas, sign-in sheets, electronic invitations, etc., related to professional development provided by the ESD using federal funds. d. End of Year Expenditures: Upload an end of year expenditure report to verify allowable expenditures. Based on the results from monitoring activities, ESDs will be selected for additional monitoring and may be subject to an onsite visit if determined necessary. The Fiscal Monitoring Procedures Handbook for Educational Service Districts has been finalized March 2023. Timeline for Full Implementation: ? February 1, 2024: Last day for ESDs to upload required documentation. ? February 2024: Finalize review of required documents. Issue Report to ESDs that identify any Actions Required or Actions Recommended. ? March 2024: Final reports issued no later than 60 calendar days after the ESD review. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, section 332, Requirements for pass-through entities, establishes the requirements for all pass-through entities.

2022-027 The Office of Financial Management did not have adequate internal controls over and did not comply with federal level of effort requirements for the Education Stabilization Fund program. Assistance Listing Numbers and Titles: 84.425D COVID-19 Elementary and Secondary School Emergency Relief Fund (ESSER) 84.425R COVID-19 Coronavirus Response and Relief Supplemental Appropriations Act, 2021 ? Emergency Assistance to Non-Public Schools (CRRSA EANS) 84.425U COVID-19 American Rescue Plan ? Elementary and Secondary School Emergency Relief (ARP ESSER) 84.425V COVID-19 American Rescue Plan ? Emergency Assistance to Non-Public Schools (ARP EANS) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: S425D210015; S425R210012; S425U210015; S425V210012 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Level of Effort Known Questioned Cost Amount: None Background The U.S. Department of Education distributed funding to multiple federal subprograms of the Education Stabilization Fund (ESF). Beginning in March 2020, Congress set aside the Elementary and Secondary School Emergency Relief (ESSER) Fund to address the effect that COVID-19 has had, and continues to have, on elementary and secondary schools across the nation. Several rounds of funding were distributed to states under the ESF program, each with the intent to support public and non-public schools. The U.S Department of Education awarded ESF grants to the Office of Financial Management (Office), which then dispersed funds to the Office of Superintendent of Public Instruction for pass through to Local Education Agencies (LEAs). In fiscal year 2022, the state spent more than $1.15 billion in ESF federal funding. The ESF program included a level of effort requirement to ensure states provided a minimum level of funding to LEAs based on prior years. Under the American Rescue Plan Act, ESF recipients were required to meet a proportional amount of their state?s support for elementary and secondary education relative to their overall spending, averaged over fiscal years 2017, 2018 and 2019. The Legislature included a proviso with ESF funding that instructed the Office to coordinate with the Office of Superintendent of Public Instruction and legislative fiscal staff from the House of Representatives Office of Program Research and Senate Committee Services on the data, quantification, and report required to seek from the U.S. Department of Education a waiver to the state?s level of effort requirement. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and did not comply with federal level of effort requirements for the ESF program. The Office performed the calculations required to monitor the level of effort requirements for the ESF program, and determined that the fiscal year 2022 expenditures did not meet the level of effort requirement. When compared to overall state spending, the average of state spending on elementary and secondary education for fiscal years 2017, 2018 and 2019 totaled 49.25 percent. The state was required to spend at least this percentage toward education in fiscal year 2022. However, the state only expended 46.85 percent of total state spending on education, meaning the level of effort requirement was not met by approximately 2.5 percent, or $725,311,449. Once the Office determined the state did not meet the level of effort requirement, it submitted a waiver request to the U.S. Department of Education in accordance with the Legislature?s proviso. However, the U.S. Department of Education did not approve waivers for any state during the audit period, and the Office?s waiver request is still pending. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition In response to the effects of the COVID-19 pandemic, the Legislature approved a state budget that spent proportionally more on social supports like food, rent and medical services than in prior years. Further, state revenues declined due to restrictions included in the Governor?s pandemic-related emergency proclamations that were intended to slow the spread of COVID-19. These changes, as well as directives to achieve state spending reductions, resulted in not meeting the ESF program?s level of effort requirement because the state budget allocated less funding to elementary and secondary education than the average of the previous three fiscal years. Effect of Condition By not establishing adequate internal controls, the Office cannot ensure the state is meeting the federal level of effort requirement for the ESF program. In addition, receiving a waiver from the U.S. Department of Education for this requirement is not guaranteed. By not complying with federal requirements, the Office risks having to repay federal funds or having future federal funds withheld. Recommendations We recommend the Office: ? Consult with the grantor to discuss the pending waiver request and the next steps it should take ? Consult with the appropriate state-level authority to ensure the state maintains the level of effort required to comply with federal law Office?s Response The Office of Financial Management (OFM) does not concur with the finding and maintains that there are adequate internal controls in place to ensure compliance with federal requirements. OFM performed the maintenance of effort (MOE) calculations in accordance with the guidance provided by U.S. Department of Education (ED). Based on appropriations and past funding, it was determined that the fiscal year 2022 expenditures did not meet the MOE requirement. OFM followed the federal guidance and direction from a legislative proviso in the enacted state budget (Chapter 334, Laws of 2021, Sec. 954) and submitted a waiver request on ED?s MOE Waiver Request Form for FY22 and FY23. The submission date was before ED?s stipulated deadline of December 31, 2021. ED?s website confirmed an MOE waiver request was received from Washington State and the status of the request is currently listed as ?under review.? OFM followed all federal and state requirements with due diligence in requesting the waiver. The approval process rests with the federal grantor, and the waiver has not been disapproved. In addition, OFM has been meeting with ED on a monthly basis since October 2022 and is already consulting with the grantor regarding the pending waiver request. OFM will also continue to work with the Legislature, which is the state-level authority for state appropriations. Auditor?s Remarks While we understand the Office submitted a request to the U.S. Department of Education to waive the maintenance of effort requirement during the audit period, unless and until the waiver is approved, the state is noncompliant with federal law. The submission of a waiver request does not guarantee its approval. In addition, the reason the waiver was requested was the State did not have sufficient internal controls to ensure it complied with federal law prior to expending the federal award. We reaffirm our finding, and we will follow up on the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Coronavirus Response and Relief Supplemental Appropriations Act, 2021 (CRSSA Act) Sec. 317. (a) At the time of award funds to carry out sections 312 or 313 of this title, a State shall provide assurances that such State will maintain support for elementary and secondary education (which shall include State funding to institutions of higher educations and state need-based financial aid, and shall not include support for capital projects or for research and development or tuition fees paid by students) in fiscal year 2022 at least at the proportional levels of such State?s support for elementary and secondary educations and for higher education relative to such State?s overall spending, averaged over fiscal years 2017, 2018, and 2019. (b) The Secretary may waive the requirement in subsection (a) for the purpose of relieving the fiscal burdens on State that have been experienced a precipitous decline in financial resources. The American Rescue Plan Act, Section 2004. Maintenance of Effort and Maintenance of Equity, states in part: (a) State Maintenance of Effort. ? 1. In general.?As a condition of receiving funds under sections 2001, a State shall maintain support for elementary and secondary education, and for higher education (which shall include state funding to institutions of higher education and State need-based financial aid, and shall not include support for capital projects or for research and development or tuition and fees paid by students), in each of fiscal years 2022 and 2023 at least at the proportional levels of such state?s support for elementary and secondary education and for higher education relative to such State?s overall spending, averaged over fiscal years 2017, 2018, and 2019. 2. Waiver.?For the purpose of relieving fiscal burdens incurred by States in preventing, preparing for, and responding to the coronavirus, the Secretary of Education may waive any maintenance of effort requirements associated with the Education Stabilization Fund.

2022-028 The University of Washington did not establish adequate internal controls to ensure payments to contractors and subrecipients for the Global AIDS program were allowable, properly supported and within the period of performance. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. To achieve the performance goals of the program, the Seattle headquarters of I-TECH (Seattle HQ) provides funding to subrecipients and contractors. Invoices submitted by contractors directly to Seattle HQ are reviewed and approved for payment by budget managers who have delegated authority from the Principal Investigator. Invoices submitted by subrecipients are reviewed and approved for payment by a Principal Investigator. Principal Investigators are also responsible for monitoring the subrecipient?s technical progress and performance. Seattle HQ also provides funding to country offices operating within the University?s global network. The country offices incur costs associated with furnishing supplies and equipment to address the HIV/AIDS epidemic, as well as staffing resources and acquiring goods and services from contractors to carry out the objectives of the program. Payments made by country offices are approved by Country Directors and Country Representatives as delegated by the University. Under the University?s policies, country offices are reimbursed for locally incurred expenses at least monthly. An invoice, accompanied by a schedule of expenses incurred, is submitted and approved by the Country Director and then by the Director of Finance at Seattle HQ, prior to payment. Country offices also responsible for obtaining and retaining supporting documentation for costs incurred and paid on each project. Monthly, Budget Managers review and approve a Budget Activity Report (BAR) that details the expenses charged to the project for the previous month to ensure accurate posting of already approved expenses. This review is also to determine whether the work performed during the billing period reconciles to costs claimed within the contractor?s invoice so that payment may be authorized. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls to ensure payments to contractors and subrecipients of the Global AIDS program were allowable properly supported and within the period of performance. Payments to country offices We used a statistical sampling method to randomly select and examine 58 out of 1,644 transactions for country offices. Of the 58 payments examined, we identified one payment (1.7 percent) that was not approved by the Country Director and the corresponding Budget Activity Report was not approved by the Director of Finance. Payments to contractors We used a statistical sampling method to randomly select and review 58 out of 3,040 payments to contractors. We found: ? Invoices for three payments (5 percent) were not approved by a Budget Manager ? Monthly Budget Activity Reports were not approved for 12 payments (20 percent) Subrecipient reimbursements We used a statistical sampling method to randomly select and review 55 out of 438 payments to subrecipients. We found the assigned Budget Manager did not review and approve the monthly Budget Activity Reports for 52 payments (94 percent). We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition Program management did not require supporting documentation for each payment to be forwarded to and reviewed by headquarters personnel prior to payment authorization. Management also did not monitor the submission of invoices and Budget Activity Reports to ensure they were approved by the responsible Budget Manager, as required. Effect of Condition Without establishing adequate internal controls, the University cannot reasonably ensure it is using federal funds for allowable purposes and that expenditures of federal funds are supported by adequate documentation. Recommendations We recommend the University: ? Improve its internal controls to ensure invoices are properly approved by Principal Investigators, as required ? Improve its internal controls to ensure Budget Mangers review and approve monthly Budget Activity Reports before authorizing payments for projects incurring reimbursement requests ? Ensure it retains supporting documentation sufficient to show costs incurred and paid by the program are allowable, and to demonstrate the required managerial reviews have occurred prior to issuing payment University?s Response In response to the findings for the Global Aids Program, we would like to clarify the following: General Clarification: The draft finding inaccurately represents the role of BARS approvals as part of the internal controls to ensure payments to country offices, contractors and subrecipients are allowable, properly supported and within the period of performance. This is not the role of the BARS review process. Compliance, Budget Manager and PI reviews are the controls that ensure allowability of payments and BARS approvals are after-the-fact validations of accurate posting of already approved expenditures. We provided edits to the Background section to reflect our process. We request in light of this that the description of condition, cause of condition and recommendation sections of this finding be updated accordingly. Payments to country offices I-TECH country offices are not contractors; the offices are an extension of the University of Washington. Your review identified one of fifty-eight samples (1.7%) did not meet the approval requirements set forth in I-TECH?s standard operating procedure. Based on the error percentage, we disagree with this finding. Payments to contractors Payments to contractors have multiple approvals. Upon receipt, individual invoices are approved by the program/budget manager either by signature or email. Invoices are then sent to the I-TECH Accounts Payable Administrator for input to the University?s procurement system, ARIBA, which requires compliance approval from the Accounts Payable Supervisor or other manager, as well as funding approval from the budget manager prior to payment. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to contractors, they are reviews of the monthly expenses posted to the budget and the program manager?s concurrence that the expenses are as expected. The exceptions noted were payments made to country offices instead of contractors. The support for approvals were provided to the State Auditors on April 26, 2023, prior to the completion of fieldwork. We therefore disagree with this finding. We also request that the finding be adjusted to omit the 20% of missing BARS approvals as this is not related to the contractor payments. Subrecipient reimbursements Each subrecipient invoice is reviewed for reasonableness, allowability and allocability by the contracts manager and approved by both budget managers and principal investigators prior to being processed for payment in ARIBA. PI approvals were provided and verified for each subrecipient selection with no omissions noted by the auditors. Approvals of Budget Activity Reports (BARS) are not approval of individual payments to subrecipients, they are after-the-fact reviews of the monthly expenses posted to the budget, intended as documentation of the program manager?s concurrence that the expenses are posted as expected. We acknowledge the instances detailed in the finding where we were unable to produce related BARS approvals for 52 of the transactions; however, we request that the finding be adjusted as these BARS approvals are not related to subrecipient invoice review and approvals. Our record keeping process for BARS approvals was to save the emails in a folder within our Finance Team mailbox. We learned during this review that emails beyond a certain date are deleted but maintained in the MS360 file. We?ve searched for the missing BARS approvals but have not yet been able to locate them. We have since begun saving the approvals to our server to ensure we have access to the data going forward. Auditor?s Remarks The University?s I-TECH Global Operations Manual stipulates that BARs will be generated, reviewed and approved monthly by the Budget Manager and management team. This information was provided to our Office as part of the University?s overall design of internal controls over payments to contractors, subrecipients and country offices. The University responded to our Office on April 20, 2023 adding that ?BAR review is the University?s key post payment control designed to ensure charges are accurately processed, coded and allowable on the budget charged.? We interpret this response to indicate the BAR review process is a monitoring control, and the University asserted on multiple occasions this is a key internal control, which is why we tested it. On January 5, our Office notified University management in writing that the BAR review process would be tested as a key control over the cost principles and period of performance requirements for Global AIDS expenditures. We received no additional inquiry or concerns from University management regarding this internal control until the draft finding was issued on April 14. We provided the University with a final written summary of our fieldwork in this area on April 6, 2023, after fieldwork had concluded. On April 7, the Finance Director responded to our Office in writing confirming they had no further questions or concerns regarding our testing results. It was not until after the University received this finding that additional documentation supporting expenditures tested during the audit were ultimately given to our Office. The basis for this audit finding is the key internal control failure rate of BAR approvals that exceeds our established materiality threshold of five percent, and constitutes a material weakness in internal control, which under the Uniform Guidance is required to be reported as an audit finding in accordance with 2 CFR 200.516 ? Audit findings. We reaffirm our finding and will follow up on the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 02 ? Acceptance of Sponsored Program Awards and Fiscal Compliance on Sponsored Program Accounts (Budget Numbers), states in part: Responsibilities Principal Investigator ? Supervises expenditure of sponsored program funds and approves sub-recipient invoices (see GIM 8) to assure: o That funds are used only for purposes that directly relate to and benefit the activity supported in the award. o That expenditures are consistent with all special terms, conditions, or limitations that apply to expenditures under the particular grant or contract. o That expenditures do not exceed the total funds authorized for a given period under the grant or contract. GIM 07 ? Sponsored Program Subaward Administration, states in part: Principal Investigator ? Review and approve subaward invoices. GIM 08 ? Subrecipient Monitoring, states in part: Roles & Responsibilities PI / Department Responsibilities Project level monitoring of subrecipient including: o Reviews that expenses are necessary, reasonable, and allocable to the work completed and are aligned with technical progress. o Approve invoices for payment. Subrecipient Monitoring ? Project Level Subrecipient invoices are reviewed and approved in accordance with the requirements of GIM 2 in the manner and frequency stated in the subaward. The University of Washington I-TECH Global Operations Manual (GRef 2.3), Section 2, Finance, Accounting Policy and Procedure Requirements, states in part: In addition to the Fiscal Guidelines set forth in the I-TECH Field Operations Manual, these country specific policies are implemented at I-TECH. 10. Budget Management and Reporting f. Reports that show the variance between the budget plan and the activity for each region and activity code will be generated, reviewed and approved by the budget managers and the Management Team each month.

2022-029 The University of Washington did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $46.4 million of which it awarded to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $30,000. The University must report subawards by the end of the month following the month in which it made the subaward or subaward amendment. The intent of the Act is to empower citizens with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. During the audit period, the University was required to report 18 subawards totaling about $46 million of program funds that it awarded to 10 subrecipients. The University generates subawards and subaward modifications using information from its Sponsored Projects Administration and Electronic Research Compliance (SPAERC) system. We randomly selected seven of the 18 subawards required to be reported during the audit period. We found the University failed to report one subaward (14 percent) totaling $113,353 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. The issue was not reported as a finding in the prior audit. Cause of Condition The University uses SPAERC to identify and monitor active subawards and subaward modifications for the Global AIDS program. However, OSP does not currently use SPAERC data to generate external reports to identify subawards and subaward modifications that require reporting in FSRS. During the audit period, staff responsible for submitting the required reports manually searched the system for related transactions to report during the audit period. In addition, management did not review FSRS submissions and compare the information to SPAERC to ensure all required information was reported. Effect of Condition Failing to submit the required reports diminishes the federal government?s ability to ensure accountability and transparency of federal spending. The terms and conditions of the federal award allow the grantor to penalize the University for noncompliance by suspending or terminating the federal award or withholding future awards. Recommendations We recommend the University: ? Establish effective internal controls to ensure reports are submitted, as required ? Ensure management monitors reporting of this information to ensure future reports are submitted completely and accurately Department?s Response The University acknowledges that we neglected to submit one FFATA report related to one Global AIDS program subaward modification during the audit period. We have since submitted that report. The University believes that we already have solid and effective controls in place related to FFATA reporting. We have reviewed all subaward actions (new subawards and modifications) for the Global AIDS program during the audit period and have verified that no additional reports were missed. Please note that per federal regulations, UW submits FFATA reports as required for all financial actions under 1st tier subawards once the threshold has first been met for a particular subaward. This generally results in multiple FFATA reports for a single subaward, with each monetary subaward action (new subawards and modifications) under direct federal funding requiring reporting once the threshold has been met. This results in a large volume of FFATA reports each month. Reporting for the Global AIDS project is handled along with all other FFATA reporting for subawards under the University?s federal awards. We acknowledge that our current processes can be improved through better use of the data in SPAERC. Upon receipt of the final FY2022 audit report (scheduled for June 2023) the University will design a report to assist in the identification and review of FFATA-reportable actions. Due to the timing, implementation of this report will not occur until FY2024. Auditor?s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 ? Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) 3. What to report. You must report the information about each obligating action that the submission instructions posted at http:www.fsrs.gov specify

2022-030 The University of Washington did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.067 Global AIDS 93.067 COVID-19 Global AIDS Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU2GGH001430; NU2GGH001968; NU2GGH002038; NU2GGH002116; NU2GGH002242; NUGGH002360; NU2GGH002157; NU2GGH002298; NU2GGH002374 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Global AIDS program is a federal initiative focused on treating and preventing the transmission of HIV/AIDS around the world. The program is authorized by Sections 307 and 317(k)(2) of the Public Health Service Act, the U.S. Leadership Against HIV/AIDS, Tuberculosis, and Malaria Acts of 2003 and 2008, and the U.S. President?s Emergency Plan for AIDS Relief. Since it was established in 2003, the federal government has invested more than $100 billion in the global HIV/AIDS response, providing testing and treatment for millions of people, preventing transmission among affected communities, and supporting numerous countries to achieve HIV epidemic control. The program distributes funding through public and private sector partnerships to reach the populations most vulnerable to HIV/AIDS epidemics. The University of Washington administers this grant for the state through its International Training and Education Center for Health (I-TECH). I-TECH is a center in the University?s Department of Global Health operated by more than 2,000 staff in offices located in Africa, Asia, the Caribbean, Eastern Europe and the United States. In fiscal year 2022, the University spent more than $66 million in federal program funds, about $44 million of which it passed through to subrecipients. Federal regulations require the University to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single or program-specific audit. For the Global AIDS program, the Centers for Disease Control and Prevention requires foreign subrecipients to submit their audits directly to the federal government and pass-through entity within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the University must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for a University-funded program, federal law requires the University to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the federal government. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Global AIDS program received required single or program-specific audits, and that it appropriately followed up on findings and issued management decisions. We found the University did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Management decisions were required to be issued for subrecipients who required a single or program-specific audit We used a nonstatistical sampling method to randomly select and examine seven out of a total population of 21 subrecipients. We found the University did not adequately monitor one subrecipient (14 percent) to ensure it received a required single or program-specific audit. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Staff in the University?s Office of Sponsored Programs (OSP) used a spreadsheet to track subrecipient certifications and responses, and reviewed annual certifications from the subrecipient to monitor its audit status. However, OSP did not correctly interpret the subrecipient?s response and, therefore, did not require it to provide documentation of a single or program-specific audit. Additionally, management did not review the subrecipient?s federal assistance expenditures to detect that it required an audit and, therefore, also failed to adequately follow up to ensure any reported findings were resolved with appropriate corrective action, if required. Effect of Condition Without establishing adequate internal controls, the University cannot ensure all subrecipients that required a single or program-specific audit received one. Furthermore, the University cannot ensure it is following up on subrecipient audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness where required, the University cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the University: ? Follow policies and procedures to ensure subrecipients receive required single or program-specific audits ? Establish and follow effective internal controls to ensure it reviews audit reports for its subrecipients and issues written management decisions, as required ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations ? Follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations ? Issue a written management decision for all applicable audit findings, if necessary University?s Response The University of Washington has established internal controls to carry out a risk assessment per Uniform Guidance, 2 CFR ? 200.332, Requirements for pass-through entities, and our UW Grants Information Memorandum (GIM) 8. This involves using various factors to assess risk. Part of our process to obtain the information needed from each subrecipient is through a certification process. The certification was obtained from the subrecipient, along with additional documentation from the subrecipient, such as an audited financial statement. We made a risk assessment using our standard risk criteria. We did misinterpret the response provided from the subrecipient regarding whether it expended $750,000 or more in federal awards during a fiscal year in order to obtain a single or program-specific audit from this subrecipient. While this was not obtained and reviewed, a risk assessment using our standard criteria was performed with the subrecipient rated as a medium risk, and subject to monitoring throughout the project, per GIM 8. The monitoring at the program level occurred during the period in question. We will be improving our required communications with subrecipients to have clear questions and responses regarding whether the subrecipient expended $750,000 or more in federal awards during the fiscal year in order to obtain a single or program-specific audit, follow up with the subrecipient to ensure the required audit reports are received and reviewed to determine if the subrecipient is required to take corrective action to address audit recommendations, and issue a written management decision for all applicable audit findings, if necessary. Auditor?s Remarks We thank the University for its cooperation and assistance during the audit. Whether the University performed a risk assessment for the subrecipient is not being questioned. The University did not adequately monitor the subrecipient to ensure it detected whether the subrecipient was required to receive a single audit, or program-specific audit in accordance with 2 CFR ?200.332(f). There is no other mechanism for the Federal government to monitor subrecipients of the University and, because a single audit of the subrecipient was not performed, neither the federal grantor nor the University had reasonable assurance of the subrecipient?s compliance with federal award requirements. We reaffirm our finding and will follow up on the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). The University of Washington?s Policies, Procedures and Guidance (UW Research), GIM 8 ? Subrecipient Monitoring, states in part: Background Additionally, per the Federal Uniform Guidance, UW must evaluate each subrecipients? risk of noncompliance with federal regulations, include specific terms and conditions in the subaward as necessary, and monitor the activities of the subrecipient through various mechanisms. These mechanisms include: Training and technical assistance to subrecipients, on-site reviews, review of audit results, increased reporting requirements and enforcement action, if necessary. University Policy UW reviews each subrecipient entity according to an entity level comprehensive risk assessment prior to the issuance of a subaward. This risk assessment includes an entity level review of their fiscal systems, past audit activity, and if required, financial statements of the entity as well as the project specific activity proposed and that the required compliance approvals are obtained. When necessary, UW imposes limitations and requirements on the subrecipient through subaward terms and conditions per Federal Uniform Guidance, Section 200.521, prior to the issuance or renewal of a subaward. UW?s subrecipient monitoring requirements are comprised, at a minimum, of the following: ? Completion of the UW?s entity level comprehensive risk assessment (Certs & Reps, Annual Audit Certification) Subrecipient Monitoring ? Entity Level Entity level monitoring consists of a combination of the following: ? Initial Subrecipient Certification Form completion and assurance by subrecipient?s authorized official ? Annual audit assurance through an annual audit certification form ? Maintenance of a subrecipient profile list, which includes information on the entity?s past audit information and certifications ? Risk assessment carried out at each annual renewal of a subaward

2022-031 The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable, met cost principles, and were within the period of performance for the Immunization Cooperative Agreements program. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268 COVID-19 Immunization Cooperative Agreements Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 5 NH23IP922619-03-00; 6 NH23IP922619-03-01; 6 NH23IP922619-03-02; 6 NH23IP922619-02-01; 6 NH23IP922619-02-02; 6 NH23IP922619-02-03; 6 NH23IP922619-02-04; 6 NH23IP922619-02-06 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: $4,287,159 Background The Department of Health administers the Immunization Cooperative Agreements program, which aims to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. Emphasis is placed on populations at highest risk for underimmunization and disease, including children eligible under the Vaccines for Children program. In fiscal year 2022, the Department spent more than $44.2 million in federal program funds, about $14.2 million of which it disbursed to subrecipients. The Department also received more than $94.5 million in non-cash assistance from the federal grantor in the form of vaccines. To help carry out the program?s objectives, the Department issues consolidated contracts to Local Health Jurisdictions that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate and high-risk subrecipients for each of the following expense categories: ? Salaries and benefits ? Equipment ($5,000 or more) ? Materials, supplies, and other ? Travel (in-state and out-of-state) ? Contracts and sub-subrecipients ? Administrative/indirect costs The Department?s Fiscal Monitoring Unit (FMU) also conducts fiscal reviews of each subrecipient to review source documentation to ensure payments are for allowable activities and within the period of performance. During the audit period, subrecipients submitted invoices to the Department?s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The emails were sent to Department program staff requesting review to ensure the payment was allowable and within the period of performance. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable, met cost principles, and were within the program?s period of performance. Department program staff used the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, were within the period of performance, and included required supporting documentation. However, program staff did not document their review or approval, so we were unable to determine if the proper reviews occurred. During the audit period, the FMU conducted a fiscal monitoring review for four subrecipients that received program funds. We reviewed the fiscal monitoring activity for all four subrecipients and determined none of the four reviews included a detailed transaction review of program payments to ensure they had adequate supporting documentation. We used a statistical sampling method to randomly select and review 55 out of 432 provider payments. Additionally, we judgmentally reviewed two individually significant payments that exceeded $1.2 million each. In total, we examined more than $9.3 million in provider payments as part of the audit. Of the 57 payments examined, we identified 27 payments that did not have the required supporting documentation for the subrecipients? assigned risk level. This included one of the individually significant payments. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department?s established procedures allowed for paying providers without ensuring program staff reviewed and determined the payment was allowable, within the grant?s period of performance, and adequately supported. Furthermore, program management did not ensure staff followed the existing review procedures. In addition, management had not established guidance for how many transactions a fiscal reviewer needed to review to source documentation in order to have assurance the program funds were spent in accordance with grant requirements. Management also did not ensure transactions selected for review by the FMU represented all subawards issued to the subrecipient. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes. By not ensuring subrecipients submitted required supporting documentation, staff could not adequately verify the reimbursement claims, and the Department could not ensure its subrecipients complied with the subaward?s terms and conditions. The 27 payments for which the Department did not have required supporting documentation from subrecipients totaled $4,287,159 in known questioned costs. Based on these results, we estimate that the total amount of likely improper payments using federal funds to be $5,503,611. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). To ensure a representative sample, we stratified the population by dollar amount. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Improve internal controls to ensure that it obtains adequate supporting documentation from subrecipients before reimbursing them ? Improve internal controls to ensure program staff review and approve expenditures to verify they are for allowable activities and within the period of performance prior to payment ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response We appreciate the State Auditor?s Office (SAO) audit of the Immunization Cooperative Agreement. The Department is committed to ensuring our programs comply with federal regulations and understand that it is SAO?s point of view that we did not have adequate controls over provider payments to ensure allowability in meeting cost principles and meeting period of performance. The Department partially agrees with SAO?s findings. The Department does agree and has already taken steps to improve internal controls over ensuring payments to providers contain support in line with our A-19 matrix and risk assessed of our subrecipients. Immunization staff who review invoices have been provided additional training and tracking sheets have been developed which enables staff to record details from backup documentation reviews. This ensures the proper level of review is completed and aligns with the agency?s A-19 documentation matrix. We will also be addressing the control weakness identified with the consolidated contract payment process and documenting our review and approval by program staff to ensure allowability and that funds were spent within the period of performance. It should be noted that the current process over provider payments at the Department of Health has been in place for well over a decade and has been through several annual audits by the State Auditor?s Office and separate federal reviews by our federal funders without issue. The defined process of consolidated contract payments was in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions (LHJs) for state and federal programs in order to serve the residents of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the LHJs. We would also note that for the exceptions identified with the Fiscal Monitoring Unit (FMU) visits, for all four reviews the totality of costs charged to Immunizations during the scope of those reviews were for staffing costs. FMU test staffing as a centralized function to determine if appropriate internal controls are being utilized to ensure costs are reasonable, necessary, allowable, and allocable. During review of these agencies, FMU did not find any instances of unallowable salary costs for time keeping samples that were tested. We would respectfully disagree with the number of exceptions and questioned costs identified. While the level of support did not meet our internal policies, which are held to a higher standard than federal requirements, the level of documentation received from the subrecipient accounting system gave us assurance that the transactions/costs questioned met federal cost principles for allowability and period of performance. This, along with the following additional overall internal monitoring and policy processes support our overall assurance of the allowability of payments: ? Program staff maintain detailed budget information for each subrecipient by project area, and as A-19s are submitted, program and accounting staff update budget spreadsheets. When reviewing the support provided by the subrecipient, they ensure amounts submitted by project are reasonable and are in alignment with expectations for the budget period submitted. ? The immunization program refers to the federal Immunization Program Operations Manual (IPOM) to determine allowable costs, purchase, and procurement procedures. This information is available to all subrecipients. ? FMU provides technical assistance and training, not only to program staff, but to the subrecipients while onsite and at the request of the entities receiving funding. ? Program staff provide technical assistance, policies, and training to Immunization subrecipients related to both allowability and compliance as it relates to programmatic processes. As a compensating control, each subrecipient of federal funds receive a monitoring visit from our Fiscal Monitoring Unit (FMU) once every two years. During the course of these visits monitoring staff perform walk-throughs and assessments of the internal controls surrounding the A19 payment process. They select the most recent three A19?s submitted for funding and review all charges to appropriate source documentation to ensure allowability using cost principles as a basis. Auditor?s Remarks Department management has implemented procedures to ensure adequate documentation is reviewed to support reimbursement requests from subrecipients receiving federal funds. Our testing was based on these documentation requirements, but we do not agree that these requirements are higher than the Uniform Guidance requires. We found that payments were made without the required level of support to ensure they were allowable and met cost principles. The Department asserts that the fiscal monitoring performed every two years compensates for the lack of adequate documentation. However, we found the fiscal monitoring transaction level review for payroll and vendor reimbursement requests did not include a review of any Immunization program payments and therefore gave no assurance that grant funds were spent on allowable activities and were adequately supported. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Title 2 CFR Part 200, Uniform Guidance, section 403, Factors affecting allowability of costs, describes the general criteria in order for a cost to be allowable under federal awards, including being adequately documented. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 11/30/20 This is the backup documentation required based on the determined risk level. Please ensure the detailed GL expenditure report clearly aligns with the A19 form. More supporting documentation may be requested by programs at any time due to programmatic requirements regardless of risk category. Expenditure Category Low-Risk Moderate-Risk High-Risk Salaries and Benefits A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked AND ? Time Sheets for all staff direct charging to the award Note: Salaries and benefits must be broken out as separate line items. Equipment ($5,000 or more) A-19 and a detailed GL expenditure report that provides vendor name and amount Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount AND ? Item Description Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount, item description AND ? Invoice ? Supporting documentation reflecting authorizing official?s approval. Materials, Supplies, and Other A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $1,000 Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $200. Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation Travel A-19 and a detailed GL expenditure report that provides: ? Employee name Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name AND ? Travel expense form* ? All itemized receipts * Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name ? Travel expense form* ? All itemized receipts AND Pre-approval required for any flights and overnight stays. *Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. Contracts and Sub-Subrecipients A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $1,000.00 A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $200.00. NOTE: Indirect costs included on A19s must include verification of the following: ? Indirect plan is current and on file with DOH ? Indirect rate is being applied accurately to allowable expenditures ? If the indirect cost rate plan has expired, no indirect costs can be charged

2022-032 The Department of Health did not have adequate internal controls to ensure it filed accurate and timely reports required by the Federal Funding Accountability and Transparency Act for the Immunization Cooperative Agreements program. Assistance Listing Number and Title: 93.268 Immunization Cooperative Agreements 93.268, COVID-19 Immunization Cooperative Agreements Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 5NH23IP922619-03-00; 6NH23IP922619-03-01; 6NH23IP922619-03-02; 6NH23IP922619-02-01; 6NH23IP922619-02-02; 6NH23IP922619-02-03; 6NH23IP922619-02-04; 6NH23IP922619-02-06 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Department of Health (Department) administers the Immunization Cooperative Agreements program. The objective of the program is to reduce and ultimately eliminate vaccine-preventable diseases by increasing and maintaining high immunization coverage. Emphasis is placed on populations at highest risk for underimmunization and disease, including children eligible under the Vaccines for Children (VFC) program. In fiscal year 2022, the Department spent more $44.2 million in federal program funds, approximately $14.2 million of which it disbursed to subrecipients. The Department also received more than $94.5 million in non-cash assistance from the federal grantor in the form of vaccines. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $25,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). For federal awards issued on or after November 12, 2020, the monetary threshold for reporting increased to $30,000. The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower citizens with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure it filed accurate and timely reports required by the Act. During the audit period, the Department reported approximately $45 million of program funds that it awarded to 65 subrecipients. The Department?s process for filing FFATA reports started with a fiscal analyst maintaining a spreadsheet throughout the month with the subaward information required for reporting. The fiscal analyst prepared and submitted the report each following month, and then emailed management to notify them the report was submitted. However, neither Department staff or management reviewed the reports for accuracy and completeness. We consider this internal control deficiency to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The Department does not require a review of FFATA reports before or after submitting them. Department officials said the purpose of the monthly email from the fiscal analyst is to inform management when a report has been finalized and uploaded, and it is not a request for managerial review. Effect of Condition Without requiring a review of the reports, management cannot ensure the Department is submitting accurate, complete and timely reports. To test for compliance with the Act, we randomly selected 12 of the 65 subawards obligated during state fiscal year 2022. We found the following: ? Eleven (92 percent) of the 12 subawards incorrectly reported the subaward obligation date. ? One (8 percent) of the 12 subawards was not reported timely. Failing to submit complete, accurate and timely reports diminishes the federal government?s ability to ensure accountability and transparency of federal spending. The terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance by suspending or terminating the federal award, or withholding future awards. Recommendation We recommend the Department establish and follow effective internal controls, including a review, to ensure FFATA reports are accurate and complete before submitting them. Department?s Response We appreciate the State Auditor?s Office audit of the immunization grant. DOH is committed to ensuring our programs comply with federal regulations. We understand that it is SAO?s point of view that we are not in compliance with FFATA reporting requirements. We will review our processes and determine when a review is most effective to ensure accuracy and completeness of FFATA submissions. Management has already addressed the obligation dates to ensure we?re reporting the execution date of the award or amendment. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 U.S. Code of Federal Regulations (CFR) Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 ? Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) 3. What to report. You must report the information about each obligating action that the submission instructions posted at http:www.fsrs.gov specify.

2022-033 The Department of Health did not have adequate internal controls over and did not comply with fiscal monitoring requirements to ensure subrecipients of the Epidemiology and Laboratory Capacity for Infectious Diseases program only used funds for allowable activities and met cost principles. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: NU50CK000515-01-00; NU50CK000515-01-06; NU50CK000515-01-07; NU50CK000515-01-08; NU50CK000515-01-09; NU50CK000515-02-00; NU50CK000515-02-01; NU50CK000515-02-03; NU50CK000515-02-04; NU50CK000515-02-06; NU50CK000515-02-07; NU50CK000515-02-09; NU50CK000515-03-00; NU50CK000515-03-01; NU50CK000515-03-03 Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Subrecipient Monitoring Known Questioned Cost Amount: $1,644,873 Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local, and territories? public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction, and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory, and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports several specific infectious disease programs and projects and provides special appropriations in response to infectious disease emergencies. The Department spent almost $330 million in federal grant funds in fiscal year 2022, about $103 million of which it disbursed to subrecipients. To help carry out the program?s objectives, the Department issues consolidated contracts to Local Health Jurisdictions that are classified as subrecipients. A consolidated contract is for one subrecipient that combines funding for multiple federal programs. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria, and it maintains a matrix that specifies the documentation that subrecipients at each risk level are required to submit with every reimbursement. There are varying requirements among low, moderate and high-risk subrecipients for each of the following expense categories: ? Salaries and benefits ? Equipment ($5,000 or more) ? Materials, supplies, and other ? Travel (in-state and out-of-state) ? Contracts and sub-subrecipients ? Administrative/indirect costs The Department?s Fiscal Monitoring Unit (FMU) also conducts fiscal reviews of each subrecipient every two years to review source documentation to ensure payments are for allowable activities. A fiscal reviewer completes a standardized template to document what federal programs and reimbursement payment samples are reviewed. The fiscal reviewer judgmentally determines how many samples to test. During the audit period, subrecipients submitted invoices to the Department?s accounting unit where staff, on a weekly basis, compiled a list of all consolidated contract invoices into one email. The emails were sent to Department program staff requesting review to ensure the payment was allowable. The emails consisted of 30 to 50 invoice requests with hundreds of pages of supporting documentation. Each invoice listed in the email would be considered approved if program staff did not respond. To address concerns about an invoice, program staff were required to email the accounting unit within 10 business days to withhold payment until the items in question were resolved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable and met cost principles. Department program staff were required to use the documentation matrix when reviewing subrecipient payments to ensure they were for allowable activities, met cost principles, and included required supporting documentation. However, program staff did not document their review or approval to the accounting unit that issues payment, so we were unable to determine if the proper reviews occurred. We used a statistical sampling method to randomly select and review 57 out of 880 provider payments. Additionally, we judgmentally reviewed three individually significant payments that exceeded $5.5 million each. In total, we examined more than $75.4 million in provider payments as part of the audit. Of the 57 randomly selected payments examined, we identified four payments (7 percent) that did not have the required supporting documentation for the subrecipients? assigned risk level. For fiscal monitoring, we used a nonstatistical sampling method to randomly select and examine five out of a total of eight subrecipients that received a review during the audit period. We found that none of the detailed transactions reviewed were noted as being for the ELC program. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department?s established procedures allowed for paying providers without ensuring program staff reviewed and determined the payment was allowable and adequately supported. Furthermore, program management did not ensure staff followed the existing review procedures. In addition, management had not established guidance for how many transactions a fiscal reviewer needed to review to source documentation in order to have assurance the program funds were spent in accordance with grant requirements. Management also decided that all pandemic-related programs would be documented as ?COVID? on the detailed testing section of the standardized template. Therefore, it was not possible to determine if any ELC transactions were reviewed. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes. By not ensuring subrecipients submitted required supporting documentation, staff could not adequately verify the reimbursement claims, and the Department could not ensure its subrecipients complied with the subaward?s terms and conditions. Allowing staff to select samples without adequate guidance from management does not provide the Department with reasonable assurance that subrecipients spent program funds in accordance with grant requirements and federal regulations. Additionally, because the reviewers do not document which specific pandemic-related federal program is being covered in the transaction-level testing, management cannot perform sufficient oversight to ensure the Department has met federal requirements. The four payments for which the Department did not have required supporting documentation from subrecipients totaled $1,644,873 in known questioned costs. Based on these results, we estimate that the total amount of likely improper payments using federal funds to be $2,905,694. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). To ensure a representative sample, we stratified the population by dollar amount (if applicable). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Improve internal controls to ensure that it obtains adequate supporting documentation from subrecipients before reimbursing them ? Improve internal controls to ensure program staff review and approve expenditures to verify they are for allowable activities prior to payment ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response We appreciate the State Auditor?s Office (SAO) audit of the Epidemiology and Laboratory Capacity (ELC) for Infectious Diseases program. The Department of Health (DOH) is committed to ensuring our programs comply with federal regulations and would like to thank SAO for their work over the activities allowed and subrecipient monitoring requirements on the audit. The Department partially agrees with the finding. DOH would like to note that during the timeframe of this audit the Department and ELC program was in full COVID pandemic response mode. DOH was the leading agency charged with implementing a statewide response to an unprecedented pandemic. During this audit period, DOH?s ELC Grants, and fiscal teams managed 27 newly awarded ELC grants totaling close to one billion dollars, which included applications, planning, restructuring, and monitoring. There were many emergency declarations that were also in place as well, creating new processes that staff were not familiar with, which created an environment where many of the normal day-to-day operations were pushed to their limits as well as the staff performing them. The COVID pandemic has shown us where we may have gaps in our processes, and we are diligently working to not only fill those gaps but to be better prepared for the next emergency response. The Department does agree and is taking steps to improve internal controls over ensuring payments to providers contain support in line with our A19 matrix and risk assessed of our subrecipients. ELC staff who review invoices will be provided additional training and tracking sheets have been developed which enables staff to record details from backup documentation reviews. This ensures the proper level of review is completed and aligns with the agency?s A-19 documentation matrix. Moving forward we?ve updated our A19 matrix to be more in line with federal guidance and the identified risk levels. The Department partially agrees with SAO?s assessment of a material weakness in internal controls over Subrecipient Monitoring. DOH agrees that the detailed transactions reviewed identified as being for ?COVID? should have been specified to the specific revenue source and will do so in future monitoring visits. However, the Department would disagree that this is a material weakness over the subrecipient monitoring process. While the specific revenue source was not identified in testing allowability, monitoring staff document key control systems such as payroll and disbursements when conducting a fiscal monitoring site visit. When testing, this ensures those controls are operating effectively and provide assurance that amounts reported for reimbursement are allowable and accurate. Thus, not all transactions for that period may be tested. The Department respectfully disagrees with SAO?s assessment of a material weakness in internal controls over the consolidated contract provider payment process to ensure allowability in meeting cost principles with our ELC program. When accounting staff send the A19 consolidated contract invoices to the applicable programs ELC program staff review invoice support for allowability and period of performance and keep a spreadsheet with a breakdown of the total payment requested for ELC. If the payment has no issues or concerns, the total payment is logged in the spreadsheet and staff save the spreadsheet to denote no issues and evidence of review and that full payment can be made. If there is a question on allowable cost, period of performance, a need for additional backup documentation or an error, program ELC staff will update spreadsheet with the amounts in question and communicate with the Local Health Jurisdiction, document the correspondence, and contact the accounting consolidated contract payment desk to withhold the specific amount of payment until the issue is resolved. Once resolved staff update the spreadsheet to denote the issue has been resolved and email accounting to release the payment amount in question. It should be noted that the current process over provider payments at the Department of Health has been in place for well over a decade and has been through several annual audits by the State Auditor?s Office and separate federal reviews by our federal funders without issue. The defined process of consolidated contract payments was in response to issues arising with timely payment of funds to our local government partners. The consolidated contracts are an essential tool in providing such funding on a large scale. This process balances many needs in tracking payments, providing documentation to the programs for review as well as allowing for timely distribution of funding to the local health jurisdictions (LHJs) for state and federal programs in order to serve the residents of the State of Washington. It also simplifies the invoicing and payment process as well as reconciliation between DOH and the LHJs. We would also respectfully disagree with the number of exceptions and questioned costs identified. While the level of support did not meet our internal policies, which are held to a higher standard than federal requirements, the level of documentation received from the subrecipient accounting system gave us assurance that the transactions/costs questioned met federal cost principles for allowability and period of performance. This, along with the following additional overall internal monitoring and policy processes support our overall assurance of the allowability of payments: ? Detailed ELC budgets were originally submitted by the subrecipient, reviewed and approved by Program staff so that they can ensure costs will be reasonable and are in alignment with expectations for the budget period submitted over time. No payment is made to an entity without that approved budget. ? The ELC program has allowable cost guidance documents that are provided to the subrecipients initially, on their SOWs, and after any changes. ? The ELC program/contract managers meet with subrecipients routinely (monthly or bi-monthly) to monitor progress of the work, resources, capacity, and budget management are discussed as well. ? Program staff provide technical assistance and policies to subrecipients related to both allowability and compliance as it relates to programmatic processes. Auditor?s Remarks Department management has implemented procedures to ensure adequate documentation is reviewed to support reimbursement requests from subrecipients receiving federal funds. Our testing was based on these documentation requirements, but we do not agree that these requirements are higher than the Uniform Guidance requires. We found that payments were made without the required level of support to ensure they were allowable and met cost principles. The Department asserts that the fiscal monitoring performed every two years compensates for the lack of adequate documentation. However, we found the fiscal monitoring transaction level review for payroll and vendor reimbursement requests did not specifically include a review of any ELC payments and therefore gave no assurance that grant funds were spent on allowable activities and were adequately supported. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Washington State Department of Health A-19 Documentation Matrix Approved by FMU 11/30/20 This is the backup documentation required based on the determined risk level. Please ensure the detailed GL expenditure report clearly aligns with the A19 form. More supporting documentation may be requested by programs at any time due to programmatic requirements regardless of risk category. Expenditure Category Low-Risk Moderate-Risk High-Risk Salaries and Benefits A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked Note: Salaries and benefits must be broken out as separate line items. A-19 and a detailed GL expenditure report for all employees who are charged to the grant for the period with the following information: ? Salaries & Wages ? Employee name ? Employee rates of pay ? Hours worked AND ? Time Sheets for all staff direct charging to the award Note: Salaries and benefits must be broken out as separate line items. Equipment ($5,000 or more) A-19 and a detailed GL expenditure report that provides vendor name and amount Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount AND ? Item Description Note: Pre-approval documentation must be provided A-19 and a detailed GL expenditure report that provides vendor name, amount, item description AND ? Invoice ? Supporting documentation reflecting authorizing official?s approval. Materials, Supplies, and Other A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and a detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $1,000 Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation. A-19 and detailed GL expenditure report that provides: ? Vendor Name ? Item description ? Cost of item AND Invoices for transactions over $200. Note: If the entity has a petty cash fund, they must supply 100% of the supporting documentation Travel A-19 and a detailed GL expenditure report that provides: ? Employee name Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name AND ? Travel expense form* ? All itemized receipts * Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. A-19 and a detailed GL expenditure report that provides: ? Employee name ? Travel expense form* ? All itemized receipts AND Pre-approval required for any flights and overnight stays. *Travel expense form should include employee signature, supervisor approval and purpose. Note: Pre-approval documentation from DOH for any out of state travel must be provided. Contracts and Sub-Subrecipients A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $1,000.00 A-19 and a detailed GL expenditure report that provides: ? Contractor/ Subrecipient Name AND ? Invoices for individual transactions over $200.00. NOTE: Indirect costs included on A19s must include verification of the following: ? Indirect plan is current and on file with DOH ? Indirect rate is being applied accurately to allowable expenditures ? If the indirect cost rate plan has expired, no indirect costs can be charged

2022-034 The Department of Health did not have adequate internal controls over and did not comply with reporting requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Assistance Listing Number and Title: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases 93.323 COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: NU50CK000515-01-08; NU50CK000515-02-04; NU50CK000515-02-07 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Department of Health administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The goal of the program is to support state, local, and territories? public health efforts to reduce morbidity and associated deaths caused by a wide range of infectious disease threats. ELC provides annual funding, strategic direction, and technical assistance to domestic jurisdictions for strengthening core capacities in epidemiology, laboratory, and health information systems activities. In addition to strengthening core infectious disease capacities nationwide, the program also supports a myriad of specific infectious disease programs and projects and provides special appropriations in response to infectious disease emergencies. The Department spent almost $330 million in federal grant funds during fiscal year 2022. During the audit period, the Department was required to submit reports for the ELC projects Enhancing Detection, Enhancing Detection Expansion, and Reopening Schools. These projects are required to submit various reports to the Centers for Disease Control and Prevention (CDC). Fiscal Reporting For all three projects, the Department submits monthly fiscal reports in REDCap, a web-based system used by the CDC to collect data. This report summarizes the total monthly expenses, including salaries, fringe benefits, equipment, travel, supplies, and contractual payments. Testing Reporting This report is utilized by the Reopening Schools project to collect data on the use of polymerase chain reaction, antigen, and over-the-counter COVID tests at schools. The Department collects the information for each type of test and submits the data utilizing the CDC report template. Case Investigation and Contact Tracing (CICT) For the Enhancing Detection and Enhancing Detection Expansion projects, the Department is required to submit monthly reports covering various attributes related to the number of COVID cases reported and investigated. When a COVID case is identified in the Washington Disease Reporting System, it is entered into the Case Risk and Exposure Surveillance Tool (CREST). Epidemiologists at the Department follow contact tracing protocols and enter the results of their investigations into CREST. The data is then reported in REDCap. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements for the ELC program. During the audit period, for all three reports, Department program staff asserted that all reports were reviewed and approved by appropriate staff before submission to the federal government. However, program staff did not document their review or approval, so we were unable to determine if the proper reviews occurred. For the CICT reports, we used a non-statistical sampling method to randomly select and review five out of twelve monthly reports. We identified two months (40 percent) where the data reported in CREST did not match what was reported in REDCap. The variance between the CREST and REDCap reports ranged from 312 percent underreported to 98 percent overreported. For one month, 16 of the 19 (84 percent) fields were incorrect. For the second month, 14 of the 19 (74 percent) fields were incorrect. The Department identified the errors in March 2022, seven months after the first inaccurate report was submitted. At that time, the Department tried to have the report updated in REDCap, but the system would not allow the edits due to the length of time between the report filing date and the detection of the errors. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department did not require management to document their reviews of reports before or after submission. If reviews of the CICT reports were performed, they were not adequate to detect the identified errors. Effect of Condition By not establishing adequate internal controls to ensure reports are complete and accurate, the Department reported incorrect data to the CDC. Recommendation We recommend the Department establish and follow effective internal controls, including a documented review, to ensure reports are accurate and complete before submitting them to the federal grantor. Department?s Response We appreciate the State Auditor?s Office (SAO) audit of the Epidemiology and Laboratory Capacity (ELC) for Infectious Diseases program. The Department of Health (DOH) is committed to ensuring our programs comply with federal regulations and would like to thank SAO for their work over ELC reporting requirements on the audit. The Department partially agrees with the finding given the following clarifications. DOH would like to note that during the timeframe of this audit the Department and ELC program was in full COVID pandemic response mode. DOH was the leading agency charged with implementing a statewide response to an unprecedented pandemic. During this audit period, DOH?s ELC Grants, and fiscal teams managed 27 newly awarded ELC grants totaling close to one billion dollars, which included applications, planning, restructuring, and monitoring. There were many emergency declarations that were also in place as well creating new processes that staff were not familiar with, which created an environment where many of the normal day-to-day operations were pushed to their limits as well as the staff performing them. The COVID pandemic has shown us where we may have gaps in our processes, and we are diligently working to not only fill those gaps but to be better prepared for the next emergency response. DOH does agree that there needs to be evidence of review of the reports documented and saved in a central location. During the audit period there was turnover in key positions involved in the report review process. Documented reviews and approvals were conducted as evidenced in the signed attestations by applicable remaining staff involved, however we were unable to locate the approval emails from staff that had left the agency, thus we will ensure in the future that documentation is saved in a central location accessible by program leadership. The Department also acknowledges that through effective internal controls a review process of submitted data ensures accurate reporting to the CDC. However, we disagree that evidence of such a review would have changed the SAO findings, as the data entry was correct at the time of submission. The ELC program did, in fact, catch the errors that were originally submitted and notified the CDC within the reporting period (February 2022). Due to a technical issue, the federal REDCap information system would not allow ELC Grant program staff to directly update the months of July through October (2021). After discussion with our CDC partners initiated by DOH, program staff were advised to email the corrected data which was accepted by the CDC and the issue was resolved. DOH asserts internal controls were in place as stated in multiple attestations by program staff. However, the Department recognizes that controls in place need to detect errors more timely. In closing DOH would like to thank SAO for their work in this area and the Department will continue to ensure we have adequate controls over reporting for our ELC program in the future. Auditor?s Remarks The Department asserts that a more thorough review would not have detected that the two reports were inaccurate because the data was correct at the time of submission. While the amounts reported matched the supporting documentation used when filing the report, the data used was not complete. In our judgement, a thorough review by a knowledgeable person should have detected that incomplete data was being used to compile the report. Additionally, while the Department emailed the CDC with the correct reporting information, the Department did not receive confirmation from the CDC stating the reports had been updated and at the time of testing the reports were still inaccurate in RedCap. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2022-035 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with Temporary Assistance for Needy Families funds were allowable and properly supported. Assistance Listing Number and Title: 93.558 Temporary Assistance for Needy Families Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2101WATANF; 2201WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Known Questioned Cost Amount: $67,699,429 Background The Department of Social and Health Services (DSHS), Community Services Office, administers the Temporary Assistance for Needy Families (TANF) grant that provides temporary cash assistance for families in need. To receive TANF benefits, participants must be engaged in activities listed in the Individual Responsibility Plan through the WorkFirst program, unless the TANF benefits are received only on behalf of a child. TANF grant funds are also used to pay clients? child care costs to meet one of the program?s primary purposes of helping clients obtain employment. Washington has established the Working Connections Child Care (WCCC) program to help eligible working families pay for child care. Both the Department of Children, Youth, and Families (Department) and DSHS administer the program. The Department is responsible for establishing policies and procedures for licensing child care providers and paying them for allowable child care services. DSHS determines TANF client eligibility and reimburses the Department for child care payments under an agreement between the two agencies. The Department uses its Social Service Payment System (SSPS) to process the payments it makes to child care providers. The system allocates payments to various funding sources, based on the eligibility of the client. These funding sources include multiple federal programs, multiple Child Care Development Fund (CCDF) federal grant awards, and state funding. The Department uploads the payment data into the state?s accounting system at a summary level based on the various funding sources. DSHS worked with the Department to setup coding in the Payment Allocating Model (PAM) system that looks at the client-level information and then assigns the correct TANF source of funds. Once source of funds is identified, that information is then sent to SSPS for allocation assignment. The Department prepares electronic reports for funds allocated to TANF funding sources and sends DSHS a monthly bill. There is always a need to transfer the funding sources for some payments throughout the year to manage federal and state funds properly. Prior to state fiscal year 2021, the Department prepared supporting documentation for transfers that included details of what payments it was transferring. The purpose of documenting this detail was to maintain proper support for federal expenditures. Some payments the Department makes for child care are funded by both the CCDF and TANF grants. While the two federal programs are separate, the requirements and policies in Washington for child care payments are consolidated under the WCCC program. Federal regulations require grant fund expenditures to be adequately supported to show that they have been used in accordance with program requirements. In fiscal year 2022, DSHS incurred $67,699,429 in child care service-related expenditures. Federal regulations require recipients to establish and follow internal controls that ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with TANF funds were allowable and properly supported. The prior finding number was 2021-028. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with TANF funds were allowable and properly supported. In order to identify TANF-funded payments the Department made to child care providers, we requested a population of payments charged to TANF sources from SSPS. However, during the fiscal year 2021 audit, management informed us the Department had changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditure coding in SSPS inaccurate and unreliable for testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent TANF funds in accordance with federal and state regulations. As a result, we could not test the Department?s payments to child care providers for compliance with activities allowed and cost principles. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. Management decided to modify the Department?s accounting practices in a way that now prevents it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions from SSPS that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. Officials from the U.S. Department of Health and Human Services informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition and Questioned Costs By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit the federal dollars it used for payments to child care providers. Because we could not test transaction-level detail, we also could not determine whether the issues we identified in prior audits had improved or worsened, including the Department?s lack of adequate internal controls and significant rate of noncompliance for payments to child care providers. Because the Department did not comply with federal requirements to allow for the tracing of grant expenditures to a payment level, we are questioning all $67,699,429 in federal program costs for child care payments that DSHS incurred during the audit period. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules ? Update service level agreements with DSHS to ensure payments are sufficient and properly supported ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response The Working Connections Child Care (WCCC) program was previously managed by the Department of Social and Health Services (DSHS) and the Department of Early Learning. Since the program transitioned in 2019, the Department has been making efforts to strengthen internal controls over payments to child care providers and other grant requirements. The Department implemented grant-level management of all federal funds, including the TANF grant. The Department allocated the TANF grant to eligible clients and allowable activities in compliance with 45 CFR 98.67. For the fiscal year 2021 program audit, the State Auditor?s Office (SAO) issued a finding with $32 questioned costs for non-compliance with the CCDF eligibility requirement. No other findings, management letters, or exit items were reported in this compliance area or the cost allocation of funds based on eligibility for the CCDF or TANF grants. Given that eligibility or cost allocation has not been an area of concern, and transfers were processed between TANF and CCDF source of funds with the same eligibility criteria, the Department is assured that TANF funding was spent appropriately within federal regulations. In the Cause of Condition, the SAO stated, ?HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant.? The Department does not agree with this interpretation of the meeting outcome. During this informal meeting, on February 23, 2022, the State Auditor?s Office, Office of Financial Management, and the Department met with HHS and they stated they would not offer an opinion until they received the completed finding from the state. As part of the audit resolution process, HHS Administration for Children and Families?, which oversees the TANF and CCDF programs at the federal level, reviews all SAO findings and issues management decision letters. The letters will reflect the grantor?s determination of whether an audit finding is sustained, the reasons for the decision, and the required actions by the auditee. When a management decision is issued for the fiscal year 2022 finding, the Department will work with HHS and follow the audit resolution process. The Department is committed to improving internal controls. The Department does not currently have the resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance recommended by SAO. In response to prior year?s audit recommendations, the Department has submitted a budget request to the Legislature in the 2023-2025 biennial budget for additional resources to process adjustments to include transaction-level data. Auditor?s Remarks The level of assurance needed to support grant expenditures is not established by our Office, but in titles 2 and 45 of the Code of Federal Regulations and the State?s grant award. We appreciate the Department?s commitment to resolving these matters and will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200.1, Uniform Guidance establishes definitions for improper payments. Part 200.53 defines improper payments. Part 200.403 establishes factors affecting allowability of costs. Part 200.410 establishes requirements for the collection of unallowable costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2022-036 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with client eligibility requirements for child care services paid with the Child Care and Development Fund and Temporary Assistance for Needy Families funds. Assistance Listing Number and Title: 93.558, Temporary Assistance for Needy Families 93.575, Child Care and Development Block Grant 93.575, COVID-19 Child Care and Development Block Grant 93.596, Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2003WACCDF; 2103WACCDF; 2203WACCDF; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2103WACCDD; 2203WACCDD; 2101WATANF; 2201WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: Temporary Assistance for Needy Families ? $5,689 Child Care and Development Fund ? $5,078 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2022, the Department spent $668.6 million in CCDF federal funding. The Department of Social and Health Services (DSHS) administers the Temporary Assistance for Needy Families (TANF) grant. To meet one of the program?s primary purposes of helping clients obtain employment, TANF grant funds may be used to pay clients? child care costs. If a client obtains employment and is no longer eligible for the program, TANF funds may still be used to pay child care costs to help the client maintain employment. In fiscal year 2022, the Department spent more than $260.5 million in CCDF and $67.7 million in TANF federal grant funds on child care subsidy payments to providers. Some payments made for child care are paid for by both the CCDF and TANF grants. While the two federal programs are separate, the requirements and policies in Washington for child care payments are consolidated under the Working Connections Child Care program. As of July 1, 2019, the responsibility for making and documenting child care eligibility determinations under the CCDF and TANF grants was transferred from DSHS to the Department. For a family to be eligible for child care assistance, state and federal rules require that at the time of application or reapplication, children must: ? Reside in Washington and be a citizen or legal resident of the United States; ? Be younger than 13 years, or if for verified special needs, be younger than 19 years; ? Reside with a parent(s) or guardian whose countable income does not exceed 200 percent of the federal poverty level at application or 220 percent at reapplication for July, August and September 2021 but in October 2021 changed to 60 percent of the state median income at application or 65 percent of the state median income at reapplication; ? Reside with a parent(s) or guardian who works or attends a job-training or education program, or needs to be receiving protective services. State rules describe the information clients must provide to the Department to verify their eligibility. The information must be accurate, complete, consistent and from a reliable source. This information includes, but is not limited to, employer and hourly wage information, proof of an approved activity under TANF, and family household size and composition. Once determined to be eligible for the program, a client is eligible for one year unless a change in income causes the client to exceed 85 percent of the state?s median income The Department requires that clients self-report such income changes. A written notice communicates the recipients? reporting requirement and the specific dollar threshold applicable to the household?s annual income. Once the client?s income exceeds this cutoff level, the Department terminates services. The Department has access to systems that contain wage and household benefit and composition data for some, but not all, child care recipients. The Department uses this information in part to determine program eligibility, benefit level, including client copayment, and the amount of child care the family is eligible to receive. If an ineligible client receives assistance, the payment made to the child care provider is not allowable and the client must repay the ineligible amount. The Department also uses household income to determine the amount families must contribute for their monthly copay to providers. Beginning July 1, 2021, monthly copayments were calculated using an updated schedule described in Washington Administrative Code 110-15-0075. Federal regulations require the Department to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the past 10 audits, we reported findings related to eligibility for the Working Connections Child Care program. In these prior audits, we reported the Department did not have adequate internal controls over the eligibility process for child care subsidy recipients. These were reported as finding numbers 2021-035, 2020-039, 2019-032, 2018-030, 2017-026, 2016-023, 2015-026, 2014-026, 2013-017 and 2012-30. Description of Condition The Department did not have adequate internal controls over and did not comply with client eligibility requirements for CCDF and TANF. During the audit period the Department determined 69,815 children were eligible for child care. We used a statistical sampling method to randomly select and examine 59 of these determinations. In four instances (6.8 percent), we found the Department made eligibility determinations improperly, did not obtain required documentation, incorrectly assessed copayment, or did not verify information before authorizing services. Specifically, we found: ? Two cases (3.4 percent) where the Department had incorrectly determined household composition and did not obtain sufficient data for all parents in the household to make an accurate eligibility determination. ? One case (1.7 percent) where the Department did not follow procedure for verifying employment, which led to an incorrect household income calculation. ? One case (1.7 percent) where the copay was incorrectly assessed, which resulted in an underpayment due to a system error. Though the Department has established internal controls, they were insufficient for ensuring material compliance with client eligibility requirements. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Department staff made eligibility determinations without obtaining sufficient supporting documentation to ensure households were eligible to receive assistance. This deviated from the standard policies and procedures the Department has established, and management did not monitor sufficiently to ensure staff made proper eligibility determinations. Further, the incorrect copay calculation was due to system error. Effect of Condition and Questioned Costs By not implementing adequate internal controls, the Department is at higher risk of paying providers for child care services when clients are ineligible. Of the four client eligibility determinations that had errors, three resulted in $10,767 of federal overpayments to providers. The Department used $5,078 in CCDF grant funds and $5,689 in TANF grant funds for these payments. Because we used a statistical sampling method to randomly select the payments examined in the audit, we estimate the amount of likely improper payments to be $6,008,693 for the CCDF grant and $6,731,953 for the TANF grant. Although we identified known and likely questioned costs, we do not have reasonable assurance that the payments in question are appropriately represented in the Department?s accounting records because of the grant management practice issue reported in findings 2022-035 and 2022-041. Additionally, the payments in question are duplicative of the costs already questioned in the aforementioned provider payment findings. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department improve its internal controls over determining client eligibility to ensure it: ? Reviews eligibility determinations sufficiently to detect improper eligibility determinations ? Reviews sufficient support for clients? income and household composition information for accuracy We also recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department`s Response The Department appreciates, acknowledges, and supports SAO?s mission, which is to hold state and local government accountable for the use of public resources. Further, we appreciate SAO?s work with us over the past year to strengthen the auditing process. Due to recent changes to CCSP directed by the Legislature, the Department anticipates continued reduction in eligibility determination errors. The Fair Start for Kids Act (FSKA) required the Department to make several changes that expanded eligibility during SFY 2022. The FSKA increased the State Median Income (SMI) threshold, allowing more two parent households to be eligible for child care subsidy. The FSKA also capped copayments to $115 for applicants and $215 for reapplicants, greatly reducing the copay amounts for typical two parent households. These changes are disincentives for fraud as struggling families receive needed benefits and are more likely to provide accurate and complete information. This is supported by the overall reduction in investigation requests submitted to the Office of Fraud and Accountability. In the federal fiscal year prior to the implementation of the FSKA, the Department submitted 1,405 requests for investigations. The year following FSKA implementation requests for investigations fell to 912. The Department continues to explore ways to remove the possibility for improper use of CCDF funds. The Department agrees with the SAO that there is a need to review household composition at application and reapplication to improve reliability of eligibility decisions. The Department accesses data across available state systems to confirm information, including household composition provided by clients. Unfortunately, there is no household composition verification system, and information provided to other state agencies is often provided by client self-attestation. The Department continues to balance verification requirements with providing timely benefit decisions to support family access to high quality child care. Eighty-six percent of households receiving child care subsidies are headed by single parents. Supporting these families with child care is essential for their continued participation in work, education, and other social service programs. The Department provides training for eligibility in the specific areas of household composition and income determination and improvements to training are ongoing. The Department recently made changes to the professional development and training process to improve staff skills and accuracy. Staff training is in a continuous improvement cycle and evolves with staff needs and changes in rule. The Department will continue to improve processes and internal controls and create and deliver staff training based on current data trends and patterns. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Washington Administrative Code (WAC) 110-15-0015 ? Determining family size, states in part: (1) DCYF determines a consumer?s family size as follows: (a) For a single parent, including a minor parent living independently, DCYF counts the consumer and the consumer?s children; (b) For unmarried parents who have at least one mutual child, DCYF counts both parents and all of their children living in the household; (c) Unmarried parents who have no mutual children are counted as separate WCCC households, the unmarried parents and their respective children living in the household; (d) For married parents, DCYF counts both parents and all of their children living in the household; (e) For parents who are undocumented aliens as defined in WAC 388-424-0001, DCYF counts the parents and children, documented and undocumented, and all other family rules in this section apply. Children needing care must meet citizenship requirements described in WAC 110-15-0005; (f) For a legal guardian verified by a legal or court document, adult sibling or step-sibling, nephew, niece, aunt, uncle, grandparent, any of these relatives with the prefix ?great,? such as a ?great-nephew,? or an in loco parentis custodian who is not related to the child as described in WAC 110-15-0005, DCYF counts only the children and only the children?s income is counted; (g) For a parent who is out of the household because of employer requirements, such as training or military service, and expected to return to the household, DCYF counts the consumer, the absent parent, and the children; (h) For a parent who is voluntarily out of the household for reasons other than requirements of the employer, such as unapproved schooling and visiting family members, and is expected to return to the household, DCYF counts the consumer, the absent parent, and the children. WAC 110-15-0020 and all other family and household rules in this section apply; (i) For a parent who is out of the country and waiting for legal reentry in to the United States, DCYF counts only the consumer and children residing in the United States and all other family and household rules in this section apply; (j) An incarcerated parent is not part of the household count for determining income and eligibility. DCYF counts the remaining household members using all other family rules in this section; and (k) For a parent incarcerated at a Washington state correctional facility whose child lives with them at the facility, DCYF counts the parent and child as their own household. (2) When the household consists of the consumer?s own child and another child identified in subsection (1)(f) of this section, the household may be combined into one household or kept as distinct households for the benefit of the consumer. WAC 110-15-0065 ? Calculation of income, states in part: DSHS uses a consumer?s countable income when determining income eligibility and copayment. A consumer?s countable income is the sum of all income listed in WAC 110-15-0060 minus any child support paid out through a court order, division of child support administrative order, or tribal government order. (1) To determine a consumer?s income, DSHS either: (a) Calculates an average monthly income by: (i) Determining the number of months, weeks or pay periods it took the consumer?s WCCC household to earn the income; and dividing the income by the same number of months, weeks or pay periods. (ii) If the past wages are no longer reflective of the current income, DSHS may accept the employer?s statement of current, anticipated wages for future income determination. (b) When the consumer begins new employment and has less than three months of wages, DSHS uses the best available estimate of the consumer?s WCCC household?s current income: (i) As verified by the consumer?s employer; or (ii) As provided by the consumer through a verbal or written statement documenting the new employment at the time of application, reapplication or change reporting, and wage verification within sixty days of DSHS request. (2) If a consumer receives a lump sum payment (such as money from the sale of property or back child support payment) in the month of application or during the consumer?s WCCC eligibility: (a) DSHS calculates a monthly amount by dividing the lump sum payment by twelve; (b) DSHS adds the monthly amount to the consumer?s expected average monthly income: (i) For the month it was received; and (ii) For the remaining months of the current eligibility period; and (c) To remain eligible for WCCC the consumer must meet WCCC income guidelines after the lump sum payment is applied. WAC 110-15-0075 ? Determining income eligibility and copayment amounts, states (effective prior to October 1, 2021): (1) DCYF takes the following steps to determine a consumer?s eligibility and copayment, whether care is provided under a WCCC voucher or contract: (a) Determine the consumer?s family size (under WAC 110-15-0015); (b) Determine the consumer?s countable income (under WAC 110-15-0065). (2) DCYF calculates the consumer?s copayment as follows: If a consumer?s income is: Then the consumer?s copayment is: (a) At or below 82% of the federal poverty guidelines (FPG). $15 (b) Above 82% of the FPG up to 137.5% of the FPG. $65 (c) Above 137.5% of the FPG through 200% of the FPG. The dollar amount equal to subtracting 137.5% of the FPG from countable income, multiplying by 50%, then adding $65, up to a maximum of $115. (3) DCYF does not prorate the copayment when a consumer uses care for part of a month. (4) The FPG is updated every year. The WCCC eligibility level is updated at the same time every year to remain current with the FPG. WAC 110-15-0075 ? Determining income eligibility and copayment amounts, states (effective beginning October 1, 2021): (1) DCYF takes the following steps to determine consumers? eligibility and copayments, when care is provided under a WCCC voucher or contract: (a) Determine their family size as described in WAC 110-15-0015; and (b) Determine their countable income as described in WAC 110-15-0065. (2) DCYF calculates consumers? copayments as follows: If the household?s income is: Then the household?s maximum monthly copayment is: At or below 20 percent of the SMI Waived Above 20 percent and at or below 36 percent of the SMI $65 Above 36 percent and at or below 50 percent of the SMI $90 Above 50 percent and at or below 60 percent of the SMI $115 At reapplication, above 60 percent and at or below 65 percent of the SMI $215 (3) DCYF does not prorate copayments when consumers use care for only part of a month. (4) For parents age 21 years or younger who attend high school or are working towards completing a high school equivalency certificate, copayments are not required.

2022-037 The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements to ensure staff properly considered the income information obtained from data matching when determining client eligibility and benefits for the Temporary Assistance for Needy Families program. Assistance Listing Number and Title: 93.558 Temporary Assistance for Needy Families Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2101WATANF; 2201WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Special Tests and Provisions: Income Eligibility Verification System Known Questioned Cost Amount: None Background The Department of Social and Health Services administers the Temporary Assistance for Needy Families (TANF) grant that provides temporary cash assistance for families in need. To receive TANF benefits, applicants must meet individual eligibility criteria and financial eligibility criteria according to the state?s quantified income and resource criteria. The Department spent more than $372 million in federal grant funds during fiscal year 2022. Federal regulations require the Department to participate in the Income Eligibility and Verification System (IEVS). The state is required to coordinate data exchanges with other formally assisted benefit programs, and request and use income and benefit information when making eligibility determinations. The Department uses the Automated Client Eligibility System (ACES) in determining eligibility, issuing benefits, providing management support, and sharing data between agencies. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure staff properly considered the income information obtained from data matching when determining client eligibility and TANF benefits. Department management asserted that part of the eligibility determination process included ACES alerting staff when there was a discrepancy between the information that was reported by applicants and the information that was obtained through the IEVS data matching. During our testing, we confirmed that this internal control was not in place. We determined ACES generated an alert when an applicant reported having no income, but the IEVS data match showed income. However, ACES did not return an error if the applicant reported any income other than zero, regardless of how large the discrepancy was with the IEVS data match. We used a statistical sampling method to randomly select and examine 59 out of a total population of 134,107 clients who were determined eligible during state fiscal year 2022. We found seven instances (12 percent) where we could not determine if the Department properly considered income information when determining eligibility because it did not retain supporting documentation for the client?s income. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department relied on an automated alert system that management did not know was not in place and operating as intended. The Department?s policy required eligibility staff to review information from IEVS cross-matches and document results in the case file. However, the policy did not require eligibility staff to adequately document their review of IEVS data matching in detail or the basis of their conclusion in determining income eligibility. Effect of Condition Without sufficiently documenting clients? income, management cannot ensure whether staff are properly considering the information from IEVS data matching when determining client eligibility and the amount of TANF benefits they will receive. Recommendation We recommend the Department improve its internal controls to ensure staff properly consider and adequately document the income information from IEVS data matching when determining client eligibility and the amount of TANF benefits they will receive. Department?s Response The Department does not concur with this audit finding. The Department does not concur with the SAO?s determination that DSHS did not have adequate internal controls over and did not comply with requirements to ensure staff properly considered the income information obtained from data matching when determining client eligibility and benefits for the Temporary Assistance for Needy Families (TANF) Program. The audit objective was to determine if income information obtained through the various interfaces verifies the accuracy of the information in the case to determine financial eligibility. The key control for ACES is working as designed to sufficiently determine eligibility. The SAO had preconceptions about when ACES alerts occur and how eligibility staff complete these alerts. The department clarified that: ?ACES generates an alert to be reviewed by Community Service Division (CSD) staff if there is an inconsistency within the information recorded in ACES and the income or benefit information that is obtained through the various interfaces to verify accuracy of the information and eligibility of the TANF program.? During the eligibility determination process at application intake, the eligibility worker: 1. Interviews the client to determine income. 2. Compares client reported information against cross matches including IEVS per Code of Federal Regulations (CFR). 3. Resolves discrepancies for all new or previously unverified information received. 4. Uses the information to determine if the client income is below the maximum earned income limits for TANF per WAC 388-478-0035. The Department then verifies all circumstances as required in WAC 388-490-0005, which includes when discrepancies exist, and where the agency takes appropriate action if the information is questionable, confusing or outdated. The Department uses templates to appropriately and comprehensively document the eligibility determination to ensure consistency, accuracy, and lean processes. Income documentation templates address: ? Income received within 30 days of the application date, ? Any discrepancies found between the case record, online verification systems, what was used to project income and income type. The income template does not require documentation if there is no income reported, and no discrepancies were found in cross matches. Not requiring this eliminates steps for the worker therefore ensuring a lean process. This is the instance when the final narrative documentation template includes check boxes to select cross matches reviewed during application intake. The final narrative will always have a summary of the transaction that occurred. Spider is a tool that combines several different data matches including IEVS. The eligibility workers created the referenced documentation in all seven cases using the final narrative template consistent with Department procedures. In all seven exception cases, documentation existed in the final narrative stating: "Reviewed the following system(s): Spider." The Department did not use earned income templates in the seven exception cases because there was no income reported and no income found in IEVS and other cross matches, no discrepancies, and no changes within 30 days. This action is in alignment with department procedures. Department procedures for "Standard Remarks and Narrative Documentation" requires documentation to verify circumstances and states: 1. *Use the Narrative for client interactions and case actions. Use Templates when applicable. a. Complete the appropriate template based on the case action, adding relevant information to ensure that there is an accurate, complete summary. 6. Include Remarks to reconcile any discrepancies, or important information not otherwise captured, including required questions left blank on the application or eligibility review form. 7. When documenting Earned or Unearned income: d. Address any discrepancies between information in the case record, online verification systems, and what was used to project income: If there was no discrepancy and no income indicated in IEVS, eligibility staff are not required to document anything as there is no discrepancy to address. Once there is an open case, ACES generates alerts when an applicant is budgeted with zero income, and the IEVS data match shows income. To be clear, this would be new information because any such discrepancies existing in IEVS at the application intake would already be addressed at that time. As SAO points out in this finding, alerts were not generated for all income fluctuations. The Department agrees, and asserts that the system is working as designed, and alerts are created when staff review is required. Creating alerts for unnecessary and unhelpful reviews arising from the scenarios outlined above would take staff time away from other required and mission-critical actions. Alerts are generated, as appropriate, when a review and potential action is required. This is evidenced by the fact that the department accurately determined eligibility in 100% of all seven cases the SAO determined to be exceptions. Auditor?s Remarks The 2022 OMB Compliance Supplement instructs auditors to ?Test a sample of TANF cases subject to IEVS to ascertain if the state properly considered the information obtained from the data matching in determining eligibility and the amount of TANF benefits.? We tested to determine if the Department sufficiently documented that staff properly considered the details of income verification when reviewing a client?s application. While the Department may have followed internal procedures when not fully documenting its eligibility decisions, in our opinion, the documentation was not sufficient to demonstrate compliance with federal law. We disagree with the Department?s presumption that ?SAO had preconceptions about when ACES alerts occur and how eligibility staff complete these alerts.? This statement is inaccurate because the Department first provided our Office with information about the internal control in question on July 14, 2022, and later confirmed it during a meeting with staff on July 19, 2022. Department management said that when the IEVS system identifies a discrepancy, ACES will generate an alert notifying the case worker to review the information. On November 23, 2022, we notified the Department of the internal controls we planned to test, which included the key control asserted. We asked Department management on December 13, 2022, if this was the correct key control and if it was accurate. Department staff responded that it was, and we tested the control on January 18, 2023. In its response to this finding, the Department asserts our Office had preconceptions about the following internal control: ?ACES generates an alert to be reviewed by Community Service Division (CSD) staff if there is an inconsistency within the information recorded in ACES and the income or benefit information that is obtained through the various interfaces to verify accuracy of the information and eligibility of the TANF program.? This is the same internal control that we tested. It differs slightly in language, but it reiterates the Department?s original assertion that an alert was generated if there was an inconsistency identified. We determined, and the Department confirmed, the alert was only generated when the system identified an inconsistency in the cases where an applicant claimed to have zero income and the other verifications reported an income other than zero. If the applicant claimed anything other than zero, the alert did not generate no matter how large or small the discrepancy was between the claimed income and the income identified through various interfaces. Staff who oversee the system confirmed on January 10, 2023, that this internal control was not functioning in the manner that Department management asserted. Once our Office informed program staff that the internal control was not working as intended, the Department made a new assertion that the system was working as designed and that we misunderstood the internal control conveyed to us many times by management over the course of the audit. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 75, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for HHS Awards, section 361, Retention requirements for records, states in part: Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the HHS awarding agency or pass-through entity in the case of a subrecipient. HHS awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. The only exceptions are the following: (a) If any litigation, claim, or audit is started before the expiration of the 3-year period, the records must be retained until all litigation, claims, or audit findings involving the records have been resolved and final action taken. (b) When the non-Federal entity is notified in writing by the HHS awarding agency, cognizant agency for audit, oversight agency for audit, cognizant agency for indirect costs, or pass-through entity to extend the retention period. (c) Records for real property and equipment acquired with Federal funds must be retained for 3 years after final disposition. (d) When records are transferred to or maintained by the HHS awarding agency or pass-through entity, the 3-year retention requirement is not applicable to the non-Federal entity. (e) Records for program income transactions after the period of performance. In some cases, recipients must report program income after the period of performance. Where there is such a requirement, the retention period for the records pertaining to the earning of the program income starts from the end of the non-Federal entity's fiscal year in which the program income is earned. (f) Indirect cost rate proposals and cost allocations plans. This paragraph applies to the following types of documents and their supporting records: Indirect cost rate computations or proposals, cost allocation plans, and any similar accounting computations of the rate at which a particular group of costs is chargeable (such as computer usage chargeback rates or composite fringe benefit rates). (1) If submitted for negotiation. If the proposal, plan, or other computation is required to be submitted to the Federal Government (or to the pass-through entity) to form the basis for negotiation of the rate, then the 3-year retention period for its supporting records starts from the date of such submission. (2) If not submitted for negotiation. If the proposal, plan, or other computation is not required to be submitted to the Federal Government (or to the pass-through entity) for negotiation purposes, then the 3-year retention period for the proposal, plan, or computation and its supporting records starts from the end of the fiscal year (or other accounting period) covered by the proposal, plan, or other computation.

2022-038 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2201WALIEA; 2101WALIEA; 2101WALWC5; 2101WALWC6 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Department of Commerce (Department) administers the Low-Income Home Energy Assistance Program, which provides financial assistance to low-income households to meet their home energy needs. The Department makes subawards to community-based organizations to provide this assistance. In fiscal year 2022, the Department spent more than $102 million in federal program funds, approximately $98 million of which it paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $25,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). For federal awards issued on or after November 12, 2020, the monetary threshold for reporting increased to $30,000. The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower citizens with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate controls over and did not comply with this reporting requirement. The prior finding number was 2021-031. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. The Department has two units?energy assistance and weatherization?that administer the two different program funding activities. Each unit is responsible for complying with this reporting requirement. During the audit period, the Department was required to report 127 subawards (103 energy assistance and 24 weatherization) totaling approximately $123 million of program funds that it awarded to 26 subrecipients. We found the Department did not report 101 of these subawards in FSRS as required, including all 24 of the weatherization subawards, totaling $77.8 million. We randomly selected eight of the 26 subawards reported during the audit period. We found the following: ? Eight (100 percent) subawards were submitted after the end of the month following the month in which the obligation was made. ? Eight (100 percent) did not have the correct obligation amount and date. ? One (12.5 percent) had an incorrect DUNS number. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The energy assistance unit began to report subawards during the audit period, but employees did not know how to correctly submit the reports. In addition, management did not ensure employees in the weatherization unit knew about the reporting requirements. The Department implemented a new reporting procedure in April 2022, but the units did not consistently follow it. Effect of Condition Failing to submit the required reports diminishes the federal government?s ability to ensure accountability and transparency of federal spending. The terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance by suspending or terminating the federal award, or withholding future awards. Recommendations We recommend the Department: ? Establish effective internal controls to ensure reports are submitted as required ? Ensure the energy assistance and weatherization units follow the newly implemented reporting procedure ? Provide training for employees who oversee reporting and who verify the submission and accuracy of the reports ? Ensure management monitors reporting of this information to ensure future reports are submitted completely and timely Department?s Response LIHEAP The Department of Commerce received additional pandemic funding for the LIHEAP program beginning in FY20. As a result of the reporting finding issued for FY20, the LIHEAP program implemented recommended procedures to resolve deficiencies identified. Regarding the correct submission of reports, LIHEAP employees misunderstood the requirements for entering FFATA and are in the process of correcting the misunderstanding and how the information will be reported to FFATA in the future. The Program Manager did not find any instructions in the FFATA guide that disallowed the process used for reporting. Only after SAO reviewed the FFATA reports did LIHEAP receive guidance on how to enter the FFATA reports separately for each award and the corresponding amendments. Regarding the April 2022 implementation of the reporting procedure, the program consistently followed the procedures that were established which is why all LIHEAP FFATA reporting was not entered correctly. The Program Manager provided FFATA reporting for combined awards, not all awards and amendments were separated. This resulted in the numbers reported not matching the original awards. The Program Manager has updated the FFATA reporting procedure to provide only one award or amendment is reported for the 2023 program year funding. Weatherization LIHEAP History: The Federal Funding Accountability and Transparency Act (FFATA) was signed on September 26, 2006. This legislation intends to empower every American to hold the government accountable for spending decisions. The Commerce Low Income Weatherization team understands and values this work. In 2018, our team went through a staff transition process at both the position primarily responsible for completing FFATA reporting as well as the position supervising this position. Staff onboarding and transition processes did not adequately train new staff to maintain FFATA reporting requirements. Furthermore, internal contracting processes were not adequately in place to recognize the deficiency. Solution to Finding: The Low-income Weatherization team concurs with the finding and has researched FFATA reporting requirements to gain clear understanding of how to fulfill them moving forward. The Program Coordinator is primarily responsible for reporting in the online FFATA system has been trained on how to accurately register relevant sub-grantees in the system, as well as how to input required data within the mandated time period. This task will also be added to the Program Coordinator onboarding checklist to ensure this requirement will continue to be met by new staff after any future position transition. The FFATA reporting requirement has also been added to our internal federal contracting timeline which is referenced at monthly meetings by the relevant Program Supervisor, Program Manager, and Program Coordinator. At the time any future obligation memo is approved for a federal fund source with FFATA reporting requirements, staff will immediately initiate fulfilling this requirement within 30 days. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 U.S. Code of Federal Regulations (CFR) Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 ? Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) 3. What to report. You must report the information about each obligating action that the submission instructions posted at http:www.fsrs.gov specify.

2022-039 The Department of Commerce did not have adequate internal controls over and did not comply with reporting requirements for the Low-Income Home Energy Assistance Program. Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2201WALIEA; 2101WALIEA; 2201WALIEI; 2101WALWC5; 2101WAE5C6; 2102WALWC6 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia, and territories. In Washington, the Department of Commerce (Department) administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. The Department makes subawards to community-based organizations to provide this assistance. The Department is required to collect and report program information annually. The LIHEAP Performance Data Form is used to report performance metrics, mostly related to home energy burden targeting and reduction, as well as the continuity of home energy service. The Annual Report on Households Assisted by LIHEAP, which consists of six different sections, outlines assistance given to households and households applying for assistance. Both reports are required to separate the data by regular LIHEAP funding and additional LIHEAP funding under the Coronavirus Aid, Relief, and Economic Security (CARES) Act and the American Rescue Plan Act (ARPA). In fiscal year 2022, the Department spent more than $102 million in federal program funds, approximately $94 million of which it paid to subrecipients. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate controls over and did not comply with reporting requirements for the Annual Report on Households Assisted. The prior finding number was 2021-032. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements for the Low-Income Home Energy Assistance Program. We reviewed the LIHEAP Performance Data Form and the Annual Report on Households Assisted that were due during the audit period. We examined the report the Department submitted for the federal fiscal year ending September 30, 2021, and attempted to recalculate the information reported using data the Department pulled from its LIHEAP database. The Department informed us that for the first five weeks of the reporting period, this data did not contain sufficient information to fully recalculate the values reported for the program year under review. Based on the data the Department provided, we identified the following: ? LIHEAP Performance Data Form o 160 of the 225 fields (71 percent) were inaccurate. o The difference between values reported and the data provided varied between less than 1 percent and 200 percent. o The ?all household? categories had the most significant variance, ranging from (921) to 29,301 in households reported. ? Annual Report on Households Assisted o 100 of the 138 fields (72 percent) were inaccurate. o The difference between values reported and the data provided varied between 1 percent and 783 percent. o The ?all household? categories had the most significant variance, ranging from (1,052) to 38,151 in households reported. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Prior to the audit period, the Department designed an automated system to sort and categorize funds that were traditional LIHEAP and funds that were from CARES and ARPA, and automatically populate those numbers on the report. However, this automated system was not in place for the first five weeks of the reporting period, covering October 1, 2020, to November 11, 2020. Therefore, the data for this period did not contain information necessary to identify the funding source of each household benefit payment. Although management reviewed the report, the staff responsible for preparing and submitting it did not retain the data used to support the amounts listed in the report. Furthermore, management said that the grantor instructed the Department to include only traditional LIHEAP-related data in the ?all households? category, but was not able to provide written documentation of this guidance. Effect of Condition By not retaining supporting documentation for the report, management was unable to demonstrate the amounts the Department reported to the federal grantor were complete and accurate. Additionally, the terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance with reporting requirements by suspending or terminating the award, or withholding future awards, should it choose to do so. Recommendations We recommend the Department: ? Establish effective internal controls to ensure the report is accurate and complete ? Strengthen its management reviews to ensure amounts reported are accurate and staff retain adequate documentation to support amounts included in the reports ? Consult with the federal grantor to determine if revision and resubmission of both reports is necessary to correct amounts reported Department?s Response The Department agrees with this finding. The program was instructed by the United States Department of Health and Human Services (HHS) that with the additional funding we received in response to the COVID pandemic, we were to track and report all funds separately. The program manager assumed incorrectly that this meant program reporting as well as financial reporting and reported Regular LIHEAP-funded households (contract #32606) separately from the CARES Act-funded households (contract #3260C) and ARP-funded households (contract #3260A) when they should have been counted together in module 2A of the report. This caused all other numbers in the reports to be off when the data was pulled from the LIHEAP data system by SAO data analysts per the compliance supplemental instructions. The program manager has reached out to the LIHEAP liaison at HHS for guidance on updating the reports and will proceed with the corrections once guidance is received from HHS. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 75, Subpart 342, Monitoring and reporting program performance, states in part: (b) Non-construction performance reports. The HHS awarding agency must use standard, OMB-approved data elements for collection of performance information (including performance progress reports, Research Performance Progress Report, or such future collections as may be approved by OMB and listed on the OMB Web site). (1) The non-Federal entity must submit performance reports at the interval required by the HHS awarding agency or pass-through entity to best inform improvements in program outcomes and productivity. Intervals must be no less frequent than annually nor more frequent than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes. Annual reports must be due 90 calendar days after the reporting period; quarterly or semiannual reports must be due 30 calendar days after the reporting period. Alternatively, the HHS awarding agency or pass-through entity may require annual reports before the anniversary dates of multiple year Federal awards. The final performance report will be due 90 calendar days after the period of performance end date. If a justified request is submitted by a non-Federal entity, the HHS awarding agency may extend the due date for any performance report. Title 45 CFR Part 96, Subpart 82, Required report on households assisted, states in part: (a) Each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Office Management and Budget, 2022 Compliance Supplement, Assistance Listing 93.568 Low-Income Home Energy Assistance, states in part: As part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. Territories with annual allotments of less than $200,000 and all Indian tribes are required to report only on the number of households served for each program component (42 USC 8629; 45 CFR section 96.82). The U.S. Department of Health and Human Services, Division of Energy Assistance, Office of Community Services, Administration of Children and Families? Instructions for the LIHEAP Household Report Long Form FY2021, states in part: Introduction: Federal LIHEAP Funds The purpose of the LIHEAP Household Report is to report on the number of households assisted with all available federal LIHEAP funds during FY 2021, including those LIHEAP funds obligated in FY 2020, but not expended until FY 2021. LIHEAP funding includes all federal funds allocated to LIHEAP. To separately identify the impact of supplemental federal LIHEAP funding, HHS requires grantees to report three pieces of information for each item in the Household Report. ? The first line is for grantees to report information for all households regardless of funding source. This is consistent with what grantees were required to report in the past. Grantees should report the total count of households, counting each household once if it received that type of assistance during FY 2021. Report households assisted with regular LIHEAP funds, LIHEAP CARES funds, LIHEAP ARPA funds, or any combination of these funds. ? The second line is for grantees to report information on the subset of households that were assisted with CARES Act supplemental LIHEAP funding. Include households that received a benefit that was fully or partially funded with CARES Act funds. Exclude households that did not receive a benefit that was fully or partially funded by CARES Act funds. Important Note: This is a subset of the households reported in the first line, meaning that a household that received a benefit that was fully or partially funded with CARES Act funds should be reported in this line and in the first line as well. ? The third line is for grantees to report information on the subset of households that were assisted with American Rescue Plan Act supplemental LIHEAP funding. Include households that received a benefit that was fully or partially funded with ARPA Act funds. Exclude households that did not receive a benefit that was fully or partially funded by ARPA Act funds. Important Note: This is a subset of the households reported in the first line, meaning that a household that received a benefit that was fully or partially funded with ARPA Act funds should be reported in this line and in the first line as well. To report this information, grantees will need to identify which funding sources were used to provide each household with each type of LIHEAP assistance during FY 2021. General Requirements: Reporting Period Household data are for the reporting period for FY2021 (October 1, 2020 ? September 30, 2021). Grantees may operate their programs on a different program year (e.g. starting January 1 or July 1). However, complete household data still need to be reported for the reporting period of FY 2021. Data Consistency The data will be checked for consistency against the type of LIHEAP assistance that states report in their LIHEAP Model Plan for FY 2021 and later with the data reported in each state?s LIHEAP Performance Data Form for FY 2021. For example, if obligated funds are reported for cooling assistance and there are no household data reported for cooling assistance, then the state should include a note which explains the inconsistency. States may correct such issues by creating a revision and submitting their LIHEAP Household Report or LIHEAP Performance Data Form in OLDC.

2022-040 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to issue management decisions for audit findings to subrecipients of the Low-Income Home Energy Assistance Program. Assistance Listing Number and Title: 93.568, Low-Income Home Energy Assistance Program 93.568, COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2201WALIEA; 2101WALIEA; 2201WALIEI; 2101WALWC5; 2101WEA5C6; 2102WALWC6 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Department of Commerce (Department) administers the Low-Income Home Energy Assistance Program, which provides financial assistance to low-income households to meet their home energy needs. The Department makes subawards to community-based organizations to provide this assistance. In fiscal year 2022, the Department spent more than $102 million in federal program funds, approximately $98 million of which it paid to subrecipients. Federal regulations require the Department to monitor its subrecipients? activities. This includes verifying that subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes on to subrecipients, the Department must follow up and ensure its subrecipients take timely and appropriate corrective action on all deficiencies identified through audits, onsite reviews and other means. When a subrecipient receives an audit finding for a Department-funded program, federal law requires the Department to issue a management decision to the subrecipient within six months of acceptance of the audit report by Federal Audit Clearinghouse. The management decision must clearly state whether the audit finding is sustained, the reasons for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to issue management decisions for audit findings to the program?s subrecipients. The Department had a process in place to monitor that program subrecipients received single audits. However, for the first half of the audit period, it did not have a process in place to issue, communicate and follow up on management decisions to its subrecipients when program findings were issued. During the audit period, the Department had 26 subrecipients that were required to submit a single audit. One subrecipient received a finding for which the Department was required to issue a management decision. We found the Department did not issue a management decision for this subrecipient. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not establish sufficient internal controls or monitoring procedures to ensure the Department issued the required management decisions. The Department also lacks written policies over issuing management decisions to its federal program subrecipients. Effect of Condition Without establishing adequate internal controls, the Department cannot ensure it is following up on subrecipient single audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitor them for effectiveness, the Department cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the Department: ? Establish effective internal controls to ensure it issues management decisions by the due date and follows up on all subrecipient audit findings related to the program ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations Department?s Response The Department of Commerce concurs with the finding. The Department hired an Internal Control Officer in November 2021 assigned to complete the required verification of Federal Audit Clearinghouse (FAC) submissions. This process was completed for all recipients who expended $750,000 or more in federal funds passed through the Department. One subrecipients submission selected for testing was verified, however, a formal management decision was not issued. The audit report submitted to the FAC included various errors which included no identification of the pass through entity (the Department of Commerce) as part of the finding and the Schedule of Expenditure of Federal Awards (SEFA) reported the wrong state agency?s acronym. The Department of Corrections was listed, not Commerce as required. The accurate reporting of the pass through entity in the audit report is imperative for Commerce to identify who they are required to issue a management decision for. A comprehensive spreadsheet of the Department?s management decision was maintained, however, the subrecipient selected for testing was omitted. The Department currently has a robust and comprehensive process to identify required reporters, verify their submission to the FAC, document late or non-reporters, and document communication requests for information related to submissions. The Department has also created a method to formally communicate the management decision to our subrecipients who have received Commerce funded audit findings. Our prior process included verbally discussing the finding, corrective action plans and Commerce requests with the subrecipient. Internal controls for the monitoring of federal reporting and issuing of management decisions have been in place since March 2022. Commerce management will continue to monitor the process and implement efficiencies to ensure continued compliance with all respects of the code of federal regulations. We appreciate the State Auditor?s Office thorough review of this process and recommendations. We anticipate all future audits will find the Department has employed strong internal controls supporting compliance with all requirements. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c).

2022-041 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers for the Child Care and Development Fund Cluster programs were allowable and properly supported. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2003WACCDF; 2103WACCDF; 2203WACCDF; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2103WACCDD; 2203WACCDD Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $260,552,979 Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2022, the Department spent about $668.6 million in CCDF federal funding, which was an increase of about $341.1 million compared to the prior fiscal year. The Department is responsible for establishing policies to ensure payments to providers for child care services are allowable. In fiscal year 2022, the Department spent more than $260.5 million on monthly child care subsidy payments to child care providers. There are three child care provider types: licensed centers, licensed family homes, and licensed exempt providers referred to as Family, Friends and Neighbor providers. The Department uses the Social Service Payment System (SSPS) to process the payments it makes to child care providers. The system allocates payments to various funding sources, based on the eligibility of the client. These funding sources include multiple federal programs, multiple CCDF federal grant awards, and state funding. The Department uploads the SSPS payment data into the state?s accounting system at a summary level based on the various funding sources. There is always a need to transfer the funding sources for some payments throughout the year to manage federal and state funds properly. In prior audit periods up until fiscal year 2021, the Department prepared supporting documentation for transfers that included details of what payments it was transferring. The purpose of documenting this detail was to maintain proper support for federal expenditures. The Department of Health and Human Services (HHS), which oversees the CCDF program at the federal level, requires recipients have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers were allowable and properly supported. We have reported this condition since 2005. The most recent audit finding numbers were 2021-033, 2020-038, 2019-035, 2018?034, 2017-024, 2016-021, 2015-023, 2014-023, 2013-016, 12-28, 11-23, 10-31, 9-12 and 8?13. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers for the CCDF programs were allowable and properly supported. In fiscal year 2021, management informed us that the Department changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditure coding in SSPS inaccurate and unreliable for testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent CCDF funds in accordance with federal and state regulations. Further, this meant we could not test the Department?s payments to child care providers for compliance with activities allowed and cost principles. By processing these adjustments at the fund level, the Department invalidated the transaction-level documentation of the original child care expenditure in SSPS and did not identify the new allocation at the payment level. Additionally, the Department transferred some of these child care expenditures more than once at the fund level, making the underlying data increasingly unreliable with each transfer. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. Management decided to modify the Department?s accounting practices in a way that now prevents it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions from SSPS that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition and Questioned Costs By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit the federal dollars it used for payments to child care providers. Because we could not test transaction-level detail, we also could not determine whether the issues we identified in prior audits had improved or worsened, including the Department?s lack of adequate internal controls and significant rate of noncompliance for payments to child care providers. The total amount of known child care payments with federal CCDF funds in the audit period was $260,552,979. The Department also partially funded these payments with an additional $37,374,731 in state dollars. Because the Department did not comply with HHS requirements to allow for the tracing of grant expenditures to a payment level, we are questioning all $260,552,979 in federal program costs the Department incurred during the audit period. The payments the Department partially paid with state funds are not included in the federal questioned costs. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department?s grant adjustments were processed based on eligible clients and allowable activities. However, the adjustments did not include child-level data as required by SAO. In state fiscal year 2021, the SAO issued a finding in the amount of $32 in the area of CCDF eligibility, no other findings, management letters, or exit items in the area of eligibility or the cost allocation of funds based on eligibility were determined. Given that eligibility or cost allocation is not an area of concern and transfers were processed between CCDF source of funds with the same eligibility requirements, the Department is confident CCDF funding was spent appropriately within federal regulations. In the Cause of Condition, the SAO stated, ?HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant.? The Department does not agree with this interpretation of the meeting outcome. During this informal meeting, on February 23, 2022, the State Auditor?s Office, Office of Financial Management, and the Department met with HHS and they stated they would not offer an opinion until they received the completed finding from the state. The opinion will be part of the Management Decision letter that is expected around February 2023. The Department is committed to improving our internal controls. The Department does not currently have the staff to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the 2021 auditor?s recommendations, the Department has submitted a budget request for staffing to the Legislature for the 2023-2025 biennial budget. The staff would process adjustments to include transaction-level data. The Department will continue to review other options available for processing adjustments to include transaction-level data. Auditor?s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in titles 2 and 45 of the Code of Federal Regulations and the State?s grant award. During the meeting with HHS that the Department referenced in their response, the grantor stated the specific federal law the Department?s accounting procedures were noncompliant with was 45 CFR 98.67. While the Department references the eligibility finding as a basis for asserting federal funds were spent properly, the program has received findings related to improper payments for child care since 2005, including over $21 million in likely questioned costs identified during the 2020 audit. Because we are unable to test the child care payments during the last two audits, we are unable to determine the current status of the conditions previously reported. We appreciate the Department?s commitment to resolving these matters and will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 U.S. Code of Federal Regulations, Section 98.67 ? Fiscal requirements, states: (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part.

2022-042 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with matching, level of effort, and earmarking requirements for the Child Care and Development Fund Cluster. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2003WACCDF; 2103WACCDF; 2203WACCDF; 2003WACCC3; 2103WACDC6; 2113WACSC6; 2103WACCC5; 2103WACCDD; 2203WACCDD Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Matching, Level of Effort, Earmarking Known Questioned Cost Amount: None Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2022, the Department spent about $668.6 million in federal funding, which was an increase of about $341.1 million compared to the prior fiscal year. The CCDF consists of three distinct funding sources: Discretionary Fund, Mandatory Fund, and Matching Fund. Additionally, under the Temporary Assistance for Needy Families (TANF) program, the Department may transfer TANF funds to the CCDF, which are then treated as Discretionary Funds. The Department is instructed how to spend this federal money. For the Department to receive its allotted share of the Matching Fund, it must meet the Maintenance of Effort (MOE) requirement and match the federal Matching Fund claimed with state expenditures at the Federal Medical Assistance Percentage rate for the applicable fiscal year. The Department must also meet earmarking requirements for expenditures for administrative and quality activities. The U.S. Department of Health and Human Services (HHS), which oversees the CCDF program at the federal level, requires recipients have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Department staff run monthly and quarterly expenditure reports from the accounting system to track requirements over matching, level of effort, and earmarking for each open grant award. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over matching, level of effort, and earmarking requirements for the CCDF Cluster programs. The prior audit finding numbers were 2021-036 and 2020-040. Description of Condition The Department did not have adequate internal controls over and did not comply with matching, level of effort, and earmarking requirements for the CCDF programs. The Department?s accounting records should be used to verify it has met matching, level of effort, and earmarking requirements. In fiscal year 2021, management informed us that the Department changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditure coding in the payment system inaccurate and unreliable for testing. Without identifying which expenditures it transferred, the Department?s monitoring is insufficient for properly managing matching, level of effort, and earmarking requirements. Our Office could not rely on the data supporting the Department?s expenditures or verify that the accounting records were accurate. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent CCDF funds in accordance with federal and state regulations. Further, this meant we could not test the Department?s payments for compliance with matching, level of effort, and earmarking requirements. By processing these adjustments at the fund level, the Department invalidated the transaction-level documentation of the original child care expenditure in the payment system, and did not identify the new allocation at the payment level. Additionally, the Department transferred some of these child care expenditures more than once at the fund level, making the underlying data increasingly unreliable with each transfer. This condition is also referenced in audit finding 2022-041. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. Management decided to modify the Department?s accounting practices in a way that now prevents it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions in the payment system that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to determine if it had met matching, level of effort, and earmarking requirements. Recommendations We recommend the Department: ? Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules ? Develop effective ongoing monitoring procedures Department?s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department?s grant adjustments were processed based on eligible clients and allowable activities. However, the adjustments did not include child-level data as required by SAO. In state fiscal year 2021, the SAO issued a finding in the amount of $32 in the area of CCDF eligibility, no other findings, management letters, or exit items in the area of eligibility or the cost allocation of funds based on eligibility were determined. Given that eligibility or cost allocation is not an area of concern and transfers were processed between CCDF source of funds with the same eligibility requirements, the Department is confident CCDF funding was spent appropriately within federal regulations. In the Cause of Condition, the SAO stated, ?HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant.? The Department does not agree with this interpretation of the meeting outcome. During this informal meeting, on February 23, 2022, the State Auditor?s Office, Office of Financial Management, and the Department met with HHS and they stated they would not offer an opinion until they received the completed finding from the state. The opinion will be part of the Management Decision letter that is expected around February 2023. The Department is committed to improving our internal controls. The Department does not currently have the staff to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the 2021 auditor?s recommendations, the Department has submitted a budget request for staffing to the Legislature for the 2023-2025 biennial budget. The staff would process adjustments to include transaction-level data. The Department will continue to review other options available for processing adjustments to include transaction-level data. Auditor?s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in titles 2 and 45 of the Code of Federal Regulations and the State?s grant award. During the meeting with HHS that the Department referenced in their response, the grantor stated the specific federal law the Department?s accounting procedures were noncompliant with was 45 CFR 98.67. While the Department references the eligibility finding as a basis for asserting federal funds were spent properly, the program has received findings related to improper payments for child care since 2005, including over $21 million in likely questioned costs identified during the 2020 audit. Because we are unable to test the child care payments during the last two audits, we are unable to determine the current status of the conditions previously reported. We appreciate the Department?s commitment to resolving these matters and will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 U.S. Code of Federal Regulations, Section 98.67 ? Fiscal requirements, states: (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part.

2022-043 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with period of performance requirements for the Child Care and Development Fund. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2003WACCDF; 2103WACCDF; 2203WACCDF; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2103WACCDD; 2203WACCDD Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Period of Performance Known Questioned Cost Amount: None Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2022, the Department spent about $668.6 million in CCDF federal funding, which was an increase of about $341.1 million compared to the prior fiscal year. Each federal grant specifies a performance period during which recipients must obligate and liquidate program costs. These periods typically align with the federal fiscal year of October 1 through September 30. Payments for costs charged before a grant?s beginning date or after the ending date are not allowed without the grantor?s prior approval. The CCDF consists of three distinct funding sources: Discretionary Fund, Mandatory Fund, and Matching Fund. Each of these funds has specific period of performance requirements established in federal regulation (45 CFR ? 98.60(d)): ? Discretionary Funds must be obligated by the end of the succeeding fiscal year after award and expended by the end of the third fiscal year after award. ? Mandatory Funds must be obligated by the end of the fiscal year in which they are awarded if the state also requests Matching Funds. If no Matching Funds are requested for the fiscal year, then the Mandatory Funds are available until liquidated. ? Matching Funds must be obligated by the end of the fiscal year in which they are awarded and liquidated by the end of the succeeding fiscal year after award. During the audit period, the Department also received supplemental funds under the Coronavirus Aid, Relief, and Economic Security (CARES) and the Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Acts. These funds are treated as Discretionary Funds, however, they have their own specific obligation and liquidation timeframes. The U.S. Department of Health and Human Services (HHS), which oversees the CCDF at the federal level, requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over period of performance requirements for the CCDF program. The prior finding numbers were 2021-037 and 2020-041. Description of Condition The Department did not have adequate internal controls over and did not comply with period of performance requirements for the CCDF program. Our Office uses the Department?s accounting records to verify it has met the period of performance requirements. In fiscal year 2021, management informed us that the Department changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditures coded in the payment system inaccurate and unreliable for audit testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent CCDF funds in accordance with federal and state regulations. Further, this meant we could not test the Department?s payments for compliance with period of performance requirements. This condition is also referenced in audit finding 2022-041. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. Management decided to modify the Department?s accounting practices in a way that now prevents it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions in the payment system that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to determine if it materially met the period of performance requirements. Furthermore, without adequate internal controls in place, the Department is at a higher risk of making improper payments with grant funds. Recommendations We recommend the Department: ? Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules ? Develop written policies and procedures over federal period of performance requirements Department?s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department?s grant adjustments were processed based on eligible clients and allowable activities. However, the adjustments did not include child-level data as required by SAO. In state fiscal year 2021, the SAO issued a finding in the amount of $32 in the area of CCDF eligibility, no other findings, management letters, or exit items in the area of eligibility or the cost allocation of funds based on eligibility were determined. Given that eligibility or cost allocation is not an area of concern and transfers were processed between CCDF source of funds with the same eligibility requirements, the Department is confident CCDF funding was spent appropriately within federal regulations. In the Cause of Condition, the SAO stated, ?HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant.? The Department does not agree with this interpretation of the meeting outcome. During this informal meeting, on February 23, 2022, the State Auditor?s Office, Office of Financial Management, and the Department met with HHS and they stated they would not offer an opinion until they received the completed finding from the state. The opinion will be part of the Management Decision letter that is expected around February 2023. The Department is committed to improving our internal controls. The Department does not currently have the staff to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. In response to the 2021 auditor?s recommendations, the Department has submitted a budget request for staffing to the Legislature for the 2023-2025 biennial budget. The staff would process adjustments to include transaction-level data. The Department will continue to review other options available for processing adjustments to include transaction-level data. Auditor?s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in titles 2 and 45 of the Code of Federal Regulations and the State?s grant award. During the meeting with HHS that the Department referenced in their response, the grantor stated the specific federal law the Department?s accounting procedures were noncompliant with was 45 CFR 98.67. While the Department references the eligibility finding as a basis for asserting federal funds were spent properly, the program has received findings related to improper payments for child care since 2005, including over $21 million in likely questioned costs identified during the 2020 audit. Because we are unable to test the child care payments during the last two audits, we are unable to determine the current status of the conditions previously reported. We appreciate the Department?s commitment to resolving these matters and will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 U.S. Code of Federal Regulations, Section 98.60 -Availability of funds, states in part: (d) The following obligation and liquidation provisions apply to States and Territories: (1) Discretionary Fund allotments shall be obligated in the fiscal year in which funds are awarded or in the succeeding fiscal year. Unliquidated obligations as of the end of the succeeding fiscal year shall be liquidated within one year. (2) (i) Mandatory Funds for States requesting Matching Funds per ? 98.55 shall be obligated in the fiscal year in which the funds are granted and are available until expended. (ii) Mandatory Funds for States that do not request Matching Funds are available until expended. (3) Both the Federal and non-Federal share of the Matching Fund shall be obligated in the fiscal year in which the funds are granted and liquidated no later than the end of the succeeding fiscal year. Title 45 U.S. Code of Federal Regulations, Section 98.67 ? Fiscal requirements, states: (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part.

2022-044 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with financial reporting requirements for the Child Care and Development Fund Cluster. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2003WACCDF; 2103WACCDF; 2203WACCDF; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2103WACCDD; 2203WACCDD Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2022, the Department spent about $668.6 million in federal funding, which was an increase of about $341.1 million compared to the prior fiscal year. The Department is required to submit a quarterly ACF-696 financial report for each open grant. These reports contain information on expenditures for three CCDF funding sources: the Mandatory Fund, the Matching Fund, and the Discretionary Fund. The Department uses CCDF expenditures recorded in the state?s accounting system to compile and support the ACF-696 report. The U.S. Department of Health and Human Services (HHS), which oversees the CCDF program at the federal level, requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate controls over and did not comply with financial reporting requirements for the CCDF Cluster programs. The prior finding number was 2021-038. Description of Condition The Department did not have adequate internal controls over and did not comply with financial reporting requirements for the CCDF program. The Department?s accounting records must provide and support the financial information reported on ACF-696 reports. During the audit period, the Department?s grant management practice was to process expenditure transfers at the grant level without identifying which expenditures it transferred. Therefore, we could not rely on the data supporting the Department?s reported ACF-696 expenditures, and could not test whether the reports were accurate and complete. This condition is also referenced in audit finding 2022-041. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. Management decided to modify the Department?s accounting practices in a way that now prevents it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions in the payment system that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant. Effect of Condition By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit the federal expenditures reported on the ACF-696 financial report. Recommendation We recommend the Department design and implement internal controls to ensure the ACF-696 report is supported with transaction-level data that is sufficient to comply with federal law and state rules. Department?s Response The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This process consists of making grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The Department?s grant adjustments were processed based on eligible clients and allowable activities. However, the adjustments did not include child-level data as required by SAO. In state fiscal year 2021, the SAO issued a finding in the amount of $32 in the area of CCDF eligibility, no other findings, management letters, or exit items in the area of eligibility or the cost allocation of funds based on eligibility were determined. Given that eligibility or cost allocation is not an area of concern and transfers were processed between CCDF source of funds with the same eligibility requirements, the Department is confident CCDF funding was spent appropriately within federal regulations. In the Cause of Condition, the SAO stated, ?HHS officials informed the Department that these accounting practices do not comply with federal law, but management said they believe they are compliant.? The Department does not agree with this interpretation of the meeting outcome. During this informal meeting, on February 23, 2022, the State Auditor?s Office, Office of Financial Management, and the Department met with HHS and they stated they would not offer an opinion until they received the completed finding from the state. The opinion will be part of the Management Decision letter that is expected around February 2023. During the audit, SAO tested the reporting requirements for Federal Funding Accountability and Transparency Act for internal controls and compliance and found no deficiencies or internal control weaknesses. The state fiscal year 2022 ACF-696 reports that were filed during the audit period where submitted timely and accurately to reflect the grant level expenditures as document in the agency financial reporting system. Auditor?s Remarks The level of documentation needed to support grant expenditures is not established by our Office, but in titles 2 and 45 of the Code of Federal Regulations and the State?s grant award. During the meeting with HHS that the Department referenced in their response, the grantor stated the specific federal law the Department?s accounting procedures were noncompliant with was 45 CFR 98.67. While the Department references the eligibility finding as a basis for asserting federal funds were spent properly, the program has received findings related to improper payments for child care since 2005, including over $21 million in likely questioned costs identified during the 2020 audit. Because we are unable to test the child care payments during the last two audits, we are unable to determine the current status of the conditions previously reported. We appreciate the Department?s commitment to resolving these matters and will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 U.S. Code of Federal Regulations, Section 98.67 ? Fiscal requirements, states: (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part.

2022-045 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with health and safety requirements for the Child Care and Development Fund program. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2003WACCDF; 2103WACCDF; 2203WACCDF; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCC5; 2103WACCDD; 2203WACCDD Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Health and Safety Requirements Known Questioned Cost Amount: $412 Background The Department of Children, Youth, and Families administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2022, the Department spent about $668.6 million in CCDF federal funding. The Department oversees two types of providers: licensed providers and license-exempt Family, Friend, and Neighbor (FFN) providers. The Department is responsible for ensuring all these providers meet health and safety standards. The monitoring activity varies for licensed and FFN providers. The Department has an approved CCDF State Plan for federal fiscal year 2022-2024 that outlines how it will meet the health and safety requirements for licensed and FFN providers. Licensed providers Department licensors conduct annual monitoring visits of licensed providers. During visits, they use a monitoring checklist to verify whether providers have met required health and safety standards. The licensors use the WA Compass system to document their activities. The system allows licensing staff to monitor the completion of visits, make timely updates and streamline their processes. When licensors identify health and safety violations during a monitoring visit, they document them on an inspection report. The inspection report contains the areas of provider noncompliance and establishes deadlines for correcting them. The Department is required to conduct timely follow-up visits on noncompliance issues to ensure providers correct them. Depending on the severity of the noncompliance, the Department has five, 10 or 15 business days to verify the noncompliance has been corrected. FFN providers Washington?s CCDF State Plan and a state rule (WAC 110-16-0025) require non-relative FFN providers to complete health and safety training within 90 days of their subsidy payment start date. They also must complete ongoing health and safety training. The Department conducts an annual health and safety visit to ensure providers are following health and safety rules. The Department adopted a rule (WAC 110-16-0030) that states it must conduct annual technical assistance visits for non-relative FFN providers within a year of subsidy approval. During these visits, an FFN specialist reviews health and safety requirements and conducts the ongoing training requirements with the provider. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the seven prior audits, we reported that the Department did not have adequate internal controls over and did not comply with health and safety requirements. The previous finding numbers were 2021-039, 2020-042, 2019-039, 2018-035, 2017-025, 2016-022 and 2015?024. Description of Condition The Department did not have adequate internal controls over and did not comply with health and safety requirements for the CCDF program. Licensed provider annual monitoring and noncompliance follow-ups We used a statistical sampling method to randomly select 59 out of a total population of 5,875 licensed providers. We examined this sample of licensed providers to determine if they received an annual monitoring visit and that the Department performed timely, appropriate follow-ups when they found noncompliance issues. We identified 30 instances (50.8 percent) where providers did not receive their required annual monitoring visit. Of the remaining 29 providers that did receive a monitoring visit, we identified two instances (6.9 percent) where the licensor did not conduct the appropriate follow-up visit on noncompliance issues. Non-relative FFN provider initial training We were not able to obtain complete populations of FFN providers for the purposes of our initial training testing. We made multiple requests for the list of FFN providers, and the Department first provided a list of 85 providers that it asserted needed initial training. When it was determined this list was incomplete, we received another list from the Department that contained 702 providers. This list was also found to be incomplete due to system limitations. However, we still performed testing based on the data made available to us. We randomly selected 57 out of 702 FFN providers that the Department asserted were required to complete initial training. Of those reviewed, we determined 34 of the providers did not meet the criteria for testing because they were not subject to initial training for different reasons, such as they were relative providers, had never provided care, or were closed prior to the initial training requirement deadline. Of the remaining 23 providers that were applicable to our testing, we found one instance where the provider did not complete its initial training and was not closed within 90 days of its first subsidy payment. Non-relative FFN provider ongoing training and annual technical visits We were not able to obtain complete populations of FFN providers for the purposes of our ongoing training and technical visit testing. We made multiple requests for the list of FFN providers, and the Department first provided a list of 77 providers that it asserted were required to complete ongoing training and have a technical visit during the audit period. When it was determined this list was incomplete due to system limitations, we received another list from the Department that contained 1,443 providers. This list was also found to be incomplete, but we still performed testing based on the data made available to us. We randomly selected 58 out of 1,443 FFN providers that the Department asserted were required to complete ongoing training and have a technical visit. Of those reviewed, we determined 55 of the providers did not meet the criteria for testing because they were not subject to ongoing training or annual technical visits for different reasons, such as they were relative providers, had never provided care, or were closed prior to the training requirement and annual technical visit deadlines. Of the remaining three providers that were applicable to our testing, we found two instances where the providers completed their technical visits, but they did not receive ongoing training. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Licensed provider annual monitoring and noncompliance follow-ups The Department did not conduct 30 of the 59 monitoring visits we reviewed because it has been unable to maintain the needed level of staffing. This has made it difficult for management to ensure monitoring visits and follow-up visits on identified noncompliance have occurred, as the CCDF program requires. Non-relative FFN provider initial training, ongoing training, and annual technical visits Management did not monitor sufficiently to ensure that staff completed technical visits or monitored FFN providers to ensure they met the training requirements. Further, due to system limitations, the Department did not effectively identify during the audit period which providers were subject to training and technical visit requirements. Effect of Condition and Questioned Costs Licensed provider annual monitoring and noncompliance follow-ups By not completing monitoring visits or following up on noncompliance in a timely manner, the Department did not have assurance that providers met health and safety requirements. Further, not following up on noncompliance violations in a timely manner can put children in jeopardy of harm, neglect, and unhealthy environments. Non-relative FFN provider initial training, ongoing training, and technical visits By not monitoring FFN training requirements or conducting technical visits, the Department did not have assurance that providers met health and safety requirements. System limitations and the inability to obtain a complete population for sampling and testing created a condition that prevented our Office from fully auditing the Department?s compliance with these requirements. Because the Department did not timely terminate the FFN provider who did not complete initial training, we identified $412 of improperly paid program funds. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Although we identified known questioned costs, we do not have reasonable assurance that the payment in question is appropriately represented in the Department?s accounting records because of the grant management practice issue reported in finding 2022-041. Additionally, the payments in question are duplicative of the costs already questioned in the aforementioned provider payment finding. Recommendations We recommend the Department: ? Strengthen internal controls to ensure it sufficiently monitors all health and safety requirements ? Ensure management follows established policies and procedures to ensure licensors complete all monitoring visits and conduct thorough, timely follow-ups on any identified noncompliance issues ? Ensure management follows established policies and procedures to ensure non-relative FFN providers complete their required initial training, ongoing training, and receive technical visits We also recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department?s Response The Department is strongly committed to ensuring the health, safety, and well-being of all children in care. The Department would like to acknowledge the child care providers that continued to operate during the COVID-19 pandemic and provided support to families and their community. As to the Auditor?s specific findings, the Department concurs and offers the following detail: Licensed provider annual monitoring and noncompliance follow-ups In response to the COVID-19 pandemic and under the Washington State Governor?s Stay Home, Stay Healthy Order, the Department received from Administration for Children and Families (ACF) a waiver of CCDF?s annual unannounced monitoring requirement and allowing for virtual monitoring, through September 30, 2021. The Department updated its CCDF Plan accordingly with ACF approval, but some providers were unable to participate in the virtual process resulting in monitoring visits not being conducted during SFY22. In addition, due to their COVID-19 safety concerns, some providers denied the licensor access or were not available for recheck within the required recheck time-line. Due to the COVID-19 pandemic, the Department experienced a high level of child care licensor turnover. The Department focused available resources on assisting new and current providers to ensure access to child care for families, first responders, and health care workers per the Governor?s directive. The Department processed 1,080 health and safety waivers during calendar years 2020-2022, and prioritized allocating resources to DOH COVID-19 related requirements. Given the Department?s limited staffing resources and high volume of providers, the Department was unable to complete all monitoring visits and was unable to send licensing staff to assist other offices with this work. Starting in fall 2022, the Department began work to recruit new staff and train them on child care licensing rules and regulations to address turnover; however, this effort takes time, due to the extensive training we give our staff. As part of its quality improvement initiates, the Department is now implementing data driven decisions to assist providers and their staff to meet health and safety requirements, and prioritizing monitoring visits to come back into compliance with health and safety requirements. In addition, the Department is implementing new recruitment and training plans for child care licensors. In November 2022, the Department added a new position to assist supervisors with onboarding and training of new staff hired during the audit period. The Department concurs that health and safety monitoring visits were not properly completed during the fiscal year and acknowledge that state fiscal year 2023 audit will indicate similar numbers while the Department implements a corrective action plan along aggressive timelines. The Department is focusing resources to strengthening internal controls around all health and safety requirements. Non-relative FFN provider initial training, ongoing training, and annual technical visits The Department tracks health and safety requirements for FFN providers using the limited tools and fields currently available in WA Compass. The WA Compass system was implemented for licensed child care providers and has not been fully developed for the FFN provider type. The State Auditor?s Office requested data from the WA Compass system for their audit testing in a format the system does not currently support. Due to the fluid nature of the FFN providers, and their payment start dates, the Department was unable to pull data that reflected only providers with open authorizations during the audit period. Further, WA Compass does not currently include all health and safety requirements for FFN providers. The Department has dedicated staff resources to update WA Compass to include all health and safety requirements for FFNs and address data format issues. Staff will continue to track and monitor FFN health and safety requirements with available tools until all system development is completed. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 98.41, Health and safety requirements, states in part: (a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements, which are subject to monitoring pursuant to ? 98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (a) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, the following provisions apply: (1) As part of their health and safety provisions in this area, Lead Agencies shall assure that children receiving services under the CCDF are age-appropriately immunized. Those health and safety provisions shall incorporate (by reference or otherwise) the latest recommendation for childhood immunizations of the respective State, territorial, or tribal public health agency. (2) Notwithstanding this paragraph (a)(1)(i), Lead Agencies may exempt: (1) Children who are cared for by relatives (defined as grandparents, great grandparents, siblings (if living in a separate residence), aunts, and uncles), provided there are no other unrelated children who are cared for in the same setting. (2) Children who receive care in their own homes, provided there are no other unrelated children who are cared for in the home. (3) Children whose parents object to immunization on religious grounds. (4) Children whose medical condition contraindicates immunization. (3) Lead Agencies shall establish a grace period that allows children experiencing homelessness and children in foster care to receive services under this part while providing their families (including foster families) a reasonable time to take any necessary action to comply with immunization and other health and safety requirements. (1) The length of such grace period shall be established in consultation with the State, Territorial or Tribal health agency. (2) Any payment for such child during the grace period shall not be considered an error or improper payment under subpart K of this part. (3) The Lead Agency may also, at its option, establish grace periods for other children who are not experiencing homelessness or in foster care. (4) Lead Agencies must coordinate with licensing agencies and other relevant State, Territorial, Tribal, and local agencies to provide referrals and support to help families of children receiving services during a grace period comply with immunization and other health and safety requirements; (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man- caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of biocontaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and (xi) May include requirements relating to: (A) Nutrition (including age-appropriate feeding); (B) Access to physical activity; (C) Caring for children with special needs; or (D) Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children?s health and safety. (2) Include minimum health and safety training on the topics above, as described in ? 98.44. (b) Lead Agencies may not set health and safety standards and requirements other than those required in paragraph (a) of this section that are inconsistent with the parental choice safeguards in ? 98.30(f). (c) The requirements in paragraph (a) of this section shall apply to all providers of child care services for which assistance is provided under this part, within the area served by the Lead Agency, except the relatives specified at ?98.42(c). (d) Lead Agencies shall describe in the Plan standards for child care services for which assistance is provided under this part, appropriate to strengthening the adult and child relationship in the type of child care setting involved, to provide for the safety and developmental needs of the children served, that address: (1) Group size limits for specific age populations; (2) The appropriate ratio between the number of children and the number of caregivers, in terms of age of children in child care; and (3) Required qualifications for caregivers in child care settings as described at ?98.44(a)(4). (e) Lead Agencies shall certify that caregivers, teachers, and directors of child care providers within the State or service area will comply with the State?s, Territory?s, or Tribe?s child abuse reporting requirements as required by section 106(b)(2)(B)(i) of the Child Abuse and Prevention and Treatment Act (42 U.S.C. 5106a(b)(2)(B)(i)) or other child abuse reporting procedures and laws in the service area. Washington Administrative Code (WAC) 110-16-0025 Health and safety training: (1) A provider described in WAC 110-16-0015 (4)(b) or (c) must complete the following training within ninety calendar days of the subsidy payment begin date: (a) Infant, child, and adult first aid and cardiopulmonary resuscitation (CPR): (i) This training must be taken in person and the provider must demonstrate learned skills to the instructor. (ii) The instructor must be certified by the American Red Cross, American Heart Association, American Safety and Health Institute, or other nationally recognized certification program. (b) Prevention of sudden infant death syndrome and safe sleep practices when caring for infants; and (c) Department approved health and safety training which includes the following topic areas: (i) Prevention and control of infectious diseases; (ii) Administration of medication; (iii) Prevention of, and response to, emergencies due to food and allergic reactions; (iv) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (v) Prevention of shaken baby syndrome, abuse head trauma, and child maltreatment; (vi) Emergency preparedness and response planning for natural disasters and human-caused events; (vii) Handling and storage of hazardous materials and the appropriate disposal of bio contaminants; (viii) Appropriate precautions in transporting children; (ix) Recognition and reporting of child abuse and neglect, including the prevention of child abuse and neglect as defined in RCW 26.44.020 and mandatory reporting requirements under RCW 26.44.030; and (x) Other topic areas as determined by the department. (2) A provider described in WAC 110-16-0015 (4)(b) or (c) can meet the health and safety training in subsection (1)(c) of this section if the department verifies that the provider has completed any of the following either prior to or within ninety calendar days of the subsidy payment begin date: (a) Child care basics, a department approved thirty-hour health and safety training. (b) Washington state early childhood education initial certificate (twelve credits) that includes early childhood education and development 105 health, safety, and nutrition. (3) A provider described in WAC 110-16-0015 (4)(b) or (c) must complete a minimum of two hours of health and safety training annually, using the subsidy payment begin date. The training must include, but is not limited to, one or more of the following: (a) Prevention and control of infectious diseases; (b) Emergency preparedness and response planning for natural disasters and human-caused events; (c) Recognizing and prevention of shaken baby syndrome, head trauma abuse, neglect, and child maltreatment; and (d) Prevention of sudden infant death syndrome and safe sleep practices, if caring for an infant or toddler. WAC 110-16-0030 Health and safety activities: (1) A provider described in WAC 110-16-0015 (4)(b) or (c), must participate in an annual, scheduled visit conducted by department staff in the home where care is provided. (2) The purpose of the visit is to: (a) Provide technical assistance to the provider regarding the health and safety requirements described in this chapter; (b) Observe the provider?s interactions with the child, and discuss health and safety practices; (c) Provide written information and local resources about child development to include the major domains of cognitive, social, emotional, physical development, and approaches to learning; and (d) Provide regional contact information for FFN child care services and resources. (3) A provider will be considered out of compliance with the requirements of this chapter if, after three attempts, the department is not able to complete an annual, scheduled visit in the home where care is provided. (4) At the annual, scheduled visit, the provider must show, unless previously provided to the department: (a) Proof of identity; (b) Proof of current certification for first aid and cardiopulmonary resuscitation (CPR) in the form of a card, certificate, or instructor letter; (c) Proof of vaccination against or acquired immunity for vaccine-preventable diseases for all children in care, if the provider?s children are on-site at any time with the eligible children. Proof can include: (i) A current and complete department of health (DOH) certificate of immunization status (CIS) or certificate of exemption (COE) or other DOH approved form; or (ii) A current immunization record from the Washington state immunization information system (WA IIS). (d) Written permission from the parent to: (i) Allow children to use a swimming pool; (ii) Administer medication for treatment of illnesses and allergies of the children in care; (iii) Provide for and accommodate developmental and special needs; and (iv) Provide transportation for care, activities, and school when applicable. (e) The written emergency preparedness and response plan required in WAC 110-16-0035 (8)(c).

2022-046 The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements to ensure potential child care fraud was correctly identified and reported for the Child Care and Development Fund Cluster. Assistance Listing Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2003WACCDF; 2103WACCDF; 2203WACCDF; 2003WACCC3; 2103WACDC6; 2103WACSC6; 2103WACCDD Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Fraud Detection and Repayment Known Questioned Cost Amount: None Background The Department of Children, Youth, and Families (DCYF) administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2022, the Department spent about $668.6 million in CCDF federal funding, which was an increase of about $341.1 million compared to the prior fiscal year. The Department spent more than $260.5 million of this CCDF federal funding on monthly child care subsidy payments to child care providers. Although DCYF is the lead agency for the CCDF program, the Department of Social and Health Services? (Department) Office of Fraud and Accountability (OFA) has the statutory authority to conduct investigations related to allegations of fraud in the program. State law requires DCYF to refer suspected incidents of child care subsidy fraud to OFA for appropriate investigation and action. Both DCYF and the Department accept reports of suspected fraud online, by mail, phone or fax. Staff from either agency can report suspected fraud through internal systems or to a hotline. When the Department receives a report of suspected client fraud in a program it oversees, it runs the report through an automated process in its Barcode system to assess the level of potential fraud risk. The process considers which programs the client receives benefits from, the total benefits (dollars) the client receives, whether the client has come up on prior reports, the client?s overpayment history, and how the suspected fraud was referred. These factors are all assigned point values that vary based on the client?s particular case, including adding four points if the case was referred through the OFA hotline. These point values are summed and, based on this total, the priority level of the suspected fraud is rated from 1 to 5, with 1 being the highest risk level. Each priority level is separated by five points. Once OFA receives the priority rating, the case is assigned to an investigator for review. OFA supervisors attempt to assign all reports rated as 1 or 2 and then work their way down to lower-rated reports. In 2018, the OFA Director issued a directive to managers that all Fraud Early Detection (FRED) reports rated as 1 or 2 should be assigned within 90 days of the case being referred. OFA management explained that some reports are not assigned to investigators because of workload capacity. No matter what priority level is assessed, if a FRED report is not assigned to an investigator within 90 days, it is ?aged out? and sent back to Department program staff. Program staff review the original reported information and decide whether to send the case back through the automated process to be reassessed or dismiss the fraud report. In fiscal year 2022, OFA received 2,324 child care fraud reports. Of those, 294 (13 percent) reports aged out of the system. If an OFA Intentional Overpayment Investigation (IOI) concludes that potential fraud occurred, the results are sent to a local prosecuting attorney?s office or United States attorney?s office. If a court responds with the legal determination of fraud, the case is forwarded to the Department?s Office of Financial Recovery to seek repayment from the client. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure potential child care fraud was correctly identified and reported for the program. During our review of CCDF fraud cases, we found that the Department?s Barcode system did not add the required four-point value to 143 child care fraud cases that originated from the OFA hotline. This resulted in cases receiving a lower priority level than they should have. Additionally, the Department did not retain documentation supporting the priority level of cases received. Therefore, we were unable to accurately recalculate the assigned priority level to determine how many were improperly assigned a lower priority level. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not establish sufficient internal controls to ensure the Barcode algorithm was properly assigning point values to child care fraud cases received from the OFA hotline, and that data supporting the priority level assigned to potential fraud cases was retained and reviewed for accuracy. Effect of Condition By not establishing adequate internal controls, the Department cannot ensure it is properly prioritizing and reviewing potential child care fraud cases originating from the fraud hotline. Because the Department did not retain support for its original calculations, we could not recalculate the priority levels that should have been originally assigned to child care fraud cases and therefore cannot determine the overall effect of this internal control weakness. By failing to ensure that all fraud hotline referrals for child care fraud cases are being correctly identified and reviewed, the Department cannot ensure it is recovering fraudulent child care payments. Recommendations We recommend the Department: ? Establish effective internal controls to ensure the Barcode algorithm properly scores potential fraud cases ? Establish effective internal controls to ensure the original data supporting case priority levels is retained for managerial monitoring and review Department?s Response The Department concurs with the finding. The barcode algorithm was updated to fix the improper scoring of the Fraud Early Detection referrals (FRED) when the deficiency was identified. Referrals are being scored as per the details of the algorithm to include the additional four points for FRED referral received from hotline calls. A request to store the information for the prioritization tool was made to the Economic Services Administration (ESA). ESA maintains the Barcode system and server space that it is hosted on. This request must go through all appropriate review and considerations to be worked on by the Barcode team. ESA will decide if it is feasible to store this information on all processed referrals. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 98, Child Care and Development Fund, section 60, Availability of funds, states in part: (i) Lead agencies shall recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. Directive / Prioritizing FRED Cases ? dated January 31, 2018, states in part: As is current practice, all Regional Managers are directed to assign FRED cases using the prioritization scoring system. Cases should be assigned based on priority level starting with Priority level 1 cases and working down to priority level 5 as workloads permit. A manager?s focus should be on getting all the priority 1 and 2 cases assigned within 90 days of the referral from CSD based on available staffing in each region. After priority level 1 and 2 cases are assigned, the balance of the priority levels should be assigned based on the scoring, geography of the region and worker availability. This has been the practice of OFA since the FREDS were given scores but a recent state audit recommended it become written policy.

2022-047 The Department of Children, Youth, and Families did not have adequate controls over and did not comply with certain requirements of its Public Assistance Cost Allocation Plan. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: 2102WAFOST; 2202WAFOST Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Known Questioned Cost Amount: None Background As a condition of receiving federal grant funds, the Department of Children, Youth, and Families must submit a Public Assistance Cost Allocation Plan (PACAP) to the U.S. Department of Health and Human Services each state fiscal year. The PACAP describes how the Department is authorized to allocate indirect costs like overhead and general administrative expenses to all funding sources, including federal grants. The Department uses the Cost Allocation System (CAS), a subsystem of the Agency Financial Reporting System (AFRS), to execute its PACAP. The Department develops appropriate methodologies and updates cost allocation base input tables that contain cost objectives, which automatically distribute the cost of payments to either state, local or federal funding sources. The tables in CAS can be added, deleted, changed, or inactivated each calendar month. As part of its cost allocation process, the Department establishes bases that are used to distribute costs to multiple funding sources. Each base consists of elements that are assigned a percentage that dictates how much of the original payment is allocated to it. For example, a base could be made up of three elements that allocate 35 percent, 25 percent, and 40 percent, respectively, that will total 100 percent. Records of these bases are kept in workbooks that management review and approve before they are uploaded or keyed into AFRS for use. In fiscal year 2022, the Department allocated about $17 million in indirect costs to the Foster Care grant. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate controls over and did not comply with certain requirements of its PACAP. According to the Department?s PACAP, Base 100, which are charges for administrative costs, should be updated monthly with full-time equivalents disbursed to reflect the work that agency staff have performed. This method allows the Department to allocate administrative charges proportionately to the staffing level required to meet the program?s needs. We examined nine monthly workbooks completed during the audit period. While the Department was supposed to complete 12 workbooks, we found it did not complete them for the first three months of the audit period (July, August and September of 2021). We determined this internal control deficiency is a material weakness that led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not assign sufficient staffing resources to ensure all monthly workbooks were completed in accordance with the Department?s approved PACAP. Effect of Condition The Department?s inadequate internal controls affected the accuracy of the indirect costs charged to the Foster Care grant for the first three months of the audit period. Specifically, we found the Department undercharged the Foster Care program by $154,113. When workbooks are not updated, the Department increases its risk of undercharging or improperly allocating indirect costs to the Foster Care program. Recommendation We recommend the Department strengthen internal controls to ensure that monthly workbooks are properly updated in accordance with the approved PACAP. Department?s Response The Department concurs with the finding. During July through September, the first three months of the audit period, the Department did not have adequate staffing levels to maintain the business processes for Base 100 entries. Available staff were focused on grant reconciliations and closing out the prior fiscal year financial transactions. The Department is committed to improving our internal controls and has reviewed the base edit form written procedures with staff and added monthly reminders for the Cost Allocation and Grants Management Unit. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 95, Subpart E ? Cost Allocation Plans, section 95.501, Purpose, states: (a) Preparation, submission, and approval of State agency cost allocation plans for public assistance programs; and (b) Adherence to approved cost allocation plans in computing claims for Federal financial participation. Public Assistance Cost Allocation Plan ? Appendix 3 Administrative Costs, Base 100, states in part: FTEs are based on actual months and are reported by funding source. This information is obtained on a monthly basis from the Enterprise Reporting system at DCYF and is used on a rolling period with a one-month lag. For example, the FTEs for July would be used in the September plan.

2022-048 The Department of Children, Youth, and Families did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 ? Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2102WAFOST; 2202WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: None Background The federal Foster Care Title IV-E (Foster Care) program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state?s child welfare agency until the children are returned home, placed with adoptive families, or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for the adults in the Foster Care program, including state agency staff, foster parents and certain private agency staff. In Washington, the Department of Children, Youth, and Families (Department) administers the Foster Care program. During fiscal year 2022, the Department spent about $123 million in federal grant funds, including approximately $7.3 million for travel and family visits. Parent-child visits are a key strategy for minimizing a child?s time in out-of-home care and working toward family reunification. The Department creates a visit plan based on dependency court order visit requirements and other information to ensure the child?s safety. This visit plan is created and saved in FamLink. When the Department needs contracted family time services, the Department sends a visit plan/referral through a Famlink-Sprout interface. Visit coordinators send this referral to the most appropriate contracted service provider through the Sprout system. These referrals authorize the contracted provider to provide the needed services. After the visit is completed, contracted service providers complete visit reports, which include travel mileage and travel time. Based on these reports and information the contractor enters into the Sprout system, the Department will determine reimbursement on the invoice. These reports and invoices are to be reviewed and approved by the contracted provider administrator or manager, to catch errors and ensure quality assurance. The Department pays the provider solely based on the summary-level information it enters into Sprout. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. The prior finding number was 2021-040. Description of Condition The Department did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. The Department did not follow its procedures for performing fiscal monitoring of foster care service providers to ensure federally funded payments for travel and family visits were adequately supported and only for allowable activities. We consider this internal control deficiency to be a significant deficiency. Cause of Condition Management did not perform fiscal monitoring of the Department?s providers because it thought Sprout had fiscal monitoring features and did not verify they were in place and operating effectively. Effect of Condition By not performing adequate fiscal monitoring, the Department cannot ensure payments for travel and family visits are allowable and adequately supported. Recommendation We recommend the Department follow its fiscal monitoring procedures to ensure payments to providers for travel and family visits are allowable and adequately supported. Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor?s Office?s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. The Department is committed to strengthening internal controls and complying with grant requirements. The Department will work with Financial and Business Services Division and Foster Care Program to review the fiscal monitoring procedures to ensure payments to providers for travel and family visits are allowable and adequately supported. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2022-049 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with some Public Assistance Cost Allocation Plan requirements. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 Foster Care Title IV-E 93.659 Adoption Assistance 93.659 COVID-19 Adoption Assistance Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2102WAFOST; 2202WAFOST; 2102WAADPT; 2202WAADPT Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: None Background The Department of Children, Youth, and Families uses the Random Moment Time Study (RMTS) to allocate costs for its headquarters and regional operations to the proper state and federal programs. Department staff generally work on multiple programs and cases throughout a workday, which makes maintaining a timesheet difficult and time consuming. The RMTS simplifies how the Department allocates the cost of time and effort to state and federal programs. The RMTS is a sampling tool that the Department uses to generate statistically valid statewide estimates of various activities employees have performed. The Department also uses a system called FamLink, which allows staff to work on client cases, document information, generate samples and compile RMTS results. The Department?s use of the RMTS is included in its Public Assistance Cost Allocation Plan (PACAP) with the federal grantor. The PACAP is approved annually and outlines the general operating policies and procedures that the RMTS staff must follow. For the RMTS to properly calculate the percentages of activities Department staff have performed, it must start by identifying a sampling universe that is accurate and complete. The sampling universe lists the eligible worker types to be included and is updated monthly to ensure all eligible workers are included in the sample. The RMTS Coordinators and RMTS Headquarters (HQ) are responsible for keeping the list of sample workers current. To ensure the sample worker population is complete, the RMTS HQ runs the worker report, filters it, and then communicates the report to the RMTS Coordinators to verify proper workers are included, excluded, or documented with the right worker type to maintain an accurate RMTS population. The RMTS Coordinators send the RMTS HQ emails informing them of the changes that need to be made to assigned workers and the unassigned workers. The RMTS HQ will then update the workers? profiles in FamLink as updates come in. Sampled workers are responsible for completing an accurate and timely RMTS sample within three business days. The RMTS HQ performs a quality control review of all completed samples to ensure staff are completing them correctly. At the end of the month, the Department uses FamLink to summarize the sample results for the month. The results are then compiled and used to fill out the Cost Allocation Base Data Input Sheets for each RMTS base. The results are then entered into the Cost Allocation System. During fiscal year 2022, the Department used the RMTS to allocate about $34.8 million to the Foster Care-Title IV-E and Adoption Assistance programs. Federal regulations require recipients to establish and follow internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In the prior three audits, we reported the Department did not have adequate internal controls over and did not comply with some PACAP requirements. The prior finding numbers are 2021-042, 2020-044 and 2019-044. Description of Condition The Department did not have adequate internal controls over and did not comply with some PACAP requirements. We randomly selected five out of the 12 monthly employee updates to determine whether the sampling universe was complete. The RMTS HQ Program Manager is responsible for creating monthly employee reports that show current staff who are in the sampling population, as well as a report of employees who may be RMTS eligible. The Program Manager forwards these reports to the RMTS Coordinators asking for updates of employees on each report. Once the Program Manager receives the RMTS Coordinators? responses, the Program Manager updates FamLink to ensure the sampling universe is complete. For all five of the sampled months that we examined, the Department was unable to demonstrate the RMTS sampling universe was completed due to a lack of documentation. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not retain documentation detailing which workers were added and removed from the sampling universe each month. Because of this, it was not possible to verify the completeness of the RMTS population. Effect of Condition The Department?s inadequate internal controls affected the integrity of its RMTS sampling universe. An erroneous sample could cause the costs the Department has charged to federally funded programs for its headquarters and regional operations to be unallowable, according to the PACAP. Recommendation We recommend the Department ensure staff follow its own established procedures to ensure RMTS sampling populations are accurate and complete. Department?s Response The Department maintains that the sampling universe is accurate and complete. There is not a deficiency with the integrity of the RMTS sample and the Department complies with federal requirements. The Department?s RMTS instructions included in the federally approved Public Assistance Cost Allocation Plan (PACAP) are more restrictive than federal requirements. Communication with the Regional RMTS Coordinators occurs regularly and cost pools are updated within the parameters identified within the RMTS instructions. The HQ RMTS Coordinator pulls three monthly reports from FamLink, the Child Welfare case management system, which the RMTS is a component of, and the Human Resource Management System to verify worker eligibility and proper classification to strengthen the internal controls around RMTS samples pulled. For these reasons, the Department maintains the position that the sampling universe complies with federal regulations. The Department contracted with the University of Massachusetts, effective October 2022, for the design and implementation of the RMTS mechanism. The Department has updated the RMTS instructions in the PACAP based on the new quarterly process implemented under the University of Massachusetts contract. The new process remains in compliance with federal law while alleviating the department-imposed restrictions and addresses the auditor?s concerns regarding the internal controls applicable to the RMTS worker types included in the sampling universe. Auditor?s Remarks Our audit procedures were designed to determine whether the Department charged only allowable costs to federal grants in compliance with their approved PACAP and federal law. Two CFR 200.430 requires the following: ? The sampling universe must include all employees whose salaries and wages are to be allocated based on sample results ? The entire time period involved must be covered by the sample ? The results must be statistically valid and applied to the period being sampled. During the audit period, the Department was unable to provide sufficient documentation showing the sampling universe was complete. We reaffirm our finding, and we will follow up on the Department?s corrective action during the next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Department of Children Youth and Families Public Assistance Cost Allocation Plan, RMTS Program Instructions, page 37, states in part: Headquarters RMTS staff shall be responsible for the following actions: Overseeing the system?s monthly batching of new samples which includes three variables: ? Random Moment Starting Time ? Random Interval Time Random ? Employee List The Headquarters RMTS Staff work with the RMTS Coordinators in order to keep the list of sampled workers current. Worker employment status changes should be reported by the social workers? supervisors to RMTS Coordinators. In addition, HQ Staff need to verify that each worker has an RMTS Worker Type associated with him or her and an RMTS Group linking the worker to his or her coordinator. The Regional RMTS Coordinator shall be responsible for the following actions: Notify HQ RMTS Staff of any updates to their worker list when there is any change in employment status of a worker participating in the RMTS survey within five working days of change. In addition, the coordinator needs to provide HQ RMTS Staff with an appropriate RMTS Worker Type code for each worker added to the system.

2022-050 The Department of Children, Youth, and Families did not have adequate internal controls to ensure group care facility employees had cleared background checks before having unsupervised access to children. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2102WAFOST; 2202WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: None Background The federal Foster Care Title IV-E (Foster Care) program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state?s child welfare agency until they are returned home, placed with adoptive families, or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for the adults in the Foster Care program, including state agency staff, foster parents and certain private agency staff. In Washington, the Department of Children, Youth and Families administers the Foster Care program. During fiscal year 2022, the Department spent about $123 million in federal grant funds, including approximately $28.5 million dollars for payments to providers for direct client services with $1.2 million being payments to licensed group care facilities. Licensed group care facilities are maintained and operated for groups of children on a 24-hour basis to provide safe, healthy living environments that meet the developmental needs of the children in care. These facilities are not permanent homes for foster children, but they provide a higher level of care for the children who are in them. Before a facility becomes licensed, it must complete an application that the Department reviews to ensure the facility is compliant with licensing requirements. This includes ensuring all people working in the facility have cleared background checks, which is a requirement in state and federal law. After the initial application, the Department requests the group care facility provide quarterly reports of new and existing employees to ensure all have cleared background checks before they are allowed unsupervised access to children. To track this, the Department enters employees? information and the facility they work at into the FamLink system. FamLink is a service delivery and support system the Department uses to track clients statewide, and management uses it to track service performance and outcomes. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure group care facility employees had cleared background checks before having unsupervised access to children. The Department has established monitoring procedures to ensure group care facility employees have cleared background checks before beginning work. To determine if these procedures were effective for ensuring employees had cleared the required background checks before beginning work, we used a statistical sampling method to randomly select and examine 59 group care facility employees out of a total population of 4,900. We reviewed the 59 employees? background checks and compared them to their employment start dates. We found the Department did not document employees? start dates, and it could not verify that 28 employees we selected had cleared background checks before beginning work in a group care facility. We consider this internal control deficiency to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition FamLink does not have a function that allows the Department to effectively monitor when an employee first starts working in a facility. The Department attempted to use quarterly rosters to assist with tracking start dates, but this process did not work as intended. Effect of Condition Without documenting employees? start dates, the Department cannot ensure they have cleared background checks before beginning work. By not adequately monitoring group care facility employee start dates, ineligible employees could have unsupervised access to children before they have cleared the required background checks. To ensure the 28 employees had cleared background checks before beginning work, we independently reviewed additional information the Department requested from the group care facilities during our audit. Our review confirmed all 28 employees had cleared background checks before beginning work. Recommendation We recommend the Department strengthen its internal controls and ensure all group care facility employees have cleared backgrounds check before beginning work. Department?s Response The Department partially concurs with the finding. As stated in the audit finding section, Effect of Condition, all group care facility staff sampled during the audit had a cleared background check prior to working in the facility. While we agree the use of definitions such as ?effective date? and ?start date? could be misleading, we do not concur the Department did not have adequate internal controls to ensure group care facility employees had cleared back ground checks before having unsupervised access to children. The Department is committed to ensuring the health, safety and well-being of all children in our care. We are confident that staff who work with children and youth have a cleared background check. The Department concurs we do not document staff members? start dates in FamLink. FamLink is used to document background clearance information, but it only allows for one date to be entered as the ?effective date.? This ?effective date? is imported to the Background Check System as the ?start date.? The Department?s Licensing Division enters the ?effective date? as the date that the background check paperwork on an applicant/staff member is received from the facility, this is to verify the correct applicant/staff member whose background check is being processed. The data pulled as part of the audit referenced the ?start date? from the Background Check System, which the auditor?s office interpreted as hire date or first date they began work in the facility, which was not accurate. To strengthen internal controls and documentation, effective April 1, 2023, the Department implemented a new process for processing background checks for group care facilities. Applicant/staff member background check request forms are submitted directly to the Background Check Unit by the facility. The Background Check Unit processes a fingerprint background check, a child abuse/neglect history check, and if applicable, a suitability assessment. The results are then provided to the Licensing Division and the group care facility. If the applicant is cleared, the Licensing Division staff adds the staff member to the group care facility in FamLink. The new ?effective date? in FamLink is the final approval from the Background Check Unit. In addition, Regional licensors continue to conduct yearly health and safety monitoring visits, which includes a random sample review of personnel files containing background check information. Auditor?s Remarks The purpose of our testing was to ensure employees had a clear background check prior to them working at the group home facility. During our review, the Department was unable to demonstrate whether some employees had clear background checks before working because they did not have the start date of their employment. For these employees, the Department had to go to each facility to determine the start date of employees to verify the employee we selected for our testing had a clear background check before working. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 45 CFR Part 1356.30, Safety requirements for foster care and adoptive home providers, states in part: (f) In order for a child care institution to be eligible for title IV-E funding, the licensing file for the institution must contain documentation which verifies that safety considerations with respect to the staff of the institution have been addressed. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. RCW 43.43.837, Fingerprint-based background checks?Requirements for applicants and service providers?Shared background checks?Fees?Rules to establish financial responsibility, states in part: (1) Except as provided in subsection (2) of this section, in order to determine the character, competence, and suitability of any applicant or service provider to have unsupervised access, the secretary of the department of social and health services and the secretary of the department of children, youth, and families may require a fingerprint-based background check through both the Washington state patrol and the federal bureau of investigation at any time, but shall require a fingerprint-based background check when the applicant or service provider has resided in the state less than three consecutive years before application, and: (a) Is an applicant or service provider providing services to children or people with developmental disabilities under RCW 74.15.030; (b) Is an individual sixteen years of age or older who: (i) Is not under the placement and care authority of the department of children, youth, and families; and (ii) resides in an applicant or service provider's home, facility, entity, agency, or business or who is authorized by the department of children, youth, and families to provide services to children under RCW 74.15.030; (c) Is an individual who is authorized by the department of social and health services to provide services to people with developmental disabilities under RCW 74.15.030; or (d) Is an applicant or service provider providing in-home services funded by: (i) Medicaid personal care under RCW 74.09.520; (ii) Community options program entry system waiver services under RCW 74.39A.030; (iii) Chore services under RCW 74.39A.110; or (iv) Other home and community long-term care programs, established pursuant to chapters 74.39 and 74.39A RCW, administered by the department of social and health services. (2) Long-term care workers, as defined in RCW 74.39A.009, who are hired after January 7, 2012, are subject to background checks under RCW 74.39A.056. (3) To satisfy the shared background check requirements provided for in RCW 43.216.270 and 43.20A.710, the department of children, youth, and families and the department of social and health services shall share federal fingerprint-based background check results as permitted under the law. The purpose of this provision is to allow both departments to fulfill their joint background check responsibility of checking any individual who may have unsupervised access to vulnerable adults, children, or juveniles. Neither department may share the federal background check results with any other state agency or person. (4) The secretary of the department of children, youth, and families shall require a fingerprint-based background check through the Washington state patrol identification and criminal history section and the federal bureau of investigation when the department seeks to approve an applicant or service provider for a foster or adoptive placement of children in accordance with federal and state law. Fees charged by the Washington state patrol and the federal bureau of investigation for fingerprint-based background checks shall be paid by the department of children, youth, and families for applicant and service providers providing foster care as required in RCW 74.15.030. (5) Any secure facility operated by the department of social and health services or the department of children, youth, and families under chapter 71.09 RCW shall require applicants and service providers to undergo a fingerprint-based background check through the Washington state patrol identification and criminal history section and the federal bureau of investigation. (6) Service providers and service provider applicants, except for those long-term care workers exempted in subsection (2) of this section, who are required to complete a fingerprint-based background check may be hired for a one hundred twenty-day provisional period as allowed under law or program rules when: (a) A fingerprint-based background check is pending; and (b) The applicant or service provider is not disqualified based on the immediate result of the background check. Department of Children, Youth, and Families, Policies and Procedures 6800 ? Background Checks, states in part: 3(c) Requestors must, prior to authorizing unsupervised access to children or youth, review background check decisions on the completed Background Check Request/Decision DCYF 09-131 form received from the BCU ?

2022-051 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with reporting requirements for the Foster Care program. Assistance Listing Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 ? Foster Care Title IV - E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2102WAFOST; 2202WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The purpose of the Foster Care program is to provide safe and stable out-of-home care for children under placement and care authority of state welfare agencies. To accomplish this, the Administration for Children and Families (ACF) in the U.S. Department of Health and Human Services (HHS) offers financial support to states to offset the cost of foster care maintenance for eligible children, administrative costs to manage the program, and training for state agency staff, foster parents and qualified private agency staff. As of June 2022, approximately 8,000 children were in Washington?s foster care system. In fiscal year 2022, the Department spent almost $126 million in federal program funds, Within 30 days after each fiscal quarter, the Department of Children, Youth, and Families (Department) is required to file the CB-496: Title IV-E Programs Quarterly Financial Report with HHS to report its Foster Care program expenditures and the number of children it has served. The ACF relies on the information reported to award funds, determine the allowability of the reported expenditures, and to provide reports to Congress. Federal regulations require recipients to establish and follow internal controls that ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with reporting requirements for the Foster Care program. We reviewed all four reports the Department submitted during the audit period, and we found that three were inaccurate. In the three reports with errors, the Department misstated its program expenditures by a total of $10,097,303, including approximately $9.6 million in understatements and $500,000 in overstatements. The Department also overstated the total number of children receiving foster care benefits by 10,115. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition When completing the quarterly reports, the Department did not follow HHS?s published instructions. In addition, while the Department has an established review process, the reviews that staff performed were insufficient for detecting errors in the reports. Management said that due to competing priorities and staffing shortages, the Department did not thoroughly review the reports before submitting them to HHS. Effect of Condition Because HHS uses these reports to determine award amounts and whether reported expenditures are allowable, it may have relied on inaccurate data to make these determinations for the Department. The grant agreement also allows HHS to take action for the Department?s noncompliance, which can include temporarily withholding funds, wholly or partly suspending or terminating the award, and withholding further program awards. Recommendations We recommend the Department: ? Follow HHS?s published instructions when completing the quarterly CB-496 reports ? Strengthen its review processes to ensure the reports are accurate and supported before submitting them to HHS Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor?s Office?s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. During the audit period, the Department acknowledges errors were made in the quarterly reports. While the Department understands accuracy is vital, the error understating expenditures by $9.0 million in the first report was identified and corrected in the FFY 2022, second quarter report. We will review and strengthen our internal processes in order to complete the quarterly reports accurately. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 U.S. Code of Federal Regulations (CFR) Part 201, Grants to States for Public Assistance Programs, establishes the following applicable requirements: Section 201.5 Grants, states in part: (a) Form and manner of submittal. (1) Time and place: The estimates for public assistance grants for each quarterly period must be forwarded to the regional office 45 days prior to the period of the estimate. They include a certification of State funds available and a justification statement in support of the estimates. A statement of quarterly expenditures and any necessary supporting schedules must be forwarded to the Department of Health and Human Services, Family Support Administration, not later than 30 days after the end of the quarter. (2) Description of forms: ?State Agency Expenditure Projection - Quarterly Projection by Program? represents the State agency's estimate of the total amount and the Federal share of expenditures for assistance, services, training, and administration to be made during the quarter for each of the public assistance programs under the Act. From these estimates the State and Federal shares of the total expenditures are computed. The State's computed share of total estimated expenditures is the amount of State and local funds necessary for the quarter. The Federal share is the basis for the funds to be advanced for the quarter. The State agency must also certify, on this form or otherwise, the amount of State funds (exclusive of any balance of advances received from the Federal Government) actually on hand and available for expenditure; this certification must be signed by the executive officer of the State agency submitting the estimate or a person officially designated by him, or by a fiscal officer of the State if required by State law or regulation. (A form ?Certificate of Availability of State Funds for Assistance and Administration during Quarter? is available for submitting this information, but its use is optional.) If the amount of State funds (or State and local funds if localities participate in the program), shown as available for expenditures is not sufficient to cover the State's proportionate share of the amount estimated to be expended, the certification must contain a statement showing the source from which the amount of the deficiency is expected to be derived and the time when this amount is expected to be made available. (3) The State agency must also submit a quarterly statement of expenditures for each of the public assistance programs under the Act. This is an accounting statement of the disposition of the Federal funds granted for past periods and provides the basis for making the adjustments necessary when the State's estimate for any prior quarter was greater or less than the amount the State actually expended in that quarter. The statement of expenditures also shows the share of the Federal Government in any recoupment, from whatever source, including for title IV-A the appropriate share of child support collections made by the State, of expenditures claimed in a prior period, and also in expenditures not properly subject to Federal financial participation which are acknowledged by the State agency, including the share of the Federal Government for uncashed and cancelled checks as described at 45 CFR 201.67 and replacement checks as described at 45 CFR 201.70 in this part, or which have been revealed in the course of an audit.

2022-052 The Department of Children, Youth, and Families did not have adequate internal controls over level of effort requirements for the Adoption Assistance program. Assistance Listing Number and Title: 93.659 Adoption Assistance 93.659 COVID-19 Adoption Assistance Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2102WAADPT; 2202WAADPT Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Level of Effort Known Questioned Cost Amount: None Background The Adoption Assistance program is administered at the federal level by the Children?s Bureau, Administration on Children, Youth and Families, Administration for Children and Families (ACF), a component of the U.S. Department of Health and Human Services (HHS). Since federal fiscal year 2010, the Title IV-E Adoption Assistance program has provided eligibility provisions for any child who meets the expanded eligibility criteria, which resulted in more children being determined as eligible for Title IV-E. The increased eligibility allows states to receive additional federal funding for adoption, thereby allowing them to reduce the level of nonfederal funds they use for these services. The reduction in nonfederal spending is referred to as ?adoption savings.? Beginning in federal fiscal year 2015, each Title IV-E agency must annually calculate and report on the amount of any adoption savings, how savings are spent, and on what services. Agencies must use their adoption savings to expand services that may be provided under Title IV-B or IV-E programs. Additionally, agencies must spend no less than 30 percent of the savings on post-adoption services, post-guardianship services, and services to support positive outcomes for children at risk of entering foster care. Agencies must also spend at least two-thirds of this 30 percent on post-adoption and post-guardianship services. In Washington, the Department of Children, Youth, and Families (Department) administers the Adoption Assistance program to encourage people to adopt children out of the foster care system. The program supports approximately 17,000 children and 11,000 families. In fiscal year 2022, the Department spent about $58.6 million in federal funding, and had $1.9 million in state funding for Adoption Savings. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with level of effort requirements for the Adoption Assistance program. The prior finding number was 2021-045. Description of Condition The Department did not have adequate internal controls over level of effort requirements for the Adoption Assistance program. In the prior audit, we determined the Department split the responsibility for tracking and managing adoption savings expenditures between staff for the Child Welfare Program and Cost Allocation and Grant Management Unit, and that coordination between these areas was insufficient for ensuring that staff maintained accounting records to verify adoption savings expenditures. We also determined the Department did not have policies or procedures to monitor its compliance with the program?s level of effort requirements. During this audit period, the Department created a new position to manage and track its adoption savings spending, but the position was not filled until February 2022. The Department has also not implemented policies or procedures to monitor its compliance with the program?s level of effort requirements. We consider these internal control deficiencies to be a material weakness. Cause of Condition In response to the prior audit finding, the Department developed a corrective action plan to address the internal control deficiencies our Office identified. However, the Department did not fully implement the action plan during the current audit period. Effect of Condition If the Department does not have adequate internal controls and is noncompliant with program requirements, the grant agreement allows the grantor to take action, including temporarily withholding funds, wholly or partly suspending or terminating the award, and withholding further awards from the program. Recommendation We recommend the Department implement written policies and procedures to properly track its adoption savings spending. Department?s Response As stated in the Cause of Condition, the Department did not fully implement the corrective action plan during the audit period. Due to the timing and frequency of the statewide single audits, the Department is not made aware of a finding until months after the state fiscal year (SFY) concludes. It is not always feasible to correct audit issues before a new audit cycle begins. Thereby, the previous year?s audit issues will remain outstanding up to nine months of the current audit period. For this reason, the Department anticipates receiving repeat findings for consecutive years. The Department created a new position to manage the adoption support program and to oversee the adoption saving expenditures through FamLink in February 2022. In May 2022, the Department established reoccurring monthly meetings between Child Welfare Program and Cost Allocation and Grant Management Unit to review expenditures and level of effort requirements for the calculated adoption savings dollars. Written procedures for federal adoption savings expenditure requirements and tracking were reviewed and adoption savings reports were accurate during the audit period. While this is a repeat finding, the Department received the SFY 2021 finding from the State Auditor?s Office in May 2022, eleven months after SFY 2022 started. Therefore, the Department was unable to revise its internal controls prior to the SFY 2022 audit. The Department and the State Auditor?s Office will not see the full benefit of these corrective actions until the SFY 2023 audit. As to the auditor?s recommendation, the Department maintains that there are no federal regulations that require an agency to have a written policy for level of effort reporting. The Department has written procedures for federal adoption savings expenditure requirements and tracking of adoption savings. In addition, we have written procedures for the use of adoption savings paid through FamLink using assigned service codes. These service codes include evidence-based practices, parental counseling, catastrophic circumstances, and the Promoting and Support Permanency Committee for both adoption and guardianship families. The Department assigns specific FamLink service codes for payment and tracking purposes. The Department has reviewed and incorporated the guidance published by the U.S. Government Accountability Office report on Better Data and Guidance Could Help States Reinvest Adoption Savings and Improve Federal Oversight into our processes and procedures. The Department also follows the ACF reporting guidelines and uses tools they provide to track expenditures in compliance with the grant and no exceptions were noted for the audit period. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. 42 U.S. Code ? 673 ? Adoption and guardianship assistance program (a) Agreements with adoptive parents of children with special needs; State payments; qualifying children; amount of payments; changes in circumstances; placement period prior to adoption; nonrecurring adoption expenses (8) (A) A State shall calculate the savings (if any) resulting from the application of paragraph (2)(A)(ii) to all applicable children for a fiscal year, using a methodology specified by the Secretary or an alternate methodology proposed by the State and approved by the Secretary. (B) A State shall annually report to the Secretary? (i) the methodology used to make the calculation described in subparagraph (A), without regard to whether any savings are found; (ii) the amount of any savings referred to in subparagraph (A); and (iii) how any such savings are spent, accounting for and reporting the spending separately from any other spending reported to the Secretary under part B or this part. (C) The Secretary shall make all information reported pursuant to subparagraph (B) available on the website of the Department of Health and Human Services in a location easily accessible to the public. (D) (i) A State shall spend an amount equal to the amount of the savings (if any) in State expenditures under this part resulting from the application of paragraph (2)(A)(ii) to all applicable children for a fiscal year, to provide to children of families any service that may be provided under part B or this part. A State shall spend not less than 30 percent of any such savings on post-adoption services, post-guardianship services, and services to support and sustain positive permanent outcomes for children who otherwise might enter into foster care under the responsibility of the State, with at least ? of the spending by the State to comply with such 30 percent requirement being spent on post-adoption and post-guardianship services. (ii) Any State spending required under clause (i) shall be used to supplement, and not supplant, any Federal or non-Federal funds used to provide any service under part B or this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2022-053 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure clients were eligible for the Children?s Health Insurance Program. Assistance Listing Number and Title: 93.767 Children?s Health Insurance Program 93.767 COVID-19 Children?s Health Insurance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2005WA5021; 1905WA5021; 2105WA5021; 2205WA5021; Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: $3,036,657 Background The Health Care Authority administers the Children?s Health Insurance Program (CHIP). CHIP is a jointly funded state and federal partnership providing insurance coverage for almost 90,000 children and pregnant people in families with incomes too high to qualify for Medicaid. Federal CHIP financing is capped, and each state operates under an allotment. During fiscal year 2022, the Authority spent more than $229 million in state and federal funds to administer CHIP. To determine initial eligibility for CHIP, families must complete an application in the Washington Health Benefit Exchange, known as Washington Healthplanfinder, or through a streamlined paper application. Once families complete their applications, electronic verification sources confirm their income, immigration status and Social Security numbers (SSNs). The Authority automatically reviews applicants? eligibility first for Medicaid and then for CHIP if they are ineligible for Medicaid. Children in low-income families who are ineligible for Medicaid are enrolled in CHIP under the state CHIP plan. Washington has also elected to cover the prenatal period of some low-income pregnant people under the state CHIP plan. CHIP clients must be either U.S. citizens or lawfully present qualified noncitizens, and their eligibility is based on self-attested income in their applications; therefore, clients with verified citizenship and SSNs would be determined eligible if their reported income was between 210 percent and 312 percent of the federal poverty level. Once the Authority determines clients? initial eligibility, their start date is recorded as the first of the month in which their application was submitted, thus allowing for payments prior to approval to be processed after the fact. Children found eligible for medical assistance remain continuously eligible for a full 12 months, regardless of any changes in their household income or third-party liability. Households must report financial and nonfinancial changes, but these will not render them ineligible during the continuous eligibility period. However, if recipients? household income decreases, the Authority can move children to a more favorable program, such as Medicaid, to eliminate the premium payment requirements. Termination during the continuous eligibility period is acceptable only for the following reasons: ? Changes in residency (permanent move out of state) ? Death ? Fraud (unless it is going to prosecution) ? Failure to pay the premium for more than three months ? The child turns 19 years old (remains eligible through the end of their birth month) ? After the end of the month in which the postpartum period ends for pregnant people ? When a client requests to be removed from the program In response to the COVID-19 pandemic, the Centers for Medicare and Medicaid Services (CMS) approved waivers and disaster relief state plan amendments (SPA), effective March 1, 2020, through the end of the public health emergency declaration, allowing flexibilities to ensure the continuity of coverage through the public health emergency. The waivers and SPA allowed the Authority to implement flexibilities, including the following: ? Allow self-attestations for all eligibility requirements, excluding citizenship and immigration status, on a case-by-case basis ? Extend the redetermination timeline for current CHIP enrollees in the state to maintain continuity of coverage as permissible From the start of the pandemic, CMS kept an ongoing Frequently Asked Questions (FAQs) document to aid state Medicaid and CHIP agencies in their response to COVID-19, including guidance on eligibility, benefits and financing regarding the pandemic. This document was finalized on January 6, 2021. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit we reported the Authority did not have adequate internal controls to ensure clients were eligible for CHIP. The prior finding number was 2021-046. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure clients were eligible for CHIP. We used a statistically valid sampling method to randomly select and examine 59 out of a total population of 93,793 clients who had a federally verified SSN. We also used a statistically valid sampling method to randomly select and examine 59 out of a total population of 10,933 clients who did not have a federally verified SSN. For the sample of clients who had a verified SSN, we identified: ? One instance where the client aged out of services and was not referred to Washington Healthplanfinder to be redetermined eligible for Medicaid during the COVID-19 pandemic, as required. ? One instance where the Authority continued CHIP coverage for a client after the allowable postpartum period. For the sample of clients who did not have a federally verified SSN, we identified: ? Seventeen instances where the Authority continued CHIP coverage for clients after the allowable postpartum period. We also used computer-assisted audit techniques to analyze the entire client population. We found 3,416 clients who were over the age of 19 that were still receiving CHIP services during fiscal year 2022. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Authority chose not to remove clients from CHIP even when they aged out of coverage or their postpartum period ended. Effect of Condition and Questioned Costs By not having adequate internal controls, the Authority is at risk of not detecting or preventing ineligible payments of federal CHIP funds on behalf of recipients. We determined the following questioned costs: Audit Area Known Questions Costs (state and federal) Known questioned costs ? Federal portion only Likely improper payments (state and federal) Likely improper payments ? federal portion only Verified SSNs $ 2,117 $ 1,468 $ 3,365,166 $ 2,333,411 Non-Verified SSNs $14,760 $ 10,236 $ 2,735,142 $ 1,896,870 Over 19 years old $ 4,353,425 $ 3,024,953 $ 0 $ 0 Totals $ 4,370,302 $ 3,036,657 $ 6,100,308 $ 4,230,281 Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflect this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Authority: ? Implement internal controls to ensure all clients meet CHIP eligibility requirements ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Authority?s Response The Authority does not concur with any of the results cited by the auditor related to CHIP program eligibility. The agency has worked with the Governor?s Office and the Office of Financial Management to continue equity of state funded coverage for all individuals during the public health emergency, including CHIPRA pregnancy coverage. The postpartum period in CHIPRA coverage is state-funded. The State Auditor?s Office did not allow the Authority enough time to obtain the journal vouchers from our accounting partners that show the use of state funds for these expenditures. Regarding the clients receiving CHIP benefits who were aged 19 and over, the agency has pursued, and been notified of approval for, an 1115 disaster waiver from the Centers for Medicare & Medicaid Services. The waiver approves funding for CHIP clients aged 19 and over during the public health emergency and is retroactive to March 18, 2020. Once the approval letter is received by the Authority, the associated federal expenditures identified by the auditor will be valid. The agency was provided very little time and flexibility to respond to the audit results during a time when the agency and its federal counterparts are inundated and backlogged with unwinding the public health emergency. Auditor?s Remarks We provided the Authority with preliminary exceptions on February 27, 2023 and on March 15th, the Authority provided additional information that cleared some of the exceptions. The draft finding was provided to the Authority on April 17, 2023. It was not until April 18th, after audit work was concluded, that the Authority asserted the postpartum exceptions we identified were transferred from federal funding to state funding with journal vouchers. Despite not conveying this information to us timely, we requested copies of the journal vouchers to attempt to confirm the Authority?s assertion. On April 25, 2023, the Authority informed us that staff were not able to pull the journal vouchers and we therefore could not determine whether any of the federally funded payments were subsequently transferred to state funding. For the clients aged 19 and over, there was no formal approval from CMS in place during the audit period or currently. Therefore, we conducted our audit in accordance with codified eligibility rules. We reaffirm our finding and will follow up on the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Title 42 CFR, Public Health Part 435 Subpart J, Eligibility in the States and District of Columbia, establishes the following applicable requirements: Section 435.926 Continuous eligibility for children, states in part: (b) Eligibility. The agency may provide continuous eligibility for the period specified in paragraph (c) of this section for an individual who is: (1) Under age 19 or under a younger age specified by the agency in its State plan; and (2) Eligible and enrolled for mandatory or optional coverage under the State plan in accordance with subpart B or C of this part. (c) Continuous eligibility period. (1) The agency must specify in the State plan the length of the continuous eligibility period, not to exceed 12 months. (2) A continuous eligibility period begins on the effective date of the individual?s eligibility under ? 435.915 or most recent redetermination or renewal of eligibility under ? 435.916 and ends after the period specified by the agency under paragraph (c)(1) of this section. (d) Applicability. A child?s eligibility may not be terminated during a continuous eligibility period, regardless of any changes in circumstances, unless: (1) The child attains the maximum age specified in accordance with paragraph (b)(1) of this section; (2) The child or child?s representative requests a voluntary termination of eligibility; (3) The child ceases to be a resident of the State; (4) The agency determines that eligibility was erroneously granted at the most recent determination, redetermination or renewal of eligibility because of agency error or fraud, abuse, or perjury attributed to the child or the child?s representative; or (5) The child dies. Title 42 CFR, Public Health, Part 457 establishes the following applicable requirements: Section 457.342 Continuous eligibility for children, states in part: (a) A State may provide continuous eligibility for children under a separate CHIP in accordance with the terms of ? 435.926 of this chapter, and subject to a child remaining ineligible for Medicaid, as required by section 2110(b)(1) of the Act and ? 457.310 (related to the definition and standards for being a targeted low-income child) and the requirements of section 2102(b)(3) of the Act and ? 457.350 (related to eligibility screening and enrollment). Section 457.380 Eligibility verification. (a) General requirements. Except where law requires other procedures (such as for citizenship and immigration status information), the State may accept attestation of information needed to determine the eligibility of an individual for CHIP (either self-attestation by the individual or attestation by an adult who is in the applicant?s household, as defined in ? 435.603(f) of this subchapter, or family, as defined in section 36B(d)(1) of the Internal Revenue Code, an authorized representative, or if the individual is a minor or incapacitated, someone acting responsibly for the individual) without requiring further information (including documentation) from the individual. (b) Status as a citizen, national or a non-citizen. (1) Except for newborns identified in ? 435.406(a)(1)(iii)(E) of this chapter, who are exempt from any requirement to verify citizenship, the agency must ? (i) Verify citizenship or immigration status in accordance with ? 435.956(a) of this chapter, except that the reference to ? 435.945(k) is read as a reference to paragraph (i) of this section; and (ii) Provide a reasonable opportunity period to verify such status in accordance with ? 435.956(a)(5) and (b) of this chapter and provide benefits during such reasonable opportunity period to individuals determined to be otherwise eligible for CHIP. (2) [Reserved] (c) State residents. If the State does not accept self-attestation of residency, the State must verify residency in accordance with ? 435.956(c) of this chapter. (d) Income. If the State does not accept self-attestation of income, the State must verify the income of an individual by using the data sources and following standards and procedures for verification of financial eligibility consistent with ? 435.945(a), ? 435.948 and ? 435.952 of this chapter. (e) Verification of other factors of eligibility. For eligibility requirements not described in paragraphs (c) or (d) of this section, a State may adopt reasonable verification procedures, consistent with the requirements in ? 435.952 of this chapter, except that the State must accept self-attestation of pregnancy unless the State has information that is not reasonably compatible with such attestation. (f) Requesting information. The terms of ? 435.952 of this chapter apply equally to the State in administering a separate CHIP. (g) Electronic service. Except to the extent permitted under paragraph (i) of this section, to the extent that information sought under this section is available through the electronic service described in ? 435.949 of this chapter, the State must obtain the information through that service. (h) Interaction with program integrity requirements. Nothing in this section should be construed as limiting the State?s program integrity measures or affecting the State's obligation to ensure that only eligible individuals receive benefits or its obligation to provide for methods of administration that are in the best interest of applicants and enrollees and are necessary for the proper and efficient operation of the plan. (i) Flexibility in information collection and verification. Subject to approval by the Secretary, the State may modify the methods to be used for collection of information and verification of information as set forth in this section, provided that such alternative source will reduce the administrative costs and burdens on individuals and States while maximizing accuracy, minimizing delay, meeting applicable requirements relating to the confidentiality, disclosure, maintenance, or use of information, and promoting coordination with other insurance affordability programs. (j) Verification plan. The State must develop, and update as modified, and submit to the Secretary, upon request, a verification plan describing the verification policies and procedures adopted by the State to implement the provisions set forth in this section in a format and manner prescribed by the Secretary. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Plan Amendment Approval Letter from CMS dated July 15, 2020 states in part: This letter is to inform you that your title XXI Children?s Health Insurance Program (CHIP) state plan amendment (SPA), WA-20-0001, submitted on May 4, 2020, has been approved. This SPA has an effective date of March 1, 2020. This amendment, as it applies to the COVID-19 public health emergency (PHE), makes the following changes beginning March 18, 2020, unless otherwise noted, through the duration of the Federally-declared PHE: ? Delay acting on changes in circumstances for CHIP beneficiaries other than the required changes in circumstances described in 42 CFR 457.342(a) cross-referencing 42 CFR 435.926(d); COVID-19 Frequently Asked Questions (FAQs) for State Medicaid and Children?s Health Insurance Program (CHIP) Agencies (Last Updated January 6, 2021) Section J. Children?s Health Insurance Program (CHIP) states in part: 4. Can states continue coverage for the duration of the Public Health Emergency for individuals in a separate CHIP who are aging out of eligibility or ending their postpartum period? No. The requirement in section 6008(b)(3) of the FFCRA to maintain coverage in Medicaid in order to receive the temporary increase in the Medicaid federal medical assistance percentage does not apply to separate CHIPs. Therefore, states may not continue to provide separate CHIP coverage to young adults aging out or women ending their postpartum period. If the state determines that the individual is eligible for Medicaid, they may be transitioned to the appropriate Medicaid eligibility group. States may not transition individuals to Medicaid without first determining them eligible in accordance with 42 C.F.R ? 457.350(b). States are required to transfer the accounts of individuals losing CHIP eligibility who are determined to be ineligible for Medicaid to the Exchange, in accordance with 42 C.F.R ? 457.350(b)(3) and (i).

2022-054 The Health Care Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. Assistance Listing Number and Title: 93.767 Children?s Health Insurance Program 93.767 COVID-19 Children?s Health Insurance Program 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: 2005WA5021; 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; 1905WA5021; 2105WA5021; 2205WA5021; 2205WA5MAP; 2205WA5ADM; Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Managed Care Financial Audit Known Questioned Cost Amount: None Background The Health Care Authority (Authority) administers both the Medicaid and the Children?s Health Insurance Program (CHIP). Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one third of the state?s federal expenditures. CHIP provides health coverage for almost 90,000 children and pregnant women in families with incomes too high to qualify for Medicaid. During fiscal year 2022, the Medicaid program spent more than $17.6 billion in federal and state funds, and CHIP spent more than $229 million in federal and state funds. Managed Care Organizations (MCO) contract with the Authority under a comprehensive risk contract to provide prepaid health care services to eligible enrollees under their managed care programs. In fiscal year 2022, the Authority contracted with five MCOs and paid them more than $9.2 billion for Medicaid and CHIP services. Under federal regulations, contracts between states and MCOs must include a requirement that MCOs annually submit an audited financial report to the state. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. At least once every three years, the Authority must conduct or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data each MCO submits. The Authority must also post these audit results on its website. These requirements went into effect for contract years starting after July 1, 2017. Federal regulations require recipients to establish and follow internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. The prior finding number was 2021-048. Description of Condition The Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. Audited financial reports The Authority did not include this requirement in its MCO contracts, and it did not have internal controls in place to ensure it complied with the requirement to collect financial reports. During the audit period, the Authority took steps toward updating the MCO contract language to include the audited financial report requirements; however, the changes were not implemented until after the audit period. As a result, the Authority did not obtain any audited financial reports from the MCOs. The Authority expects to receive its first MCO financial reports in June 2023. Periodic audits The Authority did not establish internal controls to ensure it complied with the periodic audit requirements of MCO encounter and financial data. To meet the periodic audit requirements, the Authority would have needed to complete MCO audits of both the encounter and financial data within the last three years. Though the Authority completed encounter data audits in July 2021, it did not complete any financial data audits. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The audited financial reports and periodic audits are newer requirements that became applicable for the MCO contracts beginning January 2018. The Authority did not have policies or procedures on collecting audited financial reports or on how and when to perform periodic audits. While the Authority was in the process of implementing procedures for meeting these requirements, the implementation was delayed because of staff turnover in the leadership of the unit in charge. Effect of Condition By not collecting the audited financial reports and conducting periodic audits, the Authority increases its risk of relying on inaccurate or incomplete information. This could lead to an increased risk of making improper payments and reduced public transparency. The Authority could also be subject to sanction by the federal grantor for not meeting Medicaid and CHIP requirements. Recommendations We recommend the Authority: ? Implement policies and procedures over obtaining audited financial reports ? Implement policies and procedures over conducting required periodic audits ? Establish a process to ensure it collects audited financial reports annually ? Establish a process to conduct audits of encounter and financial data at least once every three years Authority?s Response The authority concurs with the recommendations and has taken the following steps: ? Amended managed care contracts to require annual submission of audited financial reports. The amended contract language directs managed care organizations when and where to submit audited financial reports. Failure to submit reports is sanctionable. ? Conducted an encounter data validation audit and began a financial report validation audit. Processes have been established to ensure that audits will be conducted no less than once every three years. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will follow up on the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 42 U.S. Code of Federal Regulation Part 438, Managed Care establishes the following applicable requirements: Section 438.3 Standard Contract Requirements states in part: (m) Audited financial reports. The contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section 438.600 Statutory basis, basic rule, and applicability states in part: (c) Applicability. States will not be held out compliance with the following requirements of this subpart prior to the dates noted below so long as they comply with the corresponding standard(s) in 42 CFR part 438 contained in the CFR, parts 430 to 481, edition revised as of October 1, 2015: (1) States must comply with ?438.602(a), 438.602(c) through (h), 438.604, 438.606, 438.608(a), and 438.608(c) and (d), no later than the rating period for contracts starting on or after July 1, 2017. (2) States must comply with ?438.602(b) and ? 438.608(b) no later than the rating period for contracts beginning on or after July 1, 2018. Section 438.602 State responsibilities states in part: (e) Periodic audits. The State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP. (g) Transparency. The State must post on its Web site, as required in ?438.10(c)(3), the following documents and reports: (1) The MCO, PIHP, PAHP, or PCCM entity contract. (2) The data at ?438.604(a)(5). (3) The name and title of individuals included in ?438.604(a)(6). (4) The results of any audits under paragraph (e) of this section. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11.

2022-055 The Health Care Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and Children?s Health Insurance Program. Assistance Listing Number and Title: 93.767 Children?s Health Insurance Program 93.767 COVID-19 Children?s Health Insurance Program 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2005WA5021; 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; 1905WA5021; 2105WA5021; 2205WA5021; 2205WA5MAP; 2205WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions ? Provider Eligibility (Screening and Enrollment) Known Questioned Cost Amount: $612,277 Background The Health Care Authority administers both Medicaid and the Children?s Health Insurance Program (CHIP). Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one third of the state?s federal expenditures. CHIP provides health coverage for almost 90,000 children and pregnant people in families with incomes too high to qualify for Medicaid. During fiscal year 2022, the Medicaid program spent more than $17.6 billion in federal and state funds, and CHIP spent more than $229 million in federal and state funds. The Authority ensures medical providers for both programs are eligible to provide services for clients. Providers must continue to meet eligibility requirements to receive payments under the programs. Washington had more than 127,000 participating providers in fiscal year 2022. During that time, the Authority paid more than $6.6 billion to providers for direct client services under the programs. The Authority is responsible for performing screening measures appropriate for the provider type at application and initial enrollment. Federal regulations require state Medicaid agencies to revalidate the enrollment of all Medicaid and CHIP providers at least every five years. To meet this requirement, the Authority has implemented an automated revalidation notification process that is supposed to send a letter to providers in time for them to be revalidated before the end of the five-year period. Federal law also requires state Medicaid agencies to check federal databases at least monthly to confirm the identity and exclusion status of providers, as well as any person with ownership, controlling interest, or acting as an agent or managing employee of the provider. The provider enrollment and revalidation processes are similar. The first step in both processes is to determine the provider?s screening risk level. A provider can be designated as one of three risk levels: limited, moderate or high. Each risk level requires progressively greater scrutiny of the provider before it can be enrolled or revalidated. For providers enrolled with both Medicare and Medicaid, state Medicaid agencies must assign them to the same or higher risk category applicable under Medicare. Additionally, certain provider behaviors require them to be moved to a higher screening level. The following are the required screening procedures for all risk types: ? Verify that the provider meets applicable federal regulations or state requirements for the provider type before making an enrollment determination ? Conduct license verifications, including for licenses in states other than where the provider is enrolling ? Conduct database checks to ensure providers continue to meet the enrollment criteria for their provider type. Such database checks include the National Plan and Provider Enumeration System, List of Excluded Individuals/Entities, Excluded Parties List System, and Death Master File index. If state Medicaid agencies assess providers at a moderate or high risk, they are required to conduct onsite visits for those that did not have one as part of their Medicare enrollment. Federal regulations require a high-risk provider, or a person with a 5 percent or more direct or indirect ownership in the provider, to receive a fingerprint-based criminal background check. The deadline to fully implement a fingerprint-based criminal background check was July 1, 2018. The Authority is also responsible for ensuring that providers obtain the proper signed attestations and disclosures. For servicing only providers, a direct link must be made to a billing provider that has an active Core Provider Agreement (CPA) on file. A CPA contains the required attestation and disclosures of the billing provider to allow for the payment of medical claims. To ensure the Authority has completed all applicable screening and enrollment or revalidation steps before enrolling or revalidating providers, staff members use checklists for each enrollment and revalidation. The staff member signs and dates the checklist to indicate the provider is eligible to render services and receive payments. In response to the COVID-19 pandemic, the Authority obtained flexibilities under blanket waivers approved by the Centers for Medicare and Medicaid Services (CMS), which were effective March 1, 2020, through the end of the emergency declaration period. These included the waiving of provider application fees and fingerprint-based criminal background checks. The CMS waivers also allowed for expedited processing of any new or pending provider applications, as well as the postponement of all revalidation actions until November 1, 2020. Also in response to the COVID-19 pandemic, the Authority?s Chief Medical Officer approved a blanket waiver for the backdating of all providers effective dates, as allowed by CMS and Washington Administrative Code. This waiver allows providers to submit claims for services provided before their enrollment and revalidation applications are approved. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it revalidated providers every five years and met screening requirements. The prior finding numbers were 2021-047, 2020-046, 2019-048, 2018-042, 2017-033, and 2016-035. Description of Condition The Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and CHIP programs. During the audit period, the Authority processed 10,959 new provider enrollments and was required to perform ongoing eligibility determinations for 114,427 active providers. We used a statistical sampling method to randomly select and examine 59 newly enrolled providers and 59 active providers to determine if the Authority properly screened them based on their enrollment status and correctly determined their eligibility status. Of the 118 providers examined, we found seven instances for six providers (5 percent) when the Authority did not take the appropriate actions to ensure providers met eligibility requirements. Specifically, we found: ? Staff enrolled three providers without a valid CPA on file. Because the providers were not covered by a CPA, they were improperly enrolled. ? Staff did not conduct a proper license check for three providers. A proper license check for these providers would have led staff to identify that their license was either expired or did not cover the enrollment period, and, therefore, were ineligible. ? Staff did not properly screen one provider based on a moderate risk level. The improper screening checklist was used and the risk level was not properly addressed. To determine if the Authority had revalidated providers every five years or had taken actions to deactivate providers, we used computer-assisted audit techniques to analyze the entire population of 2,049 providers that should have been revalidated or deactivated during the fiscal year. We found the Authority?s internal controls were insufficient and resulted in none of the 2,049 providers (100 percent) being revalidated before the due date. We determined 648 providers were subsequently revalidated, and the Authority backdated them. We also determined 1,242 providers were deactivated, but the Authority did not process the deactivation until at least 30 days after the eligibility end date. There were an additional 159 providers that should have been deactivated, but the Authority did not take actions to deactivate or revalidate them. Federal law requires the Authority to check federal databases at least monthly to confirm the identity and exclusion status of providers. However, the automated system that performs these checks and notifies the Authority of possible problems with providers was not operating correctly, and it frequently provided incorrect information. Management decided to ignore this information and stopped performing the monthly database checks. The Authority did review the results of the check once during the fiscal year, in July of 2021. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Although the Authority has established internal controls over screening and enrolling providers, they were ineffective for preventing or detecting noncompliance. Management also did not ensure staff consistently followed the procedures in place. Additionally, the automated revalidation notification was inadequate for ensuring the Authority complied with the five-year revalidation requirement. To comply with this requirement, the Authority should notify providers about their revalidations and ensure they are started and completed before the due date. Our audit found that the Authority?s automated system is designed to notify providers of their revalidations one day after the due date. Due to this inadequate system design, all provider revalidations were completed after their due dates. Although management directed staff to stop performing the monthly database checks because of issues with the automated system, they did not reinstate the procedures used before the system was implemented so staff could continue verifying providers? identity and exclusion status. Effect of Condition and Questioned Costs By not conducting required licensing, screening, and enrollment processes in a timely manner, the Authority is at risk of not detecting or preventing ineligible providers from providing services to clients and receiving federal Medicaid and CHIP funds. Payments to providers who are ineligible are unallowable, and the Authority could be required to repay the grantor for these payments. We identified the following payments made to ineligible providers: Audit Area Known questioned costs (state and federal) Known questioned costs (federal portion only) Likely improper payments (state and federal) Likely improper payments (federal portion only) New Providers $7,092 $3,985 $1,317,224 $740,280 Deactivated Providers $302,372 $292,051 $399,999 $351,698 Not Revalidated or Deactivated $509,702 $316,241 Total $819,166 $612,277 $1,717,223 $1,091,978 In addition to the questioned costs in the table above, we also identified $26,148,599 in costs at risk for those providers whose revalidations were backdated. If the providers had not been revalidated, these costs would also be considered questioned costs. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs,? as required by 2 CFR ? 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: ? Strengthen internal controls to ensure providers are adequately screened, licensed, enrolled, and eligible to provide and bill for services ? Implement internal controls designed to bring it into material compliance with the provider revalidation process Authority?s Response The Authority partially concurs with the finding. The Authority agrees that ProviderOne sends revalidation notifications one day after the due date rather than before the due date to allow time for the revalidation process. A system revision is in process, and we expect this issue to be resolved by the beginning of 2024. The Authority does not concur with the remainder of the auditor?s findings. The auditor provided the final exceptions and this finding at the close of the audit. The document with the final exceptions did not contain enough information for the Authority to adequately review the results of the auditor?s testing or the methodology used to calculate questioned costs. The time allotted to the Authority to review the testing results, seek clarification, and provide an agency response was not sufficient to analyze the results and provide an informed response. Due to the lack of complete information and time provided, the Authority is unable to agree or disagree with the results of the audit. Finally, on March 19, 2020, the Centers for Medicare & Medicaid Services (CMS) approved Washington?s request for an 1135 COVID-19 Emergency Declaration Blanket Waiver for Health Care Providers, effective through the end of the federal Public Health Emergency. This waiver temporarily suspended provider enrollment and revalidation requirements. Should the Authority agree with any or all of the results from the audit, it would not concur that questioned costs be returned because provider enrollment and revalidations requirements were temporarily suspended by CMS. Auditor?s Remarks We provided the Authority with preliminary exceptions on December 20, 2022 for ?Not Revalidated or Deactivated Providers? and on December 30, 2022 for ?New Providers?, ?Active Providers?, and ?Deactivated Providers?. The Authority provided additional information on January 31, 2023 that cleared some of the exceptions. We provided final exceptions on March 3, 2023 which included the unique transaction identifier for each exception. The Authority requested that we perform additional testing for the ?Deactivated Providers? on March 15th. The draft finding was provided to the Authority on April 14, 2023 and the Authority provided their response on May 3rd. Despite several years of the known system weaknesses, the Authority has not updated the system or implemented compensating processes to ensure providers are eligible to provide Medicaid and Chip services. Regarding the 1135 COVID-19 Emergency Declaration Blanket Waiver, the Authority informed us that beginning October 1, 2020, Authority management had reinstated the majority of provider eligibility requirements that had been waived. We reaffirm our finding with questioned costs and will follow up on the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Guidance establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR Part 433, State Fiscal Administration, Subpart F ? Refunding of Federal Share of Medicaid Overpayments to Providers, describes the requirements for identifying, reporting, collecting, and remitting Medicaid overpayments. Title 42 CFR section 438 subpart H ? Additional Program Integrity Safeguards, states in part: Section 438.602 State responsibilities. (a) Monitoring contractor compliance. Consistent with ? 438.66, the State must monitor the MCO?s, PIHP?s, PAHP?s, PCCM?s or PCCM entity?s compliance, as applicable, with ?? 438.604, 438.606, 438.608, 438.610, 438.230, and 438.808. (b) Screening and enrollment and revalidation of providers. (1) The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PIHPs, and PAHPs, in accordance with the requirements of part 455, subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. This provision does not require the network provider to render services to FFS beneficiaries. (2) MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section of up to 120 days, but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120 day period without enrollment of the provider, and notify affected enrollees. (c) Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM or PCCM entity, and any subcontractors as required in ? 438.608(c). (d) Federal database checks. Consistent with the requirements at ? 455.436 of this chapter, the State must confirm the identity and determine the exclusion status of the MCO, PIHP, PAHP, PCCM or PCCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM or PCCM entity through routine checks of Federal databases. This includes the Social Security Administration?s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with ? 438.610(c). Title 42 CFR section 455 Subpart B ? Disclosure of Information by Providers and Fiscal Agents, states in part: Section 455.104 Disclosure by Medicaid providers and fiscal agents: Information on ownership and control. (a) Who must provide disclosures. The Medicaid agency must obtain disclosures from disclosing entities, fiscal agents, and managed care entities. (b) What disclosures must be provided. The Medicaid agency must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: (1) (i) The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. (ii) Date of birth and Social Security Number (in the case of an individual). (iii) Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. (2) Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. (3) The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. (4) The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). (c) When the disclosures must be provided ? (1) Disclosures from providers or disclosing entities. Disclosure from any provider or disclosing entity is due at any of the following times: (i) Upon the provider or disclosing entity submitting the provider application. (ii) Upon the provider or disclosing entity executing the provider agreement. (iii) Upon request of the Medicaid agency during the re-validation of enrollment process under ? 455.414. (iv) Within 35 days after any change in ownership of the disclosing entity. (2) Disclosures from fiscal agents. Disclosures from fiscal agents are due at any of the following times: (i) Upon the fiscal agent submitting the proposal in accordance with the State?s procurement process. (ii) Upon the fiscal agent executing the contract with the State. (iii) Upon renewal or extension of the contract. (iv) Within 35 days after any change in ownership of the fiscal agent. (3) Disclosures from managed care entities. Disclosures from managed care entities (MCOs, PIHPs, PAHPs, and HIOs), except PCCMs are due at any of the following times: (i) Upon the managed care entity submitting the proposal in accordance with the State?s procurement process. (ii) Upon the managed care entity executing the contract with the State. (iii) Upon renewal or extension of the contract. (iv) Within 35 days after any change in ownership of the managed care entity. (4) Disclosures from PCCMs. PCCMs will comply with disclosure requirements under paragraph (c)(1) of this section. (d) To whom must the disclosures be provided. All disclosures must be provided to the Medicaid agency. (e) Consequences for failure to provide required disclosures. Federal financial participation (FFP) is not available in payments made to a disclosing entity that fails to disclose ownership or control information as required by this section. Title 42 CFR section 455 Subpart E ? Provider Screening and Enrollment, states in part: Section 455.410 Enrollment and screening of providers (a) The State Medicaid agency must require all enrolled providers to be screened under to this subpart. (b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. (c) The State Medicaid agency may rely on the results of the provider screening performed by any of the following: (1) Medicare contractors. (2) Medicaid agencies or Children?s Health Insurance Programs of other States. Section 455.412 Verification of provider licenses The State Medicaid agency must ? (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. (b) Confirm that the provider?s license has not expired and that there are no current limitations on the provider?s license. Section 455.414 Revalidation of enrollment The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years. Section 455.436 Federal database checks The State Medicaid agency must do all of the following: (a) Confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. (b) Check the Social Security Administration?s Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. (c) (1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and (2) Check the LEIE and EPLS no less frequently than monthly. Section 455.450 Screening levels for Medicaid providers. A State Medicaid agency must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. (a) Screening for providers designated as limited categorical risk. When the State Medicaid agency designates a provider as a limited categorical risk, the State Medicaid agency must do all of the following: (1) Verify that a provider meets any applicable Federal regulations, or State requirements for the provider type prior to making an enrollment determination. (2) Conduct license verifications, including State licensure verifications in States other than where the provider is enrolling, in accordance with ? 455.412. (3) Conduct database checks on a pre- and post-enrollment basis to ensure that providers continue to meet the enrollment criteria for their provider type, in accordance with ? 455.436. (b) Screening for providers designated as moderate categorical risk. When the State Medicaid agency designates a provider as a ?moderate? categorical risk, a State Medicaid agency must do both of the following: (1) Perform the ?limited? screening requirements described in paragraph (a) of this section. (2) Conduct on-site visits in accordance with ? 455.432. (c) Screening for providers designated as high categorical risk. When the State Medicaid agency designates a provider as a ?high? categorical risk, a State Medicaid agency must do both of the following: (1) Perform the ?limited? and ?moderate? screening requirements described in paragraphs (a) and (b) of this section. (2) (i) Conduct a criminal background check; and (ii) Require the submission of a set of fingerprints in accordance with ? 455.434. (d) Denial or termination of enrollment. A provider, or any person with 5 percent or greater direct or indirect ownership in the provider, who is required by the State Medicaid agency or CMS to submit a set of fingerprints and fails to do so may have its - (1) Application denied under ? 455.434; or (2) Enrollment terminated under ? 455.416. (e) Adjustment of risk level. The State agency must adjust the categorical risk level from ?limited? or ?moderate? to ?high? when any of the following occurs: (1) The State Medicaid agency imposes a payment suspension on a provider based on credible allegation of fraud, waste or abuse, the provider has an existing Medicaid overpayment, or the provider has been excluded by the OIG or another State?s Medicaid program within the previous 10 years. (2) The State Medicaid agency or CMS in the previous 6 months lifted a temporary moratorium for the particular provider type and a provider that was prevented from enrolling based on the moratorium applies for enrollment as a provider at any time within 6 months from the date the moratorium was lifted. Medicaid Provider Enrollment Compendium (MPEC) B. Enrolled Provider?s Payment Eligibility for Retroactive Dates of Service The practice of ?backdating? enrollment involves approving an enrollment with a retroactive billing date. This practice allows a provider, once enrolled, to submit claims for services dated prior to the date upon which the SMA approved the enrollment. As discussed earlier, provider screening enables states to identify ineligible parties before they are able to enroll and start billing. Components of provider screening include database and licensure checks, and may also include site visits and FCBCs. To the extent a SMA approves the enrollment of a new provider and permits the provider to bill for services dated prior to applicable screening(s), this practice creates risk. For example, if a newly enrolling provider is subject to a site visit, and the SMA completes a site visit for the provider but nonetheless permits the provider to bill for services dated prior to the date on which the site visit occurred, there is risk the prov

2022-056 The Department of Social and Health Services, Developmental Disabilities Administration, did not have adequate internal controls over and did not comply with requirements to ensure Medicaid payments to supported living providers were allowable and adequately supported. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; 2205WA5MAP; 2205WA5ADM Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $237,404,150 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one-third of the state?s federal expenditures. During fiscal year 2022, the program spent about $17.6 billion in federal and state funds. The Department of Social and Health Services? Developmental Disabilities Administration administers the Home and Community-Based Services (HCBS) program for people with developmental disabilities. The HCBS is a waiver program that permits states to provide an array of community-based services to help Medicaid clients live in the community and avoid institutionalization. States have broad discretion to design waiver programs, but they must be approved by the Centers for Medicare and Medicaid Services (CMS). Supported living services support Medicaid clients to live in their own homes, generally with one to three other people, and receive instruction and support delivered by contracted service agencies (providers). Supported living clients pay their own rent, food and other personal expenses. Supported living is an option under the HCBS Core and Community Protection waivers. In fiscal year 2022, the state Medicaid program paid about $638.8 million in federal and state funds to supported living agencies that provided care to about 4,000 Medicaid clients. Client assessment, Person-Centered Service Plan, and tiered rate The Department uses a rate assessment tool to evaluate client support needs to live in the community. With this assessment, the Department develops a Person-Centered Service Plan (PCSP) to determine the support and instruction a client is expected to receive. The economies of scale are applied to the assessed level of care generated by the rate assessment tool to produce a daily rate in one of nine tiers that is paid to the supported living agency. The tiered rate is comprised of two components: payment for direct client services (known as instruction and support services, ISS) and administrative (known as non-ISS). A tiered rate methodology is used to allow providers more flexibility in delivering services to clients. A daily tiered rate is loaded into the Department?s payment system, and providers claim payment for each day they provide services to the clients. The supported living agency is contractually obligated to fulfill the client?s support needs outlined in the PCSP. Cost report and settlements Providers are required to prepare and submit a cost report by March 31st for the prior calendar year, with each cost report covering the last six months of one fiscal year and the first six months of the next fiscal year. Providers must attest to the accuracy of the reported information. The Department uses the cost report information to: ? Provide program cost data to regional managers and residential providers; ? Determine settlements with supported living providers; ? Provide accountability and transparency for the use of public funds. In the HCBS waiver, the Department states it reconciles purchased support services with provided support services for the calendar year. Using the cost report, the Department calculates settlements to determine if the provider received more reimbursement for ISS care than what it paid to its employees who provided the client care. Department policy states that when staff reviews a cost report to determine if a settlement is required, the following will be verified: a. All sections of the cost report are complete; b. The information in Residential Rates for Developmental Disabilities (RRDD) matches the ProviderOne payment report; c. The report conforms with generally accepted accounting principles; d. The report meets the requirements of the provider?s contract; and e. Expenses are accurately reported. If the provider does not spend all ISS reimbursement funds on costs to provide direct care to clients, then it is required to pay the Department back the difference. In the HCBS waiver, the Department states that there is no settlement for administrative or indirect client support costs. Cost report payroll verifications The Department conducts payroll verifications of the cost report for selected providers to determine the accuracy and reasonableness of the self-attested expenditures reported. Before verifying payroll, the Department requires the provider to submit supporting documentation, including detailed payroll cost support for two to three months of the calendar year. Department staff review the provider?s detailed support, which shows that it only used ISS funds received from the Department to provide ISS care. The Department?s ISS Payroll Verification Process guide outlines the payroll verification process and the documents providers must maintain to support expenditures recorded on their cost reports. The guide states: ? The payroll summary must include detail for employees who performed direct support. ? The payroll data must be by employee with job titles. ? The providers are responsible for demonstrating how their records tie to the amounts reported on the cost reports. ? If payroll summaries do not match amounts providers reported on the cost reports, then the Department will review additional months up to the entire calendar year. Provider documentation requirements According to Department policy, providers are required to maintain detailed payroll records to verify the cost of services provided to clients. Upon request, the providers must provide job descriptions for employees who are allocated to both ISS and non-ISS duties. Providers must retain detailed monthly or quarterly payroll and supporting records that support the amounts on their cost reports. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior ten audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to supported living providers were allowable. The finding numbers were 2021-049, 2020-051, 2019-054, 2018-058, 2017-044, 2016-041, 2016-045, 2015-049, 2015-052, 2014-041, 2014-042, 2013-036, 2013-038 and 2012-039. After the fiscal year 2019 audit, the grantor, the Center for Medicaid and CHIP Services (CMS), issued a management decision letter in which it requested ?the state provide documentation that shows an adequate payment review process was implemented that occurs more frequently than once a year,? and it requested the state repay the questioned costs identified in the finding. After the fiscal year 2020 audit, CMS requested that the state provide documentation that justifies its position on current adequate internal controls regarding Medicaid payments to supported living providers, and it requested the state also repay the questioned costs from that finding. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure Medicaid payments to supported living providers were allowable and adequately supported. July 1 to December 31, 2021 Cost reports and settlements ? completed during audit period The Department reconciled and settled all of the 140 cost reports it received during this period. Of these reports, 74 were completed during the audit period, but they did not receive a payroll verification. For calendar year 2021, the Department did not require documentation to support the self-attested provider costs. Because of the Department?s insufficient monitoring activity, we determined the cost report reconciliation and settlement process was insufficient for ensuring payments made to providers for ISS care were for allowable activities and met cost principles. Cost report payroll verifications During the audit period, the Department verified payroll for 66 providers for calendar year 2021. We randomly selected 12 of these providers to examine and identified the following issues in the cost report review process that Department staff had performed: ? The cost report payroll verifications only cover 7.9 to 11.8 percent of all months of payments in calendar year 2021. This is insufficient coverage in our judgment. ? Eleven of the providers examined (92 percent) included overtime and nine of the providers (75 percent) included bonus payments in their ISS payroll expenditures. Department policy allows overtime and bonus payroll expenditures to be included as support for cost reports, but these are not factors considered in the tiered rate calculation. We do not believe this is appropriate because considering overtime and bonus dollars to be the same as regular pay dollars does not accurately reflect the services being provided to clients. We do not consider these reviews effective for ensuring providers? self-attested expenditures on the cost reports were allowable and supported. January 1 to June 30, 2022 Because cost reports and payroll verifications are prepared on a calendar year basis, the Department had not collected the reports and verified payroll for 2022 by the end of the audit period. The Department did not perform any other systematic review of these expenditures; therefore, we determined the Department did not have sufficient controls over the federal compliance requirements of activities allowed/unallowed and allowable costs/cost principles during this period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management believed that when the Department switched to using a tiered rate system, the level of monitoring it was conducting was sufficient for meeting federal requirements. However, the grantor has since informed the Department that it must implement an adequate payment review process that occurs more than once a year, but management has chosen not to do so. Cost reports and settlements The Department does not require providers to submit supporting documentation with their cost reports. Instead, the Department allows self-attested payroll expenditures as adequate support for the cost report settlements. Effect of Condition and Questioned Costs Without establishing an adequate payment review process, the Department had little assurance that it used program funds only for allowable purposes and payments to providers were adequately supported. We are questioning: Payments made from July 1, 2021, through December 31, 2021 Cost reports and settlements ? $136,400,692 in ISS payments made to 74 providers for which the Department did not verify payroll. The federal share of these questioned costs is $76,657,188. Payments made from January 1, 2022, through June 30, 2022 We are questioning all $286,026,617 in supported living payments during this period. The federal share of these questioned costs is $160,746,962. Summary of questioned costs The table below summarizes, by audit area, the known questioned costs and likely improper payments: Audit Area Known Questioned Costs (State and Federal) Known Questioned Costs (Federal Portion Only) Costs reports reconciled, but no payroll verification performed $136,400,692 $76,657,188 Expenditures with no cost reports $286,026,617 $160,746,962 Totals $422,427,309 $237,404,150 We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Implement an adequate payment review process that occurs more frequently than once a year to ensure federal funds paid to providers are used only for allowable purposes and are adequately supported. ? Consult with its grantor about whether the questioned costs identified in the audit should be repaid. Department?s Response The Department respectfully does not concur with the finding. The State Auditor?s Office (SAO) has questioned large portions of the Department?s reimbursements for instruction and support services provided to supported living clients. This includes questioning all reimbursements from the second half of fiscal year 2022, and all costs from the first half of the fiscal year that are associated with the seventy-four providers who did not undergo a payroll verification review. The Department strongly disagrees that all these costs should be questioned. The Department had numerous internal controls in place during the fiscal year. These controls are detailed later in this response and together they provide sufficient assurance that the paid services were provided. It is noteworthy that the SAO did not have any questioned costs from the first half of the fiscal year (July 1, 2021, through December 31, 2021) that were associated with the sixty-six providers who were subject to the Department?s payroll verification review. In fact, the SAO apparently, and appropriately, considered the Department?s payroll verification process an internal control that is generally sufficient to ensure payments to supported living providers are allowable. For the second half of the fiscal year (January 1, 2022, through June 30, 2022) the Department had the same internal control in place. That is, the Department?s verifications were performed based upon provider payroll received from the second half of the year in the same way that they were performed on payroll from the first half of the fiscal year. While we disagree with how the auditor arrived at known questioned costs, as the Department had the same internal control in place in both halves of the fiscal year one would expect to see similar, while incorrect, questioned costs (relating to providers who received a payroll verification). Instead, the SAO questioned all the costs from the second half of the fiscal year. The SAO appears to have errantly concluded that this internal control was non-existent for the second half of the year, which is neither true nor accurate. As stated above, the same internal control was in place, a control that the SAO otherwise considers to be sufficient. The stated reason that the SAO did not consider this control for the second half of the year is based solely on the timing of the SAO?s audit cycle, rather upon reasonable doubt regarding the sufficiency of the control. In fact, the Department reconciles payments on a calendar year basis which is set forth in policy and is approved by the federal government as part of its waiver approval process. The SAO audits on a fiscal year basis and counter-intuitively, does not consider control activities when they fall outside of their audit period. As the SAO does not consider the payroll verification reviews that applied to the second half of the fiscal year, the Department considers the SAO?s audit incomplete. This incompleteness results in the contradictory conclusion that payments over which the Department had sufficient controls were completely unallowable: Audit Area Known Questioned Costs (Federal Portion Only) 7/1/21-12/31/21 74 Costs reports reconciled, but no payroll verification performed. $76,657,188 1/1/22-6/30/22 140 Providers with expenditures but no cost reports submitted. (Cost Reports are not submitted until 12/31/22) $156,784,641 Totals $237,404,150 We would also like to speak to SAO?s opinion on overtime and bonuses. The fact that overtime and bonuses are actually paid for client support is evidence of, and an accurate reflection that, the services and supports were being provided to clients. Additionally, it is clear evidence of trends that CMS and every State Medicaid agency are aware of: the health care service sector has been hit with unprecedented staff shortages. Overtime is a necessary expense needed to cover these shortages and assure that clients are receiving their Medicaid services. Bonuses are also increasingly a necessary retention tool in the tight labor pool to help agencies compete for staff to reduce the shortages. Bonuses increase retention and reduce turnover. Bonuses also reward quality services and supports to clients. The Department does not control how a provider operates their business. The Department does follow the federal directive of necessary an ordinary when reviewing expenditures. The Department considers overtime and bonuses as ordinary and necessary costs for supportive living businesses. Federal cost reporting equally considers overtime and bonuses as normal expenses/costs of doing business. The Department conducted ISS payroll audits of all eleven providers in the SAO test. Overtime and bonuses were reviewed and determined to be supported by the documentation in the ISS payroll reviews that the Cost Analysts conducted. Overtime is a necessary cost of doing business inside and outside of state government. Providers who pay overtime are demonstrating that they are willing to pay their employees the amount necessary to cover every shift for client support and safety, even if it means they end up spending more than they were reimbursed by DDA. Average turnover at the direct service provider level is approximately 50% each year in the residential provider industry. Rather than the current posture, the SAO should be concerned about providers with high turnover who don?t report any overtime. The Department would question whether such a provider truly honored their contracted financial obligations to their clients in such scenarios. Just because a provider pays out overtime does not mean they provided any less of a service. It simply means that they spent more money out of their own pockets for the cost of client care than they were contracted to spend for that contracted care. The SAO would be challenged to find many companies operating today that do not pay any overtime. Overtime is a necessary cost of any business, particularly when employees are granted paid time off, sick, and holiday pay. Even companies who are fully staffed must occasionally pay out overtime to ensure that necessary work gets completed when employees are out sick, take holidays, and vacations. When individuals work with intellectually disabled children and adults, often someone must be available 24/7 to support these clients. This means that someone must work on holidays and weekends. Someone must be there when a co-worker is on vacation, or sick. Without overtime pay, critically needed work would be left unattended. In the Department?s work, work left unattended could result in clients left unattended. It is difficult to understand why the SAO would support the potential that DDA clients would be left without support and at risk of being unattended. The SAO interpretation of overtime and bonuses is another example of some continuing and fundamental misunderstandings as to how supported living in the context of State Medicaid service delivery works. The SAO?s unique interpretation of the allowability of overtime and bonuses makes no sense in relation to the clients that the Department is empowered and directed by the Legislature to serve. The Department continues to assert that payment reconciliations, cost reports, and settlement are all primary internal controls. As an additional measure, ISS payroll reviews are selected annually to further validate the primary internal controls. The SAO also did not consider supported living daily rates/payments as adequate internal controls. As an example, the Department completed internal control for all of the January 1, 2022 rate/payment increases, a total of some 3,800 plus payments, all mandated by the Legislature. The SAO?s audit did not review this payment change or even factor it in for internal controls in their finding. The Department remains concerned that the SAO appears to place 100% of the weight towards ISS payroll reviews as DDA?s only measure of internal control. Cost reporting and ISS payroll reviews are only one piece of many other processes that DDA employs to provide internal controls over their residential programs. The Department has many significant oversight and monitoring strategies for internal controls. They are as follows: ? Medicaid Service Verifications The Developmental Disabilities Administration (DDA) Quality Compliance Coordinator (QCC) team carries out Medicaid Service Verifications each month for a random sample of 79 clients who receive Medicaid services. This includes clients receiving supported living services. Clients or their legal representatives receive a service verification survey which asks if they received the services identified in their plan. If a client or their representative responds ?no? to this or any other question, a member of the QCC team follows up with a phone call to determine the next steps. ? Segregation of duties Service planning and service authorization are separate duties. Case managers are responsible for service planning. Resource managers are responsible for the rate assessment. There are also separate oversight processes for each of these duties. Oversight of service planning is performed by supervisors. Oversight of the rate approval process is performed by Resource Manager Supervisors and the DDA headquarters Community Residential Services Program Manager. ? Verification and approval process Resource managers complete the rate assessment. The rate assessment process applies multiple efficiencies to achieve cost effectiveness. Oversight of the rate approval process is performed by Resource Manager Supervisors and the DDA headquarters Community Residential Services Program Manager. A rate sheet (called ?Exhibit C? in the contract) is generated, and the provider confirms and signs it as part of their contract. The rates are uploaded into the Health Care Authority?s ProviderOne payment system, allowing the provider to claim the authorized rate. Rates assessed as tier nine and single-person households require an exception to policy, which is reviewed and approved by managerial staff. ? Allowable Costs Payment Reconciliation Twice per year the Department reconciles the provider?s payments for services provided to individual clients. There is a six-month review of payments for the first half of the calendar year and then a twelve-month review at the end of the calendar year. The final payments and cost settlement are adjusted for all variances in costs as determined by the reviews. ? Rate Payment and Increases For calendar year 2022, over 3,800 individual supported living daily rates and payments were reviewed because of a legislative mandate for the rates and payments to increase. ? Rate, cost report, settlement, and reconciliation processes Supported living uses a tiered rate reimbursement methodology. The tiered rate is a daily rate for an individual client. It is based upon the client?s assessed needs and economies of scale. The tier level and rate amount are calculated by algorithms established in rule. The systems involved include the Comprehensive Assessment, Review & Evaluation (CARE) tool, Residential Rates for Developmental Disabilities (RRDD), and Provider One. ALTSA and DDA staff monitor the systems and rates for accuracy. The tier methodology was reviewed and approved by CMS. The cost report is a financial report prepared by the contracted provider that identifies the costs related to community residential habilitative services and supports provided in the calendar year. Allowable costs are detailed in DDA policy 6.04. DDA rate analysts and agency providers both receive annual training on the cost report process and accuracy in the recording of all the financial information involved. When the cost report is submitted to the Department, the provider attests to its accuracy and completeness. DDA rate analysts review the cost report, checking for accuracy and completion in accordance with generally accepted accounting rules, and DDA polices 6.02 and 6.04. The initial review includes a checklist of instructions the analyst follows to ensure the cost report is reasonable, allowable, and completed accurately. The review includes a reconciliation of payments. The reconciliation process verifies the provider claimed the correct number of days of service and rate for every client in their contract. Reconciliation is done by comparing payments in the DDA RRDD database to those claimed in the Health Care Authority ProviderOne database. Variances are corrected in ProviderOne and on the cost report settlement when they are determined and verified by both the rate section and DDA field staff. The RRDD approval process for rates is a 3-step approval process that must pass the inspection of an RMA, Program Manager, and Cost Analyst for each rate to be approved and paid to a provider. The reconciliation process ensures that each client rate is paid exactly as it was contracted to be paid. For setting a rate, a case manager must approve the time allotted to each client and a resource manager must create each rate based on each case manager?s assessment. The cost report is not used to set rates. The cost report is used to calculate a financial settlement that compares payment revenue to actual expenses. When instruction and support services (ISS) payment revenue is more than the ISS expenses, a settlement is generated. The provider returns the amount owed (per the settlement) to the Department?s Office of Financial Recovery (OFR). ? Payroll verification process A sample of providers is required to submit payroll records that support the instruction and support services (ISS) expenses claimed on the cost report. Over the past three years, these verifications have increased from 25%, to 33% and for FY22 47% of providers were included in the sample. Samples are selected in mid-March, and the review process begins in mid-April after cost reports are submitted. Providers are given two weeks to provide payroll records. DDA?s rate analyst compares the provider payroll records to the ISS expenses reported on the cost report to verify that their payroll supports their reported ISS expenses. If inaccuracies are identified, the analyst may request additional information, or that corrections be made to the documentation submitted. ? Quality Assurance Review DDA?s Residential Quality Assurance unit had one employee who provides technical assistance for certified community residential settings during FY22. With the transition from the legacy ISS hour-driven rate system to the person-centered assessment driven tiered rate system, a formalized and more holistic quality assurance oversight process was developed. It was implemented in July 2019. This new QA oversight approach includes routine reviews to ensure selected supports listed in clients? person-centered service plans (PCSPs) align with the supports provided. The PCSP is the state?s primary instruction to the provider for the provision of contracted services. The quality assurance staff conducts virtual reviews of the quality and quantity of service in relation to individuals? assessed needs across ten domains of the CARE tool (the tool which contains the algorithm that drives the tiered rate). Reviews were historically conducted for approximately two providers per month, which resulted in 24 reviews. These reviews included a sample of clients across multiple homes and different service levels. During calendar year 2023, the Residential Quality Assurance unit hired three additional staff. With four staff, the goal will be 96 reviews per calendar year. The quality assurance staff provides recommendations if the providers? practices should be revised. This increases security and helps achieve better compliance with WAC 388-101D requirements. The quality assurance staff provides thorough, written feedback following the review, and requests a written plan of correction from the provider. The quality assurance staff monitors to ensure all providers submit the written plan. ? Duplicate Payment Report On a monthly basis the Department checks for overlapping service claims made by more than one provider for the same client ? that is, payments made to a provider on the same day that there is another claim for Medicaid funding (such as a claim for services provided by a hospital). When such claims are detected the Department contacts providers to gather further information and to provide guidance. Claims and authorizations are adjusted, as necessary. Additionally, in the ProviderOne system there is an automated system check which denies payments for multiple identical

2022-057 The Department of Social and Health Services? Aging and Long-Term Support Administration did not have adequate internal controls over and did not comply with requirements to ensure timely investigation of complaints of client abuse and neglect at Medicaid residential facilities. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Services Federal Award Number: 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; 2205WA5MAP; 2205WA5ADM Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions ? Provider Health and Safety Standards Known Questioned Cost Amount: None Background Medicaid is a jointly funded state and federal partnership serving 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one third of the state?s federal expenditures. The program spent more than $17.6 billion in federal and state funds during fiscal year 2022. The Centers for Medicare and Medicaid Services (CMS), which administers the program at the federal level, allows states to provide long-term care services to Medicaid clients that require daily nursing services. Medicaid coverage for nursing homes and intermediate care facilities for intellectually disabled clients is only authorized when services are provided in a residential facility licensed and certified by the state survey agency. The state survey agency is also responsible for investigating complaints and allegations of abuse, neglect or misappropriation. Residential Care Services, under the Department of Social and Health Services? Aging and Long-Term Support Administration (Department), is the state?s long-term care facility survey agency. Residential Care Services manages the Complaint Resolution Unit (Unit), which is the frontline response system for providing the intake and assignment functions for complaints from staff, residents, families and the public. The Unit receives two types of complaints, also known as reports: 1) complaints from Department staff, the public, government agencies, or law enforcement and 2) reports from facilities. People can submit complaints to the Unit by phone, mail, email, fax or online. The Unit responds to complaints received on holidays and after hours on the next business day. Until October 2021, the Department used the Tracking Incidents of Vulnerable Adults (TIVA) case management system to input, prioritize and track complaints. The Unit then began using the Secure Tracking and Reporting System (STARS) case management system for the rest of the audit period. Unit intake staff perform an initial review of complaints before entering them into STARS. Clinical triage nurses determine the final priority assignment of all nursing home and intermediate care facility complaints. According to state law (RCW 74.34.063), a complaint of suspected abandonment, abuse, financial exploitation, neglect, or self-neglect of a vulnerable adult must be responded to no later than 24 hours after knowledge of the report. The following table lists the five different priority levels for new complaints and the respective response times. During the COVID-19 pandemic, CMS guidance allowed states to work only on complaints with Immediate Jeopardy and Nonimmediate Jeopardy-High Priority levels. Priority Levels Required response times Immediate Jeopardy Initiate investigation within 2 working days of receipt Nonimmediate Jeopardy-High Initiate investigation within 10 working days of prioritization Nonimmediate Jeopardy-Medium Initiate investigation within 20 working days of prioritization Nonimmediate Jeopardy-Low Initiate investigation within 45 working days of prioritization Quality Review Field Manager Review The CMS State Operations Manual requires each complaint to be triaged by someone who is professionally qualified to evaluate the nature of the problem based on their experience and knowledge of current clinical standards of practice and federal requirements. Unit intake staff review, research, and prioritize complaints to ensure the level of response corresponds to the severity of the allegation. If necessary, the Unit assigns complaints to the Department?s field unit offices within two working days of knowledge of the complaint. Field staff investigate the complaints and follow up on them within the specified time frame as determined by the severity of the concerns noted. In fiscal year 2022, the Department received 50,626 complaints. Of these, 15,408 were related to nursing homes and 958 were related to intermediate care facilities for intellectually disabled people. The following table shows the number of Immediate Jeopardy and Nonimmediate Jeopardy-High Priority complaints for both provider types: Provider Type Immediate Jeopardy Complaints Received Nonimmediate Jeopardy-High Complaints Received Nursing Home 212 2,525 Intermediate Care Facility for the Intellectually Disabled 5 59 Combined Total 217 2,584 Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure timely investigation of complaints of client abuse and neglect at Medicaid residential facilities. The prior finding number was 2021-054. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure timely investigation of complaints of client abuse and neglect at Medicaid residential facilities. We evaluated all Immediate Jeopardy and Nonimmediate Jeopardy-High Priority complaints that occurred during fiscal year 2022 to ensure they met the required timelines for initiating an investigation. We found the Department did not initiate investigations timely for one of the Immediate Jeopardy complaints (0.5 percent) and 99 of the Nonimmediate Jeopardy-High Priority complaints (3.8 percent). For the Immediate Jeopardy complaint, the Department initiated an investigation four days after receipt. For the Nonimmediate Jeopardy-High Priority complaints, the Department initiated investigations between 11 to 83 days after receipt. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Department had limited staffing resources and received a large increase of COVID-19 related complaints. As a result, staff were unable to follow up on all complaints by the required response times. In addition, management did not effectively allocate sufficient resources to ensure all complaints were followed up on timely. Effect of Condition When the Department does not prioritize and investigate complaints timely, vulnerable residents at nursing homes and intermediate care facilities are at a higher risk of abuse, neglect and financial exploitation. Recommendation We recommend the Department strengthen its internal controls to ensure it responds to and investigates complaints timely, as federal and state regulations require. Department?s Response The Department partially agrees with the finding. We agree that not all complaint investigations were initiated within the required timeframes. However, we do not agree that it is due to inadequate internal controls. Residential Care Services (RCS) has effectively used our current internal controls since FY2017, when we received the SAO Stewardship Award related to this audit area. Compliance with required timeframes declined due to an increase in complaints from the previous fiscal year that were assigned for investigation and the staff vacancy rate. The effects of the COVID-19 pandemic including exposure, illness, staff resignation due to vaccination mandates, and continued staff vacancy rate of 24% impacted our ability to complete complaint investigations in the required timeframes. The 2021-054 Audit Corrective Action Plan (CAP) stated that we would be in compliance with Immediate Jeopardy intakes by 12/31/22, which is after the FY2022 audit period. In FY22 there was one late Immediate Jeopardy intake, which is a 97% improvement from the prior audit period. The CAP stated we would be in compliance with Non-Immediate Jeopardy intakes by 6/30/23. In FY22 there was a 48% improvement, proving that we are on pace to meet the 2021-054 CAP action item target date. Residential Care Services will continue to use our current internal controls, in addition to condensing and streamlining surveyor training, and extending the contract with Health Care Management Solutions to assist with surveys. This will allow staff to focus on the complaint investigations and complaint investigation backlog and compliance with required investigation timeframes. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR Part 488 Subpart E, Survey and Certification of Long-Term Care Facilities, section 335, Action on complaints of resident neglect and abuse, and misappropriation of resident property, states in part: (a) Investigation. (1) The State must review all allegations of resident neglect and abuse, and misappropriation of resident property and follow procedures specified in ? 488.332. (2) If there is reason to believe, either through oral or written evidence that an individual used by a facility to provide services to residents could have abused or neglected a resident or misappropriated a resident's property, the State must investigate the allegation. (3) The State must have written procedures for the timely review and investigation of allegations of resident abuse and neglect, and misappropriation of resident property. (b) Source of complaints. The State must review all allegations regardless of the source. The Centers for Medicare and Medicaid Services, State Operations Manual Chapter 5 ? Complaint Procedures, states in part: Section 5010 ?General Intake Process A complaint is an allegation of noncompliance with Federal and/or State requirements. If the SA determines that the allegation(s) falls within the authority of the SA, the SA determines the severity and urgency of the allegations, so that appropriate and timely action can be pursued. Each SA is expected to have written policies and procedures to ensure that the appropriate response is taken for all allegations and is consistent with Federal requirements as well as with procedures in the State Operations Manual. This structure needs to include response timelines and a process to document actions taken by the SA in response to allegations. If a State?s time frames for the investigation of a complaint/incident are more stringent than the Federal time frames, the intake is prioritized using the State?s time frames. The SA is expected to be able to share the logic and rationale that was utilized in prioritizing the complaint/incident for investigation. The SA response must be designed to protect the health and safety of all residents, patients and clients. Section 5070 ? Priority Assignment for Nursing Homes, Deemed and Non-Deemed Non-Long Term Care Providers/Suppliers, and EMTALA An assessment of each complaint or incident intake must be made by an individual who is professionally qualified to evaluate the nature of the problem based upon his/her knowledge of Federal requirements and his/her knowledge of current clinical standards of practice. For non-long term care providers/suppliers, in situations where a determination is made that immediate jeopardy may be present and ongoing, the SA is required to start the on-site investigation within two working days of receipt of the complaint or incident report in the case of a deemed provider or supplier, within two working days of RO authorization for investigation. For all non-immediate jeopardy situations, the complaint/incident is prioritized within two working days of its receipt, unless there are extenuating circumstances that impede the collection of relevant information. The Department of Social and Health Services, Residential Care Services Division Standard Operation Procedure: Complaint Resolution Unit Chapter 4A20, states in part: Procedure A. CRU staff will prioritize complaint intakes using the following guidelines: 1. 2 working days (Immediate Jeopardy) ? A situation in which the provider?s noncompliance with one or more requirements of participation has caused, or is likely to cause, serious injury, harm, impairment, or death to a resident. Immediate corrective action is necessary. 2. 10 working days (Non Immediate Jeopardy-High) ? The alleged noncompliance may have caused harm that negatively impacts the individual?s mental, physical and/or psychosocial status and are of such consequence to the person?s well-being, the SA conducts a rapid response. Usually, specific rather than general information (such as, descriptive identifiers, individual names, date/time/location of occurrence, description of harm, etc.) factors into the assignment of this level of priority.

2022-058 The Department of Social and Health Services did not have adequate internal controls over False Claims Act requirements. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; 2205WA5MAP; 2205WA5ADM Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions ? Utilization Control and Program Integrity Known Questioned Cost Amount: None Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one-third of the state?s federal expenditures. During fiscal year 2022, the program spent more than $17.6 billion in federal and state funds. Federal law requires states to ensure providers and contractors receiving or making payments totaling at least $5 million annually under their Medicaid program have: ? Established written policies for all employees (including management) about the federal False Claims Act, whistleblower protections, administrative remedies, and any pertinent state laws and rules ? Detailed provisions in their policies about detecting and preventing fraud, waste and abuse ? Included in any employee handbook a discussion of the False Claims Act, whistleblower protections, administrative remedies, and pertinent state laws and rules The Department of Social and Health Services, Aging and Long-Term Support Administration (ALTSA), uses an SQL Server Reporting Services (SSRS) report to review prior federal fiscal year expenditures for both ALTSA and Development Disability Administration (DDA) providers and contractors. For the applicable providers and contractors identified as meeting or exceeding the $5 million threshold, the administrations send requests around March or April of each year to obtain support to ensure False Claims Act requirements are met. Providers and contractors appearing on the SSRS report for the first time are sent a letter requesting their policies and procedures, including information on the False Claims Act, whistleblower protections, detecting and preventing fraud, waste and abuse, and any existing employee handbook/policy manual if available. If a provider or contractor has sent this information in prior years, the templated letter requests that they send this information only if there have been significant changes to their policies or employee handbook. However, the Department requests that all providers and contractors in the report complete an Attestation of Compliance form detailing that they have complied with the False Claims Act requirements. The letters typically ask for documents to be returned within 45 days, and the status of each request is logged and monitored in tracking spreadsheets individually maintained by ALTSA and DDA. In fiscal year 2022, the state Medicaid program paid more than $1 billion to 67 providers and contractors exceeding the False Claims Act threshold. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over False Claims Act requirements. While independently confirming the completeness and accuracy of the SSRS report populations, we identified two providers paid nearly $30 million that were not included in the Department?s SSRS report. The report did not show newer providers because it used and referenced an old provider table that had not been updated since 2015. Therefore, newer providers would not populate on the report. After the audit period ended, the Department identified and corrected the issue. However, during the audit period, it did not request, obtain, or review these two providers for False Claims Act requirements. Additionally, we found the Department had not established internal controls to ensure documentation from providers and contractors was obtained timely. The Department?s request letters set a 45 day deadline for required items to be provided, however, it has not implemented procedures to enforce remedial actions for late submissions, such as payment suspension or contract termination. In our review of the tracking logs, we found that of the applicable 67 entities, 14 providers and contractors attributed to DDA returned their False Claims Act documents after our audit period?several as late as December 2022?which is 15 months after the end of the period the records pertain to. We consider these internal control deficiencies to be a material weakness. This was not reported as a finding in the prior audit period. Cause of Condition Department management and staff did not know the SSRS report query was not capturing new providers and contractors. In addition, management did not think it necessary to enforce the deadline for providers and contractors to return False Claims Act documents, because their associated services are crucial to the Department?s objectives. Effect of Condition By not establishing sufficient internal controls over False Claim Act requirements, the Department is unable to identify all providers and contractors that require monitoring. Furthermore, the Department did not meet federal requirements for the two entities that were not captured or monitored during our audit period. Recommendations We recommend the Department: ? Improve internal controls to ensure all providers and contractors exceeding the $5 million threshold are appropriately identified ? Monitor the two omitted providers to ensure their compliance with False Claims Act requirements ? Implement internal controls to ensure all provider and contractor responses are received timely, and define possible consequences and outcomes if timelines are not met Department?s Response The Department agrees with the Finding. As of February 2023, a new report generated and tested through the Data Mart is being used that will include all Aging and Long-Term Support Administration/Developmental Disabilities Administration (ALTSA/DDA) Medicaid providers. On April 1, 2023 the ALTSA Provider was mailed a letter requesting the False Claims Act attestation and policy/procedures. ALTSA will ensure that the FCA attestation and policy/procedures are returned to ensure compliance with the FCA requirement by 5/31/2023. DDA provider?s attestations were mailed in a timely manner and were received, although some were received after the due date. DDA will add to its process to follow up with their providers every month until the attestations are received. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. 42 U.S. Code Section 1396a ? State plans for medical assistance, states in part: A State plan for medical assistance must ? (68) provide that any entity that receives or makes annual payments under the State plan of at least $5,000,000, as a condition of receiving such payments, shall? (A) establish written policies for all employees of the entity (including management), and of any contractor or agent of the entity, that provide detailed information about the False Claims Act established under sections 3729 through 3733 of title 31, administrative remedies for false claims and statements established under chapter 38 of title 31, any State laws pertaining to civil or criminal penalties for false claims and statements, and whistleblower protections under such laws, with respect to the role of such laws in preventing and detecting fraud, waste, and abuse in Federal health care programs (as defined in section 1320a?7b(f) of this title); (B) include as part of such written policies, detailed provisions regarding the entity?s policies and procedures for detecting and preventing fraud, waste, and abuse; and (C) include in any employee handbook for the entity, a specific discussion of the laws described in subparagraph (A), the rights of employees to be protected as whistleblowers, and the entity?s policies and procedures for detecting and preventing fraud, waste, and abuse;

2022-059 The Department of Social and Health Services did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid Program. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 ? State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U. S. Department of Health and Human Services Federal Award Number: 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; 2205WA5MAP; 2205WA5ADM Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions ? Provider Eligibility Known Questioned Cost Amount: None Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one-third of the State?s federal expenditures. During fiscal year 2022, the program spent about $17.6 billion in federal and state funds. The Department of Social and Health Services (Department) is responsible for ensuring Medicaid social service providers are eligible to render services to recipients of the program. Providers are to remain in good standing with eligibility requirements in order to continue receiving payments under the program. The Department is responsible for performing measures appropriate for the provider type at application and initial enrollment. Federal regulations require state Medicaid agencies to revalidate the enrollment of all Medicaid providers at least every five years. Washington had over 81,000 active providers during fiscal year 2022. During that time, the Department paid nearly $4.6 billion to providers for direct client services. The Department initiates and revalidates the enrollment of Medicaid providers through its contracting process. Individual providers contract terms are four years, and contracting requirements are screened by a contract specialist within the Department?s Aging and Long-Term Support and Developmental Disabilities Administrations. Contracts are also screened by Area Agencies on Aging offices. A valid Washington state driver?s license or other valid picture identification and either a Social Security card or proof of authorization to work in the United States must be checked during the initial contract or revalidation for individual providers (IPs). Nursing facility contract expiration dates are open ended, but the contract unit revalidates nursing facility enrollment every five years. Contracting requirements are screened by the Department?s contract unit. When a new provider is enrolled or a provider?s contract is revalidated, contract staff review the application packet, including picture identification and proof of authorization to work in the United States for IPs, and a contract file is created in the Department?s Agency Contracts Database (ACD). Once the application is marked approved in ACD, the Automated Provider Screening system automatically screens the provider through the following federal databases the following day: ? List of Excluded Individuals/Entities (LEIE) ? Excluded Parties List System (EPLS), now called System for Awards Management (SAM) ? SSA Limited Access Death Master File Contract unit staff are notified by email if the screening resulted in a match and staff then manually verify if the match was legitimate. Federal law also requires that in between revalidation periods, state Medicaid agencies are to determine the exclusion status of providers, including any person with ownership, controlling interest, or acting as an agent or managing employee of the provider, no less frequently than monthly by performing checks of LEIE and SAM. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid Program. During the audit period, the Department processed nine nursing facility revalidations and 13,352 new and revalidated individual provider enrollments. During this same period, the Department was required to perform ongoing eligibility determinations for 73,368 existing individual providers and 195 existing nursing facilities. Federal law requires the Authority to check federal databases at least monthly to confirm the identity and exclusion status of providers. However, the automated system that performs these checks and notifies the Department of possible problems with providers was not operating correctly, and it frequently provided incorrect information. A management decision was made to instead only screen all providers on an annual basis. In September 2021, the Department manually screened all providers against the federal systems. For all other months, only newly populated providers from the automated systems check would receive screening for the month. Additionally, we used a statistical sampling method to randomly select and examine 59 new and revalidated individual providers and five revalidated nursing facilities to determine if the Department had properly screened and enrolled providers in accordance with federal requirements. We found one individual provider in our sample for which the Department could not locate the enrollment documentation. Therefore, we could not confirm the Department?s determination of the provider?s eligibility status. We consider these internal control deficiencies to be a material weakness which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Because of issues with the automated system, the Department said they did not have the time or resources to manually perform database checks of all providers each month. The Department could not locate the enrollment documentation for the one individual provider, because the provider never provided services to clients, and therefore was not associated with a region where the provider packets are typically filed and stored. Effect of Condition By not reviewing the exclusion status all providers in a timely and routine manner, the Department was non-compliant with federal requirements to check the LEIE and EPLS no less frequently than monthly. As a result, the Department is at risk of not properly identifying any newly excluded or sanctioned providers. By not retaining documentation for all enrollments, the Department could not demonstrate the individual provider was eligible to provide services to Medicaid beneficiaries. Recommendations We recommend the Department: ? Implement internal controls designed to bring it into compliance with monthly provider screening requirements ? Ensure provider documentation is retained to support the Department?s screening and enrollment determinations Department?s Response The Department agrees with the Finding. As of March 2023, DSHS is reviewing all providers on the monthly exclusion report. On 6/1/2022 with the change to Consumer Direct of Washington (CDWA), Individual Providers are no longer contracted with DSHS. As a result, this type of error will not occur for this provider type moving forward. It was verified that the ALTSA Provider that was missing enrollment documentation was never employed and did not receive any payments. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR section 455 Subpart E ? Provider Screening and Enrollment, states in part: Section 455.410 Enrollment and screening of providers (a) The State Medicaid agency must require all enrolled providers to be screened under to this subpart. (b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. (c) The State Medicaid agency may rely on the results of the provider screening performed by any of the following: (1) Medicare contractors. (2) Medicaid agencies or Children's Health Insurance Programs of other States. Section 455.414 Revalidation of enrollment The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years. Section 455.436 Federal database checks The State Medicaid agency must do all of the following: (a) Confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. (b) Check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. (c) (1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and (2) Check the LEIE and EPLS no less frequently than monthly. Section 455.450 Screening levels for Medicaid providers. A State Medicaid agency must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of ?limited,? ?moderate,? or ?high.? If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. (a) Screening for providers designated as limited categorical risk. When the State Medicaid agency designates a provider as a limited categorical risk, the State Medicaid agency must do all of the following: (1) Verify that a provider meets any applicable Federal regulations, or State requirements for the provider type prior to making an enrollment determination. (2) Conduct license verifications, including State licensure verifications in States other than where the provider is enrolling, in accordance with ? 455.412. (3) Conduct database checks on a pre- and post-enrollment basis to ensure that providers continue to meet the enrollment criteria for their provider type, in accordance with ? 455.436. (b) Screening for providers designated as moderate categorical risk. When the State Medicaid agency designates a provider as a ?moderate? categorical risk, a State Medicaid agency must do both of the following: (1) Perform the ?limited? screening requirements described in paragraph (a) of this section. (2) Conduct on-site visits in accordance with ? 455.432. (c) Screening for providers designated as high categorical risk. When the State Medicaid agency designates a provider as a ?high? categorical risk, a State Medicaid agency must do both of the following: (1) Perform the ?limited? and ?moderate? screening requirements described in paragraphs (a) and (b) of this section. (2) (i) Conduct a criminal background check; and (ii) Require the submission of a set of fingerprints in accordance with ? 455.434. (d) Denial or termination of enrollment. A provider, or any person with 5 percent or greater direct or indirect ownership in the provider, who is required by the State Medicaid agency or CMS to submit a set of fingerprints and fails to do so may have its - (1) Application denied under ? 455.434; or (2) Enrollment terminated under ? 455.416. (e) Adjustment of risk level. The State agency must adjust the categorical risk level from ?limited? or ?moderate? to ?high? when any of the following occurs: (1) The State Medicaid agency imposes a payment suspension on a provider based on credible allegation of fraud, waste or abuse, the provider has an existing Medicaid overpayment, or the provider has been excluded by the OIG or another State's Medicaid program within the previous 10 years. (2) The State Medicaid agency or CMS in the previous 6 months lifted a temporary moratorium for the particular provider type and a provider that was prevented from enrolling based on the moratorium applies for enrollment as a provider at any time within 6 months from the date the moratorium was lifted.

2022-060 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited cost report data for rate setting, hospital billings, and other financial and statistical records for inpatient hospital services. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; 2205WA5MAP; 2205WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions ? Inpatient Hospital and Long-Term Care Facility Audits Questioned Cost Amount: None Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one third of the state?s federal expenditures. During fiscal year 2022, the program spent more than $17.6 billion in federal and state funds, including over $360 million paid to hospitals for inpatient services. The Health Care Authority (Authority), the state Medicaid agency, pays for inpatient services to hospitals by using rates that are economic, efficient, and in accordance with the state plan. The federal grantor requires the Authority to periodically audit the financial and statistical records of participating providers, as established in the state plan. The Medicaid State Plan, Attachment 4.19, lists the financial audit requirements for establishing payment rates for inpatient hospital services. Prior to October 1, 2021, the plan stated that cost report data used for rate setting, hospital billings, and other financial and statistical records will be periodically audited. Beginning October 1, 2021, the plan was amended and now states that cost report data used for rate setting may be periodically audited and hospital billings and other financial and statistical records will be periodically audited. Washington Administrative Code also states that the agency will periodically audit cost report data used for rate setting, hospital billings, and other financial and statistical records. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the most recent audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited cost report data for rate setting, hospital billings, and other financial and statistical records for inpatient hospital services. The prior finding numbers were 2021-051 and 2020-049. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited cost report data for rate setting, hospital billings, and other financial and statistical records for inpatient hospital services. Although the Authority did reconcile amounts paid to hospitals for inpatient services based on the amounts facilities reported, it did not periodically audit cost report data used for rate setting, hospital billings, or other financial and statistical records, which both state regulations and the state plan require. Additionally, the Authority does not have documented methodology, policies or procedures for when and how the audits would be performed. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Authority did not establish policies and procedures to ensure it periodically audited cost report data, hospital billings, and other financial and statistical records for inpatient hospital services. Effect of Condition By not ensuring that it periodically audits cost report data, hospital billings, and other financial and statistical records, the Authority increases its risk of improperly paying for inpatient hospital services. Recommendation We recommend the Authority establish and implement adequate internal controls to ensure it meets federal inpatient hospital audit requirements. Authority?s Response The State of Washington uses a prospective payment system that no longer uses cost reports for the reimbursement of almost all hospital providers, other than outlier payments, transplants, Critical Access Hospitals and Certified Public Expenditure Hospitals for inpatient fee for service. The Authority is not aware of federal intention or directive for states to continue auditing cost reports if they are not used to establish reimbursement rates. In addition, a strict interpretation of this CFR is not consistent with the fact that CMS allows for states to rely on the Medicare audited cost reports even in cost-based reimbursement systems. 42 CFR 447.253(g) states ?the Medicaid agency must provide for periodic audits of the financial and statistical records of participating providers.? Washington does ensure there are reviews of hospital financial and statistical records, including the review of hospital Disproportionate Share Hospital (DSH) reimbursement through the DSH audit. The Agency will explore ways to review or audit the financial and statistical records of the components used in the ratio of cost to charges calculation. Auditor?s Remarks The cost report requirement the Authority asserts was not relevant, was required for the first three months of the audit period by the state plan and for the entire audit period by Washington Administrative Code 182-550-5700. Additionally, the Authority may not use the audits of the Medicare cost reports to meet this requirement since those reports are for a different federal program. The Medicaid state plan, Washington Administrative Code 182-550-5700, and 42 CFR 447.253(g) all require the Authority to periodically audit inpatient hospital billings and other financial and statistical records. The Authority asserted it performs reviews of hospital financial and statistical records. However, during the audit, we confirmed these reviews are informal, have no policies and procedures related to them, and do not meet this audit requirement. In addition, the DSH reimbursement audit referenced is a separate program requirement mandated by federal law CFR (42 CFR 455.304). We reaffirm our finding and will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 U.S. Code of Federal Regulations (CFR) Part 447, Payments for Services, section 447.253, Other requirements, states in part: (a) State assurances. In order to receive CMS approval of a State plan change in payment methods and standards, the Medicaid agency must make assurances satisfactory to CMS that the requirements set forth in paragraphs (b) through (i) of this section are being met, must submit the related information required by ? 447.255 of this subpart, and must comply with all other requirements of this subpart. (f) Uniform cost reporting. The Medicaid agency must provide for the filing of uniform cost reports by each participating provider. (g) Audit requirements. The Medicaid agency must provide for periodic audits of the financial and statistical records of participating providers. (i) Rates paid. The Medicaid agency must pay for inpatient hospital and long term care services using rates determined in accordance with methods and standards specified in an approved State plan. Medicaid State Plan, Attachment 4.19-A Part I Methods and Standards for Establishing Payment Rates for Inpatient Hospital Services, page 60 states in part: 3. Financial Audit Requirements Cost report data used for rate setting may be periodically audited. Hospital billings and other financial and statistical records will be periodically audited by the agency. Washington Administrative Code 182-550 Hospital services specifies requirements for the Authority regarding hospitals providing Medicaid services. WAC 182-550-5410 CPE Medicaid cost report and settlements, states in part: (4) The medicaid cost report schedules and supporting documentation are subject to audit by the agency or its designee to verify that claimed costs qualify under federal and state rules governing the CPE payment program. The documentation required includes, but is not limited to: (a) The revenue codes assigned to specific cost centers on the medicaid cost report schedules. (b) The inpatient charges by revenue codes for uninsured patients and medicaid clients enrolled in an MCO plan. (c) The outpatient charges by revenue codes for uninsured patients and medicaid clients enrolled in an MCO plan. (d) All payments received for the inpatient and outpatient charges in (b) and (c) of this subsection including, but not limited to, payments for third party liability, uninsured patients, and medicaid clients enrolled in an MCO plan. WAC 182-550-5700 Hospital reports and audits, states in part: (4) The agency will periodically audit: (a) Cost report data used for rate setting; (b) Hospital billings; and (c) Other financial and statistical records.

2022-061 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; 2205WA5MAP; 2205WA5ADM Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Utilization Control and Program Integrity Known Questioned Cost Amount: None Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one-third of the State?s federal expenditures. During fiscal year 2022, the program spent about $17.6 billion in federal and state funds. Under federal regulations, Medicaid state plans must include methods and procedures to safeguard against unnecessary utilization of care and services. The regulations require states to implement a statewide surveillance and utilization control program that: ? Safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments; ? Assesses the quality of those services; ? Provides for the control of the utilization of all services provided under the plan; and ? Provides for the control of the utilization of inpatient services. Multiple state agencies in Washington manage aspects of the Medicaid program. The agencies include the Authority, Department of Social and Health Services, Department of Health, Office of the Attorney General, and Department of Children, Youth, and Families. The Centers for Medicare and Medicaid Services (CMS) considers the Authority to be Washington?s official Medicaid agency. Federal regulations require the Medicaid agency: (1) Monitor the statewide utilization control program; (2) Take all necessary corrective action to ensure the effectiveness of the program; (3) Establish methods and procedures to implement this section; (4) Keep copies of these methods and procedures on file; and (5) Give copies of these methods and procedures to all staff involved in carrying out the utilization control program. Federal regulations also require the Medicaid agency have procedures for the ongoing evaluation, on a sample basis, of the need for, quality and timeliness of Medicaid services. These reviews must occur on a post-payment basis so that the State can review beneficiary utilization and provider service profiles, as well as identify exceptions so that the Authority can correct misutilization practices of beneficiaries and providers. Furthermore, federal statute requires States to ensure providers and contractors receiving or making payments totaling at least $5 million annually under a state?s Medicaid program have: ? Established written policies for all employees (including management) about the Federal False Claims Act, whistleblower protections, administrative remedies, and any pertinent state laws and rules ? Included as part of these policies detailed provisions regarding detecting and preventing fraud, waste, and abuse ? Included in any employee handbook a discussion of the False Claims Act, whistleblower protections, administrative remedies, and pertinent state laws and rules. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the last four audits, we reported the Authority did not establish adequate internal controls over and did not comply with utilization control and program integrity requirements. The prior finding numbers were 2021-050, 2020-047, 2020-048, 2019-052, 2019-053, and 2018-047. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. Washington?s Medicaid state plan does not include all methods and procedures to safeguard against unnecessary utilization of care and services. The Authority also did not implement and monitor a statewide surveillance and utilization control program. We found that the Authority performs various types of program integrity and control utilization reviews, but in our judgment these efforts did not meet requirements of evaluating the appropriateness and quality of Medicaid services on a post-payment basis. Additionally, our review of False Claims Act requirements for 130 applicable providers and contractors which exceeded the $5 million threshold found that the Authority did not appropriately monitor two contractors who were paid over $108 million. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Authority has a Program Integrity unit that is responsible for safeguarding against unnecessary utilization of care and services for the Medicaid program. However, they do not have policies and procedures to adequately ensure they met all compliance requirements that the Authority was responsible for. These requirements include implementing and monitoring the statewide utilization control program, which includes overseeing and monitoring the activities of other state agencies. Program Integrity?s scope of reviews do not include the topic of Medicaid service quality, and though other units at the Authority perform reviews to address quality, they are usually not performed on a post-payment basis. The Authority and the Department of Social and Health Services (DSHS) are both responsible for ensuring the False Claims Act requirements are met. The noncompliance for the two contractors was due to confusion over whose responsibility it was to monitor them as these were DSHS contracts that were paid by the Authority and therefore each agency assumed it was the others? responsibility and no monitoring was performed. Effect of Condition By not establishing methods and procedures to safeguard against unnecessary utilization of care and services, there is an increased risk of unnecessary or inappropriate use of Medicaid services and payments. Additionally, the current False Claims Act process in place for contractors outside of Managed Care Organizations (MCO) is not sufficient to prevent future noncompliance. Furthermore, the Authority did not meet federal program integrity requirements and could be subject to federal sanctions because it has not established a statewide surveillance and utilization program and does not describe its safeguarding methods and procedures in the Medicaid state plan. Recommendations We recommend the Authority: ? Update the Medicaid state plan to include all the methods and procedures it uses to safeguard against unnecessary utilization of care and services ? Implement and monitor a statewide surveillance and utilization control program ? Implement adequate internal controls to ensure it complies with utilization control and program integrity requirements ? Improve internal controls for contractors subject to False Claims Act requirements to ensure all entities are properly monitored ? Perform monitoring of the two omitted contractors to ensure their compliance with False Claims Act requirements. Authority?s Response The Authority partially concurs with the finding. The Authority has received guidance from CMS and will adjust the state plan based on CMS requirements. This will not include separately listing the methods and procedures it uses to safeguard against unnecessary utilization of care and services, per CMS guidance. The Authority does not concur with the auditor?s conclusion regarding its statewide surveillance and utilization control program. The program meets CMS standards and requirements and provides reasonable oversight. The Authority concurs that two PACE providers were not monitored for their compliance with the FCA during the fiscal year. Our sister agency, DSHS, manages the contracts for the PACE program but payments to these providers are routed through ProviderOne. The process for PACE provider monitoring has been clarified with DSHS and they will provide FCA oversight for these contracts going forward. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR Subchapter C Medical Assistance Programs Part 456, Utilization Control, Subpart B, Utilization Control: All Medicaid Services states in part: Section 456.1 Basis and purpose of part. (a) This part prescribes requirements concerning control of the utilization of Medicaid services including - (1) A statewide program of control of the utilization of all Medicaid services; (b) The requirements in this part are based on the following sections of the Act. Table 1 shows the relationship between these sections of the Act and the requirements in this part. (1) Methods and procedures to safeguard against unnecessary utilization of care and services. Section 1902(a)(30) requires that the State plan provide methods and procedures to safeguard against unnecessary utilization of care and services. Section 456.2 State plan requirements. (a) A State plan must provide that the requirements of this part are met. (b) These requirements may be met by the agency by: (1) Assuming direct responsibility for assuring that the requirements of this part are met; or (2) Deeming of medical and utilization review requirements if the agency contracts with a QIO to perform that review, which in the case of inpatient acute care review will also serve as the initial determination for QIO medical necessity and appropriateness review for patients who are dually entitled to benefits under Medicare and Medicaid. Section 456.3 Statewide surveillance and utilization control program. The Medicaid agency must implement a statewide surveillance and utilization control program that - (a) Safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments; (b) Assesses the quality of those services; (c) Provides for the control of the utilization of all services provided under the plan in accordance with subpart B of this part; and (d) Provides for the control of the utilization of inpatient services in accordance with subparts C through I of this part. Section 456.4 Responsibility for monitoring the utilization control program. (a) The agency must - (1) Monitor the statewide utilization control program; (2) Take all necessary corrective action to ensure the effectiveness of the program; (3) Establish methods and procedures to implement this section; (4) Keep copies of these methods and procedures on file; and (5) Give copies of these methods and procedures to all staff involved in carrying out the utilization control program. Section 456.5 Evaluation criteria. The agency must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. This section does not apply to services in hospitals and mental hospitals. For these facilities, see the following sections: ?? 456.122 and 456.132 of subpart C; and ? 456.232 of subpart D. Title 42 CFR Subchapter C Medical Assistance Programs Part 456, Utilization Control, Subpart B, Utilization Control: All Medicaid Services states in part: Section 456.21 Scope. This subpart prescribes utilization control requirements applicable to all services provided under a State plan. Section 456.22 Sample basis evaluation of services. To promote the most effective and appropriate use of available services and facilities the Medicaid agency must have procedures for the on-going evaluation, on a sample basis, of the need for and the quality and timeliness of Medicaid services. Section 456.23 Post-payment review process. The agency must have a post-payment review process that - (a) Allows State personnel to develop and review - (1) Beneficiary utilization profiles; (2) Provider service profiles; and (3) Exceptions criteria; and (b) Identifies exceptions so that the agency can correct misutilization practices of beneficiaries and providers. 42 U.S. Code Section 1396a ? State plans for medical assistance, states in part: A State plan for medical assistance must - (68) provide that any entity that receives or makes annual payments under the State plan of at least $5,000,000, as a condition of receiving such payments, shall? (A) establish written policies for all employees of the entity (including management), and of any contractor or agent of the entity, that provide detailed information about the False Claims Act established under sections 3729 through 3733 of title 31, administrative remedies for false claims and statements established under chapter 38 of title 31, any State laws pertaining to civil or criminal penalties for false claims and statements, and whistleblower protections under such laws, with respect to the role of such laws in preventing and detecting fraud, waste, and abuse in Federal health care programs (as defined in section 1320a?7b(f) of this title); (B) include as part of such written policies, detailed provisions regarding the entity?s policies and procedures for detecting and preventing fraud, waste, and abuse; and (C) include in any employee handbook for the entity, a specific discussion of the laws described in subparagraph (A), the rights of employees to be protected as whistleblowers, and the entity?s policies and procedures for detecting and preventing fraud, waste, and abuse;

2022-062 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to report recoveries of fraudulent overpayments on the CMS-64 report. Assistance Listing Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 ? State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U. S. Department of Health and Human Services Federal Award Number: 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; 2205WA5MAP; 2205WA5ADM Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Test and Provisions: Medicaid Fraud Control Unit (MFCU) Known Questioned Cost Amount: $977,613 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.3 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one-third of the State?s federal expenditures. During fiscal year 2022, the program spent about $17.6 billion in federal and state funds. The Health Care Authority is required to refer suspected fraud or other criminal violations to the Medicaid Fraud Control Division (MFCD) for investigation and prosecution. The Authority reports any overpayment recoveries resulting from MFCD actions on the CMS-64 report. The CMS-64 report is the quarterly statement of Medicaid Program expenditures that agencies use to report the actual program benefit costs and administrative expenses to the Centers for Medicare & Medicaid Services (CMS). CMS uses this information to compute the federal financial participation for the state?s Medicaid Program costs. When MFCD completes an investigation, it sends the final results over to the Authority for management review and signature. After a final judgement is made on an overpayment resulting from fraud, the State has 30 days to refund the entire federal share. Once the Authority receives the outcome, a Journal Voucher (JV) is created to move the federal portion of the overpayment over to state-only funding, which creates a credit on the CMS-64 report. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to report MCFD overpayment recoveries on the CMS-64 report. The prior finding numbers were 2021-052 and 2020-050. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to report recoveries of fraudulent overpayments on the CMS-64 report. Our audit found the Authority did not create JVs to move the entire federal portion of the two final judgments resulting from fraud over to state-only funding or report the entire overpayment on the CMS-64 report as a credit. Instead, the Authority only created JVs of the payments as they were made to the State. Additionally, the Authority did not have policies and procedures in place that described the process staff should follow for creating the JV or for reporting the MFCD overpayments on the CMS-64 report. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management did not implement sufficient internal controls to ensure the Authority returned recoveries of fraudulent overpayments to the grantor in a timely manner. Additionally, the MFCD inadvertently did not notify the Authority at the time of final filing for one judgement resolution. Effect of Condition and Questioned Costs For fiscal year 2022, two final judgements were made totaling $2,792,013 in overpayments resulting from fraud. The Authority created JVs and reported $139,718 on the CMS-64 report dated June 30, 2022. JVs for the entire federal portion should have been processed and reported on the June 30, 2022 CMS-64 report. We are questioning the costs of $977,613 that the Authority did not report on the CMS-64 report or return to CMS, as federal regulations require. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: ? Establish a formal process to ensure it properly reports recoveries of fraudulent overpayments on the quarterly CMS-64 report ? Consult with the federal grantor about whether or not the questioned costs identified in the finding should be repaid Authority?s Response The Authority partially concurs with the finding. It has documented the processes and procedures staff will follow to acknowledge and comply with the applicable federal rules and regulations concerning the timely return of federal revenue associated with fraudulent overpayments. The authority does not concur with repayment of $976,580 questioned costs related to one of the fraud referrals. The provider in this case was out of business and its business license expired May 2017, and then became inactive October 2017. The State pursued assets through available means and through the court. Final court rulings were made in June 2022, and in April 2023, within one year of the final rulings, the Attorney General?s Office certified that the defaulted corporation had no identifiable assets. In accordance with 42 CFR 433.318 (d) the provider is out of business and the Authority is not required to refund overpayment to CMS. The Authority will work with the Centers for Medicaid & Medicare Services to coordinate the return of the remaining $1,032 in identified questioned costs. Auditor?s Remarks The Authority states that the $976,580 in questioned costs is not required to be returned due to the corporation having no identifiable assets. While this may be the case since the Attorney General?s Office certified the corporation had no assets on April 13th, 2023, which was outside of our audit scope, the summary judgement order for this case was issued on May 2, 2022, and the overpayments were required to be returned within 30 days of that ruling. We reaffirm our finding and will follow up on the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 42 U.S. Code of Federal Regulations (CFR) Part 433, State Fiscal Administration, Subpart F ? Refunding of Federal Share of Medicaid Overpayments to Providers, describes the requirements for identifying, reporting, collecting, and remitting Medicaid overpayments. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200, Uniform Guidance, section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 CFR Part 433, State Fiscal Administration, Subpart F ? Refunding of Federal Share of Medicaid Overpayments to Providers states in part: Section 433.300 Basis. This subpart implements - (a) Section 1903(d)(2)(A) of the Act, which directs that quarterly Federal payments to the States under title XIX (Medicaid) of the Act are to be reduced or increased to make adjustment for prior overpayments or underpayments that the Secretary determines have been made. (b) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. (c) Section 1903(d)(3) of the Act, which provides that the Secretary will consider the pro rata Federal share of the net amount recovered by a State during any quarter to be an overpayment. Section 433.312 Basic requirements for refunds. (a) Basic rules. (1) Except as provided in paragraph (b) of this section, the State Medicaid agency has 1 year from the date of discovery of an overpayment to a provider to recover or seek to recover the overpayment before the Federal share must be refunded to CMS. (2) The State Medicaid agency must refund the Federal share of overpayments at the end of the 1-year period following discovery in accordance with the requirements of this subpart, whether or not the State has recovered the overpayment from the provider. (b) Exception. The agency is not required to refund the Federal share of an overpayment made to a provider when the State is unable to recover the overpayment amount because the provider has been determined bankrupt or out of business in accordance with ? 433.318. Section 433.316 When discovery of overpayment occurs and its significance. (a) General rule. The date on which an overpayment is discovered is the beginning date of the 1-year period allowed for a State to recover or seek to recover an overpayment before a refund of the Federal share of an overpayment must be made to CMS. (b) Requirements for notification. Unless a State official or fiscal agent of the State chooses to initiate a formal recoupment action against a provider without first giving written notification of its intent, a State Medicaid agency official or other State official must notify the provider in writing of any overpayment it discovers in accordance with State agency policies and procedures and must take reasonable actions to attempt to recover the overpayment in accordance with State law and procedures. (c) Overpayments resulting from situations other than fraud. An overpayment resulting from a situation other than fraud is discovered on the earliest of - - (1) The date on which any Medicaid agency official or other State official first notifies a provider in writing of an overpayment and specifies a dollar amount that is subject to recovery; (2) The date on which a provider initially acknowledges a specific overpaid amount in writing to the medicaid agency; or (3) The date on which any State official or fiscal agent of the State initiates a formal action to recoup a specific overpaid amount from a provider without having first notified the provider in writing. (d) Overpayments resulting from fraud. (1) An overpayment that results from fraud is discovered on the date of the final written notice (as defined in ? 433.304 of this subchapter) of the State's overpayment determination. (2) When the State is unable to recover a debt which represents an overpayment (or any portion thereof) resulting from fraud within 1 year of discovery because no final determination of the amount of the overpayment has been made under an administrative or judicial process (as applicable), including as a result of a judgment being under appeal, no adjustment shall be made in the Federal payment to such State on account of such overpayment (or any portion thereof) until 30 days after the date on which a final judgment (including, if applicable, a final determination on an appeal) is made. (3) The Medicaid agency may treat an overpayment made to a Medicaid provider as resulting from fraud under subsection (d) of this section only if it has referred a provider's case to the Medicaid fraud control unit, or appropriate law enforcement agency in States with no certified Medicaid fraud control unit, as required by ? 455.15, ? 455.21, or ? 455.23 of this chapter, and the Medicaid fraud control unit or appropriate law enforcement agency has provided the Medicaid agency with written notification of acceptance of the case; or if the Medicaid fraud control unit or appropriate law enforcement agency has filed a civil or criminal action against a provider and has notified the State Medicaid agency. (e) Overpayments identified through Federal reviews. If a Federal review at any time indicates that a State has failed to identify an overpayment or a State has identified an overpayment but has failed to either send written notice of the overpayment to the provider that specified a dollar amount subject to recovery or initiate a formal recoupment from the provider without having first notified the provider in writing, CMS will consider the overpayment as discovered on the date that the Federal official first notifies the State in writing of the overpayment and specifies a dollar amount subject to recovery. (f) Effect of changes in overpayment amount. Any adjustment in the amount of an overpayment during the 1-year period following discovery (made in accordance with the approved State plan, Federal law and regulations governing Medicaid, and the appeals resolution process specified in State administrative policies and procedures) has the following effect on the 1-year recovery period: (1) A downward adjustment in the amount of an overpayment subject to recovery that occurs after discovery does not change the original 1-year recovery period for the outstanding balance. (2) An upward adjustment in the amount of an overpayment subject to recovery that occurs during the 1-year period following discovery does not change the 1-year recovery period for the original overpayment amount. A new 1-year period begins for the incremental amount only, beginning with the date of the State's written notification to the provider regarding the upward adjustment. (g) Effect of partial collection by State. A partial collection of an overpayment amount by the State from a provider during the 1-year period following discovery does not change the 1-year recovery period for the balance of the original overpayment amount due to CMS. (h) Effect of administrative or judicial appeals. Any appeal rights extended to a provider do not extend Section 433.320 Procedures for Refunds to CMS. (a) Basic requirements. (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of - (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with ? 433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, nonrefunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment.

2022-063 The Health Care Authority did not have adequate controls over and did not comply with requirements to ensure payments to providers for the Block Grants for Community Mental Health Services were allowable and met period of performance requirements. Assistance Listing Number and Title: 93.958 Block Grants for Community Mental Health Services 93.958 COVID-19 Block Grants for Community Mental Health Services Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 1B09SM082638-01; 6B09SM082638-01M001; 6N09SM082638-01M004; 6B09SM082638-01M002; 6B09SM082638-01M003; 6N09SM083829-01M001; 1B09SM083829-01; 1B09SM086035-01; 6B09SM086035-01M001; 6B09SM086035-01M002; 6B09SM086035-01M003; 1B09SM085384-01; 1B09SM085912-01; 1B09SM083998-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: $8,668,982 Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grant for Community Mental Health Service (MHBG). The Authority subawards federal funds to counties, tribes, and nonprofit organizations to provide mental health treatment and crisis service to adults diagnosed with serious mental illness and children diagnosed with serious emotional disturbances. In fiscal year 2022, the Authority spent about $31.7 million in federal program funds, $20.5 million of which it paid to subrecipients. The Authority can use grant funds only for costs that are allowable and incurred during the period of performance, as specified in the grant?s terms and conditions. At the beginning of each federal fiscal year and whenever the Authority receives a new federal grant, it establishes new cost objectives and allocation codes to ensure expenditures are charged to the proper grants. When the Authority receives reimbursement requests, program managers are responsible for reviewing supporting documentation to determine if the services billed meet the period of performance requirements under the grant. Fiscal managers are also responsible for ensuring that payments are coded to the correct period. The Authority follows the accrual basis of accounting and uses the Agency Financial Reporting System (AFRS), which is the state?s central accounting system, to record federal expenditures. At the end of the fiscal year, the Authority?s federal financial reporting (FFR) unit estimates the amount of outstanding obligations to providers. These amounts are recorded in AFRS as an accrued expenditure for MHBG and subsequently reported to OFM for the compilation of the Schedule of Expenditures of Federal Awards. FFR has written procedures for calculating its estimated accruals. The calculation begins by using a spreadsheet that tracks contractual obligations to MHBG subrecipients and vendors to determine the total state obligation amount through the end of the subaward or contract, which usually extend past the end of the current state fiscal year. This total is then reduced by the amount of actual payments made to the subrecipients and vendors, and is also reduced an additional 2 percent to account for anticipated underspending. The remaining total is then recorded as an estimated accrual for the fiscal year. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure payments to providers for the MHBG program were allowable and met period of performance requirements. During the audit period, the FFR unit recorded two state fiscal year-end estimated accruals totaling $8,668,982. The Authority did not retain the obligation workbook used at the time of calculating these estimated accruals. Without this documentation, we were unable to assess the accuracy of the obligated amount. However, the Authority confirmed that the obligation amount used in the calculation included expenditures that were incurred after the state fiscal year. Any expenditures incurred after the state fiscal year has ended are not allowed to be included in an accrual. Furthermore, provider payments liquidated after the state fiscal year are not assigned to the estimated accrual in the accounting system. Therefore, we could not determine if the estimated accrual amount was reasonable and accurately reflected expenditures that occurred within the state fiscal year. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition While the Authority has written procedures for the year-end estimated accruals, management did not ensure that only obligations within the state fiscal year were included. Furthermore, the Authority does not have a process in place to review estimated year-end accruals to verify the reasonableness of the accrual calculation. Effect of Condition and Questioned Costs Without retaining adequate support for the estimated year-end accruals and having a process to verify the reasonableness of the estimated calculation, the Authority cannot reasonably ensure that its MHBG expenditures are for allowable activities and within the period of performance. We identified $8,668,982 in known questioned costs related to the estimated year-end accruals. Without establishing adequate internal controls, the Authority cannot reasonably ensure it is using federal funds for allowable purposes and that spending occurs within the allowed period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: ? Improve its internal controls to ensure estimated accruals are reasonable and supported ? Improve its internal controls to ensure payments are within the award?s period of performance ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Authority?s Response HCA concurs in part. HCA acknowledges that the version of the document used to determine year-end accruals was not retained as a supporting document. We also acknowledge that some portion of the accrued amount could have included obligations beyond state fiscal year 2022. HCA does not agree that we cannot reasonably ensure that MHBG expenditures are for allowable activities and within the period of performance. Expenditures reported on MHBG are prepared based on cash and liquidations and all costs are reviewed to ensure they meet the period of performance. While the year-end accruals may included some amounts beyond the state fiscal year, the amounts accrued were based on four quarters of activity. This would not result in errors in federal reporting or federal cash draws. To question the year-end accruals in their entirety is an overstatement of any potential error that was made. The year-end accruals were solely recorded as estimates, and were not used to make any program payments or draw funds from the grantor. HCA only makes program payments to subrecipients and contractors after receiving invoices which are reviewed by staff, including review that the expenditures are within the grant period of performance. HCA does not agree with repayment of the $8,668,982 questioned costs associated with year-end accruals. HCA notes that the $8,668,982 questioned costs, do not meet the definition of Improper Payments as defined in Uniform Guidance 2 CFR 200.1. Based on preliminary discussions with the grantor, HCA should expect that repayment of questioned costs related to the accruals will not be requested as no funds were drawn. This information was shared with the auditor. Auditor?s Remarks In its response, the Authority acknowledged it did not retain supporting documentation to verify the year-end estimated accrual expenditures were incurred during the state fiscal year. Furthermore, the Authority acknowledged that the year-end estimated accruals likely included expenditures incurred after the state fiscal year. The Authority reports cash and accrued expenditures on the Schedule of Expenditures of Federal Awards and, as such, the accruals are required to be audited. In our judgment, the Authority does not have sufficient processes in place to verify the reasonableness of the year-end estimated accrual calculations. We reaffirm our finding and will follow up on the status of the Authority?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200.1, Uniform Guidance establishes definitions for improper payments, which states impart: (2) Where the costs, at the time of the audit are not supported by adequate documentation. Part 200.410 establishes requirements for the collection of unallowable costs. Title 2 CFR Part 200, Uniform Guidance, section 502, Basis for determining Federal awards expended, states in part: (a) Determining Federal awards expended. The determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs. Generally, the activity pertains to events that require the non-Federal entity to comply with Federal statutes, regulations, and the terms and conditions of Federal awards, such as: expenditure/expense transactions associated with awards including grants, cost-reimbursement contracts under FAR, compacts with Indian Tribes, cooperative agreements, and direct appropriations; the disbursement of funds to subrecipients, the use of loan proceeds under loan and loan guarantee programs; the receipt of property; the receipt of surplus property; the receipt or use of program income? the distribution or use of food commodities; the disbursement of amounts entitling the non-Federal entity to an interest subsidy; and the period when insurance is in force. Title 2 CFR Part 200, Uniform Guidance, section 510, Financial statements, states in part: (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee?s financial statements which must include the total Federal awards expended as determined in accordance with 200.52. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Behavioral Health Grant Unit Procedures, state in part: WHAT IS ACCRUAL: Fiscal year end and end of biennium contract subsequent payments. PURPOSE: To prepare contact accruals for the end of the fiscal year or biennium and the subsequent payment of those invoices by the Behavioral Health Grant Unit. BACKGROUND: Accruals and liquidations are looked at a high-level by program, fund, and fund sources (GF-S/GF-F), to see if the agency has over liquidated our authority. Some accruals are based on actual billings/claims, but a good chunk is based on estimates, because of the lag in billings, as well as the amount of contracts per grant; mainly block and SOR. BLOCK GRANT AND SOR PROCESS 1. Create a SFYXX Accrual workbook using a JV workbook template. 2. Pull grant direct expenditure data to date including GL 0159 (liquidations), cash expenditures (6510), and accruals (6505), using your grant Webi criteria. a. We pull in accruals (GL6505), because we want to see accruals that have already been booked by AP, so we don?t double book them. b. Expenditures paid in the new SFY will automatically need to be accrued since they weren?t paid in by the end of the SFY. c. Filter out/do not accrue on any interagency transactions including state universities. Those are processed outside of our unit. 3. Take total SFY of year processing obligation from grant spreadsheet. ? NOTE: For auditing purposes, if one was to reproduce the obligation amount it could change if you refer to the original document later than the date that we established the original obligation amount. Please always refer to the accrual spreadsheet for the obligation amount pulled at the time for the purpose of accruals. 4. Reduce the obligation amount by 2% so that we don?t over accrue (The percentage was recommended?due to not spending everything that is obligated.). 5. First pivot to run is to identify total expenditures and accruals for SFY being processed. Use the expenditure amount for the second pivot table. 6. Second pivot to run is to figure out the split out the expenditure between ER and NB, because they are the most common. Calculate the left to accrue amount by taking the obligations with 2% reduction subtracting the expenditures as well as the previous accrual amount. To see what you need to accrue. 7. Third and Fourth pivot tables find the most common PI for each of the subobjects. 8. Fifth pivot table identifies most common org index. 9. Calculate percentages to spread the accrual across ER and /or NB in allocations, per grant. 10. Complete the rest of the workbook following our JV process with obtaining the JV log number, filling out the JV log, adding the explanation and backup data for the upload and release tab. On the JV tab complete the TC to be 736 and include GL 5111. If we need to complete a reversal the TC would be 736R. 11. Upload and email the JV to Supervisor and Lead. 12. Supervisor and Lead review, approve, and release the JV.

2022-064 The Health Care Authority did not have adequate internal controls over level of effort requirements for the Block Grants for Community Mental Health Services program. Assistance Listing Number and Title: 93.958 Block Grants for Community Mental Health Services 93.958 COVID-19 Block Grants for Community Mental Health Services Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 1B09SM082638-01; 6B09SM082638-01M001; 6B09SM082638-01M004; 6B09SM082638-01M002; 6B09SM082638-01M003; 6B09SM083829-01M001; 1B09SM083829-01; 1B09SM086035-01; 6B09SM086035-01M001; 6B09SM086035-01M002; 6B09SM086035-01M003; 1B09SM085384-01; 1B09SM085912-01; 1B09SM083998-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Level of Effort Known Questioned Cost Amount: None Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Community Mental Health Services. The Authority subawards federal funds to counties, tribes and nonprofit organizations to provide mental health treatment and crisis services to adults diagnosed with serious mental illness and children diagnosed with serious emotional disturbances. In fiscal year 2022, the Authority spent approximately $31.7 million in federal program funds, $20.5 million of which it paid to subrecipients. Federal regulations require the Authority to maintain state spending at certain levels to meet federal grant requirements. Specifically, the Authority must maintain state spending at a level that is no less than the average of the previous two years of spending for the program. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Authority did not have adequate internal controls over level of effort requirements for the Block Grants for Community Mental Health Services program. To monitor state funding levels, the Authority generates reports from its accounting system each quarter to determine if current expenditures are on track to meet level of effort requirements for all open grant awards. Upon closing each grant, the Authority also generates a final report to ensure the requirements were met. Throughout the year, fiscal staff generated the reports using incorrect expenditure criteria and, therefore, tracked the wrong expenditure amounts. We consider these internal control deficiencies to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition The written procedures Authority staff used to prepare the reports contained wrong instructions with incorrect expenditure criteria for generating the report. Furthermore, the Authority did not require documented management review of the quarterly tracking workbooks to ensure they were accurate. Effect of Condition As a result of the Authority using incorrect expenditure criteria during the audit period, tracking workbooks for three of the four quarters contained incorrect expenditures amounts that were used to calculate the two-year average. Therefore, the Authority calculated the two-year average incorrectly. Furthermore, the Authority was required to maintain state expenditures at no less than the average of the prior two fiscal year spending levels, or $472,042,275. The Authority reported $527,952,071 in state expenditures for state fiscal year 2022. However, due to the incorrect expenditure criteria being used, it was determined the Authority actually spent $557,351,803, resulting in an underreporting of $29,399,732. While the Authority met the level of effort requirement, three of the four quarterly tracking workbooks contained incorrect state expenditure totals, and this internal control weakness could lead to noncompliance if not corrected. By not establishing adequate internal controls, the Authority cannot ensure it meets the level of effort requirement. Recommendations We recommend the Authority: ? Ensure the written procedures for completing the quarterly level of effort tracking workbooks are accurate and complete ? Ensure correct information is used to monitor spending levels ? Improve internal controls to ensure sufficient monitoring of level of effort requirements Authority?s Response We concur with the finding and recommendations. HCA has updated its procedures to include a greater level of review and approval to ensure information prepared is complete and accurate. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 42 U.S. Code 300x-4, Additional provisions, states in part: (b) Maintenance of effort regarding State expenditures for mental health (2) In general A funding agreement for a grant under section 300x of this title is that the State involved will maintain State expenditures for community mental health services at a level that is not less than the average level of such expenditures maintained by the State for the 2-year period preceding the fiscal year for which the State is applying for the grant.

2022-065 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Federal Funding Accountability and Transparency Act for the Block Grants for Community Mental Health Services. Assistance Listing Number and Title: 93.958 Block Grants for Community Mental Health Services 93.958 COVID-19 Block Grants for Community Mental Health Services Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 1B09SM082638-01; 6B09SM082638-01M001; 6B09SM082638-01M004; 6B09SM082638-01M002; 6B09SM082638-01M003; 6B09SM083829-01M001; 1B09SM083829-01; 1B09SM086035-01; 6B09SM086035-01M001; 6B09SM086035-01M002; 6B09SM086035-01M003; 1B09SM085384-01; 1B09SM085912-01; 1B09SM083998-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Community Mental Health Services. The Authority subawards federal funds to counties, tribes and nonprofit organizations to provide mental health treatment and crisis services to adults diagnosed with serious mental illness and children diagnosed with serious emotional disturbances. In fiscal year 2022, the Authority spent approximately $31.7 million in federal program funds, $20.5 million of which it paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Authority is required to collect and report information on each subaward of federal funds more than $25,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). For federal awards issued on or after November 12, 2020, the monetary threshold for reporting increased to $30,000. The Authority must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower citizens with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Act. During the audit period, the Authority was required to report approximately $10.3 million of program funds that it awarded to 12 subrecipients through 21 new and amended subawards. We found the Authority did not report any of these subawards in FSRS as required. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Authority has multiple divisions that subaward program funds, and it did not have a process in place to gather subaward information from each division so it could submit these required reports to the federal government. Effect of Condition Failing to submit the required reports diminishes the federal government?s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Authority: ? Establish effective internal controls to ensure it submits required reports ? Establish policies and procedures for filing required reports ? Provide training for employees who oversee reporting and who verify the submission and accuracy of the reports ? Ensure management monitors reporting of this information so future reports are submitted completely and timely Authority?s Response We concur with the finding and recommendations. HCA has developed a procedure coordinating between responsible divisions to ensure FFATA reports are submitted. This procedure was in place for SFY 2023. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 ? Award Term I. Reporting Subawards and Executive Compensation 1. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2020. 3. What to report. You must report the information about each obligating action that the submission instructions posted at http://www.fsrs.gov specify. Notice of Block Grants for Community Mental Health Federal Grant Award, Grant Number 1B09SM082638-01, states in part: MHBG 2020 Standard Terms and Conditions 9) Federal Financial Accountability and Transparency Act (FFATA) Reporting Subawards and Executive Compensation, 2 CFR, Appendix A to Part 170 a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that obligates $25,000 or more in Federal funds that does not include Recovery funds (as defined in section 1512(a)(2) of the American Recovery and Reinvestment Act of 2009, Pub. L. 111-5) for a subaward to an entity.

2022-066 The Health Care Authority did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Block Grants for Community Mental Health Services program and the Block Grants for Prevention and Treatment of Substance Abuse program received required single audits, and that it appropriately followed up on findings and issued management decisions. Assistance Listing Number and Title: 93.958 Block Grants for Community Mental Health Services 93.958 COVID-19 Block Grants for Community Mental Health Services 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 COVID-19 Block Grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: 1B09SM082638-01; 6B09SM082638-01M001; 6N09SM082638-01M004; 6B09SM082638-01M002; 6B09SM082638-01M003; 6N09SM083829-01M001; 1B09SM083829-01; 1B09SM086035-01; 6B09SM086035-01M001; 6B09SM086035-01M002; 6B09SM086035-01M003; 1B09SM085384-01; 1B09SM085912-01; 1B09SM083998-01 1B08TI083138-01; 6B08TI083138-01M003; 6B08TI083138-01M004; 6B08TI083486-01M001; 6B08TI083486-01M002; 6B08TI083486-01M004; 1B08TI83519-01; 1B08TI084681-01; 1B08TI083977-01 Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Community Mental Health Services (MHBG) and the Block Grants for Prevention and Treatment of Substance Abuse (SABG) programs. The Authority subawards federal funds to counties, tribes, and nonprofit organizations to provide mental health treatment and crisis services to adults diagnosed with serious mental illness and children diagnosed with serious emotional disturbances, as well as develop substance abuse prevention programs and provide treatment and support services. In fiscal year 2022, the Authority spent about $31.7 million in federal program funds for MHBG and about $67.3 million in federal program funds for SABG. Of these amounts, the Authority passed about $20.5 million to MHBG subrecipients and $52 million to SABG subrecipients. Federal regulations require the Authority to monitor its subrecipients? activities. This includes verifying that its subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a single audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within 30 days after receiving the auditor?s report or nine months after the end of the subrecipient?s audit period, whichever is earlier. Additionally, for the awards it passes onto its subrecipients, the Authority must follow up and ensure the subrecipients take timely and appropriate corrective action on all deficiencies identified through audits. When a subrecipient receives an audit finding for an Authority-funded program, federal law requires the Authority to issue a management decision to the subrecipient within six months of the audit report?s acceptance by the Federal Audit Clearinghouse. The management decision must clearly state whether the audit finding is sustained, the reason for the decision, and the actions the subrecipient is expected to take, such as repaying unallowable costs or making financial adjustments. These requirements help ensure subrecipients use federal program funds for authorized purposes and within the provisions of contracts or grant agreements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure subrecipients of the MHBG and SABG programs received required single audits, and that it appropriately followed up on findings and issued management decisions. We found the Authority did not have adequate internal controls in place to verify whether: ? Subrecipients received required audits, if necessary, and appropriate remedies were taken if audits were not filed ? Follow up occurred on findings and management decisions were issued when due We used a nonstatistical sampling method to randomly select and examine 17 out of a total population of 129 subrecipients. We found the Authority did not monitor one subrecipient (6 percent) to ensure it received a single audit when required. Additionally, we identified one subrecipient that received a single audit finding for which the Authority was required to issue a management decision. We found the Authority did not issue a management decision for this subrecipient. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Authority did not have written policies or procedures to ensure all subrecipients received an audit when required and management decisions were issued. In addition, staff used a tracking sheet to monitor the subrecipient audit requirements, but did not detect the identified noncompliance. Effect of Condition Without establishing adequate internal controls, the Authority cannot ensure all subrecipients that required a single audit received one. Furthermore, the Authority cannot ensure it is following up on subrecipient single audit findings and communicating required management decisions to subrecipients. By failing to ensure subrecipients establish corrective actions and management monitors them for effectiveness, the Authority cannot determine whether subrecipients have sufficiently corrected issues identified in audit findings. Recommendations We recommend the Authority: ? Establish and follow policies and procedures to ensure subrecipients obtain required single audits ? Establish and follow effective internal controls to ensure it issues management decisions by the due date and follows up on all subrecipient audit findings related to the programs ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations Authority?s Response HCA concurs with the finding. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 200, Uniform Guidance, establishes the following applicable requirements: Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient?s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set for the in ?200.501 Audit requirements. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity?s fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c).

2022-067 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure payments to providers for the Block Grants for Prevention and Treatment of Substance Abuse program were allowable and met period of performance requirements. Assistance Listing Number and Title: 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 COVID-19 Block Grants for Prevention and Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 1B08TI083138-01; 6B08TI083138-01M003; 6B08TI083138-01M004; 6B08TI083486-01M001; 6B08TI083486-01M002; 6B08TI083486-01M004; 1B08TI83519-01; 1B08TI084681-01; 1B08TI083977-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Period of Performance Known Questioned Cost Amount: $19,959,714 Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse (SABG). The Authority subawards federal funds to counties, tribes, and nonprofit organizations to develop prevention programs and provide treatment and support services. In fiscal year 2022, the Authority spent about $67.3 million in federal program funds, $52 million of which it paid to subrecipients. The Authority can use grant funds only for costs that are allowable and incurred during the period of performance, as specified in the grant?s terms and conditions. At the beginning of each federal fiscal year, and whenever the Authority receives a new federal grant, it establishes new cost objectives and allocation codes to ensure expenditures are charged to the proper grants. When the Authority receives reimbursement requests, program managers are responsible for reviewing supporting documentation to determine if the services billed meet the period of performance requirements under the grant. Fiscal managers are also responsible for ensuring that payments are coded to the correct period. The Authority follows the accrual basis of accounting and uses the Agency Financial Reporting System (AFRS), which is the state?s central accounting system, to record federal expenditures. At the end of the fiscal year, the Authority?s federal financial reporting (FFR) unit estimates the amount of outstanding obligations to providers. These amounts are recorded in AFRS as an accrued expenditure for SABG and subsequently reported to OFM for the compilation of the Schedule of Expenditures of Federal Awards. FFR has written procedures for calculating its estimated accruals. The calculation begins by using a spreadsheet that tracks contractual obligations to SABG subrecipients and vendors to determine the total state obligation amount through the end of the subaward or contract, which usually extend past the end of the current state fiscal year. This total is then reduced by the number of actual payments made to the subrecipients and vendors, and is also reduced an additional 2 percent to account for anticipated underspending. The remaining total is then recorded as an estimated accrual for the fiscal year. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior two audits, we reported the Authority did not have adequate internal controls to ensure payments made under the SABG program met the period of performance requirements. The prior finding numbers were 2020-059 and 2021-057. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure payments to providers for the SABG program were allowable and met period of performance requirements. Year-end Estimated Accruals During the audit period, the FFR unit recorded two state fiscal year-end estimated accruals totaling $19,870,537. The Authority did not retain the obligation workbook used at the time of calculating these estimated accruals. Without this documentation, we were unable to assess the accuracy of the obligated amount. However, the Authority confirmed that the obligation amount used in the calculation included expenditures that were incurred after the state fiscal year. Any expenditures incurred after the state fiscal year has ended are not allowed to be included in an accrual. Furthermore, provider payments liquidated after the state fiscal year are not assigned to the estimated accrual in the accounting system. Therefore, we could not determine if the estimated accrual amount was reasonable and accurately reflected expenditures that occurred within the state fiscal year. Transaction Testing We judgmentally selected and examined two expenditures that were recorded in the accounting system with service months prior to the allowed period of performance for the SABG federal fiscal year 2022 award. We found one of the expenditures (50 percent) was an accrual made at the end of the year with no subsequent liquidation payment. We also judgmentally selected and examined five out of a total population of 24 expenditures made during the SABG federal fiscal year 2020 award liquidation period. We found three expenditures (60 percent) were for indirect charges automatically applied to the award through the Authority?s cost allocation system for activities that occurred after the allowed period of performance. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition While the Authority had written procedures for the year-end estimated accrual, management did not ensure that only obligations incurred within the state fiscal year were included. Furthermore, the Authority did not have a process in place to review estimated year-end accruals to verify the reasonableness of the accrual calculation. Additionally, management did not ensure that the cost allocation system only allowed indirect payments occurring within an award?s period of performance to be charged to the grant, and did not monitor sufficiently to detect the improper charges. Effect of Condition and Questioned Costs Without retaining adequate support for the estimated year-end accruals and having a process to verify the reasonableness of the estimated calculation, the Authority cannot reasonably ensure its SABG expenditures are for allowable activities and within the period of performance. We identified $19,870,537 in known questioned costs related to the estimated year-end accruals. For the federal fiscal year 2022 award that opened during the audit period, we identified questioned costs totaling $85,492 for services performed outside the period of performance. For the federal fiscal year 2020 award that closed during the audit period, we identified questioned costs totaling $3,685 for indirect expenditures that were unallowable. In total, we identified $19,959,714 in known federal questioned costs. Without establishing adequate internal controls, the Authority cannot reasonably ensure it is using federal funds for allowable purposes and that spending occurs within the allowed period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: ? Improve its internal controls to ensure estimated accruals are reasonable and supported ? Improve its internal controls to ensure the cost allocation system only charges eligible costs to the grant ? Improve its internal controls to ensure payments are within the award?s period of performance ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Authority?s Response HCA concurs in part. HCA acknowledges that the version of the document used to determine year-end accruals was not retained as a supporting document. We also acknowledge that some portion of the accrued amount could have included obligations beyond state fiscal year 2022. HCA does not agree that we cannot reasonably ensure that SABG expenditures are for allowable activities and within the period of performance. Expenditures reported on SABG are prepared based on cash and liquidations and all costs are reviewed to ensure they meet the period of performance. While the year-end accruals may included some amounts beyond the state fiscal year, the amounts accrued were based on four quarters of activity. This would not result in errors in federal reporting or federal cash draws. To question the year-end accruals in their entirety is an overstatement of any potential error that was made. The year-end accruals were solely recorded as estimates, and were not used to make any program payments or draw funds from the grantor. HCA only makes program payments to subrecipients and contractors after receiving invoices which are reviewed by staff, including review that the expenditures are within the grant period of performance. HCA does not agree with repayment of the $19,870,537 questioned costs associated with year-end accruals. HCA also does not concur with repayment of the $85,492 questioned costs associated with an accrual transaction. An accrual was entered in the accounting system based on expected billing. No invoice for the transaction was received for FY 22 grant activity, and as noted in the finding no payment was made. HCA does not draw funds from the grantor until a payment is made, and as a result no funds were drawn for this accrual. HCA concurs with the $3,685 for indirect expenditures that were unallowable for the grant award. An accounting cost center was not correctly updated at the end of the grant period, and as a result some termination leave indirect expenditures were charged to the grant after the period of performance ended. HCA will review processes to ensure cost centers are appropriately closed to prevent unallowable expenditures from being charged to grant awards and discuss repayment with the grantor. HCA notes that of the total $19,959,714 questioned costs, only $3,685 meet the definition of Improper Payments as defined in Uniform Guidance 2 CFR 200.1. Based on preliminary discussions with the grantor, HCA should expect that repayment of questioned costs related to the accruals will not be requested as no funds were drawn. This information was shared with the auditor. Auditor?s Remarks In its response, the Authority acknowledged it did not retain supporting documentation to verify the year-end estimated accrual expenditures were incurred during the state fiscal year. Furthermore, the Authority acknowledged that the year-end estimated accruals likely included expenditures incurred after the state fiscal year. The Authority reports cash and accrued expenditures on the Schedule of Expenditures of Federal Awards and, as such, the accruals are required to be audited. In our judgment, the Authority does not have sufficient processes in place to verify the reasonableness of the year-end estimated accrual calculations. We reaffirm our finding and will follow up on the status of the Authority?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200.1, Uniform Guidance, establishes definitions for improper payments, which states in part: (2) Where the costs, at the time of the audit, are not supported by adequate documentation. Part 200.410 establishes requirements for the collection of unallowable costs. Title 2 CFR Part 200, Uniform Guidance, section 502, Basis for determining Federal awards expended, states in part: (a) Determining Federal awards expended. The determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs. Generally, the activity pertains to events that require the non-Federal entity to comply with Federal statutes, regulations, and the terms and conditions of Federal awards, such as: expenditure/expense transactions associated with awards including grants, cost-reimbursement contracts under FAR, compacts with Indian Tribes, cooperative agreements, and direct appropriations; the disbursement of funds to subrecipients, the use of loan proceeds under loan and loan guarantee programs; the receipt of property; the receipt of surplus property; the receipt or use of program income; the distribution or use of food commodities; the disbursement of amounts entitling the non-Federal entity to an interest subsidy; and the period when insurance is in force. Title 2 CFR Part 200, Uniform Guidance, section 510, Financial statements, states in part: (b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee?s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Behavioral Health Grant Unit Procedures, state in part: WHAT IS ACCRUAL: Fiscal year end and end of biennium contract subsequent payments. PURPOSE: To prepare contract accruals for the end of a fiscal year or biennium and the subsequent payment of those invoices by the Behavioral Health Grant Unit. BACKGROUND: Accruals and liquidations are looked at a high-level by program, fund, and fund source (GF-S/GF-F), to see if the agency has over liquidated our authority. Some accruals are based on actual billings/claims, but a good chunk is based on estimates, because of the lag in billings, as well as the amount of contracts per grant; mainly block and SOR. BLOCK GRANT AND SOR PROCESS 1. Create a SFYXX Accrual workbook using a JV workbook template. 2. Pull grant direct expenditure data to date including GL 0159 (liquidations), cash expenditures (6510) and accruals (6505), using your grant Webi criteria. a. We pull in accruals (GL 6505), because we want to see accruals that have already been booked by AP, so we don?t double book them. b. Expenditures paid in the new SFY will automatically need to be accrued since they weren?t paid by the end of the SFY. c. Filter out/do not accrue on any interagency transactions including state universities. Those are processed outside of our unit. 3. Take total SFY of year processing obligations from grant spreadsheet. ? NOTE: For auditing purposes, if one was to reproduce the obligation amount it could change if you refer to the original document later than the date that we established the original obligation amount. Please always refer to the accrual spreadsheet for the obligation amount pulled at the time for the purpose of accruals. 4. Reduce obligation amount by 2% so that we don?t over accrue (The percentage was recommended?due to not spending everything that is obligated.). 5. First pivot to run is to identify total expenditures and accruals for SFY being processed. Use the expenditure amount for the second pivot table. 6. Second pivot to run is to figure out the split out the expenditure between ER and NB, because they are the most common. Calculate the left to accrue amount by taking the obligations with 2% reduction subtracting the expenditures as well as the previous accrual amount. To see what you need to accrue. 7. Third and Fourth pivot tables find the most common PI for each of the subobjects. 8. Fifth pivot table identifies most common org index. 9. Sixth pivot table (SABG)identifies the ER and NB expenditures by allocation, so that they can be accrued by percentage of the total expenditures. 10. Calculate percentages to spread the accrual across ER and/or NB in allocations, per grant. 11. Complete the rest of the workbook following our JV process with obtaining the JV log number, filling out the JV log, adding the explanation and backup data for the upload and release tab. On the JV tab complete the TC to be 736 and include GL 5111. If we need to complete a reversal the TC would be 736R. 12. Upload and email the JV to Supervisor and Lead. 13. Supervisor and Lead review, approve, and release the JV.

2022-068 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it met the earmarking requirement for the Block Grants for Prevention and Treatment of Substance Abuse. Assistance Listing Number and Title: 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 COVID-19 Block Grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 1B08TI083138-01; 6B08TI083138-01M003; 6B08TI083138-01M004; 6B08TI083486-01M001; 6B08TI083486-01M002; 6B08TI083486-01M004; 1B08TI83519-01; 1B08TI084681-01; 1B08TI083977-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Earmarking Known Questioned Cost Amount: $661 Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse. The Authority provides federal funds to counties, tribes, nonprofit organizations and other state agencies to develop prevention programs and provide treatment and support services. In fiscal year 2022, the Authority spent approximately $67.3 million in federal program funds. Federal regulations require the Authority to spend no more than 5 percent of the federal program funds on administrative costs of the grant. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. To monitor the administrative earmarking requirement, the Authority has staff run monthly reports from its accounting system to determine if it is on track to meet the requirement at the time the grant closes. Upon closing a grant, the Authority also runs a final report to ensure it met the requirement. In prior audits, we reported the Authority did not have adequate internal controls and did not comply with earmarking requirements for the program. The prior finding number was 2021-056. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it met the earmarking requirement for the Block Grants for Prevention and Treatment of Substance Abuse. During the audit period, the monthly tracking workbooks used to track the earmark requirement contained an erroneous calculation for determining the percentage of administrative costs. A $13,212 supplement to the technical assistance award was incorrectly added to the base grant award amount instead of the technical assistance amount in the tracking workbook. We found the Authority closed the federal fiscal year 2020 grant while having exceeded the 5 percent administrative maximum. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition Throughout the year, staff ran the required monthly reports using the expenditures to date to track the percentage of administrative costs to meet compliance. However, management did not review these workbooks to ensure they correctly calculated and monitored this requirement. Effect of Condition and Questioned Costs The Authority was awarded $37,786,705 for the federal fiscal year 2020 grant. Therefore, it was allowed to spend $1,889,335 on administrative expenditures. However, it spent $1,889,996, which exceeded the administrative cost maximum by $661. As a result, we are questioning the $661 in unallowable administrative costs. By not establishing adequate internal controls, the Authority cannot ensure it meets the administrative earmarking requirement. By not complying with federal requirements, the Authority risks having to repay federal funds or having future federal funds withheld. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: ? Improve internal controls to ensure it does not exceed the maximum allowable amount for administrative costs at the end of the award period. ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Authority?s Response HCA concurs with the incorrect calculation of the administrative expenditure limit in the tracking workbooks and will implement formal review procedures for the tracking workbooks. However, HCA does not concur with the identified questioned costs. HCA processed subsequent adjustments reducing the final administrative expenditures charged to the grant award to $1,840,664, less than the allowed amount of $1,889,335. The auditor did not consider the adjustments during the audit. Auditor?s Remarks At the time the Authority submitted its final SF-425 report, the administrative costs that were identified as charged to the grant exceeded the allowed maximum by $661. In addition, the expenditures in question were still charged to the grant in the accounting system at the time the final report was submitted to the grantor and were not reversed until four months later. As stated above, we recommend the Authority consult with the federal grantor to discuss whether the questioned cost reported in the finding need to be repaid. We reaffirm our finding and will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. Title 2 CFR Part 200.1, Uniform Guidance establishes definitions for improper payments. Part 200.410 establishes requirements for the collection of unallowable costs. Title 2 CFR Part 200, Uniform Guidance, section 403, defines factors affecting Allowability of costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 96, Block Grants, section 135, Restrictions on expenditure of grant, states in part: (b) The State shall limit expenditures on the following: (1) The State involved will not expend more than 5 percent of the grant to pay the costs of administering the grant

2022-069 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Federal Funding Accountability and Transparency Act for the Block Grants for Prevention and Treatment of Substance Abuse. Assistance Listing Number and Title: 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 COVID-19 Block Grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 1B08TI083138-01; 6B08TI083138-01M003; 6B08TI083138-01M004; 6B08TI083486-01M001; 6B08TI083486-01M002; 6B08TI083486-01M004; 1B08TI83519-01; 1B08TI084681-01; 1B08TI083977-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse (SABG). The Authority subawards federal funds to counties, tribes and nonprofit organizations to develop prevention programs and provide treatment and support services. In fiscal year 2022, the Authority spent about $67.3 million in federal program funds, $52 million of which it paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Authority is required to collect and report information on each subaward of federal funds more than $25,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). For federal awards issued on or after November 12, 2020, the monetary threshold for reporting increased to $30,000. The Authority must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower citizens with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. The prior finding number was 2021-058. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed accurate and timely reports required by the Act. During the audit period, the Authority was required to report about $34.3 million of program funds that it awarded to 63 subrecipients through 84 new and amended subawards for the primary SABG awards. We found the Authority only reported one subaward amendment totaling $864,000 in FSRS as required. Additionally, the Authority was required to report program funds that it subawarded to subrecipients for the SABG COVID-19 Emergency Funding and SABG American Rescue Plan Act awards. However, the Authority was unable to provide subaward details for these two awards. The Authority received about $66 million for the two COVID-19-related awards. During the audit period, the Authority passed through about $16.6 million of COVID-19 SABG funds to subrecipients. We found the Authority did not report any subawards for these additional COVID-19-related awards. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Authority has multiple divisions that subaward programs funds, and it did not have a process in place to gather subaward information from each division so it could submit these required reports to the federal government. Effect of Condition Failing to submit the required reports diminishes the federal government?s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Authority: ? Establish effective internal controls to ensure it submits required reports ? Establish policies and procedures for filing required reports ? Provide training for employees who oversee reporting and who verify the submission and accuracy of the reports ? Ensure management monitors reporting of this information so future reports are submitted completely and timely Authority?s Response We concur with the finding and recommendations. HCA has developed a procedure coordinating between responsible divisions to ensure FFATA reports are submitted. This procedure was in place for SFY 2023. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 ? Award Term I. Reporting Subawards and Executive Compensation 1. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2020. 3. What to report. You must report the information about each obligating action that the submission instructions posted at http://www.fsrs.gov specify. Notice of Substance Abuse Prevention and Treatment Block Grant Federal Award, Grant Number 1B08TI083138-01, states in part: SABG 2020 Standard Terms and Conditions 7) Federal Financial Accountability and Transparency Act (FFATA) Reporting Subawards and Executive Compensation, 2 CFR, Appendix A to Part 170 a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that obligates $25,000 or more in Federal funds that does not include Recovery funds (as defined in section 1512(a)(2) of the American Recovery and Reinvestment Act of 2009, Pub. L. 111-5) for a subaward to an entity.

2022-070 The Health Care Authority did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Block Grants for Prevention and Treatment of Substance Abuse program received required risk assessments. Assistance Listing Number and Title: 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 COVID-19 Block Grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: 1B08TI083138-01; 6B08TI083138-01M003; 6B08TI083138-01M004; 6B08TI083486-01M001; 6B08TI083486-01M002; 6B08TI083486-01M004; 1B08TI83519-01; 1B08TI084681-01; 1B08TI083977-01 Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Health Care Authority, Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse (SABG). The Authority subawards federal funds to counties, tribes, and nonprofit organizations to develop prevention programs and provide treatment and support services. In fiscal year 2022, the Authority spent about $67.3 million in federal program funds, $52 million of which it paid to subrecipients. The Authority serves as a pass-through agency for SABG funding. Pass-through entities are required to monitor the activities of subrecipients to ensure they are properly using the funds. To determine the appropriate level of monitoring, federal regulations require the Authority to evaluate each subrecipient?s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Authority did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the SABG program received required risk assessments. The prior finding numbers were 2021-060 and 2020-064. Description of Condition The Authority did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the SABG program received required risk assessments. Five different units in the Authority are responsible for performing risk assessments for the program subrecipients: Prevention, Treatment, Recovery, Managed Care, and Tribal Affairs. The Authority did not have a uniform process to ensure all subrecipients received risk assessments. The Tribal Affairs unit did not complete a risk assessment for the one new subaward it issued during the audit period. In addition, we used a non-statistical sampling method to randomly select and examine 11 out of a total population of 51 new subawards issued by the other units during the state fiscal year. We found one of 11 (9 percent) did not receive a risk assessment during the audit period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition During the audit period, the Authority implemented a new risk assessment process, but it was not in place for all of the audit period. Prior to this new process, each unit was responsible for performing risk assessments for the subawards it monitors, but management did not provide sufficient oversight to ensure the Authority met this requirement. In addition, the Tribal Affairs unit did not have a risk assessment process in place. Effect of Condition Without performing risk assessments of its subrecipients for the SABG program, the Authority cannot determine the appropriate amount of monitoring required for each subrecipient. It also makes the Authority less likely to detect noncompliance with grant terms and conditions and federal regulations. Recommendations We recommend the Authority: ? Establish internal controls to ensure it performs risk assessments for each subaward it issues ? Ensure it uses the results of risk the risk assessments to determine how much and what type of subrecipient monitoring to perform, as required by federal law Authority?s Response HCA concurs with the findings, but with remarks. We concur that the Tribal Affairs unit did not complete risk assessments during the audit period, however, implementing a new process that will impact our Tribal partners appropriately requires more robust collaboration than with other partners. HCA is currently in active collaboration with the Tribes to incorporate a Tribal-specific risk assessment process to be implemented by July 1, 2023. Relating to the one finding outside of Tribal Affairs, it should be noted that the SAO is well-aware that HCA had not finalized incorporating risk assessments into the contracting process until FY 2022. The contract in question was provided a risk assessment as soon as practicable after the process had been incorporated. It should also be noted that HCA is not out of compliance with the law. 2 CFR 200 requires only that a risk assessment be done at some point. HCA has chosen to establish a process wherein we conduct risk assessments prior to contract execution. We understand that a risk assessment may not have been done during the audit period, but HCA disagrees with an implication that we are not in compliance with the law, as that is not accurate. Auditor?s Remarks While the Authority is correct that 2 CFR 200 does not explicitly require a risk assessment to be done prior to a contract being awarded, it does require the risk assessment be used to determine the level of monitoring for the subrecipient. In order to meet this requirement, the risk assessments must be completed timely to ensure the Authority implements required monitoring procedures to prevent noncompliance by the subrecipient. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit period. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Title 2 CFR Part 200, Uniform Guidance, section 303, Internal controls, describes the requirements for auditees to maintain internal controls over federal programs and comply with federal program requirements. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11. Title 45 CFR Part 75, Uniform Guidance for HHS Awards establishes the following applicable requirements: Section 75.352, Requirements for pass-through entities, states in part: All pass-through entities must: (b) Evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient?s prior experience with the same or similar subawards; (2) The results of the previous audits including whether or not the subrecipient receives a Single Audit in accordance with subpart F, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of HHS awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a HHS awarding agency).

2021-002 The Office of Superintendent of Public Instruction did not have internal controls over and did not comply with suspension and debarment requirements for the Child Nutrition Cluster program. CFDA Number and Title: 10.553 School Breakfast Program 10.553 COVID-19 School Breakfast Program 10.555 National School Lunch Program 10.555 COVID-19 National School Lunch Program 10.556 Special Milk Program for Children 10.556 COVID-19 Special Milk Program for Children 10.559 Summer Food Service Program for Children 10.559 COVID-19 Summer Food Service Program for Children 10.579 Child Nutrition Discretionary Grants Federal Grantor Name: U.S. Department of Agriculture Federal Award Number: 207WAWA3N1099, 217WAWA3N1099 217WAWA3N1199, 187WAWA7N8103 197WAWA7N8103, 207WAWA7N8103 Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Suspension and Debarment Known Questioned Cost Amount: None Background The Child Nutrition Cluster programs help states administer food services that provide healthy and nutritious meals to eligible children in public and nonprofit private schools, residential child care institutions, and summer recreation programs, as well as encourage the domestic consumption of nutritious agricultural commodities. The Office of Superintendent of Public Instruction (Office) administers the state?s Child Nutrition Cluster programs. The Office spent about $374 million in federal funds, including non-cash assistance, on eligible child nutrition meals during fiscal year 2021. The Office passed through most of the assistance to school food authorities (SFA) and other sponsors as subawards. Federal regulations prohibit grantees from making subawards under covered transactions to parties that are suspended or debarred from doing business with the federal government. The regulations require grantees to use one of three approved methods to verify that all subrecipients of federal funds are not suspended or debarred. The Office?s verification procedure is to add a clause or condition to each subaward or contract in which the signer attests it is not suspended or debarred. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Office did not have adequate internal controls over and did not comply with suspension and debarment requirements for Child Nutrition Cluster program subrecipients. The prior finding numbers were 2020-003 and 2019-004. Description of Condition The Office did not have adequate internal controls over and did not comply with suspension and debarment requirements for the Child Nutrition Cluster program. The corrective action plan the Office developed in response to the prior audit findings included developing a new Child Nutrition Program Permanent Agreement template to include information and attestation to suspension and debarment requirements and updating the internal process for reviewing and approving program applications. The Office implemented the new Permanent Agreement in December 2019. However, the Office stopped using it because of USDA?s concern about the Civil Rights Assurance statement in the Permanent Agreement. Once USDA?s concerns were resolved, the Office continued implementing the new agreement. Because of the delay, not all sponsors have signed new Permanent Agreements. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Office was still in the process of updating subrecipient agreements and implementing the new Permanent Agreement during the audit period. Effect of Condition We used a statistical sampling method to randomly select and examine 55 of a total population of 400 subrecipients. For the selected subrecipients, we examined the subaward records and program applications to confirm that the Office included a suspension and debarment clause in the agreement or application. We determined the Office did not require three subrecipients (5 percent) to certify that they were not suspended or debarred before receiving federal funds. We confirmed that the subrecipients we examined were not suspended or debarred. Therefore, we are not questioning costs related to these payments. By not verifying that entities are not suspended or debarred, the Office risks making subawards or entering into contracts with suspended or debarred entities. If the Office made payments to entities that were suspended or debarred, the payment would be unallowable and the Office could have to repay the grantor. Recommendation We recommend the Office implement established internal controls and comply with federal suspension and debarment requirements. Office?s Response The Office concurs with the finding. Child Nutrition Services has received the clarification requested from the U.S. Department of Agriculture (USDA) regarding the Civil Rights Assurance statement in our permanent agreement. Clarification was received from USDA on June 7, 2021. Child Nutrition Services resumed collection of permanent agreements soon afterwards and continues to send, receive, and process permanent agreements. Collection of permanent agreements is expected to conclude end of calendar year 2022. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective actions during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. Title 2 U.S. Code of Federal Regulations (CFR) Part 180, states in part: Subpart B ? Covered Transactions, Section 180.200 What is a covered transaction? A covered transaction is a nonprocurement or procurement transaction that is subject to the prohibitions of this part. It may be a transaction at ? (a) The primary tier, between a Federal agency and a person (see appendix to this part); or (b) A lower tier, between a participant in a covered transaction and another person. Subpart C ? Responsibilities of Participants Regarding Transactions Doing Business With Other Persons, Section 180.300 What must I do before I enter into a covered transaction with another person at the next lower tier? When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-003 The Office of Superintendent of Public instruction did not have adequate internal controls over accountability for USDA-donated foods. CFDA Number and Title: 10.553 School Breakfast Program 10.553 COVID-19 School Breakfast Program 10.555 National School Lunch Program 10.555 COVID-19 National School Lunch Program 10.556 Special Milk Program for Children 10.556 COVID-19 Special Milk Program for Children 10.559 Summer Food Service Program for Children 10.559 COVID-19 Summer Food Service Program for Children 10.579 Child Nutrition Discretionary Grants Federal Grantor Name: U.S. Department of Agriculture Federal Award Number: 207WAWA3N1099, 217WAWA3N1099 217WAWA3N1199, 187WAWA7N8103 197WAWA7N8103, 207WAWA7N8103 Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions ? Accountability of USDA-Donated Foods Known Questioned Cost Amount: None Background The Child Nutrition Cluster programs help states administer food services that provide healthy and nutritious meals to eligible children in public and nonprofit private schools, residential care institutions, and summer programs, as well as encourage the domestic consumption of nutritious agricultural commodities. The Office of Superintendent of Public Instruction (Office) administers the state?s Child Nutrition Cluster programs. The Office spent about $374 million, including non-cash assistance, in federal funds on eligible child nutrition meals during fiscal year 2021. The Office passed through most of the assistance to school food authorities (SFA) and other sponsors as subawards. The United State Department of Agriculture (USDA) makes donated agricultural commodities available for use in operating all child nutrition programs, except the Special Milk Program for Children. The Office contracts with four warehouses to perform its storage and distribution duties. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to properly account for USDA-donated foods. The prior finding numbers were 2020-004 and 2019-005. Description of Condition The Office did not have adequate internal controls over accountability for USDA-donated foods. We conducted an inventory reconciliation using the Office?s state fiscal year 2020 physical inventory records, USDA food order records, distribution records, and the Office?s state fiscal year 2021 ending physical inventory records. We determined the Office performed an annual physical inventory for all four of its warehouses. However, we found the Office: ? Did not perform proper reconciliations between the federal government distribution report, the Office?s internal inventory tracking spreadsheet and the warehouse documentation ? Did not perform a proper reconciliation between physical inventory and the Office?s inventory records ? Did not keep supporting records for inventory losses or damaged inventory item adjustments We identified 114 food items with negative adjustments. We reviewed 18 adjustments and found 14 were not supported and four were only partially supported. We also found that eight out of 307 USDA food items we examined contained discrepancies. We noted a total variance of 554 (quantity in cases) out of 70,368 cases. The Office undercounted by 118 cases and overcounted by 436 cases. We consider these internal control deficiencies to be a material weakness. Cause of Condition In response to the prior audit finding, the Office developed a corrective action plan that included implementing policies and procedures regarding the reconciliation process for donated foods and procuring a new or updated electronic food distribution system. However, at the time of the audit, the Office was still in the process of documenting system requirements for a new or updated electronic food distribution system that includes tracking and reporting capabilities to assist with the reconciliation process. Effect of Condition Without proper reconciliation between physical inventories and inventory records, the Office cannot ensure it identifies inventory discrepancies and properly accounts for the loss of donated foods. Additionally, failure to maintain records required by federal law may require the Office to pay USDA the value of the food or replace it in kind. Recommendations We recommend the Office: ? Implement established internal policies and procedures for the USDA-donated foods reconciliation process to ensure adjustments for loss are supported ? Implement internal controls to ensure physical inventory is reconciled with inventory records ? Follow up on the inventory discrepancies identified Office?s Response The Office has implemented corrective action to strengthen internal controls over accounting of USDA-donated Foods. The Office completed the documentation of system requirements for a new/updated electronic food distribution system that includes tracking and reporting capabilities to assist with the reconciliation process. This was completed September 2021. The Office will post a Request for Proposal for the procurement of the new/updated electronic food distribution system May 2022. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Title 7 U.S. Code of Federal Regulation, part 250, states in part: Section 250.12 Storage and inventory management at the distributing agency level (a) Safe storage and control. The distributing agency or subdistributing agency (which may include commercial storage facilities under contract with either the distributing agency or subdistributing agency, as applicable), must provide facilities for the storage and control of donated foods that protect against theft, spoilage, damage, or other loss. Accordingly, such storage facilities must maintain donated foods in sanitary conditions, at the proper temperature and humidity, and with adequate air circulation. The distributing agency must ensure the storage facilities comply with Federal, State, or local requirements relative to food safety and health and procedures for responding to a food recall, as applicable, and obtain all required health inspections. (b) Inventory management. The distributing agency must ensure that donated foods at all storage facilities used by the distributing agency (or by a subdistributing agency) are stored in a manner that permits them to be distinguished from other foods, and must ensure that a separate inventory record of donated foods is maintained. The distributing agency?s system of inventory management must ensure that donated foods are distributed in a timely manner and in optimal condition. On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or subdistributing agency), and must reconcile physical and book inventories of donated foods. The distributing agency must report donated food losses to FNS, and ensure that restitution is made for such losses. (c) Inventory limitations. The distributing agency is subject to the following limitations in the amount of donated foods on-hand, unless FNS approval is obtained to maintain larger inventories: (1) For TEFAP, NSLP and other child nutrition programs, inventories of each category of donated foods may not exceed an amount needed for a six-month period, based on an average amount of donated foods utilized in that period; and (2) For CSFP and FDPIR, inventories of each category of donated food in the food package may not exceed an amount needed for a three-month period, based on an average of donated food that the distributing agency can reasonably utilize in that period to meet CSFP caseload or FDPIR average participation. (d) Inventory protection. The distributing agency must obtain insurance to protect the values of donated foods at its storage facilities. The amount of such insurance must be at least equal to the average monthly values of donated food inventories at such facilities in the previous fiscal year. The distributing agency must also ensure the following entities obtain insurance to protect the values of their donated food inventories, in the same amount required by the distributing agency in this paragraph (d): (1) Subdistributing agencies; (2) Recipient agencies in household programs that have an agreement with the distributing agency or subdistributing agency to store and distribute foods (except those recipient agencies which maintain inventories with a value of donated foods that do not exceed a defined threshold, as determined in FNS policy); and (3) Commercial storage facilities under contract with the distributing agency or with an agency identified in paragraph (d)(1) or (2) of this section. (e) Transfer of donated foods. The distributing agency may transfer donated foods from its inventories to another distributing agency, or to another program, in order to ensure that such foods may be utilized in a timely manner and in optimal condition, in accordance with this part. However, the distributing agency must request FNS approval. FNS may also require a distributing agency to transfer donated foods at the distributing agency?s storage facility or at a processor?s facility, if inventories of donated foods are excessive or may not be efficiently utilized. If there is a question of food safety, or if directed by FNS, the distributing agency must obtain an inspection of donated foods by State or local health authorities, as necessary, to ensure that the donated foods are still safe and not out-of-condition before transferring them. The distributing agency is responsible for meeting any transportation or inspection costs incurred, unless it is determined by FNS that the transfer is not the result of negligence or improper action on the part of the distributing agency. The distributing agency must maintain a record of all transfers from its inventories, and of any inspections related to such transfers. (f) Commercial storage of facilities or carriers. The distributing agency may obtain the services of a commercial storage facility to store and distribute donated foods, or a carrier to transport donated foods, but must do so in compliance with procurement requirements in 2 CFR part 200, subpart D, and USDA implementing regulations at 2 CFR parts 400 and 416. The distributing agency must enter into a written contract with a commercial storage facility or carrier, which may not exceed five years in duration, including any extensions or renewals. The contract must include applicable provisions required by Federal statutes and executive orders listed in 2 CFR part 200, appendix II, Contract Provisions for Non-Federal Contracts Under Federal Awards, and USDA implementing regulations at 2 CFR parts 400 and 416. The contract must also include, as applicable to a storage facility or carrier, provisions that: (1) Assure storage, management, and transportation of donated foods in a manner that properly safeguards them against theft, spoilage, damage, or other loss, in accordance with the requirements in this part; (2) Assure compliance with all Federal, State, or local requirements relative to food safety and health, including required health inspections, and procedures for responding to a food recall; (3) Assure storage of donated foods in a manner that distinguishes them from other foods, and assure separate inventory recordkeeping of donated foods; (4) Assure distribution of donated foods to eligible recipient agencies in a timely manner, in optimal condition, and in amounts for which such recipient agencies are eligible; (5) Include the amount of insurance coverage obtained to protect the value of donated foods; (6) Permit the performance of on-site reviews of the storage facility by the distributing agency, the Comptroller General, the Department of Agriculture, or any of its duly authorized representatives, in order to determine compliance with requirements in this part; (7) Establish the duration of the contract, and provide the extension or renewal of the contract only upon fulfillment of all contract provisions; (8) Provide for expeditious termination of the contract by the distributing agency for noncompliance with its provisions; and (9) Provide for termination of the contract by either party for other cause, after written notification of such intent at least 60 days prior to the effective date of such action. Section 250.16 Claims and restitution for donated food losses. (a) Distributing agency responsibilities. The distributing agency must ensure that restitution is made for the loss of donated foods, or for the loss or improper use of funds provided for, or obtained as an incident of, the distribution of donated foods. The distributing agency must identify, and seek resolution from, parties responsible for the loss, and implement corrective actions to prevent future losses. (b) FNS claim actions. FNS may initiate and pursue claims against the distributing agency or other entities for the loss of donated foods, or for the loss or improper use of funds provided for, or obtained as an incident of, the distribution of donated foods. FNS may also initiate and pursue claims against the distributing agency for failure to take required claim actions against other parties. FNS may, on behalf of the Department, compromise, forgive, suspend, or waive a claim. FNS may, at its option, require assignment to it of any claim arising from the distribution of donated foods. Section 250.19 Recordkeeping requirements. (a) Required records. Distributing agencies, recipient agencies, processors and other entities must maintain records of agreements and contracts, reports, audits, and claim actions, funds obtained as an incident of donated food distribution, and other records specifically required in this part or in other Departmental regulations, as applicable. In addition, distributing agencies must keep a record of the value of donated foods each of its school food authorities receives, in accordance with ?250.58(e), and records to demonstrate compliance with the professional standards for distributing agency directors established in ?235.11(g) of this chapter. Processors must also maintain records documenting the sale of end products to recipient agencies, including the sale of such end products by distributors, and must submit monthly performance reports, in accordance with subpart C of this part and with any other recordkeeping requirements included in their agreements. Specific recordkeeping requirements relating to the use of donated foods in contracts with food service management companies are included in ?250.54. Failure of the distributing agency, recipient agency, processor, or other entity to comply with recordkeeping requirements must be considered prima facie evidence of improper distribution or loss of donated foods and may result in a claim against such party for the loss or misuse of donated foods, in accordance with ?250.16, or in other sanctions or corrective actions. (b) Retention of records. Records relating to requirements for donated foods must be retained for a period of three years from the close of the fiscal or school year to which they pertain. However, records pertaining to claims or audits that remain unresolved in this period of time must be retained until such actions have been resolved. Section 250.21 Distributing agency reviews. (a) Scope of review requirements. The distributing agency must ensure that subdistributing agencies, recipient agencies, and other entities comply with applicable requirements in this part, and in other Federal regulations, through the on-site reviews required in paragraph (b) of this section, and the review of required reports or audits. However, the distributing agency is not responsible for the review of school food authorities and other recipient agencies in child nutrition programs. The State administering agency is responsible for the review of such recipient agencies, in accordance with review requirements of part 210 of this chapter. (b) On-site reviews. The distributing agency must conduct an on-site review of: (1) Charitable institutions, whenever the distributing agency identifies actual or probable deficiencies in the use of donated foods by such institutions, through audits, investigations, complaints, or any other information; (2) Storage facilities at the distributing agency level (including commercial storage facilities under contract with the distributing or subdistributing agency), on an annual basis; and (3) Subdistributing and recipient agencies in CSFP, TEFAP, and FDPIR, in accordance with 7 CFR parts 247, 251, 253, respectively. (c) Identification and correction of deficiencies. The distributing agency must inform each subdistributing agency, recipient agency, or other entity of any deficiencies identified in its reviews, and recommend specific actions to correct such deficiencies. The distributing agency must ensure that such agencies or entities implement corrective actions to correct deficiencies in a timely manner.

2021-004 The Department of Health did not have adequate internal controls over and did not comply with requirements to ensure provider payments were allowable and met cost principles for the Special Supplemental Nutrition Program for Women, Infants and Children. CFDA Number and Title: 10.557 Special Supplemental Nutrition Program for Women, Infants and Children 10.557 COVID-19 Special Supplemental Nutrition Program for Women, Infants and Children Federal Grantor Name: U.S. Department of Agriculture Federal Award/Contract Number: 207WAWA7W1003; 207WAWA7W1006; 21WAWA7W6003; 21WAWA7W6006; 21WAWA7W7003; 21WAWA7W1003; 21WAWA7W1006 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Known Questioned Cost Amount: $6,711,342 Background The Department of Health (Department) operates the Special Supplemental Nutrition Program for Women, Infants and Children (WIC). WIC is funded exclusively with federal grants from the U.S. Department of Agriculture. WIC serves pregnant women, new and breastfeeding moms, and children younger than 5 years old who are at or below 185 percent of the federal poverty level. WIC provides: ? Nutrition ideas and tips on how to eat well and be more active ? Breastfeeding support, such as access to a peer counselor and breast pumps (varies by clinic) ? Health screenings and referrals ? Monthly benefits for healthy food, such as milk, cereal, fruits and vegetables To help carry out the objectives of the WIC program, the Department issues subawards to Local Health Jurisdictions, nonprofit organizations and tribal governments. Subrecipients are awarded federal funds on a reimbursement basis only. The Department assigns each subrecipient a risk level based on standardized criteria. The Department maintains a documentation matrix that specifies the documentation that subrecipients are required to submit with each reimbursement for each risk level. There are varying requirements among low, moderate, and high-risk subrecipients for each of the following expense categories: ? Salaries and wages ? Fringe benefits ? Equipment ? Materials and supplies ? Travel costs (in-state and out-of-state) ? Subcontracts ? Administrative/indirect costs ? Other miscellaneous expenses (as specified under the subaward) The Department spent over $83.5 million in federal grant funds during fiscal year 2021. Of this amount, it paid about $28.8 million to providers for direct client services. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure provider payments were allowable and met cost principles for the WIC program. During the audit period, Department program managers used the documentation matrix when reviewing subrecipient payment requests to ensure payments were for allowable activities, met cost principles and included required supporting documentation. We used a statistical sampling method to randomly select 57 out of 700 payments to review. Additionally, we judgmentally reviewed two individually significant payments that exceeded $1.5 million each. In total, we examined more than $12.4 million in provider payments as part of the audit. Of the 59 payments examined, we identified 22 payments that did not have the required supporting documentation for the assigned risk level. This included the two individually significant payments. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department has established policies and procedures for evaluating payment requests, but management did not ensure staff followed them. Although the payment requests contained program manager signatures to indicate they performed a review, the required supporting documentation was not submitted or reviewed in accordance with Department policy. Effect of Condition and Questioned Costs Without establishing adequate internal controls, the Department cannot reasonably ensure it using federal funds for allowable purposes. Additionally, by not ensuring subrecipients submitted proper supporting documentation so staff could verify their reimbursement claims, the Department cannot ensure its subrecipients have complied with the terms and conditions of the subaward. We used a statistical sampling method to randomly select the reimbursements we examined in the audit. The 22 payments for which the Department did not have adequate documentation from subrecipients to support their reimbursement requests totaled $6,711,342 in known questioned costs. Based on these results, we estimate that the total amount of likely improper payments using federal funds to be $12,329,235. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs? as required by 2 CFR 200.516(3). To ensure a representative sample, we stratified the population by dollar amount. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Improve internal controls, including its internal monitoring processes, to ensure that it obtains adequate supporting documentation from subrecipients before reimbursing them ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response We appreciate the State Auditor?s Office (SAO) audit of the Women, Infant and Children grant. The Department is committed to ensuring our programs comply with federal regulations and understand that it is SAO?s point of view that we did not have adequate controls over provider payments to ensure allowability in meeting cost principles. The Department partially agrees with SAO?s findings. The Department does agree and has already taken steps to improve internal controls over ensuring payments to providers contain support per our internal policies and procedures. However, we would respectfully disagree with the number of exceptions and questioned costs identified. While the level of support did not meet our internal policies, which are held to a higher standard than federal requirements, the totality of our subrecipient monitoring processes and level of documentation received from the subrecipient accounting system gave us assurance that many of the transactions/costs questioned met federal cost principles for allowability. Per our review of the 22 exceptions identified by the auditor?s office, we identified only five payments that did not contain any support from the subrecipient for a revised total of known questioned costs of $273,614. This, along with the following additional overall internal subrecipient monitoring and policy processes support our overall assurance of the allowability of payments: ? Each of the subrecipients of WIC funds receives a monitoring visit from our Fiscal Monitoring Unit (FMU) once every two years. During the course of these visits monitoring staff perform walk-through?s and assessments of the internal controls surrounding the A19 payments process and select the most recent three A19?s submitted for WIC funding and agree all charges to the source documentation from the subrecipient for allowability using the costs principles and criteria as a basis. It is determined via a risk-based approach if these visits will be virtual or on-site visit: ? WIC program monitoring staff also perform annual onsite visits at a minimum and perform critical reviews of program activities to ensure WIC processes and costs charged to the program are for allowable purposes and are in alignment with programmatic rules related to the Women, Infants and Children Program; ? Detailed budgets for WIC are submitted by the subrecipient, by project, reviewed and approved by Program staff annually and as A19?s are submitted program fiscal staff keep updated budget to actual spreadsheets, and while they review the support provided by the subrecipient, they ensure amounts submitted by project are reasonable and are in alignment with expectations for the budget period submitted; ? The WIC program has an allowable cost policy chapter, purchase and procurement chapter, that is provided to the subrecipients. ? FMU regularly provides technical assistance and training, not only to WIC fiscal program staff, but to the subrecipients while onsite and at the request of the entities receiving WIC funding; and ? Program staff regularly provide technical assistance, policies, and training to WIC subrecipients related to both allowability and compliance as it relates to WIC programmatic processes. Auditor?s Remarks The processes listed in the Department?s response were not presented to us by management as internal controls over the compliance requirement of activities allowed during the audit and therefore were not examined and tested. Not considering the expenditures disputed by the Department, the five exceptions would still represent a material weakness in internal controls as well as material noncompliance with the compliance requirement. We reaffirm our finding and will follow up on the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-005 The Employment Security Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the Benefit Accuracy Measurement program of the Unemployment Insurance program in a timely manner. CFDA Number and Title: 17.225 Unemployment Insurance 17.225 COVID-19 Unemployment Insurance Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: UI-35977-21-60-A-53; UI-34092-20-55-A-53; UI-34198-20-55-A-53; UI-34528-20-60-A-53; UI-34748-20-55-A-53; UI-34890-20-55-A-53; UI-35682-21-55-A-53; UI-35737-21-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: UI Benefit Payments Known Questioned Cost Amount: None Background The Unemployment Insurance program was created by the Social Security Act (SSA), and provides benefits under the Unemployment Compensation program to unemployed workers for periods of involuntary unemployment. It provides a stabilizing effect on the economy by maintaining the spending power of eligible workers while they are between jobs. The Improper Payment Elimination and Recovery Act (IPERA) of 2010 requires the State Workforce Agencies to maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is the U.S. Department of Labor?s quality control system designed to assess the accuracy of Unemployment Insurance benefit payments and denied claims. The program estimates error rates and dollar amounts of benefits improperly paid or denied by projecting the results from investigations in a state. For fiscal year 2021, the U.S. Department of Labor waived the requirement for states? review of denied claims, but not paid claims. The Employment Security Department (Department) administers the state?s Unemployment Insurance program. During fiscal year 2021, the Department paid more than $12.1 billion dollars in unemployment insurance benefits to more than 877,000 people. Under the BAM program, the Department is required to draw a weekly sample of payments and denied claims. The Department must complete this sampling promptly and conduct an in-depth investigation of the claims to determine the degree of accuracy in administering the state?s Unemployment Compensation program and compliance with federal law (20 CFR 602.21(d)). The Department has established a dedicated BAM unit to meet these requirements. The Unemployment Insurance Program Letter No. 12-19 indicates the timeframe and requirements for conducting BAM program case sampling. States must complete reviews of: ? 95 percent of the sampled cases within 90 days of the week ending date of the batch; and ? 98 percent of sampled cases within 120 days of the ending date of the annual report period. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported that the Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the BAM program of the Unemployment Insurance program in a timely manner. The prior finding number was 2020-011. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to operate a BAM program and assess the accuracy of Unemployment Insurance benefit payments. The Department did not effectively recruit, develop and retain staff to ensure it materially complied with the BAM program?s case review requirements. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Department did not have adequate staffing resources to meet BAM program requirements. According to management, the program has struggled to maintain adequate staffing due to attrition and funding. Also, once staff are hired, it takes considerable time to train new employees to complete case sampling. Staff appointed to assist the Department?s BAM unit in response to the prior audit finding left employment during the audit period, making it difficult for the Department to complete investigations in a timely manner. The Department was unable to fill these vacant positions during the audit period. Effect of Condition The Department did not comply with the federally required timelines for completing its case sampling. Specifically, we found the Department completed only 64 percent of its sampled cases within 90 days of the week ending date of the batch. This was materially noncompliant with the BAM program?s timeliness requirements. By not complying with the federally required timelines for completing case sampling, the Department cannot fully evaluate the accuracy of its claim decisions and is less likely to detect fraudulent payments. Recommendation We recommend the Department allocate the necessary staffing resources to ensure it complies with the U.S. Department of Labor?s timelines for BAM case sampling. Department?s Response The Department concurs with this finding and recommendation. The BAM unit has, since 2019, continued to improve on the staffing model within the unit and ensure compliance is met through training, sufficient staffing, and contingency planning. The unit has recently hired three additional staff to fill prior vacancies that now put the unit at full staff capacity to ensure the USDOL Acceptable Levels of Performance (ALPs) are met. ESD continues to partner and frequently communicate with USDOL Regional Offices to discuss staffing and training models. The Quality Assurance Manager and the Case Review Supervisor are committed to routinely monitor caseload, workload, and the overall assurance of meeting the BAM operations performance goals and measures as set forth by USDOL. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Title 20 U.S. Code of Federal Regulations (CFR) Part 602, Quality Control in the Federal-State Unemployment Insurance System ? Subpart B ? Federal Requirements, establishes the following applicable requirements: Section 602.21 ? Standard methods and procedures, states in part: Each State shall: a. Perform the requirements of this section in accordance with instructions issued by the Department, pursuant to 602.30(a) of this part, to ensure standardization of methods and procedures in a manner consistent with this part; b. Select representative samples for QC study of at least a minimum size specified by the Department to ensure statistical validity, f. Furnish information and reports to the Department, including weekly transmissions of case data entered into the automated QC system and annual reports, The U.S. Department of Labor, Employment and Training Administration Benefit Accuracy Measurement State Operations Handbook ? ET Handbook No. 395, 5th Edition, Chapter VI Investigative Procedures, Section 13. Completion of Cases and Timely Data Entry, states in part: The following time limits are established for completion of all cases for the year. (The ?year? includes all batches of weeks ending in the calendar year.): ? a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch, and 95 percent of cases must be completed within 90 days of the week ending date of the batch; and ? a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year.

2021-006 The Employment Security Department did not have adequate internal controls over fiscal monitoring requirements to ensure subrecipients of the Workforce Innovation and Opportunity Act program only used funds for allowable purposes. CFDA Number and Title: 17.258 Workforce Innovation and Opportunity Adult Program 17.259 Workforce Innovation and Opportunity Youth Activities 17.278 Workforce Innovation and Opportunity Dislocated Worker Formula Grants Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: AA-32219-18-55-A53, AA-33263-19-55-A-53, AA-34801-20-55-A-53, AA-32219-18-55-A-53 , AA-33263-19-55-A-53, AA-34801-20-55-A-53, AA-32219-18-55-A-53 , AA-33263-19-55-A-53, AA-34801-20-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed, Subrecipient Monitoring Known Questioned Cost Amount: None Background The Employment Security Department (Department) receives federal funding for the Workforce Innovation and Opportunity Act (WIOA) grant from the U.S. Department of Labor (DOL). WIOA authorizes formula grant programs to states to help job seekers access employment, education, training and support services to succeed in the labor market. WIOA provides employment and training programs for adults, dislocated workers, youth and Wagner-Peyser Act employment services administered by DOL. The state subawards a large portion of the federal funds it receives to 12 Local Workforce Development Boards (LWDBs) that provide employment assistance to people. The Department spent about $66.9 million in federal funds for the WIOA cluster in state fiscal year 2021. Of this amount, the Department paid about $63.7 million to the LWDBs. Additionally, the Department asserts over 50 percent of these funds are passed on from the LWDB?s to their local partners. When LWDBs request WIOA funds from the Department, they submit high-level supporting documentation like expenditure summary reports from an accounting system. To ensure federal funds are used only for allowable purposes and meet cost principles, the Department performs onsite monitoring of each LWDB every year. The onsite monitoring includes a review of a selection of reimbursement requests the LWDB has submitted since the last onsite monitoring visit. During the time between monitoring visits, each LWDB is authorized to spend federal funds from multiple subawards that the Department has issued. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over fiscal monitoring requirements to ensure subrecipients of the WIOA program only used funds for allowable purposes. The prior finding numbers were 2020-013 and 2019-012. Description of Condition The Department did not have adequate internal controls over fiscal monitoring requirements to ensure subrecipients of the WIOA program only used funds for allowable purposes. When determining which expenditures to review during an onsite monitoring visit, Department staff responsible for conducting the visit judgmentally select a sample of reimbursements made to the LWDB since the last onsite visit. The Department has procedures that describe its subrecipient monitoring process, but they do not provide staff guidance on how to: ? Determine how many expenditures they need review to give the Department reasonable assurance the LWDB spent WIOA funds in accordance with federal law ? Determine what criteria should be considered when selecting reimbursements for review ? Document the judgment they used when selecting reimbursements for review We consider this internal control deficiency to be a material weakness. Cause of Condition Management said they believed the Department?s design of its monitoring practices, contract closeout process and subrecipient audits were sufficient for detecting unallowable or unsupported costs that the LWDBs claimed for reimbursement. However, the Department?s subrecipient monitoring process was not designed to compensate for the fact that LWDBs do not provide detailed supporting documentation when they request reimbursement. Effect of Condition By not performing adequate fiscal monitoring over subrecipients, the Department is at a higher risk of not detecting or preventing unallowable activities and costs from being charged to the federal grant. Allowing staff to select samples judgmentally without adequate guidance from management does not provide the Department with reasonable assurance that LWDBs spent program funds in accordance with grant requirements and federal regulations. This may also lead to inconsistent and potentially inequitable fiscal oversight of the LWDBs. Additionally, because the reviewers do not document how they selected expenditures for review or how they achieved adequate coverage for the required level of assurance, management cannot perform sufficient oversight to ensure the Department has met federal requirements. These weaknesses have a greater effect on the Department?s ability to ensure LWDBs spent WIOA funds in accordance with federal law because it has chosen not to receive or review any detailed support for reimbursements at the time when LWDBs submit them to the Department. Therefore, the Department relies almost solely on its fiscal monitoring process to gain this assurance. Recommendations We recommend the Department: ? Strengthen its monitoring of LWDBs to ensure they are only using federal funds for allowable purposes ? Develop written policies and procedures that provide guidance to staff on how to perform fiscal monitoring reviews Department?s Response The Department respectfully disagrees with the finding. We appreciate the State Auditor?s Office?s (SAO) work. We believe the Department has complied fully with federal requirements regarding the oversight of funds provided to Workforce Development Councils (WDC?s) as part of the Workforce Innovation and Opportunity Act (WIOA) implementation in Washington State (2 CFR ? 200.331). The Employment Security Department (ESD) is committed to ensuring our programs comply with federal regulations and understand that it is SAO?s assertion that we did not have adequate internal controls over fiscal monitoring of our subrecipients. We disagree with SAO?s conclusions regarding the description of our condition. ESD provides staff guidance on what are allowable activities for the WIOA program, on how many expenditures to review, and what criteria to use when selecting reimbursements for review in the form of daily and weekly meetings as well as utilization of our risk assessments. It is always our goal to follow all federal criteria when performing monitoring of subrecipients and oversight of the grant. SAO was unable to provide us with specific criteria regarding reasonable assurance that would allow us to improve our internal controls to fit their expectations and address the issues they raised in this finding. We referenced the Uniform Guidance regarding required and considered actions for a subrecipient monitoring program: Based on Uniform Guidance (UG) we must: ? Perform a Subrecipient vs Contractor Determination. ? Enter UG information into the subaward. ? Accept Federally negotiated rate where applicable. ? Perform a risk assessment. ? Review the Reporting sent by the subrecipient. ? Issue Management Letters to ensure the Subrecipient acts against deficiencies. ? Verify the Subrecipient had / needs a Single Audit. Per the UG, monitoring agencies should consider: ? If more monitoring is required. ? Providing additional monitoring thru technical assistance and training. ? Perform on-site Reviews or agreed upon procedures. ? Develop a policy and process for subrecipient monitoring that is centered around the risk assessment analysis. ESD performs all required functions and has also implemented all the actions monitoring agencies should consider. During USDOL?s annual reviews, they have consistently cited how thorough ESD?s monitoring processes are. This is further evidenced by the following promising practices they identified during some of their recent visits: ? On February 4, 2022, USDOL reported ESD?s risk assessments take into consideration factors including staff turnover, existence of unresolved monitoring findings, expenditure rates, and current investigations of the recipient. Additionally, other important factors that may indicate a higher risk for compliance or other grant management issues are taken into consideration. The assessments enable ESD to provide targeted technical assistance to its subrecipients to help prevent potential issues. ? On January 29, 2021, USDOL reported our monitoring process and tool is a cooperative, collaborative approach that helps to build capacity and compliance. ? In 2017, USDOL reported ESD developed monitoring processes that not only fulfill the State?s monitoring requirements but add a strong focus on providing technical assistance and on-the-spot corrections. In addition, ESD has developed a set of monitoring tools that have been adopted by many of the LDWB?s and could be shared nationwide. ESD has been and remains committed to ongoing reviews of our processes with a continual aim to enhance our internal controls if needed. Auditor?s Remarks The Department did not provide our Office with any documentation that outlines the requirements for selecting samples of reimbursements to review for WIOA subrecipient monitoring visits. The Department?s Workforce Innovation and Opportunity Act Policy 5414 (WIOA Title I Monitoring), Section 3(b)(1) Scope of Monitoring Reviews ? Administrative and Financial Management, states: ?This review area includes, but is not limited to, an evaluation of the LWDB and sub-committees, the WorkSource system, administrative and financial policies and practices, and sub-recipient monitoring and oversight according to applicable federal and state legislation, regulations, policies and guidance, and OMB Circulars and Uniform Guidance. ESD Workforce Monitoring Unit will conduct this evaluation via document review and sample selection.? There is no written guidance concerning the amount or number of transactions that should be reviewed during the evaluation, nor does the policy identify the criteria to be applied in selecting transactions for review. This is further supported by the Department?s assertion in its response above that guidance was issued to staff informally through meetings and discussions, which we could not verify occurred during the audit period. It is our opinion that without formally communicating sampling requirements to the WIOA Monitoring Unit staff, the Department has not established adequate internal controls over the Federal award that provide management with reasonable assurance that subrecipient activities are compliant with federal program requirements, and performance goals have been achieved. In addition, the evaluations we examined as part of this audit did not contain any documentation of the evaluator?s judgment or criteria used to select individual transactions from each LWDB to review. Without this information, management cannot ensure that the results of each LWDB review provide reasonable assurance of compliance with WIOA program requirements. While the Department asserts it is meeting federal requirements for monitoring subrecipients, this finding also addresses the Department?s lack of internal controls over the Activities Allowed compliance requirement. The Department?s decision not to review supporting documentation at the time payment are made to subrecipients means that the monitoring of subrecipients is also being relied on to ensure all payments are only for allowable activities. In our judgment, the processes in place are not sufficient to give the Department that level of assurance. We reaffirm the audit finding and will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.302 Financial management, states in part: (a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. (b) The financial management system of each non-Federal entity must provide for the following (see also ?? 200.334, 200.335, 200.336, and 200.337): (3) Records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section 200.329 Monitoring and reporting program performance, states in part: (a) Monitoring by the non-Federal entity. The non-Federal entity is responsible for oversight of the operations of the Federal award supported activities. The non-Federal entity must monitor its activities under Federal award supported activities. The non-Federal entity must monitor its activities under Federal awards to assure compliance with applicable Federal requirements and performance expectations are being achieved. Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance.

2021-007 The Employment Security Department did not have adequate internal controls over and did not comply with requirements to ensure it submitted complete and accurate quarterly performance reports for the Workforce Innovation and Opportunity grant. CFDA Number and Title: 17.258 Workforce Innovation and Opportunity Adult Program 17.259 Workforce Innovation and Opportunity Youth Activities 17.278 Workforce Innovation and Opportunity Dislocated Worker Formula Grants Federal Grantor Name: U.S. Department of Labor Federal Award/Contract Number: AA-32219-18-55-A53, AA-33263-19-55-A-53, AA-34801-20-55-A-53, AA-32219-18-55-A-53 , AA-33263-19-55-A-53, AA-34801-20-55-A-53, AA-32219-18-55-A-53 , AA-33263-19-55-A-53, AA-34801-20-55-A-53 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Employment Security Department (Department) receives federal funding for the Workforce Innovation and Opportunity Act (WIOA) grant from the U.S. Department of Labor (DOL). WIOA authorizes formula grant programs to states to help job seekers access employment, education, training and support services to succeed in the labor market. WIOA provides employment and training programs for adults, dislocated workers, youth and Wagner-Peyser Act employment services administered by DOL. DOL requires that the Department complete performance reports using a standardized Participant Individual Record Layout (PIRL). The Department must file the PIRL every quarter using the DOL?s Workforce Integrated Performance System. DOL also requires that states develop data validation procedures related to the PIRL that include: ? Written description of the process for identifying and correcting errors or missing data, which may include electronic data checks; ? Regular data validation training for appropriate program staff; ? Monitoring protocols, consistent with 2 CFR 200.328; ? A regular review of program data for errors, missing data, out-of-range values and anomalies; ? Documentation that missing and erroneous data identified during the review process have been corrected; and ? Regular assessment of the effectiveness of the data validation process and revisions to the process as needed. The Department uses the Efforts to Outcome (ETO) system to determine if participants are eligible for programs under the WIOA grant. Local Workforce Development Boards (LWDB) enter participant information into ETO, and DOL requires the Department to perform validation procedures to ensure participant data is accurate and complete. Additionally, ETO tracks participants? progress while in the program and upon completion. The Department uses data captured in ETO to compile the data elements reported on the PIRL. In state fiscal year 2021, the Department spent about $66.9 million in federal WIOA grant funds. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure it submitted complete and accurate quarterly performance reports for the WIOA grant. The prior finding number was 2020-012. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it submitted complete and accurate quarterly performance reports for the WIOA grant. The Department did not establish an effective review process to ensure data elements of the PIRL quarterly reports were accurate and complete before submitting them to DOL. The Department also did not have adequate written data validation procedures for the PIRL report, as DOL requires. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition A contracted vendor extracts participant data from a large database and then uses customized code to transform it to produce the data the Department uses to create the PIRL reports. After the prior audit, the Department found an error in the PIRL data script, which the Department plans to correct by February 2022. Because of insufficient staffing resources, the Department did not review this process to ensure the code the vendor produced correctly pulled the data. Effect of Condition We verified the Department submitted all four quarterly PIRL reports to the DOL, as required during fiscal year 2021. We obtained and examined all four reports to determine if the Department accurately prepared them. To identify a population of WIOA participants, data elements 903, 904, and 905 are critical because they represent whether a client participated in the program. Each data element must be completed with one of the following allowable coding options: ? 0 ? Participant did not receive services ? 1 ? Yes, Local Formula ? 2 ? Yes, Statewide ? 3 ? Yes, Both Local Formula and State ? 4 ? Reportable Individual We found participants listed in the reports were missing one or more data elements for 903, 904 and 905. The following tables show the proportion of the fields that were blank compared to the total number of fields. Data Element 903 Quarter Blanks Total Percent 1 172,656 385,306 44.81% 2 170,139 368,745 46.14% 3 166,908 355,777 46.91% 4 161,432 341,679 47.25% Data Element 904 Quarter Blanks Total Percent 1 173,074 385,306 44.92% 2 170,473 368,745 46.23% 3 167,183 355,777 46.99% 4 161,653 341,679 47.31% Data Element 905 Quarter Blanks Total Percent 1 173,072 385,306 44.92% 2 170,469 368,745 46.23% 3 167,181 355,777 46.99% 4 161,653 341,679 47.31% We could not determine the total population of WIOA participants for testing because these data elements were incomplete and inaccurate. Without complete data, the Department could not demonstrate compliance with reporting requirements nor accurately inform its federal grantor of its current level of program participation. Recommendation We recommend the Department: ? Update written validation procedures for the PIRL report to meet DOL requirements ? Train LWDB on PIRL data element reporting requirements to ensure they enter all required information into ETO ? Establish a review process to ensure it submits complete and accurate quarterly PIRL reports ? Ensure all required elements are completed for participants listed in the PIRL reports before submitting them to DOL Department?s Response The Department concurs with the finding. We would like to thank the Office of the State Auditor (SAO) for their work on this area to ensure job seekers in Washington state can access employment, education, training, and support services to succeed in the labor market. We have outlined our response below with respect to the recommendations made by SAO. SAO recommendation: Ensure all required elements are completed for participants listed in the PIRL reports before submitting them to DOL. ESD has updated our scripts and they are now reflecting zero blank elements submitted and showing only allowable values. In addition to SAO?s recommendation, ESD is implementing, as a long-term solution, a new case management system. SAO recommendation: Update written validation procedures for the PIRL report to meet DOL requirements. The Data Integrity, Policy and Monitoring teams have completed their Data Element Validation (DEV) policy update, submitted it to DOL and are actively executing DEV per DOL expectations. DOL has not provided guidance or definitions through a Training Employment Guidance Letter or Training Employment Notice related to the designation of a reportable individual. Once issued, we can more effectively train stakeholders, update policy, and hold local areas accountable to what a reportable individual count would be. We will also work with our vendors who provide the data extract from Efforts to Outcome to ensure scripting produces the required outcome. SAO recommendation: Train LWDB on PIRL data element reporting requirements to ensure they enter all required information into ETO. ESD?s Data Integrity, Policy and Monitoring teams have established a technical assistance PIRL reporting process focused on continuous improvement practices including root cause analysis to guide existing and new trainings. This process has been in place since Q2 2021. We also offer and execute 1:1 specialized technical assistance and training as requested by local areas and one-stop centers. SAO recommendation: Establish a review process to ensure it submits complete and accurate quarterly PIRL reports. The Data Integrity team is heavily involved in the automation and standardization of the Quarterly Report Analysis (QRA) process. Thus far, we have concentrated on setting up a sustainable process and we are working on evaluating all defined areas in the most recent QRAs provided to date. The QRA is in its pilot phase with DOL, and Washington State has proactively established a system and reporting structure prior to it being formally required by DOL. We are seeking and receiving technical assistance with DOL as it relates to the PIRL to further establish internal controls and effectively manage data validation, quality, and integrity. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.329 Monitoring and reporting program performance, states in part: (a) Monitoring by the non-Federal entity. The non-Federal entity is responsible for oversight of the operations of the Federal award supported activities. The non-Federal entity must monitor its activities under Federal awards to assure compliance with applicable Federal requirements and performance expectations are being achieved. Monitoring by the non-Federal entity must cover each program, function or activity. See also?200.332. (b) Reporting program performance. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. As appropriate and in accordance with above mentioned information collections, the Federal awarding agency must require the recipient to relate financial data and accomplishments to performance goals and objectives of the Federal award. Also, in accordance with above mentioned common information collections, and when required by the terms and conditions of the Federal award, recipients must provide cost information to demonstrate cost effective practices (e.g., through unit cost data). In some instances (e.g., discretionary research awards), this will be limited to the requirement to submit technical performance reports (to be evaluated in accordance with Federal awarding agency policy). Reporting requirements must be clearly articulated such that, where appropriate, performance during the execution of the Federal award has a standard against which non-Federal entity performance can be measured. (c) Non-construction performance reports. The Federal awarding agency must use standard, government wide OMB-approved data elements for collection of performance information including performance progress reports, Research Performance Progress Reports. (1) The non-Federal entity must submit performance reports at the interval required by the Federal awarding agency or pass-through entity to best inform improvements in program outcomes and productivity. Intervals must be no less frequent than annually nor more frequent than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes. Reports submitted annually by the non- Federal entity and/or pass-through entity must be due no later than 90 calendar days after the reporting period. Reports submitted quarterly or semiannually must be due no later than 30 calendar days after the reporting period. Alternatively, the Federal awarding agency or pass-through entity may require annual reports before the anniversary dates of multiple year Federal awards. The final performance report submitted by the non-Federal entity and/or pass- through entity must be due no later than 120 calendar days after the period of performance end date. A subrecipient must submit to the pass-through entity, no later than 90 calendar days after the period of performance end date, all final performance reports as required by the terms and conditions of the Federal award. See also ?200.344. If a justified request is submitted by a non-Federal entity, the Federal agency may extend the due date for any performance report. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, and paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Training and Employment Guidance Letter (TEGL) WIOA No. 07-18, dated December 19, 2018 - Operating Guidance for the Workforce Innovation and Opportunity Act, states in part: Guidance for Validating Jointly Required Performance Data Submitted under the Workforce Innovation and Opportunity Act (WIOA) 4. Joint Data Validation Framework. Data validation is a series of internal controls or quality assurance techniques established to verify the accuracy, validity, and reliability of data. Establishing a joint data validation framework based on a consistent approach shared by the Departments will ensure that all program data are consistent and accurately reflect the performance of each core program in each State. To that end, the purposes of validation procedures for jointly required performance data are to: ? Verify that the performance data reported by States to the Departments are valid, accurate, reliable, and comparable across programs; ? Identify anomalies in the data and resolve issues that may cause inaccurate reporting; ? Outline source documentation required for common data elements; and ? Improve program performance accountability through the results of data validation efforts. While States must utilize a data validation strategy, the specific design, implementation, and periodic evaluation of that strategy is left to the discretion of the State so long as those strategies or procedures are consistent with these guidelines. Data validation helps ensure the accuracy of the annual statewide performance reports, safeguards data integrity, and promotes the timely resolution of data anomalies and inaccuracies. As such, it is recommended that States incorporate their data validation procedures into their internal controls procedures, which are required by 2 Code of Federal Regulations (CFR) ?200.303. State VR agencies should also consider related guidance issued in Rehabilitative Services Administration (RSA) Policy Directive 16-04. Each State must develop data validation procedures that include: ? Written procedures for data validation that contain a description of the process for identifying and correcting errors or missing data, which may include electronic data checks; ? Regular data validation training for appropriate program staff (e.g., at least annually); ? Monitoring protocols, consistent with 2 CFR ?200.328, to ensure that program staff are following the written data validation procedures and take appropriate corrective action if those procedures are not being followed; ? A regular review of program data (e.g., quarterly) for errors, missing data, out-of-range values, and anomalies; ? Documentation that missing and erroneous data identified during the review process have been corrected; and ? Regular assessment of the effectiveness of the data validation process (e.g., at least annually) and revisions to that process as needed. Performance Accountability, Information, and Reporting System - OMB Control No. 1205-0521: The report can be found by following this link: https://www.dol.gov/sites/dolgov/files/ETA/Performance/pdfs/ETA_9170_WIOA_PIRL_Final.pdf

2021-008 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to conduct program monitoring of subrecipients of the Highway Planning and Construction Cluster. CFDA Number and Title: 20.205 Highway Planning and Construction 20.205 COVID-19 Highway Planning and Construction 20.219 Recreational Trails Program 20.224 Federal Lands Access Program Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Washington State Department of Transportation?s (Department) Local Programs Office administers federal funding under the Highway Planning and Construction Cluster to local agencies throughout the state for highway construction projects. The Department spent about $510 million on highway projects during fiscal year 2021. Of that amount, it passed through about $221 million to local agencies as subawards. Federal regulations require the Department to monitor the activities of its subrecipients to ensure they use subawards for authorized purposes and that activities comply with terms and conditions of the subaward and achieve performance goals. Specifically, monitoring efforts must include reviewing financial and programmatic reports required by the pass-through entity. The Department also maintains its own requirements for subawards of federal funds, published in the Local Agency Guidelines (LAG) Manual. This manual outlines additional requirements the Department imposes on all subrecipients, including the requirement to undergo project audits, documentation reviews during the project period of performance, and project management reviews (PMR) prior to closure of each federally funded construction project. The Department revised the LAG Manual in June 2021 to provide for the selection of PMRs using a risk-based approach. The Department selects PMRs from ongoing projects it believes are at the highest risk of noncompliance. However, the U.S. Department of Transportation, Federal Highway Administration (FHWA), has stipulated in its Stewardship and Oversight Agreement (Agreement) with the Department that a PMR is conducted at least once every three years for each subrecipient. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with federal requirements to conduct program and fiscal monitoring of subrecipients for the Highway Planning and Construction Cluster. The previous finding numbers were 2020-016 and 2019-015. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to conduct program monitoring of subrecipients for the Highway Planning and Constructions Cluster. The Department did not ensure it completed PMRs of every subrecipient every three years, as required by the Agreement. We randomly selected and reviewed five of the nine PMRs scheduled during the audit period. We found the Department did not perform any of the five PMRs within three years of the previous completed review, as required. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition Despite this condition being reported in two prior audits, Department officials said they still believed that conducting on-site reviews during the closeout phase of a subrecipient?s project was sufficient to provide reasonable assurance of the subrecipient?s use of the federal subaward. During the audit period, the Department did not successfully renegotiate terms and conditions of the Agreement with FHWA to allow for a different methodology of selecting PMRs to conduct. Effect of Condition Without establishing adequate internal controls, the Department cannot reasonably ensure its subrecipients are using federal funds for allowable purposes. Additionally, without monitoring each subrecipient?s use of federal funds, the Department does not have reasonable assurance that the subrecipient has complied with the terms and conditions of the subaward. Failure to monitor each subrecipient?s use of federal grant funds also violates the terms and conditions of the Agreement, which could result in the termination or suspension of the federal grant award. Recommendations We recommend the Department: ? Update its policies and procedures for subrecipient monitoring to comply with all FHWA regulations ? Improve internal controls to ensure it completes project management reviews for every active subrecipient at least once every three years, as required under the Agreement Department?s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor?s Office audit of the Federal Highway Program. WSDOT is committed to ensuring our programs comply with federal regulations. The Department appreciates the Auditor?s perspective on the Description of Condition and Effects of the Condition. The timing of the Auditor?s finding comes as the Department is coordinating with FHWA to update its PMR process to a leading practice. This new process includes focusing on a more ?risk-based approach? which will provide a higher level of oversight to the subrecipients. Technically, the finding is correct based on the language in the Stewardship Agreement with FHWA. FHWA is reluctant to formally open the Stewardship and Oversight agreement for revisions, as a new nationwide ?template? is under development. Our risk-based program approach began in calendar year 2021 via a memo agreement with FHWA, and will be more formally adopted in calendar year 2022 via a memo acknowledgement and extension pending with FHWA. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (g) Consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Title 23 U.S. Code of Federal Regulations, Chapter 1 ? Federal-Aid Highways, Section 106: Project approval and oversight, states in part: (g) Oversight Program.? 4) Responsibility of the states.? (A) In general.?The States shall be responsible for determining that subrecipients of Federal funds under this title have? (i) adequate project delivery systems for projects approved under this section; and (ii) sufficient accounting controls to properly manage such Federal funds. Title 23 U.S. Code of Federal Regulations, Part 635 ? Construction and Maintenance ? Contract Procedures states in part: ? 635.102 Definitions. As used in this subpart: Local public agency means any city, county, township, municipality, or other political subdivision that may be empowered to cooperate with the State transportation department in highway matters. State department of transportation (State DOT) means that department, commission, board, or official of any State charged by its laws with the responsibility for highway construction. The term ?State? should be considered equivalent to State DOT if the context so implies. In addition, State Highway Agency (SHA), State Transportation Agency (STA), State Transportation Department, or other similar terms should be considered equivalent to State DOT if the context so implies. ? 635.105 Supervising agency. (a) The State DOT has responsibility for the construction of all Federal-aid projects, and is not relieved of such responsibility by authorizing performance of the work by a local public agency or other Federal agency. The State DOT shall be responsible for insuring that such projects receive adequate supervision and inspection to insure that projects are completed in conformance with approved plans and specifications. The U.S. Department of Transportation Stewardship and Oversight Agreement On Project Assumption and Program Oversight By and Between the Federal Highway Administration (Washington Division) and the Washington State Department of Transportation, states in part: Section XI. State and Local Public Agency Oversight Requirements and Reporting Requirements B. State DOT Oversight of Locally Administered Projects WSDOT provides oversight through their Local Programs Division. This dedicated staff manages the program by providing guidance, training, and technical assistance to the Local Agencies. The Local Agency Guidelines (LAG) manual describes the processes, documents, and approvals necessary to administer federal-aid projects by local transportation agencies. The manual also outlines WSDOT?s oversight and review activities. The Division reviews and approves twice a year the LAG Manual to ensure it complies with FHWA Order 5020.2 (Stewardship and Oversight of Federal-Aid Projects Administered by Local Public Agencies, August 14. 2014). By agreeing to accept federal aid funds, the local agency understands its roles and responsibilities with respect to carrying out the federal aid program. WSDOT is permitted to delegate certain activities, under its supervision, to local agencies (cities, counties, private organizations, or other state agencies) under federal regulation 23 CFR 1.11 and 635.105; however, WSDOT accepts responsibility for delegated activities. WSDOT has a certification process that allows local agencies to administer a federal aid project based on past performance, current staffing, overall capability, and knowledge of FHWA and state requirements. The certification acceptance process is outlined in Chapter 13 of the Local Agency Guidelines Manual (LAG). WSDOT is also required to conduct verification activities to assure that local agency federal aid projects are implemented in conformance with federal aid requirements. WSDOT conducts Project Management Reviews (PMR) to assess whether the certified agency administered the project in accordance with federal aid requirements. A PMR reviews all phases of a project from environmental, consultant services, design, to construction. WSDOT and the Division jointly develop the checklists for the PMRs. The Division includes items identified as part of our risk assessment process and items listed as stewardship indicators. The PMR review is conducted at a minimum every three years on the local agency?s project with the most risk associated with it and the local agency?s certification acceptance is reevaluated. WSDOT has retained some project level approval actions and conducts various reviews such as, construction inspections, billing reviews, and work-zone traffic control reviews. In addition WSDOT conducts documentation and a final inspection on every local agency federal aid project. WSDOT submits annually a Stewardship Report that summaries their verification activities, PMRs, other reviews, and stewardship indicators. The annual Stewardship Report addresses any findings or issues, as well corrective action plans if needed. The Washington State Department of Transportation Local Agency Guidelines Manual (M 36- 63.40 ? June 2021), Chapter 53 ? Project Closure, states in part: 53.3 Project Reviews In order to ensure that local agencies are administering FHWA funded projects in reasonable compliance with FHWA requirements and regulations and the Local Agency Guidelines manual, WSDOT will perform procedural reviews on federal funded local agency ad-and-award projects. Projects will be selected from the available projects awarded to the local agency based upon the assigned risk level documented in the risk assessments performed at the end of each project by the Region LPE. These reviews will be: ? Project Management Reviews (PMR) performed by HQ Local Programs ? CA Agencies must have a PMR performed every three years. (Meaning the HQ Local Program will select a qualifying project from the list of awarded federal projects. The project selection will occur near the beginning of third federal fiscal year cycle and with the actual review occurring near completion of construction.) ? PMRs will be performed in one of two ways, in person file reviews or electronic file reviews. ? Documentation Reviews are performed by the Region Local Programs Engineer with the frequencies of the reviews being based upon the risk assessment performed on each phase of the projects.

2021-009 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction Cluster. CFDA Number and Title: 20.205 Highway Planning and Construction 20.205 COVID-19 Highway Planning and Construction 20.219 Recreational Trails Program 20.224 Federal Lands Access Program Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Washington State Department of Transportation?s (Department) Local Programs Office administers federal funding under the Highway Planning and Construction Cluster to local agencies throughout the state for highway construction projects. The Department spent about $510 million on highway projects during fiscal year 2021. Of that amount, it passed through about $221 million to local agencies through subawards. Pass-through entities are required to monitor the activities of subrecipients in order to ensure they are properly using federal funds. To determine the appropriate level of monitoring, federal regulations require the Department to evaluate each subrecipient?s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. During fiscal year 2021, the Department awarded about $219 million in new subawards to 179 local agencies for 751 construction projects across the state. Department management delegated the responsibility to complete risk assessments for individual projects to the Local Programs Engineers assigned to the regional office that oversees the project. When the Department prepares to monitor or review a subrecipient, it selects an open and active project and evaluates the subrecipient based on its performance under that project. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction Cluster. The prior finding numbers were 2020-014, 2019-016, and 2018-012. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction Cluster. We randomly selected and examined 28 of 344 projects awarded funding during the audit period to determine if the Department performed a risk assessment of each project to determine the appropriate level of monitoring required for the subrecipient. We found the Department did not perform a risk assessment for four of the projects (14 percent). Additionally, four of the risk assessments the Department did perform did not have documented approval from the regional Local Programs Engineer as required. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition Management did not ensure the Department met the federal requirement to perform risk assessments for subrecipients. It did not effectively monitor regional Local Programs Engineers to ensure they completed risk assessments for each subrecipient project awarded program funds. Effect of Condition Not performing risk assessments makes the Department less likely to detect subrecipients? noncompliance with federal regulations and the grant?s terms and conditions. Without verifying the Local Programs Engineers completed risk assessments for each awarded project, the Department cannot ensure it is performing risk assessments consistently and using the proper criteria to determine the appropriate amount of monitoring required for each subrecipient project. Recommendations We recommend the Department: ? Ensure it properly performs and documents the required risk assessments, which would allow management to evaluate the results and demonstrate compliance with federal requirements ? Improve its monitoring of regional Local Programs Engineers to ensure they complete risk assessments for each awarded project receiving federal financial assistance Department?s Response We appreciate the State Auditor's Office (SAO) audit of the Federal Highway Program. WSDOT is committed to ensuring our programs comply with federal regulations and understand it is SAO's point of view that documentation must be maintained in order to verify WSDOT's compliance with the requirement to assess risk to inform our monitoring of local agencies. Prior to the pandemic, headquarters Local Programs management visited region Local Program offices once every six months, dependent on the number of active projects, to meet on emergent topics that included risk assessments. When the Governor issued the Stay Home, Stay Healthy order, regional staff?s focus was redirected to project shut down, safety, and reopening, which slowed completion of some risk assessments. Local Programs meets with regional staff remotely and will work with them on how to improve monitoring of timely risk assessments and improve on the current completion rate of 86% noted above. While every attempt is made to complete a risk assessment on each phase of a project this can be a challenging exercise due to the volume of local agency projects. It is important to note that ?effect of condition? should reflect that the risk assessment is one component of informing oversight activities. The regional staff have direct knowledge of the ?subrecipients? strengths, aptitudes and past performance delivering federal aid projects. The relationships developed individually with each agency and their project personnel is also a meaningful barometer of risk. To further emphasize the importance of risk assessments, Local Programs is working with regional management to modify position descriptions of regional local programs staff to include the timely completion of risk assessments, and this will be incorporated into future performance evaluations. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.331 Requirements for pass-through entities, states in part: All pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-010 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to issue management decisions for audit findings to subrecipients of the Highway Planning and Construction Cluster. CFDA Number and Title: 20.205 Highway Planning and Construction 20.205 COVID-19 Highway Planning and Construction 20.219 Recreational Trails Program 20.224 Federal Lands Access Program Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The Washington State Department of Transportation (Department), Local Programs Office, administers federal funding under the Highway Planning and Construction Cluster to local agencies throughout the state for highway construction projects. The Department spent about $510 million on highway projects during fiscal year 2021. Of that amount, it passed through about $221 million to local agencies through subawards. Federal regulations require the Department to monitor the activities of its subrecipients. This includes verifying that subrecipients that spend $750,000 or more in federal awards during a fiscal year obtain a Single Audit. The audit must be completed and submitted to the Federal Audit Clearinghouse within the earlier of 30 calendar days after receipt of the auditor?s report(s), or nine months after the end of the subrecipient?s audit period. Additionally, for the awards it passes on to subrecipients, the Department must follow up and ensure its subrecipients take timely and appropriate corrective action on all deficiencies detected through audits, onsite reviews and other means. Within six months of the Federal Audit Clearinghouse accepting the audit report, the Department must also issue a management decision for audit findings related to the federal award it provided to the subrecipient. These requirements help ensure the Department and its subrecipients use federal award funds for authorized purposes and within the provisions of contracts or grant agreements. The Local Programs Office communicates annually with all active subrecipients, informing them of the requirement to receive a Single Audit or program-specific audit in accordance with 2 CFR ? 200.501, and to ensure that they promptly transmit a copy of the audit report to the Department. The Local Programs Office also uses a tracking system to identify amounts passed through to subrecipients; to document audit activity for the subrecipients, including the date(s) on which audit reports were due and ultimately received by the Department; and to monitor if subrecipients received Single Audit findings. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure subrecipients received required Single Audits, findings related to federal program awards were followed up on, and management decisions were issued. The prior finding numbers were 2020-015 and 2019-017. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to issue management decisions for Single Audit findings to subrecipients that received Highway Planning and Construction Cluster funding. The Department had seven subrecipients that received Single Audits, which resulted in findings that the Department was required to issue management decisions for during the audit period. We examined the Department?s audit notes and records to determine if it had issued a management decision for these Single Audit findings. We found the Department did not issue management decisions for two of the subrecipients (28 percent) that received findings. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition Management did not ensure the Department met the federal requirement to issue management decisions for Single Audit findings to subrecipients. While the Department did review Single Audit reports filed for its subrecipients, the Local Programs Office did not correctly identify all findings related to its programs that required management decisions. Effect of Condition Not issuing a management decision when required means the Department did not determine the effect of noncompliance on the federal program and did not require subrecipients to correct the identified deficiencies. By failing to ensure subrecipients establish corrective actions and monitor those corrections for effectiveness, the Department cannot determine whether subrecipients have materially complied with all federal requirements that pertain to the subaward. Recommendations We recommend the Department: ? Review all subrecipient audit reports to determine if there are findings related to federal programs ? Follow up on and issue management decisions for all subrecipient audit findings related to the Highway Planning and Construction Cluster ? Ensure subrecipients develop and perform acceptable corrective actions to adequately address all audit recommendations Department?s Response We appreciate the State Auditor's Office (SAO) audit of the Federal Highway Program. The Department is committed to ensuring our programs comply with federal regulations related subrecipient monitoring. Our Local Programs Division had a different understanding of the requirement to issue Management Decision Letters (Decision Letters). We typically issue the Decision Letters to subrecipients that receive single audit findings related to WSDOT federal grant awards. For the subrecipients in question, we assessed risk of noncompliance and elected to forgo a formal Decision Letters when the subrecipient?s response in the audit report reflected corrective action was complete. We understand SAO?s recommendation to issue Decision Letters for all subrecipient single audit findings related to federal grant awards by the Department. Our Local Programs Division will review local agency single audit findings for FY20 that were received during FY 2022, and ensure that they issued all required Decision Letters. We will continue to review all single audits issued for our subrecipient agencies and send Decision Letters based on SAO?s recommendation. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.331 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section ? 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Section 200.339 Remedies for noncompliance, states: If a non-Federal entity fails to comply with the U.S. Constitution, Federal statutes, regulations or the terms and conditions of a Federal award, the Federal awarding agency or pass-through entity may impose additional conditions, as described in ? 200.208. If the Federal awarding agency or pass-through entity determines that noncompliance cannot be remedied by imposing additional conditions, the Federal awarding agency or pass-through entity may take one or more of the following actions, as appropriate in the circumstances: (a) Temporarily withhold cash payments pending correction of the deficiency by the non-Federal entity or more severe enforcement action by the Federal awarding agency or pass-through entity. (b) Disallow (that is, deny both use of funds and any applicable matching credit for) all or part of the cost of the activity or action not in compliance. (c) Wholly or partly suspend or terminate the Federal award. (d) Initiate suspension or debarment proceedings as authorized under 2 CFR part 180 and Federal awarding agency regulations (or in the case of a pass-through entity, recommend such a proceeding be initiated by a Federal awarding agency). (e) Withhold further Federal awards for the project or program. (f) Take other remedies that may be legally available. Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. Section 200.501 Audit requirements, states in part: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single audit conducted in accordance with ? 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) of this section. Section 200.521 Management decision, states in part: (a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements which are required to be reported in accordance with GAGAS. (c) Pass-through entity. As provided in ? 200.332(d), the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) Time requirements. The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. (e) Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with ? 200.516(c). Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-011 The Washington State Department of Transportation did not have adequate internal controls over and did not comply with quality assurance program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed testing for projects funded by the Highway Planning and Construction Cluster. CFDA Number and Title: 20.205 Highway Planning and Construction 20.205 COVID-19 Highway Planning and Construction 20.219 Recreational Trails Program 20.224 Federal Lands Access Program Federal Grantor Name: U.S. Department of Transportation Federal Award/Contract Number: Too numerous to list. All approved subaward projects under the Federal Highway Administration Stewardship and Oversight Agreement. Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Quality Assurance Program Known Questioned Cost Amount: None Background The Washington State Department of Transportation administers federal funding under the Highway Planning and Construction Cluster to local agencies throughout the state for their highway construction projects. The Department spent about $510 million on highway projects during fiscal year 2021. Federal regulations require that the Department have a quality assurance (QA) program, approved by the Federal Highway Administration (FHWA), for construction projects on the National Highway System to ensure that materials and workmanship conform to approved plans and specifications. Verification sampling must be performed by qualified testing personnel employed by the Department or by its designated agent, excluding the contractor. The Department?s QA program requirements are outlined in the Construction Manual, which is approved by the FHWA. This manual documents how materials are tested for acceptance before being incorporated into construction projects. Materials can be accepted in various ways, such as sample testing, a visual inspection documented by the Field Note Record or Inspector?s Daily Report, or a certification of compliance from the manufacturer. If a materials test is required, the Department must ensure that only qualified people perform the testing, including independent testers, consultants or certified Department employees. To ensure that materials incorporated into a project meet approved plans and specifications, the Department prepares a list of prescribed materials to be used on the project based on the approved plans and specifications. The Department uploads this list to a program called the Record of Materials (ROM). The ROM sets forth the materials and quantities that are expected to be used. The ROM also documents the proper acceptance criteria, including any test(s) personnel are required to perform on a material. Once created, Project Engineers responsible for managing the construction project update the ROM to indicate the type and quantity of materials incorporated into the project so management can ensure the materials test(s) that are required for acceptance have occurred. To ensure that only qualified people perform the testing, testers must pass a certification exam, which consists of a written and performance exam. After passing both, the testers are entered into the Qualified Tester Database and are certified for five years, after which they must recertify by passing both exams again. There are two different types of tester qualifications: module and method. Module testers are proficient in multiple method tests that can encompass all method tests for a particular material, whereas method testers may only be proficient in particular tests for any given material. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with QA program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed materials testing for projects funded by the Highway Planning and Construction Cluster. The prior finding numbers were 2020-017 and 2019-019. Description of Condition The Department did not have adequate internal controls over and did not comply with QA program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed testing for projects funded by the Highway Planning and Construction Cluster. Project Engineers did not maintain the ROM for all materials used in projects We used a statistically valid sampling method to randomly select 59 out of 130 federally funded projects that had construction expenditures during the audit period. The Department was unable to provide a comprehensive list of materials used on all projects subject to material acceptance during the audit period, so we randomly selected materials that had been placed and paid for from each project for testing purposes. This produced a sample of 59 materials. For each material, we reviewed the ROM to verify Project Engineers had updated it in accordance with the Construction Manual. Out of the selected materials, we found that Project Engineers did not maintain 14 materials (24 percent) in the ROM in accordance with the Construction Manual. Materials acceptance testing did not conform to standard specifications and the Construction Manual For the 59 randomly selected materials, we requested the supporting documentation for acceptance and/or testing of the material. We found two materials (3 percent) where testing or acceptance did not conform to standard specifications and the Construction Manual. Specifically: ? One material was not tested in accordance with the sampling frequency, and it did not have any material acceptance tests. ? One material acceptance was not properly documented in the Field Note Record or Inspector?s Daily Report. Testing personnel were not properly certified before testing materials We requested and reviewed certification documents for the personnel who performed the testing associated with the 59 randomly selected materials in our audit sample. We found that personnel who were not properly certified tested eight materials (14 percent). Additionally, the Department did not have an effective process for ensuring that testers who did not meet certification requirements were not entered into the database. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Project Engineers did not maintain the ROM for all materials used in projects Management did not ensure Project Engineers were adequately trained in maintaining the ROM. Materials acceptance testing did not conform to standard specifications and the Construction Manual Management did not adequately monitor to ensure required materials testing and acceptance occurred in accordance with the Construction Manual. Testing personnel were not properly certified before testing materials Project Engineers did not ensure tester qualifications were current and management did not ensure tester qualifications were properly entered into the Tester Database. Effect of Condition By not adequately monitoring project materials to ensure they conform to approved plans and specifications, the Department does not have reasonable assurance that materials incorporated into projects conform to standard specifications and the Construction Manual. By not properly verifying and documenting the testers? qualifications, the Department risks improper materials testing. This could result in the Department using materials that may not conform to approved plans and specifications. Recommendations We recommend the Department: ? Improve internal controls to ensure materials incorporated into federal aid projects conform to standard specifications and the requirements outlined in the Construction Manual ? Strengthen its monitoring to ensure Project Engineers accurately and completely maintain the ROM for each project ? Strengthen internal controls to ensure testers have completed all required exams?and that they have proper documentation of passing these exams?before entering them into the Qualified Tester Database ? Continue to review all testers in the Qualified Tester Database to ensure they meet the minimum requirements Department?s Response The Washington State Department of Transportation (WSDOT) appreciates the State Auditor?s Office (SAO) audit of the Federal Highway Program and the federally required Quality Assurance (QA) program. The Department is committed to ensuring our programs continue to comply with federal regulations and recognizes that there are always opportunities for improvement to its QA program. The Department has worked closely with the Federal Highway Administration (FHWA) on our QA program and received feedback from them on the strength of our program. The Department will continue to put improvements in place for the QA program based on the SAO audit recommendations for documenting materials testing and tester certifications. We will also deliver training to Project Engineering Offices to emphasize QA program requirements. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Title 23 U.S. Code of Federal Regulations Part 637, Construction Inspection and Approval establishes the following applicable requirements: Section 637.201 Purpose To prescribe policies, procedures, and guidelines to assure the quality of materials and construction in all Federal-aid highway projects on the National Highway System. Section 637.205 Policy (a) Quality assurance program. Each STD shall develop a quality assurance program which will assure that the materials and workmanship incorporated into each Federal-aid highway construction project on the NHS are in conformity with the requirements of the approved plans and specifications, including approved changes. The program must meet the criteria in (Section 637.207) and be approved by the FHWA. (b) STD capabilities. The STD shall maintain an adequate, qualified staff to administer the quality assurance program. The State shall also maintain a central laboratory. The State?s central laboratory shall meet requirements in (Section 637.209 (a)(2)). (c) Verification sampling and testing. The verification sampling and testing are to be performed by qualified testing personnel employed by the STD or its designated agent, excluding the contractor and vendor. (d) Random samples. All samples used for quality control and verification sampling and testing shall be random samples. Section 637.207 Quality assurance program (a) Each STD?s quality assurance program shall provide for an acceptance program and an independent assurance (IA) program consisting of the following: (1) Acceptance program. (i) Each STD?s acceptance program shall consist of the following: (A) Frequency guide schedules for verification sampling and testing which will give general guidance to personnel responsible for the program and allow adaptation to specific project conditions and needs. (B) Identification of the specific location in the construction or production operation at which verification sampling and testing is to be accomplished. (C) Identification of the specific attributes to be inspected which reflect the quality of the finished product. (ii) Quality control sampling and testing results may be used as part of the acceptance decision provided that: (A) The sampling and testing has been performed by qualified laboratories and qualified sampling and testing personnel. (B) The quality of the material has been validated by the verification sampling and testing. The verification testing shall be performed on samples that are taken independently of the quality control samples. The Department of Transportation Construction Manual (M41-01), Chapter 9: Materials, states in part: 9-1 General The quality of materials used on the project will be evaluated and accepted in various ways, whether by testing of samples, visual inspection, or certification of compliance. This chapter details the manner in which these materials can be accepted Requirements for materials are described in Standard Specifications for Road, Bridge, and Municipal Construction M 41-10 Section 1-06 and Division 9. It is the Project Engineer?s responsibility to accept materials in accordance with this chapter. For materials tests that do not meet specification requirements, the Project Engineer shall contact the State Construction Office which will coordinate with the State Materials Laboratory to determine the appropriate action. 9-1.2C Record of Materials The Project Office utilizes the ROM program to track all permanently incorporated materials that are placed in on the Contract. Temporary materials are also tracked in the ROM when the contract documents contain temporary material requirements. The Project Engineer is responsible for the accuracy of the ROM, other documentation methods used, and Certification of Materials. Acceptance requirements shown in the ROM can be modified by referencing the properly submitted QPL page or the approved Request for Approval of Materials. Reviewing the contract plans and provisions may identify additional materials documentation requirements as well as construction items that shall be added to the ROM and tracked for completion throughout the course of the project work. In order to ensure clarity upon completion of the work and to allow for easy certification of the project by both the Project Engineer and the Region, the ROM needs to be maintained throughout the course of the project. ?Maintained? and ?maintain? means the ROM is updated to reflect materials placed within 30 calendar days of the material payment. This includes material type, make/model, approval, acceptance, field verification documentation, Certificate of Materials Origin and other materials documentation. For materials used in the Contract, the Project Office is required to maintain the Status Work Completed (WC)/Documentation Complete (DC) / Not Used (NU) fields in the ROM. The Project Office is required to maintain quantities paid, quantities placed, quantities field verified for materials that have sampling frequencies, WSDOT Fabrications Inspection items, where the Acceptance Criteria requires quantities such as Manufacturer Certificate of Compliance, or when quantities are noted in the initial materials and acceptance criteria. 9-5.3 WAQTC Testing Technician Qualification Program The Region Independent Assurance Inspectors are responsible for maintaining the Tester Qualification database information for their Region WAQTC Testers as well as maintaining the WAQTC internal certifications and records (physical and digital). 9-5.4 Method Qualified Tester Program The Region Independent Assurance Inspectors are responsible for maintaining the Tester Qualification database information for their Region Method Testers as well as maintaining the Method internal certifications and records (physical and digital).

2021-012 The Department of Social and Health Services did not have adequate internal controls to ensure payments were allowable and properly supported, and did not comply with federal requirements to conduct fiscal monitoring of subrecipients for the Coronavirus Relief Fund. CFDA Number and Title: 21.019 COVID-19 Coronavirus Relief Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Subrecipient Monitoring Known Questioned Cost Amount: None Background In March 2020, Congress passed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). The CARES Act authorized the spending of $2.2 trillion in federal funds to respond to the COVID-19 pandemic. The CARES Act established the Coronavirus Relief Fund (CRF), which authorized $150 billion in federal financial assistance for state, local and tribal governments. Through the CARES Act, Washington was awarded about $2.95 billion of CRF money to help fund the state?s response to the COVID-19 pandemic. Of this amount, the Office of Financial Management allocated about $2.2 billion to state agencies. In fiscal year 2021, state agencies spent approximately $1.7 billion in CRF funds. The CARES Act requires recipients to only use CRF payments to cover: ? Necessary expenditures incurred due to COVID-19; ? Costs that were not accounted for in governments? most recently approved budget as of March 27, 2020; and ? Costs that were incurred during the period that began on March 1, 2020, and ended on December 31, 2021. The Department of Social and Health Services (Department) is Washington?s lead agency for providing state-funded social services. In fiscal year 2021, the Department spent approximately $224.6 million in CRF funds. The Department?s Economic Services Administration spent more than $126 million (56 percent) of this CRF money to implement and administer the Washington Immigrant Relief Fund, which provided financial assistance to people excluded from federal stimulus payments and unemployment benefits due to their immigration status. During the audit period, the Department allocated CRF money to four subrecipients for the Washington Immigrant Relief Fund. Two of these subrecipients received about $124.3 million (98 percent) to provide a one-time $1,000 payment to about 120,853 clients. Federal regulations require the Department to monitor the activities of its subrecipients to ensure they use subawards for authorized purposes and that activities achieve performance goals and comply with terms and conditions of the subaward. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure payments were allowable and properly supported, and did not comply with federal requirements to conduct fiscal monitoring of subrecipients for the CRF. When the Department approved subrecipient payments, it required high-level supporting documentation to ensure the expenditures met the CRF?s allowability requirements. The Department also performed fiscal monitoring to ensure subrecipients only used federal funds for allowable purposes and that expenditures met cost principles. The Department had a fiscal monitoring plan for its two subrecipients that administered the client payments, which included reviewing client eligibility. We found that for one subrecipient (50 percent), the Department did not have documentation to support that it had performed fiscal monitoring to ensure the subrecipient only made payments to eligible clients. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not ensure adequate internal controls were in place to monitor the subrecipient?s eligibility determinations for clients receiving CRF money. While the Department requested the subrecipient provide the required information so it could review client eligibility, the subrecipient did not respond and management did not ensure that it had received and reviewed this list. Effect of Condition By not monitoring one of the subrecipients, the Department did not have assurance that approximately 61,750 clients were eligible to receive the one-time payments. Without establishing adequate internal controls, the Department cannot reasonably ensure subrecipients are only distributing federal funds to eligible clients. Without monitoring each subrecipient?s use of federal funds, the Department does not have reasonable assurance that its subrecipients have complied with the terms and conditions of the subaward. Recommendations We recommend the Department: ? Implement additional monitoring procedures to ensure adequate review of subrecipients? use of federal subawards ? Improve internal controls to ensure subrecipients provide adequate supporting documentation when requesting reimbursement Department?s Response The Department partially concurs with the auditor?s finding. The Department does not concur that we required ?high-level? supporting documentation to ensure the expenditures met the CRF?s allowability requirements. As part of the eligibility process, the subrecipient performed the eligibility determination which included verification of immigration status and self-attestations that the client had not received a federal stimulus payment or unemployment benefits. The subrecipient then provided the Department with a list of eligible clients and supporting documentation. To protect client confidentiality, the Department assigned each client a unique client identifier and redacted their personally identifying information. When the Department approved subrecipient payments, we required supporting documentation that included the unique client identifier, some demographic information, and the check number. The unique client identifier cross-matched to the list of eligible clients allowing the Department to ensure the expenditures met the CRF?s allowability requirements. The Department concurs that for one of the subrecipients, we did not have documentation to support we had performed fiscal monitoring. The Department requested the subrecipient provide the required information to review client eligibility, but found the subrecipient to be noncompliant with providing the data. To ensure adequate review of subrecipients? use of federal subawards, the Department will update monitoring procedures to: ? Ensure contracts and monitoring plans clearly identify the required supporting documentation; ? Establish procedures for corrective action in situations of noncompliance with contract requirements and monitoring plan expectations; and ? Include language in the contract covering expectations for the subrecipient to provide adequate information prior to reimbursement. Auditor?s Remarks As acknowledged in its formal response, the Department did not perform fiscal monitoring for one subrecipient and did not obtain required documentation to support one-time payments for 61,750 clients. We reaffirm our finding and review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action of all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (g) Consider whether the results of the subrecipient?s audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity?s own records. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-013 The Department of Commerce did not have adequate internal controls over and did not comply with federal requirements to conduct fiscal monitoring of subrecipients and ensure payments were allowable and properly supported for the Coronavirus Relief Fund. CFDA Number and Title: 21.019 COVID-19 Coronavirus Relief Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Subrecipient Monitoring Known Questioned Cost Amount: $4,124,518 Background In March 2020, Congress passed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). The CARES Act authorized the spending of $2.2 trillion in federal funds to respond to the COVID-19 pandemic. The CARES Act established the Coronavirus Relief Fund (CRF), which authorized $150 billion in federal financial assistance for state, local and tribal governments. Through the CARES Act, Washington was awarded about $2.95 billion of CRF money to help fund the state?s response to the COVID-19 pandemic. Of this amount, the Office of Financial Management allocated about $2.2 billion to state agencies. In fiscal year 2021, state agencies spent approximately $1.7 billion in CRF funds. The CARES Act requires recipients to only use CRF payments to cover: ? Necessary expenditures incurred due to the COVID-19 pandemic; ? Costs that were not accounted for in governments? most recently approved budget as of March 27, 2020; and ? Costs that were incurred during the period that began on March 1, 2020, and ended on December 31, 2021. The Department of Commerce (Department) administers the Small Business Assistance, Rental Assistance and Local Government Assistance programs. These programs subawarded federal funds to subrecipients to provide COVID-19 pandemic assistance in Washington. In fiscal year 2021, the Department spent approximately $983.1 million in CRF money. The Small Business Assistance program spent more than $366 million, the Rental Assistance program spent more than $101 million, and the Local Government Assistance program spent more than $404 million. During the audit period, the Small Business Assistance, Rental Assistance and Local Government Assistance programs allocated CRF money to 376 total subrecipients. The Small Business Assistance program had 40 subrecipients, the Rental Assistance Program had 48 subrecipients, and the Local Government Assistance program had 288 subrecipients. Federal regulations require the Department to monitor the activities of its subrecipients to ensure they use subawards for authorized purposes and that activities achieve performance goals and comply with the terms and conditions of the subaward. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to conduct fiscal monitoring of subrecipients and ensure payments were allowable and properly supported for the CRF. When the Department approved subrecipient payments, it required high-level supporting documentation and a certification attesting that the expenditures met the CRF?s allowability requirements and occurred within the award?s period of performance. To determine if the expenditures were for allowable activities, we examined subrecipient payments for the three assistance programs. For the Rental Assistance program, we used a statistical sampling method to randomly select and examine 55 out of a total population of 473 payments, in addition to two individually significant payments. We found six payments (11 percent) did not have adequate documentation to support the request. Additionally, the Department did not provide any documentation for two of the payments. For the Local Government Assistance program, we used a statistical sampling method to randomly select and examine 57 out of a total population of 764 payments. We found one payment (2 percent) did not have adequate documentation to support the total payment amount. Fiscal Monitoring of Subrecipients To determine if the Department performed adequate fiscal monitoring for its subrecipients, we examined monitoring activity for the three assistance programs. For the Small Business Assistance program, we randomly selected 12 out of a total population of 40 subrecipients. We determined the Department did not perform fiscal monitoring for any of the 12 subrecipients (100 percent) during the audit period. For the Rental Assistance program, we randomly selected 11 out of a total population of 48 subrecipients. We determined the Department did not perform fiscal monitoring for any of the 11 subrecipients (100 percent) during the audit period. For the Local Government program, we randomly selected 25 out of 288 subrecipients. We determined the Department did not perform fiscal monitoring for 11 subrecipients (44 percent) during the audit period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not ensure that proper internal controls were in place to oversee the CRF-funded programs. Additionally, Department staff approved payments to subrecipients even when the underlying support did not match the amount requested. Management also said that they did not have the resources to perform adequate fiscal monitoring. Effect of Condition and Questioned Costs We determined the Department did receive adequate supporting documentation before paying subrecipients, and it did not establish adequate fiscal monitoring to ensure that expenditures were for allowable activities. As a result, we identified the following questioned costs: Program Known Questioned Costs Know and Likely Questioned Costs Rental Assistance $3,524,518 $3,844,929 Local Government Assistance $600,000 $2,563,636 In total, we identified $4,124,518 in known federal questioned costs and $6,408,565 in likely federal questioned costs. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs? as required by 2 CFR 200.516(3). To ensure a representative sample, we stratified both populations by dollar amount. Without establishing adequate internal controls, the Department cannot reasonably ensure it is using federal funds for allowable purposes and spending occurs within the allowed period of performance. Without monitoring each subrecipient?s use of federal funds, the Department does not have reasonable assurance that the subrecipient has complied with the terms and conditions of the subaward. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Implement additional monitoring procedures to ensure adequate review of each subrecipient?s use of the federal subaward ? Improve internal controls to ensure subrecipients provide adequate supporting documentation when requesting reimbursement ? Consult with the grantor to determine whether the questioned costs identified in the audit should be repaid Department?s Response Local Government Program For the Coronavirus Relief Fund program, the Local Government Program maintained a process in place to reimburse subrecipients after costs were incurred and supporting documentation was reviewed and approved. During the audit, it was determined that an error was made in processing one reimbursement request in the amount of $600,000. Our internal policies were not followed and a payment was made on a commitment of funds to the local Chamber of Commerce. Payments should not have been made on a commitment of funds, but only for actual incurred costs. We have followed up with Franklin County on this error and have confirmed that the funds were fully expended during the period of performance toward eligible uses of the funds. We reviewed an expenditure detail report which showed all costs charged to this payment and determined all costs charged were for allowable expenses. Considering the circumstances under which these funds were administered, Commerce feels strongly that its internal controls were sufficient and effective given the rapid timeline, the volume of subrecipients and funding, and staffing capacity, all of which needed to be managed during the peak of the pandemic. Over the course of a seven month sprint (June 2020 through December 2020), approximately $406 million was expended by 292 counties, cities, and towns. This was all accomplished through a small team of five staff, mostly new to state employment, who successfully learned, managed and supported these subrecipients and funds under the most challenging of circumstances. Considering the amount of funds disbursed, the small team effectively and efficiently managed the program and expenditures. This program had a large impact on supporting citizens and we are proud of the support we provided to subrecipients who disbursed funds to citizens. Rental Assistance Program The Coronavirus pandemic resulted in an unprecedented crises of imminent evictions for an estimated 200,000 households who would face homelessness during the pandemic. Prompt implementation was critical to reducing evictions and homelessness was shown to increase the spread of COVID-19 leading to death. Every week of delay would increase the number of people at risk of dying. At the time the Department received the CARES Act funds for rental assistance, we were in current contracts with grantees for the same activity for whom we had completed risk assessments and monitoring plans 12 months prior. We relied on those risk assessments to comply with CARES Act requirement so staff could focus on ensuring that racial equity measures were met and that people disproportionally impacted during the pandemic had priority access to assistance. This included reviewing voucher detail reports for grantees with subcontractors and reviewing demographic data each month. In addition, when we first received the CARES Act funds (August 2020) the program was ending in December 2020 when the CARES Act funds were set to expire. It was not until late December 2020 that Congress extended the end date and we were informed we could continue to fund the program into 2021. Our priorities for those initial five months were to maximize administrative efficiencies by relying on current risk assessments so staff could support counties in expanding programs to assist as many households as possible before evictions were issued. We thank the Washington State Auditor?s Office for their cooperation with the Department and the CRF programs during this audit. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action of all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (g) Consider whether the results of the subrecipient?s audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity?s own records. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-014 The Office of Financial Management did not have adequate internal controls over and did not comply with reporting requirements for the Coronavirus Relief Fund. CFDA Number and Title: 21.019 COVID-19 Coronavirus Relief Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background In March 2020, Congress passed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). The CARES Act authorized the spending of $2.2 trillion in federal funds to respond to the COVID-19 pandemic. The CARES Act established the Coronavirus Relief Fund (CRF), which authorized $150 billion in federal financial assistance for state, local and tribal governments. Through the CARES Act, Washington was awarded about $2.95 billion of CRF money to help fund the state?s response to the COVID-19 pandemic. The Office of Financial Management (Office) is the prime recipient and allocated $2.2 billion to state agencies. In fiscal year 2021, state agencies spent about $1.7 billion in CRF funds. The Office was required to submit quarterly Financial Progress Reports (FPR) that contained COVID-19-related costs incurred during the covered period of March 1, 2020, to December 31, 2021. The FPRs were due no later than 10 days after each calendar quarter, except for the first quarter deadline of September 21, 2020, and the second quarter deadline of October 12, 2020. The FPR submissions should be supported by the data in the state?s accounting system. The federal grantor specified there were four key line items on FPRs that contained critical information. 1) The total amount of CRF payments received from the U.S. Department of the Treasury. 2) The amount of funds received that were expended or obligated for each project or activity. 3) A detailed list of all projects or activities for which funds were expended or obligated. 4) Detailed information on any loans issued, contracts and grants awarded, transfers made to other government entities, and direct payments made by the prime recipient that are greater than $50,000. For amounts less than $50,000, the prime recipient must report in the aggregate for these expenditure categories. For direct payments to people, the prime recipient must report in the aggregate regardless of the amount. The Office was responsible for compiling this information from state agencies that spent CRF funds during the reporting period. In state fiscal year 2021, state agencies spent over $1.7 billion of CRF funds, with the Department of Social and Health Services (DSHS) and the Department of Commerce (Commerce) accounting for over $1.2 billion (70 percent) of these expenditures. Federal regulations require the Office to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding reporting requirements, retaining source data, and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and did not comply with reporting requirements for the CRF. During the audit period, the Office submitted four FPRs. It also submitted a fifth FPR, which reported on activity during the audit period, shortly after the end of the audit period. At the end of each quarter, Office staff sent an Excel template that mirrored the key line items to state agencies with CRF expenditures in the reporting period. The agencies completed and sent the template back to the Office along with detailed expenditure reports from their accounting systems to support the information they provided in the template. Office staff reviewed this information and consolidated it into one state-level template to complete the FPR submission. We examined all five FPRs the Office submitted. Our examination focused on DSHS and Commerce?s expenditures because they accounted for 70 percent of CRF expenditures. To examine the accuracy of the FPRs, we reviewed the agency and state-level templates and accounting records. The Office was not able to provide any of the five state-level templates and expenditure reports, but was able to provide some of the templates and expenditure reports that DSHS and Commerce submitted. We found that the templates and accounting records did not support the information the Office reported on the FPRs. We also found the Office?s process for preparing the report was inadequate for allowing staff to compile all the necessary information and submit the FPRs by 10 days after each quarter had ended. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Office staff responsible for gathering and preparing the FPRs left the Office in late fall of 2021, and management did not ensure staff retained the supporting documentation. Because the Office could not provide the templates or expenditure reports, we could not fully identify the source of the errors. Effect of Condition Because the Office did not establish adequate internal controls to ensure staff retained the proper supporting documentation after submitting the reports, we cannot conclude whether the FPRs were accurate and complete. Since the Office did not have these records, we contacted DSHS and Commerce directly to obtain copies in order to perform compliance testing. DSHS and Commerce were able to provide us with some of the templates. Key Line Items 2 & 3 We relied on the agency templates to determine if these key line items were accurate and complete. Below is a summary of the templates we received. Templates Received DSHS Commerce Cycle 1 N/A (no expenditures) No Cycle 2 No No Cycle 3 Yes Yes Cycle 4 Yes No Cycle 5 Yes No Since we did not receive all agency templates, we could not determine whether four of the five (80 percent) FPRs accurately reported key line items 2 and 3. Key Line Item 4 Based on available accounting records, we determined the following discrepancies in transfers to other government entities recorded under key line item 4: DSHS Reported Amount DSHS Accounting Record Amount DSHS Discrepancy Details Cycle 4 $33,989,544 $35,070,297 $(1,080,753) Underreported Cycle 5 $(448,491) $(201,703,775) $201,255,284 Overreported Commerce Reported Amount Commerce Accounting Record Amount Commerce Discrepancy Details Cycle 2 $48,597,567 $0 $48,597,567 No expenditure report provided Cycle 4 $86,342,417 $87,540,211 ($1,197,794) Underreported Cycle 5 $9,915,883 $11,790,642 ($1,874,759) Underreported Furthermore, for all five FPRs, we could not determine if amounts less than $50,000 were accurate since they were an aggregate total of all state agencies and we did not receive the state-level templates that the Office used to compile this information. Lastly, we determined the Office submitted two FPRs after the grantor?s due date: Number of Days Past Due Cycle 3 9 Cycle 5 3 Recommendations We recommend the Office: ? Improve its internal controls to ensure accounting records properly support the FPRs ? Ensure staff retain adequate documentation after FPRs have been submitted ? File future FPRs in compliance with timelines the grantor has established ? Consult with the federal grantor to determine if a revision and resubmission of the FPRs is necessary Office?s Response The Office concurs with the finding. It should be noted that when the Coronavirus Relief Fund (CRF) was provided to the state with limited guidance, the Office exercised due diligence and prudence in administering and allocating the federal funds needed to respond to the pandemic. Additionally, for the time period in question, the employee responsible for gathering and compiling the reporting data left the Office. Numerous unsuccessful attempts were made to locate the documentation from the employee?s electronic work files to support the data uploaded into the federal system. The Office is in the process of strengthening internal controls to ensure compliance with the CRF reporting requirements. The Office?s Statewide Accounting Division took over the primary responsibility for CRF reporting. A full time staff was hired who now oversees the reconciliation, compilation and reporting of CRF. The Office is also closely monitoring all state agencies that received CRF to ensure the amounts reported are accurate and properly supported. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Tread way Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. Office of Management and Budget, 2 CFR Part 200, Appendix XI, 2021 Compliance Supplement, for Assistance Listing 21.019 Coronavirus Relief Fund, states in part: L. Reporting 3. Special Reporting a. Each prime recipient of the Fund shall provide a quarterly Financial Progress Report that contains COVID-19 related costs incurred during the covered period (the period beginning on March 1, 2020; and ending on December 31, 2021) to Treasury OIG. Each prime recipient shall report this quarterly information mentioned above into the GrantSolutions portal. The prime recipient?s quarterly Financial Progress Report submissions should be supported by the data in the prime recipient?s accounting system. Key Line Items ? The following line items from the reporting contain critical information: (1) The total amount of payments from the Fund received from Treasury. (2) The amount of funds received that were expended or obligated for each project or activity. (3) A detailed list of all projects or activities for which funds were expended or obligated, including: a. The name of the project or activity b. A description of the project or activity (4) Detailed information on any loans issued; contracts and grants awarded; transfers made to other government entities; and direct payments made by the prime recipient that are greater than $50,000. For amounts less than $50,000, the prime recipient must report in the aggregate for these expenditure categories. For direct payments to individuals, aggregate reporting is required to be reported regardless of amount. b. Beginning September 21, 2020, prime recipients were required to submit via the GrantSolutions portal the first detailed quarterly Financial Progress Report, which cover the period March 1 through June 30, 2020 (with exception to the September 21 first quarter deadline and the October 13 second quarter reporting deadlines for those prime recipients using GrantSolutions? upload feature, which was available December 1, 2020). Thereafter, quarterly reporting will be due no later than ten days after each calendar quarter. If the 10th calendar day falls on a weekend or a federal holiday, the due date will be the next working day. Reporting shall end with either the calendar quarter after the COVID-19 related costs and expenditures have been liquidated and paid or the calendar quarter ending September 30, 2022, whichever comes first. The prime recipient?s quarterly Financial Progress Report submission should be supported by the data in the prime recipient?s accounting system. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, and paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-015 The Department of Social and Health Services did not have adequate internal controls over and did not comply with federal requirements to ensure subawards contained all required information and subrecipients received risk assessments for the Coronavirus Relief Fund. CFDA Number and Title: 21.019 COVID-19 Coronavirus Relief Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background In March 2020, Congress passed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). The CARES Act authorized the spending of $2.2 trillion in federal funds to respond to the COVID-19 pandemic. The CARES Act established the Coronavirus Relief Fund (CRF), which authorized $150 billion in federal financial assistance for state, local and tribal governments. Through the CARES Act, Washington was awarded about $2.95 billion of CRF money to help fund the state?s response to the COVID-19 pandemic. Of this amount, the Office of Financial Management allocated about $2.1 billion to state agencies. In fiscal year 2021, state agencies spent approximately $1.7 billion in CRF funds. The Department of Social and Health Services (Department) is Washington?s lead agency for providing state-funded social services. In fiscal year 2021, the Department spent approximately $225 million in CRF funds. The Department?s Economic Services Administration spent more than $126 million (56 percent) of this CRF money to create and administer the Washington COVID-19 Immigrant Relief Fund, which provided financial assistance to people excluded from federal stimulus payments and unemployment benefits due to their immigration status. Federal law (2 CFR 200.332) requires pass-through entities to include certain information in all of their subawards. This includes information about the federal award the pass-through entity received, details about the subaward being awarded, and clearly identifying the recipient as a subrecipient. Pass-through entities must also monitor the activities of subrecipients to ensure they are properly using federal funds. To determine the appropriate level of monitoring, federal regulations require the Department to evaluate each subrecipient?s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure subawards contained all required information and subrecipients received risk assessments for the CRF. During the audit period, the Department executed six CRF contracts related to the Washington COVID-19 Immigrant Relief Fund. We found all six contracts (100 percent) were missing the following required information: ? Subrecipient?s unique entity identifier ? Federal Award Identification Number (FAIN) ? Subaward budget period start and end date ? Assistance Listing Number and title; the pass-through entity must identify the dollar amount made available under each federal award and the Assistance Listing Number at time of disbursement ? Indirect cost rate for the federal award Additionally, five of the six subawards (83 percent) did not identify the recipient as a subrecipient as required by federal regulations. We also found the Department did not perform a risk assessment for any of the six subrecipients (100 percent). We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department has policies in place to ensure it includes all required subaward language in subrecipient contracts and completes risk assessments. However, the speed of the contracting process and lack of experience with this type of contracting and subrecipient monitoring requirements created confusion and missed practices within the Department. As a result, the Department did not follow its established policies to ensure it included all required elements in the subrecipient contracts and completed risk assessments. Management also did not provide sufficient oversight to ensure the Department complied with federal regulations. Effect of Condition By not following established policies, the Department cannot ensure it is compliant with subrecipient monitoring requirements. By not clearly identifying subaward recipients as subrecipients, the Department cannot ensure the subrecipients are adequately informed of the program requirements. Additionally, without evaluating risk, the Department cannot ensure each subrecipient receives the appropriate level of monitoring, which makes it less likely the Department would be able to detect subrecipients? noncompliance with federal regulations and the subaward?s terms and conditions Recommendations We recommend the Department: ? Follow its established policies and procedures to ensure it includes all required information in subawards ? Follow established policies and procedures to ensure it performs required risk assessments ? Ensure staff responsible for executing contracts understand subrecipient classifications Department?s Response The Department concurs with the finding. The Washington COVID-19 Immigrant Relief Fund was a new program administered at the request of the Governor?s Office with a budget of $40 million and an expedited timeline for implementation due to the pandemic. In response to the Governor?s request, the Department?s Office of Refugee and Immigrant Assistance (ORIA), under the Community Services Division (CSD), partnered directly with the Department?s Central Contracts and Legal Services (CCLS) to ensure the contract was legally and technically appropriate. The ORIA program did not have a lot of experience with this kind of contracting or the required subrecipient monitoring knowledge. ORIA did not utilize CSD?s internal contracts unit for how to monitor the contract and as a result, the program did not clearly identify the Washington COVID-19 Immigrant Relief Fund subawards as subrecipients, did not include all of the required subrecipient special terms and conditions in the subawards, and did not complete risk assessments on the subrecipients. To ensure future compliance with subrecipient monitoring requirements, the program will: ? Work directly with the CSD Contracts Unit through the entire contracting process from pre-contract to post contract execution. ? Review department policies and procedures covering subrecipient roles and responsibilities. ? Complete the appropriate refresher training. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: 1) Federal award identification. i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient?s unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in ?200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated to the subrecipient by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listing number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listing number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per ?200.414. 2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; 3) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; 4) i. An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the pass-through entity must determine the appropriate rate in collaboration with the subrecipient, which is either: A. The negotiated indirect cost rate between the pas-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass-through entity is not required to collect information justifying this rate, but may elect to do so; B. The de minimis indirect cost rate. ii. The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with ?200.405(d). 5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipients records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and 6) Appropriate terms and conditions concerning closeout of the subaward. (b) Evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for the purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1) The subrecipient?s prior experience with the same or similar subawards; 2) The result of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; and 4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also received Federal awards directly from a Federal awarding agency). Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Federal Register / Vol. 86, No. 10, Department of the Treasury, Coronavirus Relief Fund for States, Tribal Governments, and Certain Eligible Local Governments, states in part: Fund payments are considered to be federal financial assistance subject to the Single Audit Act (31 U.S.C. 7501? 7507) and the related provisions of the Uniform Guidance, 2 CFR 200.303 regarding internal controls, ??200.330 through 200.332 regarding subrecipient monitoring and management, and subpart F regarding audit requirements. Department of Social and Health Services Administrative Policy No. 13.10, Central Contracts and Legal Services (CCLS), states in part: 1. CCLS is responsible for: a. Establishing and ensuring compliance with statewide agency contracting law, policies and procedures concerning contracts subject to this policy. b. Administering the agency contracts database (ACD). c. Providing guidance, consultation, and technical assistance to administrations related to contract management practices in order to ensure compliance with applicable contracting law, regulations, policies, and procedures. d. Coordinating the development of and controlling general terms and conditions for all DSHS contracts and approving any modifications to the general terms and conditions. e. Creating and approving contract formats for use by authorized DSHS staff in developing contracts subject to this policy. 5. DSHS key contract coordinators are responsible for providing guidance and support to staff in their Administrations and: a. Ensuring the general terms and conditions developed by CCLS are incorporated into all DSHS contracts. b. Ensuring administration contracts subject to this policy are developed in accordance with this policy. c. Drafting, in collaboration with CCLS, preapproved and semi-custom contracts for final approval by CCLS. Department of Social and Health Services Administrative Policy No. 13.11, Monitoring Contractor Performance, states in part: A. Monitoring client service contracts, professional (personal) service contracts, operational (purchased) service contracts, data sharing agreements, and interlocal agreements. Administrations must: 1. Require staff who monitor contractor performance to complete all relevant CCLS contract academy and DES Procurement training courses. 2. Conduct a risk assessment for each individual contract. Risk Assessments must include, at a minimum, the following contactor and contract core risk factors: a. Contactor experience: The measurement of risk associated with the experience of the contractor in providing the services for which the contract is written. b. Performance history: The measurement of risk associated with compliance issues that resulted in known audit findings, litigations, revoked licenses, terminations for default, or corrective actions against the contractor. c. Multiple contracts and funding: The measurement of risk associated with the number of different funding sources, including other contracts with other programs within the department or other state agencies. d. Subcontracting of services: The measurement of risk associated with a contractor subcontracting our key activities and their ability to monitor the subcontractor?s performance.

2021-016 The Department of Commerce did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Coronavirus Relief Fund received risk assessments. CFDA Number and Title: 21.019 COVID-19 Coronavirus Relief Fund Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: None Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background In March 2020, Congress passed the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). The CARES Act authorized the spending of $2.2 trillion in federal funds to respond to the COVID-19 pandemic. The CARES Act established the Coronavirus Relief Fund (CRF), which authorized $150 billion in federal financial assistance for state, local and tribal governments. Through the CARES Act, Washington was awarded about $2.95 billion of CRF money to help fund the state?s response to the COVID-19 pandemic. Of this amount, the Office of Financial Management allocated about $2.1 billion to state agencies. In fiscal year 2021, state agencies spent approximately $1.7 billion in CRF funds. The Department of Commerce (Department) used CRF funds to administer the Small Business Assistance, Rental Assistance and Local Government Assistance programs. These programs passed through federal funds to subrecipients that provided COVID-19 pandemic assistance in Washington. In fiscal year 2021, the Department spent approximately $983.1 million in CRF funds. The Small Business Assistance program spent over $366 million, the Rental Assistance program spent over $101 million, and the Local Government Assistance program spent over $404 million in fiscal year 2021. Pass-through entities are required to monitor the activities of subrecipients to ensure they use federal funds properly. To determine the appropriate level of monitoring, federal regulations require the Department to evaluate each subrecipient?s risk of noncompliance with federal statues, regulations and the terms and conditions of the subaward. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure CRF subrecipients received risk assessments. During the audit period, the Small Business Assistance, Rental Assistance, and Local Government Assistance programs allocated CRF money to 376 total subrecipients. The Small Business Assistance program had 40 subrecipients, the Rental Assistance Program had 48 subrecipients, and the Local Government Assistance program had 288 subrecipients. Our audit found the Department did not ensure all subrecipients received required risk assessments applicable to the CRF. The Local Government Assistance program completed risk assessments for the new CRF money going to its subrecipients. However, the Small Business Assistance and Rental Assistance programs did not complete new risk assessments for their existing subrecipients that received CRF money. Instead, the Small Business Assistance program relied on risk assessments completed in 2017 for 37 of their existing subrecipients. The remaining three subrecipients were new, and the program did not complete risk assessments for them. The Rental Assistance program relied on risk assessments completed in 2019 for its existing subrecipients. In both cases, the risk assessments occurred before the Department received CRF money and, therefore, did not consider any of the risk factors related to the program. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition For the Small Business Assistance and Rental Assistance programs, Department management said they believed relying on prior subrecipient risk assessments was sufficient to comply with the federal requirement. Effect of Condition We determined the Department did not perform risk assessments in accordance with federal requirements for all 88 CRF subrecipients for the Small Business Assistance and Rental Assistance programs. These subrecipients accounted for 23 percent (88 out of 376) of all subrecipients for the CRF program. Without performing new risk assessments of subrecipients that received CRF funding, which the federal government has classified as a program of higher risk, the Department cannot determine the appropriate amount of monitoring required for each subrecipient. Not performing new risk assessments also makes the Department less likely to detect subrecipients? noncompliance with federal regulations and the subaward?s terms and conditions. Recommendations We recommend the Department: ? Establish procedures to ensure it performs risk assessments for all subawards it issues ? Monitor to ensure staff perform required risk assessments Department?s Response Small Business Assistance Program As the pandemic spread, the Office of Economic Development & Competitiveness (OEDC) pivoted its operations to meet the needs of small businesses affected by phased orders and public health concerns. This new body of work included new tools and programs to help existing small businesses survive and rebuild in the economic recovery phase as well as start anew, either as a current business owner or as an entrepreneur. This included expanding our traditional book of business, from providing technical assistance and services to businesses, to providing State and Federal funded Working Washington grants, which provided stop-gap assistance to thousands of businesses across the state. Overall the OEDC Pandemic response work included: ? Round One: $10 million, supported 1,508 businesses. (State Funding) ? Round Two: $10 million, supporting 1,574 businesses. (Federal CRF) ? Round Three: $100 million, supporting 7,931 businesses. (Federal CRF) ? Round Four: $240 million, supporting 11,727 businesses. (Federal CRF) ? Resiliency Round: $18 million; supported 2,646 small businesses. (Federal CRF) ? Awarding $300,000 in relief grants to 43 shellfish growers. (State Funding) ? Grants for craft beverage establishments, shellfish growers, farmers markets and agritourism: $16 million, supported 839 small businesses. ? Creating the state?s Economic Recovery Dashboard. ? Developing a new $30 million Revolving Loan Fund for small businesses. (Federal CRF) ? Securing a $15 million federal grant from the EDA for a package of Safe Start projects. ? Coordinating the production of PPE supplies when hundreds of manufacturers answered Governor Inslee?s call to retool to make PPE. Commerce staff and loaned executives from Impact Washington helped these companies pivot to produce everything from hand sanitizer to face shields and masks. ? Expanding ScaleUp program to provide free training and support to 230 small businesses trying to navigate the pandemic. ? Creating a COVID Business Planner to help businesses scale or suspend operations in response to phased health orders as well as resiliency planning for eventual reopening. ? Revamping Commerce?s small business website to focus on COVID-related content and expanded disaster planning and COVID specific content on Commerce?s website. ? Pivoting more than 30 staff members in Commerce to manage and process Working Washington grants, including reviews of tens of thousands of applications and processing payments to recipients and answering several thousand calls and emails from small business owners and nonprofits. ? Creating and conducting dozens of virtual export webinars and B2B meetings to help businesses maintain growth through successful exporting strategies. The OEDC took on an immense amount of programs and work during Federal fiscal year 2021. The additional programs impacted our only 28 employees. We had an all hands on deck approach to get the more than $439 Million in state and federal funding out for small business assistance to well over 23,000 businesses. All of this was performed while still maintaining our traditional services. In addition, time was of the essence as there were federal deadlines for getting funding out to communities. In some cases as with Working Washington 3 and the Resiliency Round of funding we had less than 45 days to develop program guidance, market, and award $270 million dollars. This was an extreme challenge for our staff; however, we were able to meet it, to serve our small businesses in Washington State. Due to staffing and timing constraints the OEDC relied on our prior risk assessments from the Associate Development Organizations (ADO), and working knowledge of our subrecipients National Development Council dba CDP Washington, and Submittable. However, the OEDC Director, Deputy Director, Contracts Manager and Small Business Grants Director maintained daily communication with all subrecipients through email and phone to ensure we were monitoring all activity occurring by and through the subrecipients. The OEDC Director, Deputy Director, Contracts Manager and Small Business Grants Director worked one-on-one with Subrecipient staff to ensure compliance with federal guidelines for the funding, and as the CFR funding program was new to all parties and did not come with much federal guidance if any, and we deemed it imperative we provided daily guidance to the subrecipients to meet all expectations as set forth from general federal grant award guidance, their contract and the OEDC program policies established. The quick implementation of these programs meant our traditional risk assessment vetting was not completed, and all on-site monitoring traditionally done for Federal funded awards was unable to occur. Due to the funds moving quickly, we relied on daily and weekly progress reports, application reviews, award reports, and other backup documentation for monitoring our subrecipients. If more time had been available we would have had the opportunity to perform in traditional ways, with risk assessments, prior to contracting our federal funding and on-site monitoring of our subrecipient files and fiscal documentation. The OEDC has set up a Corrective Action Plan for moving forward in traditional and non-traditional funding occurrences that may arise in the future. Rental Assistance Program The Coronavirus pandemic resulted in an unprecedented crises of imminent evictions for an estimated 200,000 households who would face homelessness during the pandemic. Prompt implementation was critical to reducing evictions and homelessness was shown to increase the spread of COVID-19 leading to death. Every week of delay would increase the number of people at risk of dying. At the time the Department received the CARES Act funds for rental assistance, we were in current contracts with grantees for the same activity for whom we had completed risk assessments and monitoring plans 12 months prior. We relied on those risk assessments to comply with CARES Act requirement so staff could focus on ensuring that racial equity measures were met and that people disproportionally impacted during the pandemic had priority access to assistance. This included reviewing demographic data each month and engaging outreach teams to reach underserved and marginalized populations. In addition, when we first received the CARES Act funds (August 2020) the program was ending in December 2020 when the CARES Act funds were set to expire. It was not until late December 2020 that congress extended the end date and we were informed we could continue to fund the program into 2021. Our priorities for those initial five months were to maximize administrative efficiencies by relying on current risk assessments so staff could support counties in expanding programs to assist as many households as possible before evictions were issued. We thank the Washington State Auditor?s Office for their cooperation with the Department and the CRF programs during this audit. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (b) Evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient?s prior experience with the same or similar subawards: (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (if the subrecipient also receives Federal awards directly from a Federal awarding agency). Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Office of Management and Budget?s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards: 2 CFR 200 ? Frequently Asked Questions, states in part: 200.331-10 Requirements for Pass-Through Entities. Timing of Subrecipient Risk Assessments Section 200.331(b) indicates that pass-through entities must ?evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring?? Are pass-through entities required to assess the risk of non-compliance for each applicant prior to issuing a subaward? No. While section 200.331(b) requires risk assessments of subrecipients, there is no requirement for pass-through entities to perform these assessments before making subawards. Under the Uniform Guidance, the purpose of these risk assessments is for pass-through entities to determine appropriate subrecipient monitoring. Pass-through entities may use judgment regarding the most appropriate timing for the assessments. Regardless of the timing chosen, the pass-through entity should document its procedures for assessing risk. Section 200.331(b)(1) ? (4) includes factors that a pass-through entity may consider when assessing subrecipient risk.

2021-017 The Department of Corrections did not have adequate internal controls over and did not comply with requirements to ensure it used State and Local Fiscal Recovery Funds for allowable purposes and for costs incurred within the period of performance. CFDA Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Period of Performance Known Questioned Cost Amount: $17,380,061 Background The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) provides direct payments to states to respond to the COVID-19 pandemic or its negative economic effects. This includes providing financial assistance to households and nonprofit organizations. Washington received approximately $4.4 billion of SLFRF money from the U.S. Department of the Treasury; of this amount, the state Legislature distributed approximately $28.3 million to the Washington Department of Corrections (Department) to respond to the COVID-19 pandemic and its effects on the state?s correctional facilities. Recipients are expected to use SLFRF assistance to meet pandemic response needs and rebuild a strong, more equitable economy as the country recovers. Federal requirements stipulate that states may use SLFRF funds to support public health expenditures, including COVID-19 prevention and mitigation efforts, medical and behavioral healthcare expenses, public health and safety, and premium pay for essential workers. States may only use funds to cover costs incurred during the period of performance, which began on March 3, 2021, and ends December 31, 2024. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not establish adequate internal controls over and did not comply with requirements to ensure it used SLFRF funds for allowable purposes and for costs incurred within the period of performance. The Department processed an accounting adjustment to move COVID-19-related expenses from the state?s general fund to the SLFRF. When preparing this adjustment, the Department did not effectively review to ensure only expenses incurred within the period of performance were applied to the federal award. This resulted in the Department charging $17,376,541 to the grant for costs incurred before the period of performance. We are questioning these costs. We used a statistical sampling method to randomly select and examine 58 out of 3,214 payroll transactions that occurred after March 3, 2021, to determine whether they were for allowable activities under the program and met the period of performance requirements. We found six transactions (10 percent) contained payroll expenses that were incurred before the period of performance, resulting in $3,519 in unallowable payments. We are questioning these costs. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department received authority to spend the SLFRF funds through the Legislature?s supplemental budget. The Office of Financial Management (OFM) included information about the funding for the supplemental budget, but did not provide guidance regarding special compliance requirements for the federal funds. OFM directed the Department to track all COVID-19-related expenditures in the state?s general fund with a unique project code. The amount of SLFRF funds the Department received was the same as the amount it had received for a particular general fund code that covered all of fiscal year 2021. Management did not know about the award?s period of performance restrictions and believed all of the Department?s expenditures should be reimbursed using its appropriated SLFRF budget of $28.3 million. Effect of Condition and Questioned Costs By not establishing adequate internal controls over its accounting adjustments, the Department did not have reasonable assurance it only used SLFRF funds for allowable purposes and for costs incurred within the period of performance. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs? as required by 2 CFR 200.516(3). We are questioning $17,380,061 in expenditures that the Department had incurred before the period of performance, including the payroll expenditures we examined during the audit. We estimate the likely total questioned costs to be $17,407,483. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Establish internal controls to specifically identify payments used as a basis for accounting adjustments and review the expenditures before charging them to federal awards to ensure they are eligible for reimbursement ? Ensure expenditures applied to federal awards occur within their period of performance ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response The Department only partially concurs with this finding. We appreciate the State Auditor?s Office (SAO) audit of Coronavirus State Fiscal Recovery (CSFR) grant. The Department is committed to ensuring our programs/processes comply with federal regulations and understand that it is the SAO?s point of view that the Department did not comply with requirements to ensure it used State Fiscal Recovery Funds for allowable purposes and for cost incurred within in the period of performance. The Department agrees that costs were charged to the grant before the effective date or period of performance of the grant. However, the Department asserts that it does have adequate internal controls over our accounting adjustments to ensure reasonable assurance that the funds were used for allowable purposes. The Department believes that salaries (questioned costs) charged to this grant are consistent with the purpose of the grant and would be allowable if not for occurring outside of the applicable timeframes. The Department underscores that no system of internal control is designed, or expected, to discover material information regarding funding streams that is not provided by the funder. In this instance, the Department had asked for $42 million in supplemental General Fund-State (GFS) dollars to support extraordinary costs related to Covid-19 impacts. Spending authority for the Coronavirus State Fiscal Recovery Funds was given to the Department in section 1221 of the budget bill FY2021 (July 1, 2020 - June 30, 2021) only. Below is a table detailing the expenditure authority schedule coding and how the money breaks out by program: Fund Program Code Appropriation Code Budget Coronavirus State Fiscal Recovery Fund - 706 100 [716] Coronavirus State Fiscal Recovery P100 197,000 200 [726] Coronavirus State Fiscal Recovery P200 31,700,000 300 [736] Coronavirus State Fiscal Recovery P300 5,879,000 400 746 Coronavirus State Fiscal Recovery P400 911,000 500 756 Coronavirus State Fiscal Recovery P500 3,292,000 700 776 Coronavirus State Fiscal Recovery P700 214,000 Total for Coronavirus State Fiscal Recovery Fund $42,193,000 Section 1221 of ESSB 5092 is the second supplemental appropriation for the Department of Corrections. This section did not provide any guidance regarding these funds falling under a new federal grant, nor proviso language about how the money in Fund 706 must be spent. The Department?s GFS ask was essentially swapped in the budget process with Coronavirus State Fiscal Recovery (CSFR) funds, dollar for dollar. ESSB 5092 passed Legislature on 4/25/21 and was signed by Governor Inslee on 5/18/21. Absent material information regarding this fundings? applicability period, the Department applied expenditures to the funding consistent with our Expenditure Authority schedule for FY21, and our internal controls ensured that the charges applied to the federal funds were only within FY21 dates. Unbeknownst to the Department, there was a period of performance that began March 3, 2021. In fact, several other state agencies had similar experiences. The Department finalized its accounting transaction on August 25, 2021, and ACFR Phase 2 closed on September 3, 2021. Significantly after Phase 2 close, the Department learned of the March 3 date in the entrance conference discussions with SAO for this audit. Further, the Federal Treasury Final Rule was issued January 27, 2022. The Department concurs that the result of not being provided adequate information by the funder regarding the period of performance is charges to the funding outside of the period of performance. However, due to the lateness of becoming aware of the period of performance, as well as Federal rules issued significantly after the funds were awarded, the Department was unable to make correcting entries as the FY21 ACFR had closed. The Department will consult with the federal granting agency to determine whether questioned cost will be repaid. Finally, the Department recognizes that any system of internal control can be improved and will therefore conduct a review of processes that identify eligible costs for federal grants, the necessary documentation requirements for accounting transfers and records retention organization to make records more easily accessible for audit purposes. The Department appreciated the patience of the SAO in obtaining supporting documentation for the audit. Auditor?s Remarks Washington State?s systems of internal controls over federal awards is designed in a decentralized manner. Therefore, individual state agencies are expected to be knowledgeable of federal program requirements when receiving, accounting for and spending federal funds. The U.S. Department of the Treasury?s Interim Final Rule concerning the requirements for allowable uses of Coronavirus State and Local Fiscal Recovery Funds was issued, and took effect, on May 17, 2021. This was during this audit period and prior to the state fiscal year closing date. We appreciate the Department?s commitment to evaluating its system of internal control. We reaffirm our audit finding and will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an Ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Title 31 U.S. Code of Federal Regulations (CFR) Part 35, Pandemic Relief Programs establishes the following applicable requirements: Section 35.5 Use of funds, states in part: (a) In general. A recipient may only use funds to cover costs incurred during the period beginning March 3, 2021, and ending December 31, 2024, for one or more of the purposes enumerated in sections 602(c)(1) and 603(c)(1) of the Social Security Act, as applicable, including those enumerated in ?35.6, subject to the restrictions set forth in sections 602(c)(2) and 603(c)(2) of the Social Security Act, as applicable. (b) Costs incurred. A cost shall be considered to have been incurred for purposes of paragraph (a) of this section if the recipient has incurred an obligation with respect to pay such cost by December 31, 2024.

2021-018 The Department of Agriculture did not have adequate internal controls over and did not comply with federal requirements for procurement or suspension and debarment. CFDA Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Procurement, Suspension and Debarment Known Questioned Cost Amount: $10,528,205 Background The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) provides direct payments to states to respond to the COVID-19 pandemic or its negative economic effects. This includes providing financial assistance to households and nonprofit organizations. Washington state received approximately $4.4 billion of SLFRF money from the U.S. Department of the Treasury; of this amount, the state Legislature distributed $20 million to the Washington Department of Agriculture (Department) for hunger relief efforts. Through its Food Assistance and Food Security programs, the Department purchased fresh and shelf-stable foods and supplies. The Department also distributed pass-through funds to community organizations and food banks to assist with preparing, storing and distributing food to those most affected by COVID-19. Federal regulations require states to follow the same policies and procedures for procuring property and services with federal grant funds as they do with non-federal funds. In Washington, state agencies must follow state law (RCW 39.26), as well as policies and procedures established by the Department of Enterprise Services (DES), when procuring goods and services. DES has established a $25,000 ?direct buy? threshold for agencies to make direct purchases from vendors without competitive solicitation or entering into a contract. DES also establishes master contracts for goods and services that state agencies and local governments can use to streamline the purchasing process. On March 6, 2020, DES issued a purchasing exception related to special market conditions created by the COVID-19 pandemic, which exempted state agencies from competitive solicitation requirements for goods and services directly related to the state?s COVID-19 response. Federal regulations prohibit grantees from entering into contracts or making subawards under covered transactions to parties that are suspended or debarred from doing business with the federal government. Covered transaction are typically contracts over $25,000 or subawards of any amount. The regulations require the Department to use one of three approved methods to verify that recipients of covered transactions are not suspended or debarred. These methods are: ? Checking for exclusion records relating to the recipient on the U.S. General Services Administration?s System for Award Management (SAM.gov) ? Collecting a certification from the recipient attesting it is not suspended or debarred ? Adding a clause or condition to the covered transaction stating the recipient is not suspended or debarred Before entering into a covered transaction, the Department must also require recipients to pass down the suspension debarment requirements to any lower-tier participants with whom they enter into a covered transaction. In fiscal year 2021, the Department paid $20 million for goods and services related to hunger relief efforts. Of this amount, the Department passed through approximately $4.9 million to subrecipients. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements for procurement or suspension and debarment. Goods and services purchased from vendors During the audit period, the Department was required to award contracts totaling $10,528,205 to 30 vendors whose costs exceeded $25,000. However, we found the Department did not award any SLFRF contracts to these vendors. We also found the Department did not verify the 30 vendors were not suspended or debarred, as federal regulations require. Additionally, the Department used DES master contracts in three instances to procure goods and services, but did not check the suspension and debarment status of the contractors. Funds passed through to subrecipients We selected 11 out of 21 subawards the Department issued during the audit period to determine if it had verified the subrecipients were not suspended or debarred. We randomly selected 10 subawards and specifically selected one subaward to review because it was individually significant (approximately $2.7 million). We found the Department did not use one of the three approved methods to verify the suspension and debarment status of the subrecipients for six subawards (55 percent), including the individually significant subaward. We also determined that the Department did not issue a subaward for two of the subawards that were required for covered transactions under federal regulations. As a result, the Department did not inform the subrecipients of their responsibility to pass down the suspension debarment requirements to any lower-tier participants. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. These issues were not reported as a finding in the prior audit. Cause of Condition Goods and services purchased from vendors Management said it was not aware of the requirement to enter into contracts for covered transactions exceeding $25,000, and it relied on DES?s competitive solicitation exemption to rationalize not entering into contracts with its vendors. Additionally, management incorrectly reviewed the following information to verify the vendors? suspension and debarment status: DES?s vendor debarment list, each vendor?s prior exclusion history, and vendors? current or prior participation in other federal programs. Funds passed through to subrecipients The Department has an established process for verifying the suspension and debarment status of its Food Assistance subrecipients from its other federal programs. However, because the Department did not issue two required subawards, it did not complete the suspension and debarment checks through its normal process. For Food Security subrecipients, management said it believed the Department could rely on preexisting subawards and amendments for other programs to satisfy the suspension and debarment requirements. As a result, the Department did not review the suspension and debarment status of each subrecipient to ensure it was documented for compliance purposes. The Department also did not have adequate policies and procedures for procuring goods and services or for verifying the suspension and debarment status of contractors and subrecipients. Effect of Condition and Questioned Costs By not procuring contracts properly, the Department did not comply with state and federal requirements. Additionally, by not entering into contracts with its vendors, the Department did not establish contract requirements and expected deliverables. Therefore, we conclude the Department improperly charged $10,528,205 to the SLFRF program to purchase goods and services. By not complying with suspension and debarment requirements, the Department is at an increased risk of entering into covered transactions with excluded entities. Any payments made to excluded entities would be unallowable, and the grantor could potentially recover them. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Establish internal controls to ensure it procures goods and services in accordance with state policies and procedures ? Improve its internal controls to ensure compliance with federal suspension and debarment requirements ? Update its policies and procedures for procurement and suspension and debarment ? Consult with the grantor to determine if the identified questioned costs should be repaid Department?s Response The Washington State Department of Agriculture is committed to addressing all noncompliance with the federal uniform and treasury guidance for the CSLFRF funding that was deployed to mitigate a hunger crisis in our state. We acknowledge and will remedy the administrative errors that resulted in these audit findings and we affirm that though there were errors, every dollar spent was fully accounted for, no fraud has been identified, and these funds were successfully deployed in our emergency food security response. The COVID-19 pandemic has been widely described as ?unprecedented? and in light of a sharp increase in food insecurity, with as many as one in three Washingtonians experiencing or at risk of hunger, WSDA took unprecedented measures to ensure that emergency food assistance was available to any Washingtonian in need. In spite of noncompliance and the measures we will take to address it, WSDA took the steps necessary to feed Washingtonians in need, and in that mission, we were wholly successful. WSDA is ensuring federal suspension and debarment language is added to each contract and referenced in each new amendment. In addition, program staff will check the System for Award Management (SAM) prior to the contract execution date. The contractor verification documentation will be maintained in each contract file. Staff will require each contractor to include suspension and debarment language in all lower tier agreements. WSDA will begin updating policies and procedures as recommended by SAO. Agency staff who manage federal contracts will receive training and written instructions on federal suspension and debarment requirements by June 30, 2023. The Department will update policies and procedures for federal procurement, suspension and debarment to include training for staff by June 30, 2023. We appreciate the opportunity to work with the auditors to ensure the department meets all state and federal requirement. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.317 Procurements by states, states in part: When procuring property and services under a Federal award, a State must follow the same policies and procedures it uses for procurements from its non-Federal funds. The State will comply with ?200.321, 200.322, and 200.323 and ensure that every purchase order or other contract includes any clauses required by ?200.327. Section 200.327 Contract provisions. The non-Federal entity?s contracts must contain the applicable provisions described in appendix II to this part. Section 200.331 Subrecipient and contractor determinations. Contract provisions. The non-Federal entity may concurrently receive Federal awards as a recipient, a subrecipient, and a contractor, depending on the substance of its agreements with Federal awarding agencies and pass-through entities. Therefore, a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. The Federal awarding agency may supply and require recipients to comply with additional guidance to support these determinations provided such guidance does not conflict with this section. (a) Subrecipients. A subaward is for the purpose of carrying out a portion of a Federal award and creates a Federal assistance relationship with the subrecipient. See definition for Subaward in ? 200.1 of this part. Characteristics which support the classification of the non-Federal entity as a subrecipient include when the non-Federal entity: (1) Determines who is eligible to receive what Federal assistance; (2) Has its performance measured in relation to whether objectives of a Federal program were met; (3) Has responsibility for programmatic decision-making; (4) Is responsible for adherence to applicable Federal program requirements specified in the Federal award; and (5) In accordance with its agreement, uses the Federal funds to carry out a program for a public purpose specified in authorizing statute, as opposed to providing goods or services for the benefit of the pass-through entity. (b) Contractors. A contract is for the purpose of obtaining goods and services for the non-Federal entity's own use and creates a procurement relationship with the contractor. See the definition of contract in ? 200.1 of this part. Characteristics indicative of a procurement relationship between the non-Federal entity and a contractor are when the contractor: (1) Provides the goods and services within normal business operations; (2) Provides similar goods or services to many different purchasers; (3) Normally operates in a competitive environment; (4) Provides goods or services that are ancillary to the operation of the Federal program; and (5) Is not subject to compliance requirements of the Federal program as a result of the agreement, though similar requirements may apply for other reasons. (c) Use of judgment in making determination. In determining whether an agreement between a pass-through entity and another non-Federal entity casts the latter as a subrecipient or a contractor, the substance of the relationship is more important than the form of the agreement. All of the characteristics listed above may not be present in all cases, and the pass-through entity must use judgment in classifying each agreement as a subaward or a procurement contract. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. Appendix II to Part 200 ? Contract Provisions for Non-Federal Entity Contracts Under Federal Awards, states in part: In addition to other provisions required by the Federal agency or non-Federal entity, all contracts made by the non-Federal entity under the Federal award must contain provisions covering the following as applicable. (B) All contracts in excess of $10,000 must address termination for cause and for convenience by the non-Federal entity including the manner by which it will be effected and the basis for settlement. (H) Debarment and Suspension (Executive Orders 12549 and 12689) ? A contract award (see 2 CFR 180.220) must not be made to parties listed on the governmentwide exclusions in the System for Award Management (SAM), in accordance with the OMB guidelines at 2 CFR 180 that implement Executive Orders 12549 (3 CFR part 1986 Comp., p. 189) and 12689 (3 CFR part 1989 Comp., p. 235), ?Debarment and Suspension.? SAM Exclusions contains the names of parties debarred, suspended, or otherwise excluded by agencies, as well as parties declared ineligible under statutory or regulatory authority other than Executive Order 12549. 2 CFR Part 180, OMB Guidelines to Agencies on Governmentwide Debarment and Suspension (Nonprocurement), Subpart C ? Responsibilities of Participants Regarding Transactions Doing Business With Other Persons, states in part: Section 180.220 Are any procurement contracts included as covered transactions? (a) Covered transactions under this part ? (1) Do not include any procurement contracts awarded directly by a Federal agency; but (2) Do include some procurement contracts awarded by non-Federal participants in nonprocurement covered transactions. (b) Specifically, a contract for goods or services is a covered transaction if any of the following applies: (1) The contract is awarded by a participant in a nonprocurement transaction that is covered under ?180.210, and the amount of the contract is expected to equal or exceed $25,000. Section 180.300 What must I do before I enter into a covered transaction with another person at the next lower tier? When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Section 180.330 What requirements must I pass down to persons at lower tiers with whom I intend to do business? Before entering into a covered transaction with a participant at the next lower tier, you must require that participant to - (a) Comply with this subpart as a condition of participation in the transaction. You may do so using any method(s), unless the regulation of the Federal agency responsible for the transaction requires you to use specific methods. (b) Pass the requirement to comply with this subpart to each person with whom the participant enters into a covered transaction at the next lower tier. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ?200.300 Statutory and national policy requirements through 200.309 Period of performance. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-019 The Department of Agriculture did not have adequate internal controls over and did not comply with federal requirements to ensure it issued all required subawards, included all required information in the subawards issued, and performed risk assessments for subrecipients of the Coronavirus State and Local Fiscal Recovery Fund. CFDA Number and Title: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Federal Grantor Name: U.S. Department of the Treasury Federal Award/Contract Number: SLFRP0002 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: $3,371,121 Background The Coronavirus State and Local Fiscal Recovery Fund (SLFRF) provides direct payments to states to respond to the COVID-19 pandemic or its negative economic effects. This includes providing financial assistance to households and nonprofit organizations. Washington state received approximately $4.4 billion of SLFRF money from the U.S. Department of the Treasury; of this amount, the state Legislature distributed $20 million to the Washington Department of Agriculture (Department) for hunger relief efforts. Through its Food Assistance and Food Security programs, the Department purchased fresh and shelf-stable foods and supplies. The Department also distributed pass-through funds to community organizations and food banks to assist with preparing, storing and distributing food to those most affected by COVID-19. Federal law (2 CFR 200.332) requires pass-through entities to include certain information in all of their subawards. This includes information about the federal award the pass-through entity received, details about the subaward being awarded, and clearly identifying the recipient as a subrecipient. Pass-through entities must also monitor the activities of subrecipients to ensure they are properly using federal funds. To determine the appropriate level of monitoring, federal regulations require the Department to evaluate each subrecipient?s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. In fiscal year 2021, the Department paid $20 million for goods and services related to hunger relief efforts. Of this amount, the Department passed through approximately $4.9 million to subrecipients. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure it issued all required subawards, included all required information in the subawards issued, and performed risk assessments for subrecipients of the SLFRF. During the audit period, the Department awarded SLFRF funds to 18 subrecipients, requiring 21 subawards, related to the Food Assistance and Food Security programs. We used a non-statistical sampling method to randomly select and examine 10 subrecipients, in addition to one subrecipient we specifically selected to review because the amount it received was individually significant (approximately $2.7 million). We found the Department failed to issue subawards to five subrecipients but paid them a total of $3,371,121. For the six subawards we reviewed, we found all were missing the following required information: ? Subrecipient?s unique entity identifier ? Federal Award Identification Number (FAIN) ? Federal award date ? Federal award project description (responsive to the reporting requirements under the Federal Funding Accountability and Transparency Act (FFATA)) ? Indirect cost rate for the federal award Additionally, the six subawards we reviewed did not identify the recipient as a subrecipient, as required by federal regulations. We also found the Department did not perform a risk assessment for any of its subrecipients during the audit period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. These issues were not reported as a finding in the prior audit. Cause of Condition Management and staff did not have an adequate understanding of the requirements for identifying subrecipients and executing subawards, as well as distinguishing them from the Department?s state-funded contracts and from subawards for other federal awards. The Department issued SLFRF subawards beginning in May 2021. The Department had preexisting agreements with subrecipients of other federal programs, so it relied on the results of risk assessments conducted prior to receiving its SLFRF funding instead of performing new subrecipient risk assessments before making subawards. Effect of Condition and Questioned Costs By not following established policies, the Department cannot ensure it is compliant with subrecipient monitoring requirements. By not clearly identifying subaward recipients as subrecipients, the Department cannot ensure the subrecipients are adequately informed of the program requirements. Additionally, without evaluating risk, the Department cannot ensure each subrecipient receives the appropriate level of monitoring, which makes it less likely the Department would be able to detect subrecipients? noncompliance with federal regulations and the subaward?s terms and conditions. Because the Department did not issue subawards to five of its subrecipients, we are questioning the $3,371,121 paid to these subrecipients. We also estimate likely questioned costs totaling $3,813,586. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Implement internal controls to ensure it issues subawards for federal funds passed through to subrecipients, as required ? Establish policies and procedures to ensure it includes all required information in the subawards issued ? Ensure it performs risk assessments of subrecipients and evaluates the results to determine the required level of monitoring for each subrecipient in accordance with federal requirements ? Ensure staff responsible for issuing subawards understand subrecipient classifications Department?s Response The Washington State Department of Agriculture is committed to addressing all noncompliance with the federal uniform and treasury guidance for the CSLFRF funding that was deployed to mitigate a hunger crisis in our state. We acknowledge and will remedy the administrative errors that resulted in these audit findings and we affirm that though there were errors, every dollar spent was fully accounted for, no fraud has been identified, and these funds were successfully deployed in our emergency food security response. The COVID-19 pandemic has been widely described as ?unprecedented? and in light of a sharp increase in food insecurity, with as many as one in three Washingtonians experiencing or at risk of hunger, WSDA took unprecedented measures to ensure that emergency food assistance was available to any Washingtonian in need. In spite of noncompliance and the measures we will take to address it, WSDA took the steps necessary to feed Washingtonians in need, and in that mission, we were wholly successful. The department will update policies and procedures for federal subawards to include risk assessment in the application and/or prior to contracting and establish risk-based monitoring processes. The department will conduct training for staff by June 30, 2023. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.1 Definitions, states in part: Improper payment means: 1) Any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. (i) Incorrect amounts are overpayments or underpayments that are made to eligible recipients (including inappropriate denials of payment or service, any payment that does not account for credit for applicable discounts, payments that are for an incorrect amount, and duplicate payments). An improper payment also includes any payment that was made to an ineligible recipient or for an ineligible good or service, or payments for goods or services not received (except for such payments authorized by law). Note 1 to paragraph (1)(i) of this definition. Applicable discounts are only those discounts where it is both advantageous and within the agency's control to claim them. (ii) When an agency's review is unable to discern whether a payment was proper as a result of insufficient or lack of documentation, this payment should also be considered an improper payment. When establishing documentation requirements for payments, agencies should ensure that all documentation requirements are necessary and should refrain from imposing additional burdensome documentation requirements. (iii) Interest or other fees that may result from an underpayment by an agency are not considered an improper payment if the interest was paid correctly. These payments are generally separate transactions and may be necessary under certain statutory, contractual, administrative, or other legally applicable requirements. (iv) A ?questioned cost? (as defined in this section) should not be considered an improper payment until the transaction has been completely reviewed and is confirmed to be improper. (v) The term ?payment? in this definition means any disbursement or transfer of Federal funds (including a commitment for future payment, such as cash, securities, loans, loan guarantees, and insurance subsidies) to any non-Federal person, non-Federal entity, or Federal employee, that is made by a Federal agency, a Federal contractor, a Federal grantee, or a governmental or other organization administering a Federal program or activity. (vi) The term ?payment? includes disbursements made pursuant to prime contracts awarded under the Federal Acquisition Regulation and Federal awards subject to this part that are expended by recipients. (2) See definition of improper payment in OMB Circular A-123 appendix C, part I A (1) ?What is an improper payment?? Questioned costs, including those identified in audits, are not an improper payment until reviewed and confirmed to be improper as defined in OMB Circular A-123 appendix C. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (c) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: 1) Federal award identification. i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient?s unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in ?200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated to the subrecipient by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listing number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listing number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per ?200.414. 2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; 3) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; 4) i. An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the pass-through entity must determine the appropriate rate in collaboration with the subrecipient, which is either: A. The negotiated indirect cost rate between the pas-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass-through entity is not required to collect information justifying this rate, but may elect to do so; B. The de minimis indirect cost rate. ii. The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with ?200.405(d). 5) A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipients records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and 6) Appropriate terms and conditions concerning closeout of the subaward. (d) Evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for the purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: 1) The subrecipient?s prior experience with the same or similar subawards; 2) The result of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; and 4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also received Federal awards directly from a Federal awarding agency). Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-020 Washington State University did not establish adequate internal controls over and did not comply with federal requirements to conduct risk assessments of student information security for the Student Financial Assistance programs. CFDA Number and Title: 84.007, Federal Supplemental Educational Opportunity Grant 84.033, Federal Work-Study Program 84.038, Federal Perkins Loan Program 84.063, Federal Pell Grant Program 84.268, Federal Direct Student Loans 84.379, Teacher Education Assistance for College and Higher Education Grants Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: Various Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Gramm-Leach-Bliley Act ? Student Information Security Known Questioned Cost Amount: None Background The Gramm-Leach-Bliley Act (Act) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers Title-IV eligible institutions that participate in the Title IV Educational Assistance Programs to be ?financial institutions? and subject to the Act because of their participation in the wiring of federal aid funds to consumers. Provisions of the Act include requirements for financial institutions to develop, implement and maintain an information security program over confidential and financial information. Under the Family Educational Rights and Privacy Act (FERPA), the U.S. Department of Education requires in its institutional Program Participation Agreement for institutions to adhere to the Act?s requirements and to protect student financial aid information from unauthorized disclosure, misuse, alteration, destruction or other compromising acts. The U.S. Department of Education provides further guidance to participating institutions regarding methods for meeting cybersecurity requirements. Institutions of higher education are to designate individual(s) responsible for coordinating the institution?s information security program and conducting risk assessments to identify foreseeable internal and external risks to information security, confidentiality and data integrity, and to document and evaluate the safeguards in place to mitigate the effects of, or eliminate, any identified risks. Each institution?s risk assessment must consider the following key elements: ? Employee training and management ? Information systems, including network and software design, as well as information processing, storage, transmission and disposal ? Detecting, preventing and responding to attacks, intrusions or other system failures Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported Washington State University (University) did not establish adequate internal controls over and did not comply with federal requirements to conduct risk assessments of student information security for the Student Financial Assistance programs. The prior finding number was 2020-021. Description of Condition The University did not establish adequate internal controls over and did not comply with federal requirements to conduct risk assessments of student information security for the Student Financial Assistance program. The Chief Information Security Officer is responsible for coordinating the University?s information security program. The University implemented written policies for conducting information security risk assessments and security assessment and authorization reviews during the audit period. The University also had documentation to show it implemented activities to monitor and assess threats to information security. However, the University did not have adequate documentation to show that it performed a formal risk assessment specific to the requirements for information systems covered under the Act. Because of this, we also found the University did not have readily available documentation to support the specific safeguards implemented in response to the risks identified through the required risk assessment. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition University management was aware of the information system security requirements under the Act and established policies and procedures for performing the required information security risk assessment specific to the Act. During the audit period, management redesigned the risk assessment to better address the requirements under the Act, but did not monitor staff assigned with completing the risk assessment to ensure it was performed and adequately documented. Effect of Condition By not ensuring staff completed and adequately documented risk assessments of information system security specific to the Act, the University could not easily identify which systems security safeguards were implemented in response to identified risks of unauthorized disclosure, including theft, manipulation, destruction, or misuse of student information. Recommendations We recommend the University: ? Improve its internal controls to ensure information system security risk assessments are performed in accordance with federal regulations, program requirements and University policy ? Monitor the results of risk assessments to ensure appropriate safeguards are documented and implemented in response to identified risks University?s Response Washington State University takes very seriously its responsibilities related to information system security and the protection of customer information from unauthorized disclosure, theft, manipulation, destruction, or misuse. As noted within the Background of this report, the issue within this report is repeated from the prior year, Fiscal Year 2020. The report was issued in May 2021. The current audit scope was to review for controls and implementation of corrective action through the end of the fiscal year, effectively, through June 30, 2021 (two months after report issuance date). The University had provided a corrective action plan for communicated issues and noted implementation would be affected by March 31, 2022. This deadline has been met. As of the end of March 2022, Fiscal Year 2022, the University has revised and improved the tools and processes for conducting information security risk assessments. The University used the refined tools to perform comprehensive assessments of risks against the control environment and has documentation to support both the results of the assessment and activities implemented, as a result of the assessment, to monitor and assess threats to information security. Washington State University continues to maintain its diligence in actively assessing and managing risks in information security and specific to the requirements for information systems covered under the Gramm-Leach-Bliley Act. Auditor?s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Title 16 CFR Part 314, Standards for Safeguarding Customer Information establishes the following applicable requirements: 314.2 Definitions. (b) Customer information means any record containing nonpublic personal information as defined in 16 CFR 313.3(n), about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of you or your affiliates. (c) Information security program means the administrative, technical, or physical safeguards you use to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information. 314.3 Standards for safeguarding customer information. (a) Information security program. You shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. Such safeguards shall include the elements set forth in 314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in paragraph (b) of this section. (b) Objectives. The objectives of the Act, and of this part, are to: (1) Insure the security and confidentiality of customer information; (2) Protect against any anticipated threats or hazards to the security or integrity of such information; and (3) Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. 314.4 Elements, states in part: In order to develop, implement and maintain your information security program, you shall: (b) Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems and procedures. (d) Oversee service providers, by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; and (2) Requiring your service providers by contract to implement and maintain such safeguards. (e) Evaluate and adjust your information security program in the light of the results of the testing and monitoring required by paragraph (c) of this section; any material changes to your operations or business arrangements; or any other circumstances that you know or have reason to know may have a material impact on your information security program.

2021-021 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with federal requirements to ensure Local Education Agencies implemented testing security measures. CFDA Number and Title: 84.010 Title I Grants to Local Educational Agencies (Title I, Part A of the Every Student Succeeds Act) Federal Grantor Name: U.S. Department of Education Federal Award Number: S010A180047, S101A190047-19A, S010A200047 Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Assessment System Security Known Questioned Cost Amount: None Background The Title I Grants to Local Educational Agencies (Title I, Part A) provides financial assistance to improve the teaching and learning of children who are at risk of not meeting challenging academic standards and who reside in areas with high concentrations of children from low-income families. The Every Student Succeeds Act (ESSA) requires states to perform annual statewide assessments in reading, language arts and mathematics to all students in grades three through eight. The ESSA also requires states to administer assessments in reading, language arts and mathematics once in high school, as well as in science at least once in each of grades three through five, six through nine, and 10 through 12. The Office of Superintendent of Public Instruction (Office) administers the Title I, Part A program in Washington. The Office, in consultation with Local Education Agencies (LEAs), establishes and maintains an assessment system that is valid, reliable and consistent with professional and technical standards. In its assessment system, the Office has policies and procedures to maintain test security and ensure that LEAs implement those policies and procedures. LEAs are required to complete a District Administration and Security Report (DASR) for each test administered, and they must submit the report to the Office no later than five business days after completion of each test administration. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Office did not have adequate internal controls over and did not comply with federal requirements to ensure LEAs implemented testing security measures. The prior finding number was 2020-026. Description of Condition The Office did not have adequate internal controls over and did not comply with federal requirements to ensure LEAs implemented testing security measures. Through manuals, training modules, tools, templates and other documents, the Office provides guidance to LEAs on how they must manage and administer assessments in compliance with the law. The Office also requires LEAs to submit a DASR at the conclusion of the testing cycle to ensure they have implemented testing security measures. During the audit period, the Office did not conduct on-site or desk monitoring to ensure LEAs followed the policies and procedures it implemented. The Office originally planned to implement new on-site and desk monitoring protocols in the spring of 2020 developed with the intent to conduct monitoring in accordance with federal requirements for the 2020-21 school year. However, standard protocols were followed that included identifying a list of all LEAs that administered each assessment and checking to ensure the Office received DASRs for all assessments administered. At the time of the audit, the Office had not conducted all reviews due to difficulty gathering DASRs because of the COVID-19 pandemic. During the audit period, 178 LEAs administered 178 total assessments. The Office did not receive 95 DASRs (53 percent of total assessments administered), but the 83 DASRs it did receive were completed and submitted within five business days after completion of each test administration. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition While the Office developed new monitoring protocols in response to the prior audit finding recommendations, management decided not to implement them until June 2021 due to the anticipated difficulties in obtaining records from LEAs because of the COVID-19 pandemic. Effect of Condition By not monitoring LEAs, the Office had no assurance that LEAs implemented proper testing security measures. Recommendation We recommend the Office follow its newly established procedures by monitoring the DASRs to ensure that the LEAs have implemented testing security measures. Office?s Response OSPI will continue to provide school districts with all required training materials that, when implemented, help to ensure that appropriate protocols are in place for the security of the tests. For purposes of this response, it is important to distinguish between the District Administration and Security Report (DASR), which has been in place and ongoing, and the planned onsite and desk monitoring, full implementation of which has been delayed due to the pandemic. Districts ensure training and security protocols are followed by completing a DASR. OSPI requires all districts to submit completed DASRs to document the security training and protocols were followed. OSPI begins communicating to districts that DASRs are required and when they are due at the start of each school year. This information is included in training PowerPoints, monthly statewide webcasts, and in a weekly assessment newsletter, repeated many times prior to reporting deadline. At the end of the school year, OSPI follows up with districts that do not submit on-time DASR reports, via emails and/or phone calls. This follow-up continues for three months, into the start of the new school year. OSPI documents DASR reports not received by OSPI after this period. During the 2020-21 school year, the timeframe for this audit, OSPI communicated broadly and regularly regarding the DASR requirement. This is evidenced by the broadcasting and posting of the New and All-District Coordinator Training webinars on August 28 and September 11, 2020; reminders in WAW articles on August 27, September 3, and September 10, 2020; published procedures in the Test Coordinators Manual and spring Test Coordinator Training (Feb 2021); Assessment Update Webcasts in May 2021 and June 2021; and Washington Assessment Weekly (WAW) articles on June 10 and 17, 2021. Additionally, OSPI had begun due diligence to follow-up with districts that had not submitted their reports. It is also important to note the unusual circumstances of the statewide assessment during the spring of 2021. General assessments (Smarter Balanced math and ELA and the Washington Comprehensive Assessment of Science) were deferred to a fall test administration. The alternate assessment (WA-AIM) allowed the option for either a spring or fall test administration. Therefore, this audit?s timeline spanned only part of the test administration; the remainder of testing was completed in the fall of 2021. Separate from DASR submission, and beginning with the spring 2022 assessments, OSPI will resume district monitoring, otherwise known as onsite and desk monitoring. District monitoring allows OSPI staff to make a direct and personal connection with school district staff while observing and recording that security protocols and test administration procedures are being/have been properly followed. Monitoring was paused beginning in March 2020 through the end of the school year 2021 due to the COVID pandemic. These observations will be conducted at a rotating sample of districts. The goal of these onsite and desk checks is to identify areas where districts need support and those supports can be carried over to support other districts statewide. Collection of DASRs and district monitoring/audits are separate activities due to the nature and timing of each activity. DASR submission is an activity that is completed at the end of a school district?s test administration. For most districts in WA, DASRs are completed in June, after spring testing. WA-AIM spring testing concluded on June 11, 2021. In the last two weeks of June, OSPI had begun to follow-up with districts that hadn?t yet submitted DASRs. As done in 2020-21, OSPI will continue to regularly communicate with districts regarding the DASR requirements and send follow-up communications if completed submissions are not timely. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 20 U.S. Code ?6311 ? State plans, states in part: (b) Challenging academic standards and academic assessments (2) ACADEMIC ASSESSMENTS.? (A) IN GENERAL.?Each State plan shall demonstrate that the State educational agency, in consultation with local educational agencies, has implemented a set of high-quality student academic assessments in mathematics, reading or language arts, and science. The State retains the right to implement such assessments in any other subject chosen by the State. (B) REQUIREMENTS ? The assessments under subparagraph (A) shall? (i) except as provided in subparagraph (D), be? (I) the same academic assessments used to measure the achievement of all public elementary school and secondary school students in the State; and (II) administered to all public elementary school and secondary school students in the State; (ii) be aligned with the challenging State academic standards, and provide coherent and timely information about student attainment of such standards and whether the student is performing at the student?s grade level; (iii) be used for purposes for which such assessments are valid and reliable, consistent with relevant, nationally recognized professional and technical testing standards, objectively measure academic achievement, knowledge, and skills, and be tests that do not evaluate or assess personal or family beliefs and attitudes, or publicly disclose personally identifiable information; (iv) be of adequate technical quality for each purpose required under this Act and consistent with the requirements of this section, the evidence of which shall be made public, including on the website of the State educational agency; (v)(I) in the case of mathematics and reading or language arts, be administered? (aa) in each of grades 3 through 8; and (bb) at least once in grades 9 through 12; (II) in the case of science, be administered not less than one time during? (aa) grades 3 through 5; (bb) grades 6 through 9; and (cc) grades 10 through 12; and (III) in the case of any other subject chosen by the State, be administered at the discretion of the State; (vi) involve multiple up-to-date measures of student academic achievement, including measures that assess higher-order thinking skills and understanding which may include measures of student academic growth and may be partially delivered in the form of portfolios, projects, or extended performance tasks; (vii) provide for? (I) the participation in such assessments of all students; (II)the appropriate accommodations, such as interoperability with, and ability to use, assistive technology, for children with disabilities (as defined in section 602(3) of the Individuals with Disabilities Education Act (20 U.S.C. 1401(3))), including students with the most significant cognitive disabilities, and students with a disability who are provided accommodations under an Act other than the Individuals with Disabilities Education Act (20 U.S.C. 1400 et seq.), necessary to measure the academic achievement of such children relative to the challenging State academic standards or alternate academic achievement standards described in paragraph (1)(E); and (III) the inclusion of English learners, who shall be assessed in a valid and reliable manner and provided appropriate accommodations on assessments administered to such students under this paragraph, including, to the extent practicable, assessments in the language and form most likely to yield accurate data on what such students know and can do in academic content areas, until such students have achieved English language proficiency, as determined under subparagraph (G); Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. The Professional Standards and Security, Incident, and Reporting Guidelines (PIRG) established by the Office states in part: After testing, it is the LEA?s responsibility to complete a District Administration and Security Report for each test administration. This report has check boxes of responsibilities. Include an explanation of boxes checked ?no? and notation of any missing or damaged materials. As required, submit the report to OSPI through ARMS no later than five business days after completion of each test administration.

2021-022 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with requirements to ensure payments to subrecipients were adequately supported for the Special Education program. CFDA Number and Title: 84.027 Special Education-Grants to States (IDEA, Part B) 84.173 Special Education-Preschool Grants (IDEA Preschool) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: H027A190074 - 19A, H027A200074- 20A, H173A180074, H173A190074, H173A200074 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Subrecipient Monitoring Known Questioned Cost Amount: None Background The Individuals with Disabilities Education Act?s (IDEA) Special Education Grants to States program (IDEA, Part B) provides grants to states, and through them to local educational agencies (LEAs), to help provide special education and related services to eligible children with disabilities. IDEA?s Special Education Preschool Grants program (IDEA Preschool), also known as the ?619 program,? provides grants to states, and through them to LEAs, to assist with providing special education and related services to children with disabilities ages 3 through 5 and, at a state?s discretion, to 2-year-old children with disabilities who will turn 3 during the school year. The Office of Superintendent of Public Instruction (Office) administers the Special Education program (program) in Washington and serves about 143,000 eligible students. The program provides specially designed instruction that addresses the unique needs of a student. The Office offers the program at no cost to parents, and it includes the related services students need to access their educational program. The Office spent about $234 million in federal IDEA grant funds during fiscal year 2021 and passed about $230 million of that funding through to LEAs. The Office also passes funding to educational service districts (ESDs) to help school districts save money by pooling resources, providing essential services for school districts and communities, and helping the Office implement education initiatives. ESDs spend about 3 percent of total program funding. The Office approves LEA grant applications that outline proposed special education projects, goals, a description of the services they will provide and budget categories for carrying out project activities. LEAs claim grant funding on a reimbursement basis through the Office?s Grants Claim System (system). The system allows LEAs to request reimbursement only in the specific categories laid out within their approved budget. The system approves the reimbursement request as long as grant funds are budgeted in the specific categories and are still available. LEAs are not required to submit any supporting documentation with the reimbursement requests. The Office?s procedure is to perform on-site monitoring and desk reviews of selected LEAs to ensure they use federal funds only for allowable purposes and that they meet federal cost principles. The Office uses a risk-based approach to select LEAs for review annually. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Office did not have adequate internal controls over and did not comply with requirements to ensure payments to subrecipients were adequately supported for the program. The prior finding number was 2020-028. Description of Condition The Office did not have adequate internal controls over and did not comply with requirements to ensure payments to subrecipients were adequately supported for the program. During the audit period, the Office did not perform any fiscal monitoring of subrecipients. Adequate fiscal monitoring is especially important for this grant because the Office does not receive supporting documentation with reimbursement requests. We consider this internal control deficiency to be a material weakness, which lead to material noncompliance. Cause of Condition Local Educational Agencies (LEAs) Based on the previous audit finding, the Office developed and began piloting a new fiscal monitoring process to increase its fiscal documentation reviews. However, the new process did not take place during the audit period due to the COVID-19 pandemic. Educational Service Districts (ESDs) The Office?s employees responsible for monitoring were unaware the ESDs were subrecipients and, therefore, did not include them in their monitoring process. Effect of Condition By failing to perform adequate fiscal monitoring, the Office cannot ensure reimbursement requests are accurate, allowable and adequately supported. Recommendation We recommend the Office: ? Continue with its plan to increase its fiscal monitoring of LEAs ? Comply with federal grant requirements by implementing procedures to monitor its ESD subrecipients Office?s Response The Office concurs with the finding. A. OSPI continues to implement its plan to increase fiscal monitoring of LEAs. In response to the previous audit finding from SAO (2020-028), OSPI has implemented its monthly expenditure reporting process for its LEAs. Instruction provided to LEAs related to those reporting requirements is found within the grant application and Special Education Monthly Updates. Implementation of on-site and desk reviews are being accomplished during the 2021-22 school year. Review of documentation, site-visits, Zoom meetings all are in progress. Final reviews will be completed August 2022. Special Education fiscal monitoring for 2022-23 school year will be coordinated with our WISM team and implemented. B. OSPI is implementing procedures to monitor ESD subrecipients. In response to the previous finding from SAO (OSPI 2021-003) OSPI is continuing to implement fiscal monitoring procedures to ensure payments to ESD subrecipients are adequately supported for the Special Education program. These procedures include revisions and additions to the form package submitted annually by ESD partners; documentation of time and effort, contracts, and meeting materials; end-of-year expenditure reports; and professional development and technical assistance on these new procedures. Additional details and timelines for the fiscal monitoring procedures are outlined in more detail in the table below: Plan Timeline Responsible Staff Revise and expand the form package submitted by Educational Service Districts (ESDs), including the required end of year reporting, to include the submission of documentation related to the activities identified in the Coordinated Services Agreement (CSA). Include factors for timely completion of form package activity due dates, timely submitting end-of-year reporting, and additional items listed below: March-April 2022 Director of Operations, Special Education Executive Director of Special Education Program Improvement Coordinator, Special Education Fiscal Program Supervisor, Special Education a. Documentation submitted by ESD and reviewed by OSPI will include evidence that verifies the implementation of the approved CSA activities, such as time and effort certifications, copies of contracts, contract procurement procedures, professional development agendas, sign-in sheets, etc. March-April 2022 Director of Operations, Special Education Fiscal Program Supervisor, Special Education b. ESDs will submit an end-of-year expenditure report. OSPI will review to verify that the expenditure report contains allowable expenditures and is in alignment with the ESD?s approved CSA. March-April 2022 Director of Operations, Special Education Executive Director of Special Education Fiscal Program Supervisor, Special Education c. The CSA form package will be expanded to include a section to identify contractor name and service provided. OSPI will use this information to request a copy of selected contracts for OSPI review. March-April 2022 Director of Operations, Special Education Fiscal Program Supervisor, Special Education d. Update fiscal/program monitoring guidance to reflect these changes. March-April 2022 Director of Operations, Special Education Fiscal Program Supervisor, Special Education e. Provide professional development/training to ESDs on new process. April-June 2022 Director of Operations, Special Education Executive Director of Special Education Fiscal Program Supervisor, Special Education f. Implement revised process, including OSPI review of all submitted documentation for compliance. 2022-23 school year Director of Operations, Special Education Executive Director of Special Education Program Improvement Coordinator, Special Education Fiscal Program Supervisor, Special Education Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.302 Financial management, states in part: (a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. See also ? 200.450 Lobbying. (b) The financial management system of each non-Federal entity must provide for the following (see also ?? 200.334, 200.335, 200.336 and 200.337): (1) Identification, in its accounts, of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number and year, name of the Federal agency, and name of the pass-through entity, if any. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in ?? 200.328 and 200.329. If a Federal awarding agency requires reporting on an accrual basis from a recipient that maintains its records on other than an accrual basis, the recipient must not be required to establish an accrual accounting system. This recipient may develop accrual data for its reports on the basis of an analysis of the documentation on hand. Similarly, a pass-through entity must not require a subrecipient to establish an accrual accounting system and must allow the subrecipient to develop accrual data for its reports on the basis of an analysis of the documentation on hand. (3) Records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. (4) Effective control over, and accountability for, all funds, property, and other assets. The non-Federal entity must adequately safeguard all assets and assure that they are used solely for authorized purposes. See ? 200.303. (5) Comparison of expenditures with budget amounts for each Federal award. (6) Written procedures to implement the requirements of ? 200.305. (7) Written procedures for determining the allowability of costs in accordance with subpart E of this part and the terms and conditions of the Federal award. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Depending upon the pass-through entity?s assessment of risk posed by the subrecipient (as prescribed in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient?s program operations; Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-023 The Office of Superintendent of Public Instruction did not have adequate internal controls over requirements to perform risk assessments for subrecipients of the Special Education program. CFDA Number and Title: 84.027 Special Education Grants to States (IDEA, Part B) 84.173 Special Education Preschool Grants (IDEA Preschool) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: H027A190074 - 19A, H027A200074- 20A, H173A180074, H173A190074, H173A200074 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Questioned Cost Amount: None Background The Individuals with Disabilities Education Act?s (IDEA) Special Education Grants to States program (IDEA, Part B) provides grants to states, and through them to local educational agencies (LEAs), to help provide special education and related services to eligible children with disabilities. IDEA?s Special Education Preschool Grants program (IDEA Preschool), also known as the ?619 program,? provides grants to states, and through them to LEAs, to assist with providing special education and related services to children with disabilities ages 3 through 5 and, at a state?s discretion, to 2-year-old children with disabilities who will turn 3 during the school year. The Office of Superintendent of Public Instruction (OSPI) administers the Special Education program (program) in Washington and serves about 143,000 eligible students. The program provides specially designed instruction that addresses the unique needs of a student. OSPI offers the program at no cost to parents, and it includes the related services students need to access their educational program. OSPI spent about $234 million in federal IDEA grant funds during fiscal year 2021 and passed about $230 million of that funding through to LEAs. OSPI also passes funding to educational service districts (ESDs) to help school districts save money by pooling resources, providing essential services for school districts and communities, and helping OSPI implement education initiatives. ESDs spent about three percent of total program funding. Federal law requires OSPI to evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purposes of determining the appropriate amount and type of subrecipient monitoring Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition OSPI did not have adequate internal controls over requirements to perform risk assessments for subrecipients of the Special Education program. As a result, OSPI did not perform risk assessments of any ESDs that received program funding. We consider this internal control deficiency to be a significant deficiency. This issue was not reported as a finding in the prior audit. Cause of Condition OSPI did not consider the ESDs to be subrecipients. Therefore, OSPI has never evaluated each ESD?s risk of noncompliance for the purposes of determining the appropriate amount of subrecipient monitoring. Effect of Condition Without performing risk assessments, management cannot ensure OSPI performs the appropriate amount of monitoring to ensure subrecipients comply with program requirements. Recommendation We recommend OSPI ensure it performs the required risk assessments, which would allow management to evaluate the results, monitor subrecipients appropriately, and demonstrate compliance with federal requirements. Office?s Response The Office concurs with the finding. SAO has recommended OSPI ensure it performs the required risk assessment, which would allow management to evaluate the results, monitor subrecipients appropriately, and demonstrate compliance with federal requirements. OSPI?s Response: Plan Timeline Responsible Staff 1. Revise and expand the form package submitted by Educational Service Districts (ESDs), including the required end of year reporting, to include the submission of documentation related to the activities identified in the Coordinated Services Agreement (CSA). Include factors for timely completion of form package activity due dates, timely submitting end-of-year reporting, and additional items listed below: March-April 2022 Director of Operations, Special Education Executive Director of Special Education Program Improvement Coordinator, Special Education Fiscal Program Supervisor, Special Education a. Documentation submitted by ESD and reviewed by OSPI will include evidence that verifies the implementation of the approved CSA activities, such as time and effort certifications, copies of contracts, contract procurement procedures, professional development agendas, sign-in sheets, etc. March-April 2022 Director of Operations, Special Education Fiscal Program Supervisor, Special Education b. ESDs will submit an end-of-year expenditure report. OSPI will review to verify that the expenditure report contains allowable expenditures and is in alignment with the ESD?s approved CSA. March-April 2022 Director of Operations, Special Education Executive Director of Special Education Fiscal Program Supervisor, Special Education c. The CSA form package will be expanded to include a section to identify contractor name and service provided. OSPI will use this information to request a copy of selected contracts for OSPI review. March-April 2022 Director of Operations, Special Education Fiscal Program Supervisor, Special Education d. Update fiscal/program monitoring guidance to reflect these changes. March-April 2022 Director of Operations, Special Education Fiscal Program Supervisor, Special Education e. Provide professional development/training to ESDs on new process. April-June 2022 Director of Operations, Special Education Executive Director of Special Education Fiscal Program Supervisor, Special Education f. Implement revised process, including OSPI review of all submitted documentation for compliance. 2022-23 school year Director of Operations, Special Education Executive Director of Special Education Program Improvement Coordinator, Special Education Fiscal Program Supervisor, Special Education Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will follow up on the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (b) Evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient?s prior experience with the same or similar subawards: (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Depending upon the pass-through entity?s assessment of risk posed by the subrecipient (as prescribed in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient?s program operations; Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance.

2021-024 Washington State University did not establish adequate internal controls over and did not comply with federal requirements to monitor its third-party servicer for compliance with Federal Perkins Loan Program recordkeeping and record retention requirements. CFDA Number and Title: 84.038 Federal Perkins Loan Program Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: Not applicable Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component Special Tests and Provisions: Perkins Loan Recordkeeping and Record Retention Known Questioned Cost Amount: None Background The Federal Perkins Loan Program and Perkins Loan Extension Act of 2015 awarded loans to undergraduate and graduate students until the program was suspended nationwide on September 30, 2017. Institutions are required to continue servicing their Perkins Loan portfolio (or continue contracting with a third-party servicer) and comply with various repayment, administrative and reporting requirements until they have completed their loan liquidation process and closed out their Perkins Loan program. Institutions must retain original or true and exact copies of promissory and master promissory notes (MPN), repayment records, and cancellation and deferment requests for each Perkins Loan made. They also must retain disbursement records, electronic authentication records and signature authorizations for loans made with a MPN. When an institution uses a third-party servicer for its Perkins Loan program, the institution must perform due diligence monitoring to ensure that its third-party servicer is complying with the requirements for the functions it is performing for the school. The U.S. Department of Education recommends that such monitoring could include obtaining and reviewing the third-party servicer?s most recent Title IV compliance audit. In fiscal year 2021, Washington State University (University) reported approximately $12.7 million in its outstanding Perkins Loan portfolio. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The University did not establish adequate internal controls over and did not comply with federal requirements to monitor its third-party servicer for compliance with Perkins Loan recordkeeping and record retention requirements. The University entered into a contract with its third-party servicer in January 2011 to provide loan processing services and perform, in part, the following functions: ? Retain and maintain electronic records, such as loan profile and payment history, borrower information, and other pertinent loan records ? Perform all due diligence procedures, including timely mailing of grace notices, regular past-due bills, and final demand notices ? Maintain electronically signed MPNs ? Provide borrower outreach and education on repayment, delinquency and default, and required borrower disclosures We found the University did not perform due diligence monitoring of its third-party servicer during the audit period to ensure it complied with Federal Perkins Loans Program requirements. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management was aware of the University?s responsibility of monitoring its third-party servicer for the Perkins Loan program requirements. However, the University did not perform monitoring during the audit period because it experienced turnover in the position responsible for this process. Additionally, management directed staff to assist with a University-wide software system conversion and did not ensure it performed a review of the third-party servicer?s compliance with program requirements as required. Effect of Condition By not monitoring the third-party servicer, the University could not ensure the servicer complied with Title IV requirements to maintain appropriate Perkins Loans records as set forth in federal regulations. Additionally, the University may be subject to sanctions from the federal grantor and be liable for repayment of any improperly spent program funds that the third-party servicer administered. Recommendations We recommend the University: ? Establish adequate internal controls to ensure it performs due diligence monitoring of the functions its third-party servicer performs for the Perkins Loan program in accordance with federal requirements ? Ensure staff have the necessary resources to perform due diligence monitoring of the third-party servicer for compliance, as federal regulations require University?s Response The University agrees with the Condition and the State Auditor?s Office recommendations. As noted, during the audit period, the University experienced turnover in key positions responsible for this oversight. At the same time, and with new employees in place, there was a significant effort to prepare for and implement transition to a new personnel/finance system and a new point of sale system. While these extenuating circumstances impacted implementation of monitoring controls during the audit period, the University commits to ensuring that oversight is performed in the current period and going forward. To this end, the University has established the following procedures for performing the required due diligence in regards to monitoring ECSI, our third-party services provider: ? In August/September the University will request the compliance audit report (SOC) from ECSI for review of compliance with Perkins loan recordkeeping and record retention requirements. ? The University will review that ECSI is in compliance with regulatory requirements and sign and date said report on the date the review occurs. ? For 2021 the report has been requested and reviewed. ? This will be handled by the Bursars Collection manager on a go forward basis with back up to be done by the Bursar. Auditor?s Remarks We thank the University for its cooperation and assistance throughout the audit. We will review the status of the University?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Title 34 U.S. Code of Federal Regulations (CFR) Part 674, Fiscal procedures and records establishes the following applicable requirements: Section 674.19 Retention of Records, states in part: (e) Retention of Records (1) Records. An institution shall follow the record retention and examination provisions in this part and in 34 CFR 668.24. (2) Loan records. (i) An institution shall retain a record of disbursements for each loan made to a borrower on a Master Promissory Note (MPN). This record must show the date and amount of each disbursement. (ii) For any loan signed electronically, an institution must maintain an affidavit or certification regarding the creation and maintenance of the institution's electronic MPN or promissory note, including the institution's authentication and signature process in accordance with the requirements of ? 674.50(c)(12). (iii) An institution shall maintain a repayment history for each borrower. This repayment history must show the date and amount of each repayment over the life of the loan. It must also indicate the amount of each repayment credited to principal, interest, collection costs, and either penalty or late charges. (3) Period of retention of disbursement records, electronic authentication and signature records, and repayment records. (i) An institution shall retain disbursement and electronic authentication and signature records for each loan made using an MPN for at least three years from the date the loan is canceled, repaid, or otherwise satisfied. (ii) An institution shall retain repayment records, including cancellation and deferment requests for at least three years from the date on which a loan is assigned to the Secretary, canceled or repaid. (4) Manner of retention of promissory notes and repayment schedules. An institution shall keep the original promissory notes and repayment schedules until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. (i) An institution shall keep the original paper promissory note or original paper MPN and repayment schedules in a locked, fireproof container. (ii) If a promissory note was signed electronically, the institution must store it electronically and the promissory note must be retrievable in a coherent format. An original electronically signed MPN must be retained by the institution for 3 years after all the loans made on the MPN are satisfied. (iii) After the loan obligation is satisfied, the institution shall return the original or a true and exact copy of the note marked ?paid in full? to the borrower, or otherwise notify the borrower in writing that the loan is paid in full, and retain a copy for the prescribed period. (iv) An institution shall maintain separately its records pertaining to cancellations of Defense, NDSL, and Federal Perkins Loans. (v) Only authorized personnel may have access to the loan documents.

2021-025 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with requirements to ensure it monitored Education Stabilization Fund program subrecipients and that payments to them were allowable and adequately supported. CFDA Number and Title: 84.425D COVID-19 Elementary and Secondary School Emergency Relief (ESSER) Fund 84.425R COVID-19 Coronavirus Response and Relief Supplemental Appropriations Act, 2021 ? Emergency Assistance to Non-Public Schools (CRRSA EANS) 84.425U COVID-19 American Rescue Plan ? Elementary and Secondary School Emergency Relief (ARP ESSER) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: S425D200015; S425D210015 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Subrecipient Monitoring Known Questioned Cost Amount: None Background The U.S. Department of Education distributed funding to multiple federal subprograms of the Education Stabilization Fund (ESF) program. In March 2020, Congress set aside the Elementary and Secondary School Emergency Relief (ESSER) Fund to address the effect that COVID-19 has had, and continues to have, on elementary and secondary schools across the nation. ESSER funds awarded to State Educational Agencies (SEAs) are awarded in the same proportion as each state received funds under Part A of the Title I program in fiscal year 2019. An additional award known as ESSER II was issued in December of 2020 to provide additional funding to schools in the same proportion as Title I, Part A for fiscal year 2020. Additionally, the Emergency Assistance to Non-Public Schools (EANS) program awarded grants by formula to each state governor with an approved Certification and Agreement to provide services or assistance to eligible non-public schools to address the effect that COVID-19 has had, and continues to have, on non-public school students and teachers statewide. The Office of Superintendent of Public Instruction (Office) serves as a pass-through agency to Local Education Agencies (LEAs) for ESF funding. As a pass-through agency, the Office accepts grant applications from LEAs for a variety of federal programs. It reviews and approves the applications that outline proposed projects and services, and LEAs provide budget categories for carrying out these projects. The Office reimburses LEAs through its Grants Claim System (iGrants). The Office approves reimbursement requests as long as grant funds are available in the budgeted categories and are still available for the LEA to use. LEAs are not required to submit any additional supporting documentation with these reimbursement requests. Pass-through entities are required to monitor the activities of subrecipients in order to ensure they are properly using the funds. To ensure federal funds are used only for allowable purposes, meet cost principles and grant requirements, the Office performs annual onsite monitoring of LEAs through its Consolidated Program Review (CPR) process. The CPR includes a review of a selection of reimbursement requests the LEAs submitted during the previous school year. In fiscal year 2021, the Office awarded about $936 million in new ESF subawards to approximately 308 LEAs. The federal grantor has designated the ESF program as a program of higher risk. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and did not comply with requirements to ensure it monitored ESF program subrecipients and that payments to them were allowable and adequately supported. When conducting fiscal monitoring of LEAs through its CPR process, the Office excluded the ESF payments it made during the audit period. Since the Office does not receive supporting documentation with the reimbursement requests that LEAs submit, it did not perform any fiscal monitoring of ESF funds during the audit period. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The CPR process occurs annually in July and August. The Office issued the ESF funds to LEAs beginning in July 2020 (ESSER I) and March 2021 (ESSER II). The Office?s CPR process uses prior year payment information, and management did not design monitoring procedures to address first-year grant awards, such as the ESF grants. Management decided not to review ESF reimbursements during the 2020-21 school year because LEAs had only just started to receive their subawards when the Office was planning the CPR visits. Therefore, management chose to wait until the 2021-22 school year to review ESF reimbursements as part of the CPR. Effect of Condition Without performing fiscal monitoring of its subrecipients of the ESF program, which the federal government has designated as a program of higher risk, the Office cannot reasonably ensure that LEAs are using federal funds only for allowable purposes in accordance with the terms and conditions of the subaward. Additionally, the Office cannot ensure that its reimbursements to LEAs were allowable and supported by adequate documentation. Recommendations We recommend the Office: ? Ensure it performs fiscal monitoring of subrecipients to determine that they are complying with the terms and conditions of the subaward ? Implement additional monitoring procedures for first-year grant awards to ensure the reimbursements it makes to subrecipients are allowable and supported by adequate documentation ? Consider reviewing the reimbursements it made during this audit period to determine if subrecipients used program funds only for allowable activities and in accordance with the terms and conditions of the subaward Office?s Response OSPI included the ESSER programs in its fiscal subrecipient monitoring during the current cycle, performed in the 2021-2022 school year, which included a review of 2019-20 and 2020-21 school year expenditures for these programs. The ESSER programs will also be included in future fiscal subrecipient monitoring through the end of the respective grant periods. We will also ensure that any new federal awards are included in future fiscal subrecipient monitoring. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.302 Financial management, states in part: (a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. See also ? 200.450 Lobbying. (b) The financial management system of each non-Federal entity must provide for the following (see also ?? 200.334, 200.335, 200.336 and 200.337): (4) Effective control over, and accountability for, all funds, property, and other assets. The non-Federal entity must adequately safeguard all assets and assure that they are used solely for authorized purposes. See ? 200.303. (5) Comparison of expenditures with budget amounts for each Federal award.(7) Written procedures for determining the allowability of costs in accordance with subpart E of this part and the terms and conditions of the Federal award. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Depending upon the pass-through entity?s assessment of risk posed by the subrecipient (as prescribed in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient?s program operations; Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-026 The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Education Stabilization Fund programs. CFDA Number and Title: 84.425D COVID-19 Elementary and Secondary School Emergency Relief (ESSER) Fund 84.425R COVID-19 Coronavirus Response and Relief Supplemental Appropriations Act, 2021 ? Emergency Assistance to Non-Public Schools (CRRSA EANS) 84.425U COVID-19 American Rescue Plan ? Elementary and Secondary School Emergency Relief (ARP ESSER) Federal Grantor Name: U.S. Department of Education Federal Award/Contract Number: S425D200015; S425D210015 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Subrecipient Monitoring Known Questioned Cost Amount: None Background The U.S. Department of Education distributed funding to multiple federal subprograms of the Education Stabilization Fund (ESF) program. In March 2020, Congress set aside the Elementary and Secondary School Emergency Relief (ESSER) Fund to address the effect that COVID-19 has had, and continues to have, on elementary and secondary schools across the nation. ESSER funds awarded to State Educational Agencies (SEAs) are awarded in the same proportion as each state received funds under Part A of the Title I program in fiscal year 2019. An additional award known as ESSER II was issued in December of 2020 to provide additional funding to schools in the same proportion as Title I, Part A for fiscal year 2020. Additionally, the Emergency Assistance to Non-Public Schools (EANS) program awarded grants by formula to each state governor with an approved Certification and Agreement to provide services or assistance to eligible non-public schools to address the effect that COVID-19 has had, and continues to have, on non-public school students and teachers statewide. The Office of Superintendent of Public Instruction (Office) serves as a pass-through agency to Local Education Agencies (LEAs) for ESF funding. Pass-through entities are required to monitor the activities of subrecipients in order to ensure they are properly using the funds. To determine the appropriate level of monitoring, federal regulations require the Office to evaluate each subrecipient?s risk of noncompliance with federal statutes and regulations and the terms and conditions of the subaward. In fiscal year 2021, the Office awarded about $936 million in new ESF subawards to approximately 308 LEAs. The federal grantor has designated the ESF program as a program of higher risk. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Office did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the ESF programs. Specifically, the Office did not perform risk assessments of LEAs for any ESF funds awarded during the fiscal year. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Office issued ESF subawards beginning in July 2020. In August 2020, Office management performed centralized risk assessments for other federal programs awarded to LEAs during the audit period. However, Office management chose to wait to perform risk assessments and conduct fiscal monitoring of ESF funds until the 2021-22 school year, which was after the LEAs spent the funds they were awarded during this audit period. Effect of Condition Without performing risk assessments of its subrecipients for the ESF program, which the federal government has designated a program of higher risk, the Office cannot determine the appropriate amount of monitoring required for each subrecipient. It also makes the Office less likely to detect noncompliance with grant terms and conditions and federal regulations. Recommendations We recommend the Office: ? Establish internal controls to ensure it performs risk assessments for each subaward it issues ? Document the results of each completed risk assessment so management can evaluate them and demonstrate compliance with federal requirements ? Modify its risk assessment process to incorporate new federal awards to determine the appropriate level of monitoring for each subrecipient more timely Office?s Response When the risk assessment for the year in question was developed, OSPI was not aware this federal award was required in the risk assessment. When we found out, we did include this federal award in the risk assessment and the result was not a material issue. From the point of this finding OSPI will: ? Establish internal controls to ensure it performs risk assessments for each subaward it issues o As noted, and stated above, the risk assessment has been updated to include the funds in question. ? Document the results of each completed risk assessment so management can evaluate them and demonstrate compliance with federal requirements ? As noted, and stated above, this item will be evaluated when determining for federal compliance. ? Modify its risk assessment process to incorporate new federal awards to determine the appropriate level of monitoring for each subrecipient more timely o As noted, and stated above, the risk assessment will incorporate new and high risk federal awards the year that they are awarded to determine the appropriate level of monitoring. Auditor?s Remarks We thank the Office for its cooperation and assistance throughout the audit. We will review the status of the Office?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.332 Requirements for pass-through entities, states in part: All pass-through entities must: (b) Evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient?s prior experience with the same or similar subawards: (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. (e) Depending upon the pass-through entity?s assessment of risk posed by the subrecipient (as prescribed in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient?s program operations; Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Office of Management and Budget?s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards: 2 CFR 200 ? Frequently Asked Questions, states in part: .331-10 Requirements for Pass-Through Entities. Timing of Subrecipient Risk Assessments Section 200.331(b) indicates that pass-through entities must ?evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring?? Are pass-through entities required to assess the risk of non-compliance for each applicant prior to issuing a subaward? No. While section 200.331(b) requires risk assessments of subrecipients, there is no requirement for pass-through entities to perform these assessments before making subawards. Under the Uniform Guidance, the purpose of these risk assessments is for pass-through entities to determine appropriate subrecipient monitoring. Pass-through entities may use judgment regarding the most appropriate timing for the assessments. Regardless of the timing chosen, the pass-through entity should document its procedures for assessing risk. Section 200.331(b)(1) ? (4) includes factors that a pass-through entity may consider when assessing subrecipient risk.

2021-027 The Department of Social and Health Services did not have adequate internal controls over Random Moment Time Samples and did not comply with some Public Assistance Cost Allocation Plan requirements. CFDA Number and Title: 93.558 Temporary Assistance for Needy Families (TANF) Federal Grantor Name: U.S. Department of Health and Human Services, Administration for Children & Families Federal Award Number: 2001WATANF; 2101WATANF Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed/Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: None Background The Department of Social and Health Services (Department) uses the Random Moment Time Sample (RMTS) as a method for allocating payroll costs for its field operations to state and federally funded programs. Department staff generally work on multiple programs throughout a workday, which makes keeping timesheets difficult and time consuming. RMTS simplifies how the Department allocates salaries and wages to state and federal programs. RMTS is a sampling tool that the Department uses to generate statistically valid statewide estimates of the various activities employees perform. The Department also uses a system called Barcode that allows staff to work on client cases, document information, generate samples and compile RMTS results. The Department includes its use of RMTS in its Public Cost Allocation Plan (PACAP) with the federal grantor. The PACAP is approved annually and outlines the general operating policies and procedures RMTS staff must follow. For RMTS to properly calculate the percentages of activities that Department employees perform, it first must identify a sampling universe that is accurate and complete. The sampling universe must include eligible worker types, and it is updated monthly to ensure it includes all RMTS-eligible employees. RMTS coordinators are responsible for updating the list of employees by the 19th day of each month. Sampled employees are responsible for accurately completing the RMTS samples within two hours of receiving them. RMTS coordinators must complete samples in accordance with the PACAP on behalf of employees who are unavailable to complete them. At the end of the month, the samples are compiled and results are entered into the cost allocation system. During fiscal year 2021, the Department used RMTS to allocate about $77 million in payroll costs to the Temporary Assistance for Needy Families program. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over RMTS and did not comply with some PACAP requirements. The prior finding numbers were 2020-006 and 2019-008. Description of Condition The Department lacked adequate internal controls over RMTS, and it did not comply with some PACAP requirements. In response to the prior audit finding, the Department developed a corrective action plan to address the internal control deficiencies our Office identified. However, the Department had not fully implemented the action plan during the current audit period. During this audit, we identified the following: Monthly employee updates We examined all 12 of the monthly reconciliations the Operation Analyst created and forwarded to the RMTS coordinators to update eligible staff in Barcode. We identified 18 RMTS-eligible employees that were not included in the sampling universe. We also identified nine RMTS-ineligible employees who were included in the sampling universe but should have been removed. All exceptions identified occurred before the full implementation of the corrective action plan. RMTS coordinators completing samples on behalf of sampled employees The PACAP requires RMTS coordinators to respond on behalf of sampled employees who are not on the job at the sample time or unable to respond within two hours. If a sampled employee is on the job and unable to respond within two hours, an RMTS coordinator is required to review systems to determine the employee?s activity during the sample time and complete the sample moment with the appropriate information. We used a statistically valid sampling method to randomly select and examine 58 of the 3,661 RMTS samples that RMTS coordinators completed on behalf of sampled employees who could not respond. We found one instance where the RMTS coordinator completed the employee?s sample without supporting evidence. The PACAP does not allow staff to complete samples without providing supporting evidence. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Monthly employee updates The Department had not fully completed its corrective action plan for the prior audit finding during the current audit period. RMTS coordinators completing samples on behalf of sampled employees An RMTS coordinator made a mistake by not including supporting evidence for the activities the sampled employee performed. Effect of Condition The Department?s inadequate internal controls affected the integrity of its RMTS sampling universe, and it led to the Department using incorrect percentages for federal reimbursement. An incorrect sample could cause the costs that the Department charges to federally funded programs for its field operations to be considered unallowable under the PACAP. When RMTS coordinators complete RMTS samples without supporting documentation, costs for employees? salaries and benefits will be incorrectly allocated to state and federal programs. Recommendations We recommend the Department: ? Implement adequate internal controls to ensure RMTS coordinators properly update the staff list in Barcode ? Monitor to ensure that changes RMTS coordinators make to RMTS samples are adequately supported Department?s Response The Department partially concurs with the audit finding. As part of our corrective action plans for the SFY 2019 audit finding (2019-008) and the SFY 2020 audit finding (2020-006), the Department: ? Implemented a process in January 2021 to ensure monthly staff reconciliations are performed when key personnel are out of the office. The Department also developed standard guidelines and procedures for updating the eligible staff list in Barcode. ? Reviewed the Public Assistance Cost Allocation Plan with the RMTS auditors in January 2021 to ensure they are aware of when it is appropriate to modify an RMTS sample during an audit. ? Implemented a process in February 2021 to conduct a monthly review on a subset of the staff on the reconciliation report to ensure the RMTS coordinators are properly updating the eligible staff list in Barcode. ? Updated current guidance in February 2021 to provide additional examples to staff on types of activities that are appropriate for each selection. ? Completed a one-time review of a subset of RMTS samples in June 2021 to conduct root cause analysis and determine whether additional training, procedure changes or system changes are needed. We concur with the exceptions identified by the auditor. However, we implemented all necessary corrective actions to resolve the control issues by February 2021, which was five months before the end of the SFY 2021 audit period. The exceptions identified by the auditor occurred before February 2021. Due to the timing and frequency of the audits, we acknowledged in our prior audit responses that we would likely see the same findings for the SFY 2020 State of Washington Single Audit and the SFY 2021 State of Washington Single Audit. This is because the state fiscal year spans the period of July 1 through June 30, and the audit process is conducted from August through February (which spans halfway through the next SFY). Therefore, the Department is not made aware of a finding until six months after the SFY is over and only has six months to correct the issue before the next audit begins (which is not always feasible). This means the auditor?s findings from the previous year will still be an exception during at least the first six months of their current audit period. This results in the Department receiving repeat findings for two or three years in a row. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.430 Compensation-personal services, states in part: (5) For states, local governments and Indian tribes, substitute processes or systems for allocating salaries and wages to Federal awards may be used in place of or in addition to the records described in paragraph (1) if approved by the cognizant agency for indirect cost. Such systems may include, but are not limited to, random moment sampling, ?rolling? time studies, case counts, or other quantifiable measures of work performed. (i) Substitute systems which use sampling methods (primarily for Temporary Assistance for Needy Families (TANF), the Supplemental Nutrition Assistance Program (SNAP), Medicaid, and other public assistance programs) must meet acceptable statistical sampling standards including: (A) The sampling universe must include all of the employees whose salaries and wages are to be allocated based on sample results except as provided in paragraph (i)(5)(iii) of this section; (B) The entire time period involved must be covered by the sample; and (C) The results must be statistically valid and applied to the period being sampled. (ii) Allocating charges for the sampled employees' supervisors, clerical and support staffs, based on the results of the sampled employees, will be acceptable. (iii) Less than full compliance with the statistical sampling standards noted in subsection (5)(i) may be accepted by the cognizant agency for indirect costs if it concludes that the amounts to be allocated to Federal awards will be minimal, or if it concludes that the system proposed by the non-Federal entity will result in lower costs to Federal awards than a system which complies with the standards. (6) Cognizant agencies for indirect costs are encouraged to approve alternative proposals based on outcomes and milestones for program performance where these are clearly documented. Where approved by the Federal cognizant agency for indirect costs, these plans are acceptable as an alternative to the requirements of paragraph (i) (1) of this section. (7) For Federal awards of similar purpose activity or instances of approved blended funding, a non-Federal entity may submit performance plans that incorporate funds from multiple Federal awards and account for their combined use based on performance-oriented metrics, provided that such plans are approved in advance by all involved Federal awarding agencies. In these instances, the non-Federal entity must submit a request for waiver of the requirements based on documentation that describes the method of charging costs, relates the charging of costs to the specific activity that is applicable to all fund sources, and is based on quantifiable measures of the activity in relation to time charged. (8) For a non-Federal entity where the records do not meet the standards described in this section, the Federal Government may require personnel activity reports, including prescribed certifications, or equivalent documentation that support the records as required in this section. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (4) Known questioned costs that are greater than $25,000 for a Federal program which is not audited as a major program. Except for audit follow-up, the auditor is not required under this part to perform audit procedures for such a Federal program; therefor, the auditor will normally not find questioned costs for a program that is not audited as a major program. However, if the auditor does become aware of questioned costs for a Federal program that is not audited as a major program (e.g., as part of audit follow-up or other audit procedures) and the known questioned costs are greater than $25,000, then the auditor must report this as an audit finding. (5) The circumstances concerning why the auditor?s report on compliance for each major program is other than an unmodified opinion, unless such circumstances are otherwise reported audit findings in the schedule of findings and questioned costs for Federal awards. (6) Known or likely fraud affecting a Federal program award, unless such fraud is otherwise reported as an audit finding in the schedule of findings and questioned costs for Federal awards. This paragraph does not require the auditor to report publicly information which could compromise investigative or legal proceedings or to make an additional reporting when the auditor confirms that the fraud was reported outside the auditor?s report under the direct reporting requirements of GAGAS. (7) Instances where the results of audit follow-up procedures disclosed that the summary schedule of prior audit findings prepared by the auditee in accordance with ?200.511. Audit findings follow-up, paragraph (b) materially misrepresents the status of any prior audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. DSHS RMTS Program Instructions, Pg. 39-46, states in part: Reports and Analysis The Barcode RMTS database compiles the electronic results information and produces a monthly results summary report. The results from the most recent three months are combined to produce a statistically valid percentage of participation for each program. This information is transmitted to the Office of Accounting Services (OAS) who enters the information into the automated Cost Allocation System. Local RMTS Coordinators By the 19th of each month, the RMTS coordinators must review and update the Barcode list of employees to be sampled to ensure all eligible workers are included for the RMTS sampling. All employees added between the 19th and the date the moments are generated, will be included in the sample pool. Necessary changes to the list of workers must be completed before the samples for that month can be generated. RMTS coordinators are responsible for ensuring the sampled moments are completed. If a sample worker is not on the job or does not respond, the RMTS Coordinator is responsible for responding on behalf of the sampled workers who are not on the job at the sample time or is unable to respond to the sample moment after 2 hours. If the sampled worker was on the job and unable to respond after 2 hours, the Coordinator will review systems to determine worker?s activity during the sample time and complete the sample moment with the appropriate information. RMTS Auditors Of the 1500 random samples moments generated each month, 150 (10%) sample moments are pre-selected for audits when completed. The auditor will log into Barcode and locate the audit from the RMTS- sample list to review the sample results and compare with other resources or systems to determine the accuracy of the sample. Any corrections made by the auditor is included as a final sample response. The auditor must complete the audit of the sample, and make any necessary edits, within 2 business days from the sample completion date.

2021-028 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with Temporary Assistance for Needy Families funds were allowable and properly supported. CFDA Number and Title: 93.558 Temporary Assistance for Needy Families Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2001WATANF; 2101WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Known Questioned Cost Amount: $119,917,902 Background The Department of Social and Health Services (DSHS), Community Services Office, administers the Temporary Assistance for Needy Families (TANF) grant that provides temporary cash assistance for families in need. To receive TANF benefits, participants must be engaged in activities listed in the Individual Responsibility Plan (IRP) through the WorkFirst program, unless the TANF benefits are received only on behalf of a child. TANF grant funds are also used to pay clients? child care costs to meet one of the program?s primary purposes of helping clients obtain employment. Washington has established the Working Connections Child Care (WCCC) program to help eligible working families pay for child care. Both the Department of Children, Youth, and Families (Department) and DSHS administer the program. The Department is responsible for establishing policies and procedures for licensing child care providers and paying providers for allowable child care services. DSHS determines TANF client eligibility and reimburses the Department for child care payments under an agreement with the Department. The Department uses its Social Service Payment System (SSPS) to process the payments it makes to child care providers. The system allocates payments to various funding sources, partially based on the eligibility of the client. These funding sources include multiple federal programs, multiple Child Care Development Fund (CCDF) federal grant awards, and state funding. The Department uploads the payment data into the state?s accounting system at a summary level based on the various funding sources. DSHS worked with the Department to setup coding in the Payment Allocating Model (PAM) system that looks at the client-level information and then assigns the correct TANF source of funds. Once source of funds is identified, that information is then sent to the SSPS for allocation assignment. The Department prepares electronic reports for funds allocated to TANF funding sources and sends DSHS a monthly bill. There is always a need to transfer the funding sources for some payments throughout the year to manage federal and state funds properly. In prior audit periods, the Department prepared supporting documentation for transfers that included details of what payments it was transferring. The purpose of documenting this detail was to maintain proper support for federal expenditures. Some payments the Department makes for child care are funded by both the CCDF and TANF grants. While the two federal programs are separate, the requirements and policies in Washington for child care payments are consolidated under the WCCC program. Federal regulations require grant fund expenditures to be adequately supported to show that they have been used in accordance with program requirements. In fiscal year 2021, DSHS paid the Department $119,917,902 of TANF funds for child care services that were funded at least partially with federal TANF grant funds. Federal regulations require recipients to establish and follow internal controls that ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers paid with TANF funds were allowable and properly supported. In order to identify payments the Department made to child care providers that were funded by TANF, we requested a population of payments charged to TANF sources from SSPS. However, for fiscal year 2021, management informed us the Department recently changed its grant management practices to process expenditure transfers at the grant level. This new process made the original expenditure coding in SSPS inaccurate and unreliable for testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent TANF funds in accordance with federal and state regulations. As a result, we could not test the Department?s payments to child care providers for compliance with activities allowed and cost principles. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. Management decided to modify the Department?s accounting practices in a way that now prevents it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions from SSPS that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. By processing these adjustments at the fund level, the Department invalidated the transaction-level documentation of the original child care expenditure in SSPS and did not identify the new allocation at the payment level. Additionally, the Department transferred some of these child care expenditures more than once at the fund level, making the underlying data increasingly unreliable with each transfer. DSHS paid TANF funds to the Department based on the understanding that it had implemented and followed the agreed upon PAM process and that payments were traceable to the expenditure level. Therefore, DSHS relied on the Department?s accounting system and internal controls to support the reports it received when the Department requested reimbursement of TANF funds. Effect of Condition and Questioned Costs By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit the federal dollars it used for payments to child care providers. Because we could not test transaction-level detail, we also could not determine whether the issues we identified in prior audits had improved or worsened, including the Department?s lack of adequate internal controls and significant rate of noncompliance for payments to child care providers. The total amount of known child care payments with federal TANF funds in the audit period was $119,917,902. Because the Department did not comply with federal requirements to allow for the tracing of grant expenditures to a payment level, we are questioning all $119,917,902 in federal program costs the Department incurred during the audit period. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules ? Update service level agreements with DSHS to ensure payments are sufficient and properly supported ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor?s Office?s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. The Department has managed the WCCC program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the TANF and CCDF grants. The Department allocated the TANF and CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This consisted of making significant grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The volume increased this year in comparison to previous years due to the Department?s implementation of changes to the SSPS system which were not in place until March 2021 resulting in adjustments to July through February data. The Department?s grant adjustments were processed based on eligible clients and allowable activities. However, the adjustments did not include child level data as suggested in 2 CFR 200.302. The Department will work to improve our internal controls. The Department does not currently have the staff to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. The Department will review options available for processing adjustments to include transaction-level data that is sufficient to comply with federal regulations. In addition, the Department will work with the Department of Social and Health Services (DSHS) to amend the current Service Level Agreement between DSHS and the Department related to TANF funding for WCCC provider payments to ensure the Department follows the agreed upon PAM process and that payments are traceable to the expenditure level. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-029 The Department of Social and Health Services did not have adequate internal controls over and did not comply with federal requirements to reduce or deny assistance to recipients of the Temporary Assistance for Needy Families grant who did not cooperate with the child support program. CFDA Number and Title: 93.558 Temporary Assistance For Needy Families Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2001WATANF; 2101WATANF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Child Support Noncooperation Known Questioned Cost Amount: $142 Background The Department of Social and Health Services (Department) administers the Temporary Assistance for Needy Families (TANF) grant that provides temporary cash assistance for families in need. To receive TANF benefits, participants must be engaged in entering the workforce through the Work First program, with limited exceptions. State agencies must meet or exceed minimum annual work participation rates of 50 percent overall and 90 percent for two-parent families. The Department spent more than $309 million in federal grant funds during fiscal year 2021. Federal regulations require the state agency responsible for administering the state plan under Title IV-D of the Social Security Act to determine when an individual is not cooperating with the state in establishing paternity, or in establishing, modifying or enforcing a support order with respect to a child of the individual. When it identifies non-cooperation, it is to report that information to the state agency responsible for the TANF program. The TANF program must then deduct an amount equal to not less than 25 percent from the individual?s TANF assistance and may deny the family any TANF assistance. In Washington, the Department performs both functions and therefore there is no second agency involved in this requirement. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to reduce or deny TANF assistance when recipients did not cooperate with the child support program. During fiscal year 2021, the Department referred 12 cases of child support noncooperation for further sanctions. However, we found one instance (8 percent) where the Department did not properly reduce the TANF assistance. In this one case, management did not detect a data input error by staff, and therefore, the Department did not properly reduce TANF assistance. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The staff member who made the data input error was in training at the time they made the error. Management did not detect the error because it has not implemented sufficient internal controls. Effect of Condition and Questioned Costs By not implementing adequate internal controls, the Department did not materially comply with federal requirements. Additionally, the one instance where the Department did not reduce the TANF assistance resulted in an overpayment of $142. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Improve its internal controls to ensure it reduces or denies TANF assistance when recipients are not cooperating with the child support program ? Consult with the federal grantor about whether or not the questioned costs identified should be repaid Department?s Response The Department partially concurs with this audit finding. The Department does not concur with the State Auditor?s Office (SAO) determination that a total population of 12 cases has a direct and material effect on the program. Our concern is around the SAO?s objectivity. In response to the pandemic, the IV-D program implemented a Policy Clarification Memo changing the process on how the IV-D program determines non-cooperation. This policy change reduced the number of non-cooperation cases the IV-D program sent to the IV-A program during the fiscal year. The Department believes the SAO had a preconception about the program?s objectives. When SAO learned the IV-A program had received a significantly lower number of non-cooperation cases from the IV-D program then previous years, they crept outside the scope of the audit requesting the IV-D program?s policies and procedures around determining non-cooperation, as well as verification that the Federal Office of Child Support Enforcement had approved the IV-D program?s policy change for determining non-cooperation. When the Department questioned this scope creep, SAO did reach out to the federal grantor for clarification and was able to determine that they did not need confirmation that the IV-D program?s policy was properly authorized. Regarding the scope creep, the SAO stated they ?do not view the two divisions within DSHS to be separate agencies as defined in the compliance supplement and therefore approach our testing with the understanding that DSHS is both the Title IV-D agency and the TANF (IV-A) agency.? While the Department manages both the IV-A and IV-D programs, these are still separate entities with different objectives and compliance requirements. The audit objective is to determine whether, after notification by the state Title IV-D agency, the TANF agency has taken necessary action to reduce assistance. The specific compliance requirement is outlined in 45 CFR 264.30(b) and (c) states: (b) If the IV-D agency determines that an individual is not cooperating, and the individual does not qualify for a good cause or other exception established by the State agency responsible for making good cause determinations in accordance with section 454(29) of the Act or for a good cause domestic violence waiver granted in accordance with ? 260.52 of this chapter, then the IV-D agency must notify the IV-A agency promptly. (c) The IV-A agency must then take appropriate action by: (1) Deducting from the assistance that would otherwise be provided to the family of the individual an amount equal to not less than 25 percent of the amount of such assistance. The IV-D program?s policies and procedures for determining non-cooperation are not relevant to the SAO determining if the IV-A program took the appropriate actions upon receipt of the non-cooperation case. The Department understands the SAO?s questions regarding the decrease in non-cooperation cases received by the IV-A program; however, once the SAO learned the decrease was not caused by any programmatic errors in the electronic notification process between the two programs, they should have then evaluated if the small number of non-cooperation cases received would likely have a direct and material effect on the program. The Department believes the SAO?s preconceptions on the program?s objectives impacted their decision. When the Department questioned the direct and material effect the 12 non-cooperation cases has on the program, the SAO stated: ?For the TANF non-cooperation requirement, the team learned through meetings with staff that the (IV-D) program significantly changed its approach during the pandemic in how it chose to refer cases to CSD. With this significant procedural change along with the knowledge that DSHS staffing was negatively impacted by the COVID-19 pandemic, the team felt there was an increased risk to meeting federal requirements despite the prior years of no significant audit issues. These factors made the team consider the requirement material to the program and I agree with that assessment.? The IV-D program?s policies and procedures do not affect the IV-A program?s ability to reduce TANF assistance upon receipt of the non-cooperation case as required by 45 CFR 264.30 and should not have been a factor in determining whether the 12 non-cooperation cases received by the IV-A program were likely to have a direct and material effect on the IV-A program. In addition, the Department?s IV-A program never stated that staffing was negatively impacted by the COVID-19 pandemic or that it affected their ability to process non-cooperation notices. Public confidence is maintained by auditors? integrity which includes performing their work with an attitude that is objective and fact based. The Department also does not concur that adequate internal controls were not in place. When a non-cooperation case is received and good cause is not applicable, the worker takes action by updating the case as ?not cooperating? in the Automated Client Eligibility System (ACES). This status update triggers a reduction in TANF assistance. The system has controls in place to alert the worker when there is no change to the client?s benefit amount, which should prompt the worker to review the coding of the case. The Department does concur one case did not have its TANF assistance properly reduced. When the Department?s IV-A program is notified of non-cooperation, staff take action by entering the non-cooperation in the Automated Client Eligibility System (ACES). For non-cooperation cases where good cause is not applicable, the worker would update the following fields on the ?Non-Custodial Parent? page of ACES: ? IV-D Cooperation field is changed to No (N) from the dropdown; and ? Status is changed to Not Cooperating (NC) When the worker updates both aforementioned fields as not cooperating, it results in a reduction of the TANF assistance. There is a system control so if the worker only updates one of the two aforementioned fields as ?not cooperating,? then the system alerts the worker with a warning message that ?Eligibility Recalculation results in no change.? The worker must then review the details screen which shows the previous benefit amount and the new benefit amount as unchanged and again displays a highlighted warning message that the ?Eligibility Recalculation results in no changes.? The worker must review and click ?confirm benefits? to process the action. The worker then documents their actions in the narrative screen using an auto populated template of the actions they took which again states if there was a change in benefits. The worker who processed the single non-cooperation case in question was in-training at the time the error was made, did not have the full understanding that benefits would be reduced as a result of non-cooperation, and therefore did not take action to review the coding when prompted by the system alerts. Upon discovery of the error, the IV-A program immediately corrected the case to properly code it as ?not cooperating? and processed an overpayment for the appropriate amount. In addition, the IV-A program followed up with the worker to go over the error and prevent future errors. To further address the finding, the department will: ? Continue existing regular auditing of the TANF program and further address the correct coding of noncooperation notices during a statewide policy announcement. ? Continue to review internal controls and analyze if further advancements are needed. Auditor?s Remarks The Department asserts that we ?crept outside of the scope of the audit? when we performed procedures to determine why the number of non-cooperative cases the Department identified decreased by 99.5 percent, from 2,437 to 12, in one year. This level of fluctuation in a federal program is rare and may be an indicator of significant changes in process or potential issues. In our judgment, not inquiring with management and following up on this decrease would have not been exercising good professional judgement or due diligence. It does not constitute scope creep. The Department asserts that this Special Test and Provision should not have been audited due to only 12 cases being processed during the audit period. Auditors apply both quantitative and qualitative factors when determining whether a compliance requirement is direct and material to a federal program. Materiality for this compliance requirement cannot be determined based solely on quantitative criteria. Relying on dollar amounts alone would result in this requirement never being material compared to program expenditures, and therefore it would never be tested. Instead, it is determined material for qualitative reasons, due to the nature of the requirement. This is not uncommon for Special Tests and Provisions. Federal grantors specifically include them in the compliance supplement because they want auditors to examine them and they do not fall within the standard compliance requirements. The Department also does not concur that adequate internal controls were not in place to prevent noncompliance. The Department acknowledges that the worker who processed the noncompliant case made an error. The Department said it corrected the error upon discovery. However, the Department did not detect the error; it was only made aware of the error by the auditor who performed the testing. The internal control weakness identified was not the error itself, but that management had not implemented an internal control to detect this type of error and is therefore reliant on the worker unfailingly entering correct information. This weakness in the design of the internal control structure at the Department, in our judgment, led to material noncompliance during the audit period. We reaffirm our finding, and we will follow up on the Department?s corrective action during the next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. Title 42 U.S. Code of Federal Regulations Part A ? Block Grants to States for Temporary Assistance for Needy Families establishes the following requirements: Section 608, Prohibitions; Requirements states in part: (2)Reduction or elimination of assistance for noncooperation in establishing paternity or obtaining child support If the agency responsible for administering the State plan approved under part D determines that an individual is not cooperating with the State in establishing paternity or in establishing, modifying, or enforcing a support order with respect to a child of the individual, and the individual does not qualify for any good cause or other exception established by the State pursuant to section 654(29) of this title, then the State? (A)shall deduct from the assistance that would otherwise be provided to the family of the individual under the State program funded under this part an amount equal to not less than 25 percent of the amount of such assistance; and (B)may deny the family any assistance under the State program. Section 609, Penalties states in part: (8) Noncompliance of State child support enforcement program with requirements of part D (A) In general If the Secretary finds, with respect to a State?s program under part D, in a fiscal year beginning on or after October 1, 1997? (i)(I) on the basis of data submitted by a State pursuant to section 654(15)(B) of this title, or on the basis of the results of a review conducted under section 652(a)(4) of this title, that the State program failed to achieve the paternity establishment percentages (as defined in section 652(g)(2) of this title), or to meet other performance measures that may be established by the Secretary; (II) on the basis of the results of an audit or audits conducted under section 652(a)(4)(C)(i) of this title that the State data submitted pursuant to section 654(15)(B) of this title is incomplete or unreliable; or (III) on the basis of the results of an audit or audits conducted under section 652(a)(4)(C) of this title that a State failed to substantially comply with 1 or more of the requirements of part D (other than paragraph (24), or subparagraph (A) or (B)(i) of paragraph (27), of section 654 of this title); and (ii) that, with respect to the succeeding fiscal year? (I) the State failed to take sufficient corrective action to achieve the appropriate performance levels or compliance as described in subparagraph (A)(i); or (II) the data submitted by the State pursuant to section 654(15)(B) of this title is incomplete or unreliable; the amounts otherwise payable to the State under this part for quarters following the end of such succeeding fiscal year, prior to quarters following the end of the first quarter throughout which the State program has achieved the paternity establishment percentages or other performance measures as described in subparagraph (A)(i)(I), or is in substantial compliance with 1 or more of the requirements of part D as described in subparagraph (A)(i)(III), as appropriate, shall be reduced by the percentage specified in subparagraph (B). (B) Amount of reductions The reductions required under subparagraph (A) shall be? (i) not less than 1 nor more than 2 percent; (ii) not less than 2 nor more than 3 percent, if the finding is the 2nd consecutive finding made pursuant to subparagraph (A); or (iii) not less than 3 nor more than 5 percent, if the finding is the 3rd or a subsequent consecutive such finding. (C) Disregard of noncompliance which is of a technical nature For purposes of this section and section 652(a)(4) of this title, a State determined as a result of an audit? (i) to have failed to have substantially complied with 1 or more of the requirements of part (D) shall be determined to have achieved substantial compliance only if the Secretary determines that the extent of the noncompliance is of a technical nature which does not adversely affect the performance of the State?s program under part D; or (ii) to have submitted incomplete or unreliable data pursuant to section 654(15)(B) of this title shall be determined to have submitted adequate data only if the Secretary determines that the extent of the incompleteness or unreliability of the data is of a technical nature which does not adversely affect the determination of the level of the State?s paternity establishment percentages (as defined under section 652(g)(2) of this title) or other performance measures that may be established by the Secretary. Title 45 U.S. Code of Federal Regulations (CFR) Part 264, Other Accountability Provisions, establishes the following applicable requirements: Section 264.30 ? What procedures exist to ensure cooperation with the child support enforcement requirements? (a) (1) The State agency must refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency (i.e., the IV-D agency). (2) Referred individuals must cooperate in establishing paternity and in establishing, modifying, or enforcing a support order with respect to the child. (b) If the IV-D agency determines that an individual is not cooperating, and the individual does not qualify for a good cause or other exception established by the State agency responsible for making good cause determinations in accordance with section 454(29) of the Act or for a good cause domestic violence waiver granted in accordance with ? 260.52 of this chapter, then the IV-D agency must notify the IV-A agency promptly. (c) The IV-A agency must then take appropriate action by: (1) Deducting from the assistance that would otherwise be provided to the family of the individual an amount equal to not less than 25 percent of the amount of such assistance; or (2) Denying the family any assistance under the program. Section 264.31 ? What happens if a State does not comply with the IV-D sanction requirement? (a) (1) If we find that, for a fiscal year, the State IV-A agency did not enforce the penalties against recipients required under ? 264.30(c), we will reduce the SFAG payable for the next fiscal year by one percent of the adjusted SFAG. (2) Upon a finding for a second fiscal year, we will reduce the SFAG by two percent of the adjusted SFAG for the following year. (3) A third or subsequent finding will result in the maximum penalty of five percent. (b) We will not impose a penalty if: (1) The State demonstrates to our satisfaction that it had reasonable cause pursuant to ? 262.5 of this chapter; or (2) The State achieves compliance under a corrective compliance plan pursuant to ? 262.6 of this chapter. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-030 The Department of Social and Health Services improperly charged $224,752 for the Child Support Enforcement and Child Support Enforcement Research programs. CFDA Number and Title: 93.563 Child Support Enforcement 93.564 Child Support Enforcement Research Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2001WACSES; 2101WACSES Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Known Questioned Cost Amount: $224,752 Background As a condition of receiving federal grant funds, the Department of Social and Health Services (Department) must submit a public assistance cost allocation plan (PACAP) to the U.S. Department of Health and Human Services (DHHS) each state fiscal year. The PACAP describes how the Department allocates costs to all funding sources, including federal grants. If the state amends its PACAP and fails to submit it to DHHS, the costs improperly claimed will be disallowed. The Department uses the Cost Allocation System (CAS), a subsystem of the Agency Financial Reporting System (AFRS), to execute its PACAP. The Department develops appropriate methodologies that automatically distribute the cost of payments to either state, local or federal funding sources. As part of its cost allocation process, the Department establishes bases that are used to distribute costs to multiple funding sources. Each base consists of elements that are assigned a percentage that dictates how much of the original payment is allocated to it. Each base is required to be included in the PACAP. The Department is required to submit an amended PACAP any time its cost allocation plan changes. In fiscal year 2021, the Department used CAS to allocate about $4.5 billion in costs to federal programs. Description of Condition The Department improperly charged $224,752 for the Child Support Enforcement and Child Support Enforcement Research programs. During our review, we identified 97 bases that the Department used during state fiscal year 2021. Out of those bases, we identified two bases that were not included in the PACAP. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a Single Audit exceed $25,000. As stated in the Effect of Condition and Questioned Cost section below, we are issuing this finding because the identified questioned costs exceed that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition The bases were not originally intended to be used for administrative costs, and staff inadvertently omitted language from the PACAP when the plans changed. Effect of Condition and Questioned Costs We are questioning $224,752 the Department improperly charged these programs. This includes: ? $148,336 charged to the Child Support Enforcement program ? $76,416 charged to the Child Support Enforcement Research program We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid ? Strengthen internal controls to ensure all bases are included in the PACAP Department?s Response The Department partially concurs with the audit finding. The Department concurs we inadvertently omitted language from the Public Assistance Cost Allocation Plan (PACAP). Upon discovery of this error, the Department updated the PACAPs for state fiscal years 2021 and 2022 to include the bases for the Child Support Enforcement and the Child Support Enforcement Research Programs, and resubmitted the PACAPs to the federal grantor. To ensure ongoing accuracy of the PACAP, effective October 10, 2021, the Department implemented a quarterly review of all administrative expenditures to confirm all bases are included in the PACAP. The Department does not concur that we improperly charged these funds to the Child Support Enforcement and Child Support Enforcement Research programs. The federal grantor awarded the Department the funds for the purpose for which we used them. This was strictly a technical error in the PACAP. If the grantor contacts the Department regarding the questioned costs, the Department will discuss the manner in which we used the funds with the grantor and will take additional action if appropriate. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. As stated above in the Description of Condition, the Department did not include the cost bases related to Child Support Enforcement and Child Support Enforcement Research in its PACAP submitted to the federal grantor, and therefore the federal grantor could not have been aware of the Department?s intent to apply federal funds from those awards to costs incurred by the Department. 45 CFR 95.919 states that ?if costs under a Public Assistance program are not claimed in accordance with the approved cost allocation plan, or if the State failed to submit an amended cost allocation plan as required by ?95.509, the costs improperly claimed will be disallowed.? Therefore, we reaffirm the finding and will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. Title 45 U.S. Code of Federal Regulations (CFR), Subtitle A, Subchapter A, Part 95, General Administration-Grant Programs(Public Assistance, Medical Assistance and State Children?s Health Insurance Programs, states in part: 95.509 Cost allocation plan amendments and certifications. (a) The State shall promptly amend the cost allocation plan and submit the amended plan to the DCA Director when changes occur. (b) If a State has not submitted a plan or plan amendment during a given State fiscal year, an annual statement shall be submitted to the DCA Director certifying that it?s approved cost allocation plan is not outdated. This statement shall be submitted within 60 days after the end of that fiscal year. 95.517 Claims for Federal financial participation. (a) A State must claim FFP for costs associated with a program only in accordance with its approved cost allocation plan. However, if a State has submitted a plan or plan amendment for a State agency, it may, at its option claim FFP based on the proposed plan or plan amendment, unless otherwise advised by the DCA. However, where a State has claimed costs based on a proposed plan or plan amendment the State, if necessary, shall retroactively adjust its claims in accordance with the plan or amendment as subsequently approved by the Director, DCA. The State may also continue to claim FFP under its existing approved cost allocation plan for all costs not affected by the proposed amendment. 95.519 Cost disallowance. If costs under a Public Assistance program are not claimed in accordance with the approved cost allocation plan, or if the State failed to submit an amended cost allocation plan as required by ?95.509, the costs improperly claimed will be disallowed.

2021-031 The Department of Commerce did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act. CFDA Number and Title: 93.568, Low-Income Home Energy Assistance 93.568, COVID-19 Low-Income Home Energy Assistance Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2001WALIEA; 2001WALIE4; 2101WALIEA; 2101WAE5C6 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Department of Commerce (Department) administers the Low-Income Home Energy Assistance program (program), which provides financial assistance to low-income households to meet their home energy needs. The Department makes subawards to community-based organizations to provide this assistance. In fiscal year 2021, the Department spent over $58 million in federal program funds, approximately $52 million of which it paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Department is required to collect and report information on each subaward of federal funds more than $25,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). For federal awards issued on or after November 12, 2020, the monetary threshold for reporting increased to $30,000. The Department must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower citizens with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. During the audit period, the Department was required to report approximately $65.6 million of program funds that it awarded to 26 subrecipients. We found the Department did not report any of these subawards in FSRS as required. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Department officials said they were not aware of the reporting requirements, and the grant award?s terms and conditions did not specify the Act?s reporting requirements. Additionally, management did not identify all reporting requirements of 2 CFR Subtitle A, Part 170 and, as a result, did not detect the applicability of the Act?s reporting requirements to its subawards. Effect of Condition Failing to submit the required reports diminishes the federal government?s ability to ensure accountability and transparency of federal spending. The terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance by suspending or terminating the federal award or withholding future awards. Recommendations We recommend the Department: ? Establish effective internal controls to ensure reports are submitted as required ? Establish policies and procedures for filing required reports ? Provide training for employees who oversee reporting and who verify the submission and accuracy of the reports ? Ensure management monitors reporting of this information to ensure future reports are submitted completely and timely Department?s Response The Department concurs with the finding. History The Federal Funding Accountability and Transparency Act (FFATA) was signed on September 26, 2006. This legislation intends to empower every American to hold the government accountable for spending decisions. The Commerce LIHEAP team understands and values this work. The LIHEAP program was completing this requirement of reporting. In 2015 Commerce underwent a FFATA process mapping exercise to ensure that each federal program met this requirement. In addition, the agency implemented a FFATA training to ensure compliance among agency staff. Around 2017 our team incorrectly interpreted the need to continue entering the contract amounts into the database. The incorrect interpretation was around what would continue to be tested in the LIHEAP Program audits and the federal compliance supplement. Solution to Finding The LIHEAP team walked through the specifics of the finding and developed written procedures to train staff on FFATA. Effective immediately, LIHEAP will add FFATA reporting to their funding obligation and contracting process. Our team has set an internal deadline for completing the FFATA reporting for no later than 30 days after the CSHD assistant director signs the obligation memo. The signed obligation memo ensures that the amounts that are contracted to LIHEAP agencies have been vetted through division budget staff, the community economic opportunities managing director, and the CSHD assistant director. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Title 2 U.S. Code of Federal Regulations (CFR) Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 ? Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) 3. What to report. You must report the information about each obligating action that the submission instructions posted at http://www.fsrs.gov specify.

2021-032 The Department of Commerce did not have adequate internal controls over and did not comply with reporting requirements for the Low-Income Home Energy Assistance Program. CFDA Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2001WALIEA; 2001WALIE4; 2101WALIEA; 2101WAE5C6 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The U.S. Department of Health and Human Services, through the Office of Community Services at the Administration for Children and Families, administers the Low-Income Home Energy Assistance Program (LIHEAP). The agency distributes LIHEAP block grant funds by formula to states, the District of Columbia, and territories. In Washington, the Department of Commerce (Department) administers LIHEAP, which provides financial assistance to low-income households to meet their home energy needs. The Department makes subawards to community-based organizations to provide this assistance. The Department is required to file the Annual Report on Households Assisted by LIHEAP, which consists of six different sections that outline assistance given to households and households applying for assistance. Two key sections are: 1. The number and income levels of households granted assistance under the Coronavirus Aid, Relief and Economic Security (CARES) Act or LIHEAP (heating, cooling, crisis, and weatherization); and 2. The number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household that receives funding under the CARES Act or LIHEAP. In fiscal year 2021, the Department spent over $58 million in federal program funds. Of this amount, the Department paid more than $51 million to subrecipients. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding reporting requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure the Annual Report on Households Assisted that it submitted was accurate and complete. The Department was unable to provide us with the source documentation it used to prepare the report. We examined the report the Department submitted for the federal fiscal year ended September 30, 2020, and attempted to reperform the Department?s calculations using data the Department pulled from its LIHEAP database. The Department informed us this data did not contain sufficient information to fully reperform all calculations for the program year under review. Based on the data the Department provided, we found eight of the 14 fields (57 percent) required under section one and four of the 10 fields (40 percent) required under section two of the report were materially inaccurate. The difference between values reported and the data provided varied between 13 and 656 percent. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition During the audit period, the Department designed an automated system to sort and categorize funds that were traditional LIHEAP and funds that were from the Coronavirus Relief Fund, and automatically populate those numbers on the report. However, the data did not contain information necessary to identify the funding source of each household benefit payment, and the staff responsible for preparing and submitting the report did not retain the data used to support the amounts listed in the report. Although management reviewed the report, it did not ensure staff retained the supporting data to evidence the accuracy of the report. Effect of Condition By not retaining supporting documentation for the report, management was unable to demonstrate the amounts the Department reported to the federal grantor were complete and accurate. Additionally, the terms and conditions of the federal award allow the grantor to penalize the Department for noncompliance with reporting requirements by suspending or terminating the award, or withholding future awards, should it choose to do so. Recommendations We recommend the Department: ? Establish effective internal controls to ensure queries of household expenditure data are configured appropriately to produce accurate results for reporting ? Strengthen its management reviews to ensure amounts reported are accurate and adequate documentation is retained to support amounts included in the reports ? Provide any necessary training for employees who oversee reporting and verify the submission and accuracy of the reports ? Consult with the federal grantor to determine if a revision and resubmission of the report is necessary to correct amounts reported under sections one and two Department?s Response While the program concurs with the finding of not retaining supporting documentation for the report, we will dispute being unable to demonstrate the amounts the Department reported to the federal grantor were complete and accurate. The program manager offered to provide the necessary documentation if provided with enough time. The program manager?s best estimate was that three months would be needed to complete the data analysis. A condition of the funding Commerce was awarded was being able to track whether the funds were spent and to which grant they were charged. That information for the period of review was from the Commerce Contract Management System (CMS) and required the program to review each month?s invoices for each contractor by contract. This was completed and reported. Receiving the funds after the start of the regular LIHEAP program year left the program without sufficient time to change the LIHEAP database. Interrupting the availability of the database would hinder services to Washington residents, and the program manager opted to move forward and pull the necessary data from the CMS system and match CMS spending reports to the LIHEAP data system reports by month. Since the fiscal year 2020 report was submitted to the United States Department of Health and Human Services, the developer for the LIHEAP program has retired, and the program has hired a new developer. The program has begun a modernization effort for the LIHEAP database that is planned for implementation from July 2022 through September 2022. One of the first tasks completed by the new developer was to add contract numbers to the LIHEAP database, which has been in place since LIHEAP program year 2021. Contractors must enter a contract number for every benefit awarded in the LIHEAP data system. The second task was to update the reports to include the ability to pull all administration reports by contract number, date range, and benefit type. Commerce supports that this issue has been resolved. We thank the State Auditor?s Office for the opportunity to respond to this exception. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. As stated above in the Description of Condition, the Department did not retain supporting documentation provided with the draft report to management for review, and therefore it did not have source documentation readily available for review during the audit. The timeframe noted in the Department?s response to re-create the source documentation necessary to support amounts listed in the household report exceeded the duration of our audit field work, and therefore was not considered. We reaffirm the finding and will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Tread way Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, and paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Title 2 U.S. Code of Federal Regulations (CFR) Part 170, Annual Report on Households Assisted by LIHEAP (OMG No. 0970-0060), states in part: As part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. Territories with annual allotments of less than $200,000 and all Indian tribes are required to report only on the number of households served for each program component (42 USC 8629; 45 CFR section 96.82). Section 309 of the Human Services Amendments of 1994, Public Law 103-252, amended section 2605(c)(1)(G) of the LIHEAP statute requires grantees, as part of their annual LIHEAP grant application, to report certain data on households which apply for LIHEAP assistance and on households which receive LIHEAP assistance in the most recent Federal Fiscal Year. To separately identify the impact of supplemental federal LIHEAP funding, HHS expanded the LIHEAP Household Report - Long Form for FFY 2020. For each item in the report, the revised form now includes three lines: ? The first line is for grantees to report information for all applicable households regardless of funding source. This is consistent with what grantees were required to report in the past. Grantees should report the total count of households, counting each household once if it received that type of assistance during FY 2020. ? The second line is for grantees to report information for all applicable households that were assisted with CARES Act supplemental LIHEAP funding. Include households that received a benefit that was fully or partially funded with CARES Act funds. Exclude households that did not receive a benefit that was fully or partially funded by CARES Act funds. ? The third line is for grantees to report information for all applicable households that were assisted with other federal supplemental LIHEAP funding (not including CARES Act funding), if any. (Not Applicable). For each funding category, count a household once that received at least one type of LIHEAP assistance regardless of the type(s) of assistance provided to a household. For example, if a household received three heating assistance benefits, one winter crisis assistance benefit, and one cooling assistance benefit, then count that household only once under ANY Type of LIHEAP assistance. If a household only received a SNAP nominal benefit and no other LIHEAP assistance, it should not be included in the number of households receiving any type of assistance. The U.S. Department of Health and Human Services, Division of Energy Assistance, Office of Community Services, Administration of Children and Families? Instructions for the LIHEAP Household Report Long Form FY2020, states in part: Introduction: Federal LIHEAP Funds The purpose of the LIHEAP Household Report is to report on the number of households assisted with available federal LIHEAP funds during FY 2020, including those LIHEAP funds obligated in FY2019 but not expended until FY 2020. LIHEAP funding includes all federal funds allocated to LIHEAP. General Requirements: Reporting Period Household data are for the reporting period for FY2020 (October 1, 2019 ? September 30, 2020). Grantees may operate their programs on a different program year (e.g. starting January 1 or July 1). However, complete household data still need to be reported for the reporting period of FY 2020. Data Consistency The data will be checked for consistency against the type of LIHEAP assistance that states report in their LIHEAP Model Plan for FY 2020 and later with the data reported in each state?s LIHEAP Performance Data Form for FY 2020. For example, if obligated funds are reported for cooling assistance and there are no household data reported for cooling assistance, then the state should include a note which explains the inconsistency. States may correct such issues by creating a revision and submitting their LIHEAP Household Report or LIHEAP Performance Data Form in OLDC.

2021-033 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers for the Child Care and Development Fund Cluster programs were allowable and properly supported. CFDA Number and Title: 93.575 Child Care and Development Block Grant 93.575 ? COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: G1901WACCDF, 2003WACCDF, 2103WACCDF, 2003WACCC3, 2103WACCS5 Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $271,353,409 Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2021, the Department spent about $327.5 million in CCDF federal funding, which was an increase of about $82 million compared to the prior fiscal year. The Department is responsible for establishing policies to ensure payments to providers for child care services are allowable. In fiscal year 2021, the Department spent over $271 million on monthly child care subsidy payments to child care providers. There are three child care provider types: licensed centers, licensed family homes, and licensed exempt providers referred to as Family, Friends and Neighbor providers. The Department uses a payment system to process the payments it makes to child care providers. The system allocates payments to various funding sources, partially based on the eligibility of the client. These funding sources include multiple federal programs, multiple CCDF federal grant awards, and state funding. The Department uploads the payment data into the state?s accounting system at a summary level based on the various funding sources. There is always a need to transfer the funding sources for some payments throughout the year to manage federal and state funds properly. In prior audit periods, the Department prepared supporting documentation for transfers that included details of what payments it was transferring. The purpose of documenting this detail was to maintain proper support for federal expenditures. The Department of Health and Human Services (HHS), which oversees the CCDF program at the federal level, requires recipients have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers were allowable and properly supported. We have reported this condition since 2005. The most recent audit finding numbers were 2020-038, 2019-035, 2018?034, 2017-024, 2016-021, 2015-023, 2014-023, 2013-016, 12-28, 11-23, 10-31, 9-12 and 8?13. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payments to child care providers for the CCDF programs were allowable and properly supported. In order to identify payments the Department made to child care providers, we requested and received a population of payments charged to CCDF funding sources from the Department?s Social Service Payment System (SSPS). Since 2008, we have tested samples of these transactions and found significant noncompliance with federal and state requirements. However, for fiscal year 2021, management informed us of recent changes in the Department?s grant management practices to process expenditure transfers at the grant level. This new process made the original expenditure coding in SSPS inaccurate and unreliable for testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent CCDF funds in accordance with federal and state regulations. As a result, we could not test the Department?s payments to child care providers for compliance with activities allowed and cost principles. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. Management decided to modify the Department?s accounting practices in a way that now prevents it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions from SSPS that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. By processing these adjustments at the fund level, the Department invalidated the transaction-level documentation of the original child care expenditure in SSPS and did not identify the new allocation at the payment level. Additionally, the Department transferred some of these child care expenditures more than once at the fund level, making the underlying data increasingly unreliable with each transfer. Effect of Condition and Questioned Costs By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit the federal dollars it used for payments to child care providers. Because we could not test transaction-level detail, we also could not determine whether the issues we identified in prior audits had improved or worsened, including the Department?s lack of adequate internal controls and significant rate of noncompliance for payments to child care providers. The total amount of known child care payments with federal CCDF funds in the audit period was $271,353,409. The Department also partially funded these payments with an additional $116,852,022 in state dollars. Because the Department did not comply with HHS requirements to allow for the tracing of grant expenditures to a payment level, we are questioning all $271,353,409 in federal program costs the Department incurred during the audit period. The payments the Department partially paid with state funds are not included in the federal questioned costs. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges and supports the State Auditor?s Office?s (SAO) mission, which is to hold state and local governments accountable for the use of public resources. The Department has managed the CCDF program since 2019, prior to that it was managed by the Department of Social and Health Services and the Department of Early Learning. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This consisted of making significant grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. The volume increased this year in comparison to previous years due to the Department?s implementation of changes to the SSPS system which were not in place until March 2021 resulting in adjustments to July through February data. The Department?s grant adjustments were processed based on eligible clients and allowable activities. However, the adjustments did not include child level data as suggested in 2 CFR 200. The Department will work to improve our internal controls. The Department does not currently have the staff to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. The Department will review options available for processing adjustments to include transaction-level data that is sufficient to comply with 2 CFR 200. Auditor?s Remarks We appreciate the Department?s acknowledgement that accounting adjustments were made without supporting child level data. The level of assurance needed to support grant expenditures is not established by our Office, but in titles 2 and 45 of the Code of Federal Regulations and the State?s grant award. We appreciate the Department?s commitment to resolving these matters and will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. Title 45 U.S. Code of Federal Regulations, Section 98.67 ? Fiscal requirements, states: (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-034 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payroll charges paid by the Child Care and Development Fund cluster were allowable and properly supported. CFDA Number and Title: 93.575 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund 93.575 COVID-19 Child Care and Development Block Grant Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: G1901WACCDF, 2003WACCDF, 2103WACCDF, 2003WACCC3, 2103WACCS5 Pass-through Entity: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Known Questioned Cost Amount: $21,708,066 Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. The Department is allowed to request federal reimbursement for salaries and benefits for program activities. The Department established a policy in which employees who spend 100 percent of their time working on the grant must be included in a semiannual certification. The Department requires the cost allocation unit to complete a certification for its employees whose positions are funded by a single federal award. The division director or office unit manager must approve the certification and attest that the employees did not perform any other duties. In fiscal year 2021, the Department spent about $327.5 million in CCDF federal funding. More than $21.7 million of that total was for payroll expenses of employees who worked on the program. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments for payroll charges paid by the CCDF were allowable and properly supported. The prior finding numbers were 2020-037, 2019-036, and 2018-033. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure payroll charges paid by the CCDF were allowable and properly supported. The Department has established a policy that requires the cost allocation unit to complete semiannual certifications in the second month following the certification period. This is to ensure there is a timely review of payroll expenditures applied to the CCDF to verify they are allowable and meet cost principles. We reviewed the semiannual certifications for the first half of fiscal year 2021 (July 1 to December 31, 2020) that the Department should have completed during the audit period. This set of semiannual certifications were due no later than February 28, 2021. The Department had not completed the certifications by the end of our audit period of June 31, 2021. We also reviewed the semiannual certifications for the second half of fiscal year 2021 (January 1 to June 30, 2021). The Department did not complete these semiannual certifications by the August 31, 2021, deadline. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition The Department had written policies in place to ensure salaries and benefits paid with federal grant funds were adequately supported. Department management said that due to the lack of available resources, they considered other areas to be of higher priority for responsible staff, resulting in the Department not following its established policy. Effect of Condition and Questioned Costs The Department charged $21,708,066 in direct payroll costs to the CCDF that were not adequately supported during the audit period. We are questioning these costs. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Follow established policies and procedures to ensure payroll costs charged to a federal grant are adequately supported ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response The Department agrees that payroll certifications were not completed timely, but maintains that the employees charged to the grant were allowable per the Public Assistance Cost Allocation Plan (PACAP). In addition, the cost allocation and grants unit and the budget unit review all position coding to determine allowable charges to the grant prior to position establishment or changes. The Department is committed to complying with grant requirements and the semiannual certification related to the audit period were completed in July 2021 and October 2021. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.430 Compensation-personal services states in part: (a) General. Compensation for personal services includes all remuneration, paid currently or accrued, for services of employees rendered during the period of performance under the Federal award, including but not necessarily limited to wages and salaries. Compensation for personal services may also include fringe benefits which are addressed in ?200.431 Compensation?fringe benefits. Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. (b) Reasonableness. Compensation for employees engaged in work on Federal awards will be considered reasonable to the extent that it is consistent with that paid for similar work in other activities of the non-Federal entity. In cases where the kinds of employees required for Federal awards are not found in the other activities of the non-Federal entity, compensation will be considered reasonable to the extent that it is comparable to that paid for similar work in the labor market in which the non-Federal entity competes for the kind of employees involved. (c) Professional activities outside the non-Federal entity. Unless an arrangement is specifically authorized by a Federal awarding agency, a non-Federal entity must follow its written non-Federal entity-wide policies and practices concerning the permissible extent of professional services that can be provided outside the non-Federal entity for non-organizational compensation. Where such non-Federal entity-wide written policies do not exist or do not adequately define the permissible extent of consulting or other non-organizational activities undertaken for extra outside pay, the Federal Government may require that the effort of professional staff working on Federal awards be allocated between: (1) Non-Federal entity activities, and (2) Non-organizational professional activities. If the Federal awarding agency considers the extent of non-organizational professional effort excessive or inconsistent with the conflicts-of-interest terms and conditions of the Federal award, appropriate arrangements governing compensation will be negotiated on a case-by-case basis (i) Standards for Documentation of Personnel Expenses (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities (for IHE, this per the IHE's definition of IBS); (iv) Encompass both federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity (See paragraph (h)(1)(ii) above for treatment of incidental work for IHEs.); and (vi) [Reserved] (vii) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (viii) Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity actually performed; (B) Significant changes in the corresponding work activity (as defined by the non-Federal entity's written policies) are identified and entered into the records in a timely manner. Short term (such as one or two months) fluctuation between workload categories need not be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The non-Federal entity's system of internal controls includes processes to review after-the-fact interim charges made to a Federal awards based on budget estimates. All necessary adjustment must be made such that the final amount charged to the Federal award is accurate, allowable, and properly allocated. (ix) Because practices vary as to the activity constituting a full workload (for IHEs, IBS), records may reflect categories of activities expressed as a percentage distribution of total activities. (x) It is recognized that teaching, research, service, and administration are often inextricably intermingled in an academic setting. When recording salaries and wages charged to Federal awards for IHEs, a precise assessment of factors that contribute to costs is therefore not always feasible, nor is it expected. (2) For records which meet the standards required in paragraph (i)(1) of this section, the non-Federal entity will not be required to provide additional support or documentation for the work performed, other than that referenced in paragraph (i)(3) of this section. (3) In accordance with Department of Labor regulations implementing the Fair Labor Standards Act (FLSA) (29 CFR part 516), charges for the salaries and wages of nonexempt employees, in addition to the supporting documentation described in this section, must also be supported by records indicating the total number of hours worked each day. (4) Salaries and wages of employees used in meeting cost sharing or matching requirements on Federal awards must be supported in the same manner as salaries and wages claimed for reimbursement from Federal awards. (5) For states, local governments and Indian tribes, substitute processes or systems for allocating salaries and wages to Federal awards may be used in place of or in addition to the records described in paragraph (1) if approved by the cognizant agency for indirect cost. Such systems may include, but are not limited to, random moment sampling, ?rolling? time studies, case counts, or other quantifiable measures of work performed. (i) Substitute systems which use sampling methods (primarily for Temporary Assistance for Needy Families (TANF), the Supplemental Nutrition Assistance Program (SNAP), Medicaid, and other public assistance programs) must meet acceptable statistical sampling standards including: (A) The sampling universe must include all of the employees whose salaries and wages are to be allocated based on sample results except as provided in paragraph (i)(5)(iii) of this section; (B) The entire time period involved must be covered by the sample; and (C) The results must be statistically valid and applied to the period being sampled. (ii) Allocating charges for the sampled employees' supervisors, clerical and support staffs, based on the results of the sampled employees, will be acceptable. (iii) Less than full compliance with the statistical sampling standards noted in subsection (5)(i) may be accepted by the cognizant agency for indirect costs if it concludes that the amounts to be allocated to Federal awards will be minimal, or if it concludes that the system proposed by the non-Federal entity will result in lower costs to Federal awards than a system which complies with the standards. (6) Cognizant agencies for indirect costs are encouraged to approve alternative proposals based on outcomes and milestones for program performance where these are clearly documented. Where approved by the Federal cognizant agency for indirect costs, these plans are acceptable as an alternative to the requirements of paragraph (i)(1) of this section. (7) For Federal awards of similar purpose activity or instances of approved blended funding, a non-Federal entity may submit performance plans that incorporate funds from multiple Federal awards and account for their combined use based on performance-oriented metrics, provided that such plans are approved in advance by all involved Federal awarding agencies. In these instances, the non-Federal entity must submit a request for waiver of the requirements based on documentation that describes the method of charging costs, relates the charging of costs to the specific activity that is applicable to all fund sources, and is based on quantifiable measures of the activity in relation to time charged. (8) For a non-Federal entity where the records do not meet the standards described in this section, the Federal Government may require personnel activity reports, including prescribed certifications, or equivalent documentation that support the records as required in this section. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. The Department of Children, Youth, and Families Administrative Policy 1.03.04, Time Certification for Positions Charged to a Single Federal Award, states in part: 1. The cost allocation manager must: a. Verify the allocation of employees? time that is directly charged to federal awards is identified in the DCYF written cost allocation plan and approved by the granting federal authority. b. List all of the names and position numbers for employees charged to a single federal award and distribute to appropriate agency staff for semi-annual certifications. c. Verify certifications are completed in the second month following the certification period. DCYF certification are based on the state fiscal year. d. Retain all required documentation per the applicable State Government Records Retention Schedule. 2. The division of office unit manager must: a. Review charges for the salaries and wages of employees within their program who are coded directly to a single federal award by completed semi-annual certifications. b. Validate the employees? payroll coding at the time of the certification. c. Email the cost allocation manager any necessary corrections. d. Sign the semi-annual certification and return to the cost allocation manager. 3. The division or office director or designee must: a. Review the list of names and position numbers for division level semi-annual certifications. b. Have first-hand knowledge of the actual work performed by the individuals being certified if certifying for an entire division or work unit c. Send an email to the cost allocation manager to communicate any necessary corrections. d. Sign the semi-annual certification and return to the cost allocation manager.

2021-035 The Department of Children, Youth, and Families did not have adequate internal controls over client eligibility requirements for the child care services funded with the Child Care and Development Fund. CFDA Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: G1901WACCDF; 2003WACCDF; 2103WACCDF; 2003WACCC3; 2103WACCS5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: $32 Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2021, the Department spent about $327.5 million in federal funding. For a family to be eligible for child care assistance, state and federal rules require that at the time of application or reapplication, children must: ? Reside in Washington and be a citizen or legal resident of the United States; ? Be younger than 13 years, or if for verified special needs, be younger than 19 years; ? Reside with a parent(s) or guardian whose countable income does not exceed 200 percent of the federal poverty level at application or 220 percent at reapplication; ? Reside with a parent(s) or guardian whose countable income does not increase to over 85 percent of state, territorial or tribal median income for a family of the same size; and ? Reside with a parent(s) or guardian who works or attends a job-training or education program, or needs to be receiving protective services. In response to the COVID-19 pandemic, the Department updated its CCDF State Plan to reflect necessary changes applicable to child care eligibility determinations. The State Plan amendments were approved by the Administration for Children & Families, under the U.S. Department of Health and Human Services. Effective February 29, 2020, the Department was approved for the following eligibility changes during the state declared emergency for COVID-19: ? Family contribution to copayment: ? Copayments in effect from July through September 31, 2020 ? Copayments waived from October 1, 2020, through December 31, 2020 ? Copayments capped at $115 from January 1, 2021, through June 30, 2021 ? Level of care: The amount of school-age child care for recipients was increased ? Approved activities: eligibility is extended at reapplication if the recipient is no longer in an approved activity due to a pandemic-related layoff Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the past eight audits, we reported findings related to eligibility for the CCDF program. In these prior audits, we reported the Department did not have adequate internal controls over the eligibility process for child care subsidy recipients. The five most recent audits also reported the Department was materially noncompliant with federal requirements. These were reported as finding numbers 2020-039, 2019-032, 2018-030, 2017-026, 2016-023, 2015-026, 2014-026, 2013-017 and 2012-30. Description of Condition The Department did not have adequate internal controls over client eligibility requirements for the CCDF program. Specifically, the Department did not establish a secondary review process of eligibility determinations at the time they were made. The Department performed internal audits of some eligibility determinations for the CCDF program throughout the year, but those audits occurred after it may have already issued payments for the client. In prior audits, we determined these audits of client eligibility usually have a particular focus, do not address all eligibility requirements, and the process is insufficient for detecting and correcting improper eligibility determinations timely. In May 2021, near the end of the audit period, the Department implemented a new audit process that required audit staff to review all eligibility requirements for a selected sample. Department management believes this will address the weaknesses in internal controls. However, since the Department did not implement the process until the month before the end of the audit period, we were not able to determine if the new internal control was effective. During the audit period, the Department determined 53,260 clients to be eligible for child care. We used a statistical sampling method to randomly select and examine 86 of these determinations. We identified four instances (4.7 percent) where the Department made eligibility determinations improperly. Specifically, we found: ? One case when the Department did not follow procedure for verifying new employment, which led to incorrect household income calculation. This resulted in the Department incorrectly assessing the copay amount. ? One case when the Department incorrectly calculated child support. ? One case when the Department did not include child support received in determining eligibility. ? One case when the Department incorrectly assessed the copay amount due to a system error. We consider this internal control deficiency to be a significant deficiency. Cause of Condition The Department did not fully implement its new audit process until the month before the end of the audit period because the change in process required negotiation with the Washington Federation of State Employees (WFSE). Effect of Condition and Questioned Costs By not implementing adequate internal controls, the Department is at higher risk of paying providers for child care services when clients are ineligible. Of the four client eligibility determinations that had errors, one resulted in $32 of federal overpayments to providers. The Department used CCDF grant funds to pay this entire amount. Because we used a statistical sampling method to randomly select the payments examined in the audit, we estimate the amount of likely improper payments to be $19,818. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs? as required by 2 CFR 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department improve its internal controls over determining eligibility to ensure it: ? Reviews eligibility determinations sufficiently to detect improper eligibility determinations ? Reviews sufficient support for income and household composition information for accuracy We also recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department?s Response The Department appreciates, acknowledges, and supports SAO?s mission, which is to hold state and local government accountable for the use of public resources. Further, we particularly appreciate SAO?s work with us over the past year to strengthen the auditing process. The Department performed internal audits of about 11,000 eligibility determinations for the CCDF program during the audit period. Because the eligibility system and the payment system are not linked, the reviews of determination happen after payment is made for the client. Full audits are not conducted on each client case, but are focused on high risk areas of eligibility to maximize staff resources. We have seen considerable decrease in identified errors over the last fiscal year in response to these focused audit areas. In addition, the Department has continued to simplify our rules making it easier for workers to establish eligibility and easier for families to be approved for child care. The Fair Start for Kids Act was enacted October 2021 which included several components to simplify the rules and expand eligibility. The Department will continue to improve processes and internal controls and create and deliver staff training on using data systems and performing income calculations, specifically the Division of Child Supports (SEMS) system and Employment Security Division (ESD) systems. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Washington Administrative Code 110-15-0065 Calculation of income, states in part: DSHS uses a consumer's countable income when determining income eligibility and copayment. A consumer's countable income is the sum of all income listed in WAC 110-15-0060 minus any child support paid out through a court order, division of child support administrative order, or tribal government order. (1) To determine a consumer's income, DSHS either: (a) Calculates an average monthly income by: (i) Determining the number of months, weeks or pay periods it took the consumer's WCCC household to earn the income; and dividing the income by the same number of months, weeks or pay periods. (ii) If the past wages are no longer reflective of the current income, DSHS may accept the employer's statement of current, anticipated wages for future income determination. (b) When the consumer begins new employment and has less than three months of wages, DSHS uses the best available estimate of the consumer's WCCC household's current income: (i) As verified by the consumer's employer; or (ii) As provided by the consumer through a verbal or written statement documenting the new employment at the time of application, reapplication or change reporting, and wage verification within sixty days of DSHS request. Washington Administrative Code 110-15-0075 Determining income eligibility and copayment amounts, states: (1) DCYF takes the following steps to determine a consumer's eligibility and copayment, whether care is provided under a WCCC voucher or contract: (a) Determine the consumer's family size (under WAC 110-15-0015); (b) Determine the consumer's countable income (under WAC 110-15-0065). (2) DCYF calculates the consumer's copayment as follows: IF A CONSUMER'S INCOME IS: THEN THE CONSUMER'S COPAYMENT IS: (a) At or below 82% of the federal poverty guidelines (FPG). $15 (b) Above 82% of the FPG up to 137.5% of the FPG. $65 (c) Above 137.5% of the FPG through 200% of the FPG. The dollar amount equal to subtracting 137.5% of the FPG from countable income, multiplying by 50%, then adding $65, up to a maximum of $115. (3) DCYF does not prorate the copayment when a consumer uses care for part of a month. (4) The FPG is updated every year. The WCCC eligibility level is updated at the same time every year to remain current with the FPG.

2021-036 The Department of Children, Youth, and Families did not have adequate internal controls and did not comply with matching, level of effort, and earmarking requirements for the Child Care and Development Fund Cluster. CFDA Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: G1801WACCDF; G-1901WACCDD; G1901WACCDM; 2003WACCDF; 2103WACCDF; 2101WVCCDF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Matching, Level of Effort, Earmarking Known Questioned Cost Amount: $171,849 Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) grants to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2021, the Department spent about $327.5 million in federal funding, which was an increase of about $82 million compared to the prior fiscal year. The CCDF consists of three distinct funding sources: Discretionary Fund, Mandatory Fund, and Matching Fund. Additionally, under the Temporary Assistance for Needy Families (TANF) program, the Department may transfer TANF funds to the CCDF, which are then treated as Discretionary Funds. The Department is instructed how to spend this federal money. For the Department to receive its allotted share of the Matching Fund, it must meet the Maintenance of Effort (MOE) requirement and match the federal Matching Fund claimed with state expenditures at the Federal Medical Assistance Percentage rate for the applicable fiscal year. The Department must also meet earmarking requirements for expenditures for administrative and quality activities. The Department of Health and Human Services (HHS), which oversees the CCDF program at the federal level, requires recipients have accounting procedures that are sufficient for tracing funds to a level of expenditure adequate to show that they have been used in accordance with program requirements. Department staff run monthly and quarterly expenditure reports to track requirements over matching, level of effort, and earmarking for each open grant award. Federal regulations require recipients to establish and follow internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In a prior audit, we reported the Department did not have adequate internal controls over matching, level of effort, and earmarking requirements for the Child Care and Development Fund Cluster programs. The prior finding number was 2020-040. Description of Condition The Department did not have adequate internal controls and did not comply with matching, level of effort, and earmarking requirements for the CCDF programs. During the audit period, the earmarking requirement applied to the federal fiscal year 2018 award. The requirement stipulated the Department could not spend more than five percent of total CCDF awards expended and any state expenditures for which matching funds are claimed on administrative costs. We found the Department exceeded the administrative cost maximum for the 2018 award. The Department also did not have any written policies and procedures describing how it monitored the CCDF programs to ensure it complied with matching, level of effort, and earmarking requirements. The Department?s accounting records should be used to verify it has met matching, level of effort, and earmarking requirements. During the audit period, the Department?s grant management practice was to process expenditure transfers at the grant level without identifying which expenditures it transferred. Therefore, we could not rely on the data supporting the Department?s expenditures or verify that the accounting records are accurate. This condition is also referenced in audit finding 2021-033. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management transferred the responsibility for tracking grant expenditures to multiple employees during the audit period. Management said the lack of an established process was due to insufficient staffing. The Department?s ongoing monitoring throughout the year was ineffective for ensuring it met the matching, level of effort, and earmarking requirements. Additionally, the Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. By processing these adjustments at the fund level, the Department invalidated the transaction-level documentation of the original child care expenditure in the Social Service Payment System (SSPS) and did not identify the new allocation at the payment level. Additionally, the Department transferred some of these child care expenditures more than once at the fund level, making the underlying data increasingly unreliable with each transfer. Effect of Condition and Questioned Costs For federal fiscal year 2018 awards, the Department provided us with an expenditure report showing that it had spent $171,849 over the administrative earmarking requirement. By not maintaining reliable accounting records, the Department created a condition that made it impossible for us to determine if it had met matching, level of effort, and earmarking requirements. Furthermore, without adequate internal controls in place, the Department is at a higher risk of making improper payments with grant funds. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Develop written policies and procedures describing how it will ensure it meets matching, level of effort, and earmarking requirements ? Develop effective ongoing monitoring procedures ? Design and implement internal controls to ensure CCDF expenditures are supported with transaction-level data that is sufficient to comply with federal law and state rules ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor?s Office?s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. The Child Care and Development Fund (CCDF) program was previously managed by the Department of Social and Health Services and the Department of Early Learning. Since the program transitioned in 2019, the Department has been making efforts to strengthen internal controls over CCDF grant requirements. The identified questioned costs were for the federal fiscal year 2018 awards and during the transition year. The Department agrees that internal controls were not in place during the transition to verify compliance with the administrative earmarking requirement. The audit period covered expenditures related to grant award years 2018, 2019, 2020, and 2021. Level of effort and other earmarking expenditures were not affected by journal vouchers related to child care expenditures paid through SSPS as noted in the Effect of Condition. The grantor requires specific levels of spend based on the grant award. The Department uses various elements of the Chart of Accounts in order to track the matching, level of effort, and earmarking spend requirements. These elements include using allocation code and program index to track specific activities and reporting the expenditures on the ACF-696 report. The expenditures related to the earmarking requirements are direct expenditures for quality activities related to infant and toddler services. Expenditures related to level of effort requirements are direct payments for ECEAP, tiered reimbursement, and other allowable expenditures paid with state funds. During state fiscal year 2021, the Department utilized grant-level accounting to manage the direct payments for child care subsidy payments and verified the expenditures met the minimum and maximum allowable earmarks under the federal program requirements for applicable grant award years. The expenditures to meet quality activities, level of effort, and other earmarks were not tested to verify this compliance. The Department maintains that expenditures charged to these programs were allowable payments to the CCDF grant and processed directly through the state?s agency financial reporting system. The Department will establish written procedures for federal requirements and fiscal monitoring of these areas. The Department implemented grant-level management of all federal funds, including the CCDF grants. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with 45 CFR 98.67. This consisted of making significant grant level adjustments between allowable grant sources to properly spend grant dollars within the allowable period of performance and ensure level of effort, earmarking, and matching requirements. The volume increased this year in comparison to previous years due to the Department?s implementation of changes to the SSPS system which were not in place until March 2021 resulting in adjustments to July through February data. The Department?s grant adjustments were processed based on eligible clients and allowable activities. However, the adjustments did not include child level data as suggested in 2 CFR 200. The Department will work to improve our internal controls. The Department does not currently have the staff to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance as identified by SAO. The Department will review options available for processing adjustments to include transaction-level data that is sufficient to comply with federal regulations. Auditor?s Remarks The level of assurance needed to support grant expenditures is not established by our Office, but in titles 2 and 45 of the Code of Federal Regulations and the State?s grant award. By not identifying the underlying transactions in SSPS affected by year-end accounting adjustments, management does not have reasonable assurance of compliance with level of effort and earmarking requirements for the federal awards pertaining to the transactions. We appreciate the Department?s commitment to resolving these matters and will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. Title 2 US. Code of Federal Regulations (CFR) Part 98, Child Care and Development Fund establishes the following applicable requirements: Section 98.50 Child care services states in part: (b) Of the aggregate amount of funds expended by a State or Territory (i.e., Discretionary, Mandatory, and Federal and State share of Matching funds): (1) No less than seven percent in fiscal years 2016 and 2017, eight percent in fiscal years 2018 and 2019, and nine percent in fiscal year 2020 and each succeeding fiscal year shall be used for activities designed to improve the quality of child care services and increase parental options for, and access to, high-quality child care as described at ? 98.53; and (2) No less than three percent in fiscal year 2017 and each succeeding fiscal year shall be used to carry out activities at ? 98.53(a)(4) as such activities relate to the quality of care for infants and toddlers. (3) Nothing in this section shall preclude the State or Territory from reserving a larger percentage of funds to carry out activities described in paragraphs (b)(1) and (2) of this section. (c) Funds expended from each fiscal year's allotment on quality activities pursuant to paragraph (b) of this section: (1) Must be in alignment with an assessment of the Lead Agency's need to carry out such services and care as required at ? 98.53(a); (2) Must include measurable indicators of progress in accordance with ? 98.53(f); and (3) May be provided directly by the Lead Agency or through grants or contracts with local child care resource and referral organizations or other appropriate entities. (d) Of the aggregate amount of funds expended (i.e., Discretionary, Mandatory, and Federal and State share of Matching Funds), no more than five percent may be used for administrative activities as described at ? 98.54. (e) Not less than 70 percent of the Mandatory and Federal and State share of Matching Funds shall be used to meet the child care needs of families who: (1) Are receiving assistance under a State program under Part A of title IV of the Social Security Act; (2) Are attempting through work activities to transition off such assistance program; and (3) Are at risk of becoming dependent on such assistance program. (f) From Discretionary amounts provided for a fiscal year, the Lead Agency shall: (1) Reserve the minimum amount required under paragraph (b) of this section for quality activities, and the funds for administrative costs described at paragraph (d) of this section; and (2) From the remainder, use not less than 70 percent to fund direct services (provided by the Lead Agency). (g) Of the funds remaining after applying the provisions of paragraphs (a) through (f) of this section, the Lead Agency shall spend a substantial portion of funds to provide direct child care services to low-income families who are working or attending training or education. (h) Pursuant to ? 98.16(i)(4), the Plan shall specify how the State will meet the child care needs of families described in paragraph (e) of this section. Section 98.55 Matching fund requirements states in part: (c) In order to receive Federal matching funds for a fiscal year under paragraph (a) of this section: (1) States shall also expend an amount of non-Federal funds for child care activities in the State that is at least equal to the State's share of expenditures for fiscal year 1994 or 1995 (whichever is greater) under sections 402(g) and (i) of the Social Security Act as these sections were in effect before October 1, 1995; and (2) The expenditures shall be for allowable services or activities, as described in the approved State Plan if appropriate, that meet the goals and purposes of the Act. (3) All Mandatory Funds are obligated in accordance with ? 98.60(d)(2)(i). (d) The same expenditure may not be used to meet the requirements under both paragraphs (b) and (c) of this section in a fiscal year. (e) An expenditure in the State for purposes of this subpart may be: (1) Public funds when the funds are: (i) Appropriated directly to the Lead Agency specified at ? 98.10, or transferred from another public agency to that Lead Agency and under its administrative control, or certified by the contributing public agency as representing expenditures eligible for Federal match; (ii) Not used to match other Federal funds; and (iii) Not Federal funds, or are Federal funds authorized by Federal law to be used to match other Federal funds; or (2) Donated from private sources when the donated funds: (i) Are donated without any restriction that would require their use for a specific individual, organization, facility or institution; (ii) Do not revert to the donor's facility or use; (iii) Are not used to match other Federal funds; (iv) Shall be certified both by the Lead Agency and by the donor (if funds are donated directly to the Lead Agency) or the Lead Agency and the entity designated by the State to receive donated funds pursuant to paragraph (f) of this section (if funds are donated directly to the designated entity) as available and representing funds eligible for Federal match; and (v) Shall be subject to the audit requirements in ? 98.65 of these regulations. Title 45 U.S. Code of Federal Regulations, Section 98.67 ? Fiscal requirements, states: (d) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (3) Preparation of reports required by the Secretary under this subpart and under subpart H; and (4) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-037 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with period of performance requirements for the Child Care and Development Fund. CFDA Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: G1801WACCDF, G1901WACCDD, G1901WACCDM, 2003WACCDF, 2103WACCDF, 2101WVCCDF Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Period of Performance Known Questioned Cost Amount: $4,039 Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2021, the Department spent about $327.5 million in CCDF federal funding. Each federal grant specifies a performance period during which recipients must obligate and liquidate program costs. These periods typically align with the federal fiscal year of October 1 through September 30. Payments for costs charged before a grant?s beginning date or after the ending date are not allowed without the grantor?s prior approval. The CCDF consists of three distinct funding sources: Discretionary Fund, Mandatory Fund, and Matching Fund. Each of these funds has specific period of performance requirements established in federal regulation (45 CFR 98.60(d)): ? Discretionary Funds must be obligated by the end of the succeeding fiscal year after award and expended by the end of the third fiscal year after award. ? Mandatory Funds for states must be obligated by the end of the fiscal year in which they are awarded if the state also requests Matching Funds. If no Matching Funds are requested for the fiscal year, then the Mandatory Funds are available until liquidated. ? Matching Funds must be obligated by the end of the fiscal year in which they are awarded and liquidated by the end of the succeeding fiscal year after award. The Department of Health and Human Services (HHS), which oversees the CCDF at the federal level, requires recipients to have accounting procedures that are sufficient for tracing grants to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over period of performance requirements. The prior finding number was 2020-041. Description of Condition The Department did not have adequate internal controls over and did not comply with period of performance requirements for the CCDF. Our Office uses the Department?s accounting records to verify it has met the period of performance requirements. However, for fiscal year 2021, management informed us of recent changes in the Department?s grant management practices to process expenditure transfers at the grant level. This process made the original expenditure coding inaccurate and unreliable for audit testing. As a result, we could not trace the federal funds to a level of expenditure adequate to establish whether the Department spent CCDF funds in accordance with federal and state regulations. As a result, we could not test the Department?s payments to child care providers for compliance with period of performance requirements. This condition is also referenced in audit finding 2021-033. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Department is required to maintain sufficient documentation for each payment it makes with federal dollars. Management decided to modify the Department?s accounting practices in a way that now prevents it from meeting this requirement. The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. By processing these adjustments at the fund level, the Department invalidated the transaction-level documentation of the original child care expenditure and did not identify the new allocation at the payment level. Additionally, the Department transferred some of these child care expenditures more than once at the fund level, making the underlying data increasingly unreliable with each transfer. Additionally, the Department?s ongoing monitoring throughout the year was ineffective for ensuring it met the period of performance requirements during the audit period. We also determined the Department did not have any written policies and procedures describing how it monitored to ensure it met the period of performance requirements. Effect of Condition By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to determine if it materially met the period of performance requirements. However, when analyzing the Department?s accounting records, we identified $4,039 in expenditures it charged to the CCDF for costs that occurred prior to the grant award?s beginning date. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Design and implement internal controls to ensure transaction-level data is sufficient to comply with federal law and state rules ? Develop written policies and procedures over federal period of performance requirements Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor?s Office?s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. The Child Care and Development Fund (CCDF) program was previously managed by the Department of Social and Health Services and the Department of Early Learning. Since the program transitioned in 2019, the Department has been making efforts to strengthen internal controls over CCDF grant requirements. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with federal regulations outlined in 45 CFR 98.67. This consisted of making grant level adjustments for eligible clients and allowable activities between allowable funding sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. However, the adjustments did not include child level data as suggested in federal regulations outlined in 2 CFR 200. As to the questioned cost identified by State Auditor?s Office (SAO), all of the cost identified were corrected in state fiscal year 2022 and within the liquidation period allowed by federal regulations. The corrections were not considered by SAO because they were processed outside of the audit period reviewed. The expenditures charged to indirect cost bases are automatically allocated in the cost allocation system to any open grants at the time of entry into the state?s accounting system. The CCDF grants analyst then processes a journal voucher to move the expenditures out of the grant if they are not allowable or outside the period of performance. The Department will establish written procedures for federal period of performance requirements and fiscal monitoring of these areas. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. Title 45 U.S. Code of Federal Regulations, Section 98.60 -Availability of funds, states in part: (d) The following obligation and liquidation provisions apply to States and Territories: (1) Discretionary Fund allotments shall be obligated in the fiscal year in which funds are awarded or in the succeeding fiscal year. Unliquidated obligations as of the end of the succeeding fiscal year shall be liquidated within one year. (2) (i) Mandatory Funds for States requesting Matching Funds per ? 98.55 shall be obligated in the fiscal year in which the funds are granted and are available until expended. (ii) Mandatory Funds for States that do not request Matching Funds are available until expended. (3) Both the Federal and non-Federal share of the Matching Fund shall be obligated in the fiscal year in which the funds are granted and liquidated no later than the end of the succeeding fiscal year. Title 45 U.S. Code of Federal Regulations, Section 98.67 ? Fiscal requirements, states in part: (e) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (f) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (g) Fiscal control and accounting procedures shall be sufficient to permit: (5) Preparation of reports required by the Secretary under this subpart and under subpart H; and (6) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-038 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with financial reporting requirements for the Child Care and Development Fund Cluster. CFDA Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: G1901WACCDF, 2003WACCDF, 2103WACCDF, 2003WACCC3, 2103WACCS5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Reporting Known Questioned Cost Amount: None Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care and fund improvements to child care quality. In fiscal year 2021, the Department spent about $327.5 million in federal funding, which was an increase of about $82 million compared to the prior fiscal year. The Department is required to submit a quarterly ACF-696 report for each open grant. These reports contain information on expenditures for three CCDF funding sources: the Mandatory Fund, the Matching Fund, and the Discretionary Fund. The Department uses CCDF expenditures recorded in the state?s accounting system to compile and support the ACF-696 report. The Department of Health and Human Services (HHS), which oversees the CCDF program at the federal level, requires recipients have accounting procedures that are sufficient for tracing funds to a level of expenditure adequate to show that they have been used in accordance with program requirements. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with financial reporting requirements for the CCDF program. During the audit period, the Department was required to submit ACF-696 reports for the following federal fiscal years: 2018 (final report due), 2019 (four quarterly reports due), 2020 (four quarterly reports due), and 2021 (three quarterly reports due). The Department?s accounting records must provide and support the financial information reported on ACF-696 reports. During the audit period, the Department?s grant management practice was to process expenditure transfers at the grant level without identifying which expenditures it transferred. Therefore, we could not rely on the data supporting the Department?s reported ACF-696 expenditures, and could not test whether the reports were accurate and complete. This condition is also referenced in audit finding 2021-033. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department implemented what management referred to as fund-level accounting. This consisted of making significant accounting adjustments between funding sources in its general ledger without identifying the underlying transactions that supported the adjustments. This affected all populations of child care expenditures for every month of the fiscal year. By processing these adjustments at the fund level, the Department invalidated the transaction-level documentation of the original child care expenditure in the Social Service Payment System (SSPS) and did not identify the new allocation at the payment level. Additionally, the Department transferred some of these child care expenditures more than once at the fund level, making the underlying data increasingly unreliable with each transfer. Effect of Condition By not complying with federal law regarding maintaining adequate supporting documentation for expenditures, the Department created a condition that made it impossible for our Office to audit the federal expenditures reported on the ACF-696 financial report. While the Department submitted all the required ACF-696 reports for the audit period, we could not determine whether the expenditures reported are reliable. Recommendation We recommend the Department design and implement internal controls to ensure the ACF-696 report is supported with transaction-level data that is sufficient to comply with federal law and state rules. Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor?s Office?s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. The Child Care and Development Fund (CCDF) program was previously managed by the Department of Social and Health Services and the Department of Early Learning. Since the program transitioned in 2019, the Department has been making efforts to strengthen internal controls over CCDF grant requirements. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grants to eligible clients and allowable activities in compliance with federal regulations outlined in 45 CFR 98.67. This consisted of making grant level adjustments for eligible clients and allowable activities between allowable funding sources to properly spend grant dollars within the allowable period of performance and ensure level of effort and matching requirements. However, the adjustments did not include child level data as suggested in federal regulations outlined in 2 CFR 200. The ACF-696 reports that were filed during the audit period where submitted timely and accurately to reflect the grant level expenditures as document in the agency financial reporting system. SAO also tested the reporting requirements for Federal Funding Accountability and Transparency Act for internal controls and compliance and found no deficiencies or internal control weaknesses. The Department will review options available for processing adjustments to include transaction-level data that is sufficient to comply with federal regulations and supports the ACF-696 requirements. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. Title 45 U.S. Code of Federal Regulations, Section 98.67 ? Fiscal requirements, states: (h) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (i) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (j) Fiscal control and accounting procedures shall be sufficient to permit: (7) Preparation of reports required by the Secretary under this subpart and under subpart H; and (8) The tracking of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-039 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with health and safety requirements for the Child Care and Development Fund Program. CFDA Number and Title: 93.575 Child Care and Development Block Grant 93.575 COVID-19 Child Care and Development Block Grant 93.596 Child Care Mandatory and matching Funds of the Child Care and Development Fund Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: G1901WACCDF; 2003WACCDF; 2103WACCDF; 2003WACCC3; 2103WACCS5 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions: Health and Safety Requirements Known Questioned Cost Amount: None Background The Department of Children, Youth, and Families (Department) administers the federal Child Care and Development Fund (CCDF) grant to help eligible working families pay for child care. In fiscal year 2021, the Department spent about $327.5 million in CCDF federal funding The Department oversees two types of providers: licensed providers and license-exempt Family, Friends, & Neighbors (FFN) providers. The Department is responsible for ensuring all these providers meet health and safety standards. The monitoring activity varies for licensed and FFN providers. The Department has an approved CCDF State Plan for federal fiscal year 2019-2021 that outlines how the Department will meet the health and safety requirements for licensed and FFN providers. Licensed providers Department licensors conduct annual, unannounced onsite monitoring visits of licensed providers, using a monitoring checklist, to verify whether they have met required health and safety standards. The licensors use the WA Compass system to document their activities. The system allows licensing staff to monitor the completion of visits, make timely updates and streamline their processes. When licensors identify health and safety violations during a monitoring visit, they document them on an inspection report. The inspection report contains the areas of provider noncompliance and establishes deadlines for correcting them. The Department is required to conduct timely follow-up visits on noncompliance issues to ensure providers correct them. Depending on the severity of the noncompliance, the Department has five, ten or fifteen business days to verify the noncompliance has been corrected. FFN providers Non-relative FFN providers must complete initial and ongoing health and safety training and sign a health and safety agreement between providers and parents. The Department conducts an annual health and safety visit to ensure providers are following health and safety rules. Additionally, all relative and non-relative FFN providers who receive subsidy payments are required to complete a fingerprint background check. COVID-19 waiver In response to the COVID-19 pandemic, the Administration for Children & Families, under the U.S. Department of Health and Human Services, waived the following health and safety requirements: ? Non-relative FFN annual technical visits ? Fingerprint background checks for licensed providers, non-relative FFNs, and relative FFNs Additionally, the Department: ? Revised the state plan and conducted annual, announced virtual monitoring visits of licensed providers rather than typical unannounced onsite visits ? Issued a management decision to reinstate the fingerprint requirements beginning January 2021 ahead of the waiver expiration date Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported that the Department did not have adequate internal controls over and did not comply with health and safety requirements. The previous finding numbers were 2020-042, 2019-039, 2018-035, 2017-025, 2016-022 and 2015?024. Description of Condition The Department did not have adequate internal controls over and did not comply with health and safety requirements for the CCDF Program. Licensed provider annual monitoring and noncompliance follow-ups We used a statistical sampling method to randomly select 59 out of a total population of 5,480 licensed providers. We examined this sample of licensed providers to determine if they received an annual virtual monitoring visit and that the Department performed timely, appropriate follow-ups when they found noncompliance issues. We identified six instances (10 percent) where the provider did not receive their required annual monitoring visit. Of the remaining 53 providers that did receive a monitoring visit, we identified: ? One instance (2 percent) where the licensor did not fully complete all health and safety checklist items during the virtual monitoring visit ? Three instances (6 percent) where the licensor did not conduct the appropriate follow-up visit on noncompliance issues. Specifically, we found: o Two providers did not have a follow-up visit for identified noncompliance. o One provider did not have a timely follow-up visit for identified noncompliance. The Department was required to conduct the visit within ten business days, but performed it 17 days after the initial visit. Non-relative FFN provider health and safety agreements The state plan and a state rule require non-relative FFN providers to complete a health and safety agreement with the parent of the child receiving care within 45 days of completing initial training requirements. This agreement is required to be signed by both the parent and the provider. During the audit period, Department management chose to not require agreements to be signed by both the parent and the provider. It instead accepted other forms of agreements, such as email or verbal confirmations to meet this requirement. These forms of agreement do not meet the requirements of the state plan and Washington Administrative Code 110-16-0030. During the audit period, 79 providers were required to complete health and safety agreements. However, the Department only received 38 from providers. Of those 38, only 18 were properly signed, 19 were agreed to via email and one was agreed to verbally. This resulted in 41 providers (52 percent) not completing the required health and safety agreements in any form for state fiscal year 2021. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Licensed provider annual monitoring and noncompliance follow-ups The Department did not conduct six of the 59 monitoring visits we reviewed because management chose to allow providers to refuse a monitoring visit even though this was not permitted by the state plan or the waiver. Department is working on a report to track health and safety visits that require follow-ups, but development has been delayed due to other priorities in response to the COVID-19 pandemic. Non-relative FFN provider health and safety agreements In response to the COVID-19 pandemic, Department management decided to accept an email or verbal conversation and confirmation of completion from the provider in lieu of a signed copy of the agreement due to providers having difficulties obtaining electronic signatures on the document. Management said staff did not prioritize complying with the state rule because the Department was amending it during the audit period to change the requirement. Effect of Condition Licensed provider annual monitoring and noncompliance follow-ups By not completing monitoring visits or following up on noncompliance in a timely manner, the Department did not have assurance that providers met health and safety requirements. Further, not following up on noncompliance violations in a timely manner can put children in jeopardy of harm, neglect, and unhealthy environments. Non-relative FFN provider health and safety agreements The Department did not comply with state rule and did not meet requirements in its federally approved plan. Additionally, by not having an agreement demonstrating that providers and parents have discussed health and safety requirements, children can be in jeopardy of harm, neglect, and unhealthy environments. Recommendations We recommend the Department: ? Ensure management follows established policies and procedures to ensure licensors complete all monitoring visits and conduct thorough, timely follow-ups on any identified noncompliance issues ? Obtain a waiver from the grantor if management wants to deviate from the approved state plan Department?s Response The Department is strongly committed to ensuring the health, safety, and well-being of all children in care. The Department would like to acknowledge the child care providers that continued to operate during the COVID-19 pandemic and provided support to families and their community. As to the Auditor?s specific findings, the Department offers the following detail: Licensed provider annual monitoring and noncompliance follow-ups Due to the COVID-19 pandemic and the Washington State Governor?s Stay Home, Stay Healthy Order, the Department received a waiver for the annual unannounced monitoring visits. The CCDF State Plan was updated to allow for virtual monitoring visits, but some providers were unable to participate in the virtual process resulting in monitoring visits not being conducted during SFY21. System enhancements were made in WA Compass and changes continue to be made to track when follow up health and safety visits are required. Currently the WA Compass recheck report has not been finalized and only shows violations with serious and immediate risks, not all health and safety rechecks needed. In addition, due to COVID-19, some providers denied the licensor access or were not available for recheck within the required recheck time-period. Non-relative FFN provider health and safety agreements The Department found that non-relative providers had difficulty returning a signed copy of the parent/provider health and safety agreement. As an alternative, the Department allowed providers to submit an email in lieu of the signature and added two technical assistance calls to enhance the provider?s understanding of the health and safety requirements. Regarding the recommendations to obtain a waiver from the grantor to support deviations from the approved state plan, the Department always endeavors to implement programs consistent with applicable state and federal requirements and its CCDF State Plan, or to seek waiver from federal requirements, when available, through the CCDF State Plan as necessary to support effective implementation. In July 2021, the Department updated the CCDF State Plan to be consistent with accepting email or verbal confirmation of the FFN Parent Agreement. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. 45 U.S. Code of Federal Regulations (CFR) part 98.41 Health and safety requirements, states in part: (a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements, which are subject to monitoring pursuant to ? 98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (i) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, the following provisions apply: (A) As part of their health and safety provisions in this area, Lead Agencies shall assure that children receiving services under the CCDF are age-appropriately immunized. Those health and safety provisions shall incorporate (by reference or otherwise) the latest recommendation for childhood immunizations of the respective State, territorial, or tribal public health agency. (B) Notwithstanding this paragraph (a)(1)(i), Lead Agencies may exempt: (1) Children who are cared for by relatives (defined as grandparents, great grandparents, siblings (if living in a separate residence), aunts, and uncles), provided there are no other unrelated children who are cared for in the same setting. (2) Children who receive care in their own homes, provided there are no other unrelated children who are cared for in the home. (3) Children whose parents object to immunization on religious grounds. (4) Children whose medical condition contraindicates immunization. (C) Lead Agencies shall establish a grace period that allows children experiencing homelessness and children in foster care to receive services under this part while providing their families (including foster families) a reasonable time to take any necessary action to comply with immunization and other health and safety requirements. (1) The length of such grace period shall be established in consultation with the State, Territorial or Tribal health agency. (2) Any payment for such child during the grace period shall not be considered an error or improper payment under subpart K of this part. (3) The Lead Agency may also, at its option, establish grace periods for other children who are not experiencing homelessness or in foster care. (4) Lead Agencies must coordinate with licensing agencies and other relevant State, Territorial, Tribal, and local agencies to provide referrals and support to help families of children receiving services during a grace period comply with immunization and other health and safety requirements; (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man- caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of biocontaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and (xii) May include requirements relating to: (A) Nutrition (including age-appropriate feeding); (B) Access to physical activity; (C) Caring for children with special needs; or (D) Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children's health and safety. (2) Include minimum health and safety training on the topics above, as described in ? 98.44. (b) Lead Agencies may not set health and safety standards and requirements other than those required in paragraph (a) of this section that are inconsistent with the parental choice safeguards in ? 98.30(f). (c) The requirements in paragraph (a) of this section shall apply to all providers of child care services for which assistance is provided under this part, within the area served by the Lead Agency, except the relatives specified at ?98.42(c). (d) Lead Agencies shall describe in the Plan standards for child care services for which assistance is provided under this part, appropriate to strengthening the adult and child relationship in the type of child care setting involved, to provide for the safety and developmental needs of the children served, that address: (1) Group size limits for specific age populations; (2) The appropriate ratio between the number of children and the number of caregivers, in terms of age of children in child care; and (3) Required qualifications for caregivers in child care settings as described at ?98.44(a)(4). (e) Lead Agencies shall certify that caregivers, teachers, and directors of child care providers within the State or service area will comply with the State's, Territory's, or Tribe's child abuse reporting requirements as required by section 106(b)(2)(B)(i) of the Child Abuse and Prevention and Treatment Act (42 U.S.C. 5106a(b)(2)(B)(i)) or other child abuse reporting procedures and laws in the service area. CCDF State Plan for Federal Fiscal Year 2019-2021, states, in part: 5.2 Health and Safety Standards and Requirements for CCDF Providers 5.2.2 Health and safety standards for CCDF providers a) 1. The parent and provider must complete, sign and return to DCYF an in-home Health and Safety agreement. 5.2.3 Health and safety training for CCDF providers on required topics a) 3. In-home care: Non-relative FFN providers must complete pediatric CPR/First Aid training (4-6 hours), and training on all other health and safety topics (2-4 hours), within 90 days of their authorization begin date. 5.2.4 Provide the minimum number of annual training hours on health and safety topics for caregivers, teachers, and directors required for the following. c) In-home care: Nonrelative FFN providers receive ongoing health and safety training as part of their annual health and safety visit. The ongoing training is based on health and safety topics that the provider requests more information on and areas of need as determined by the annual visit, and typically will be 2-4 hours per year. 5.3 Monitoring and Enforcement Policies and Practices for CCDF Providers 5.3.3 Inspections for license-exempt CCDF providers c) Nonrelative FFN providers are required to receive announced monitoring annually on all health and safety and fire safety topics described in plan. WAC 110-16-0030 Health and safety activities, states: (1) Providers not related to the child as described in WAC 110-16-0015 (4)(c), must comply with the following health and safety activity requirements: (a) Complete the Parent and FFN Provider Health and Safety Agreement; and (b) Participate in an annual, scheduled visit in the child's home. If necessary, as determined by the department, follow-up visits may occur on a more frequent basis. (2) The Parent and FFN Provider Health and Safety Agreement must: (a) Be signed by the provider and parent(s) and verify that the parent(s) and provider discussed and reviewed all of the topics and subject matter items contained in the agreement. The subject matter items include, but are not limited to: Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; emergency contacts; fire and emergency prevention; knowledge and treatment of children's illnesses and allergies; developmental and special needs; medication administration; safe transportation; child immunizations; and safe evacuation; and (b) Be received by the department within forty-five days of completion of the training requirements in WAC 110-16-0025 (2)(a) or verification of the training exemption in WAC 110-16-0025 (2)(b). (3) The purpose of the annual, scheduled visit in the child's home is to: (a) Provide technical assistance to the provider regarding the health and safety requirements described in this chapter; (b) Observe the provider's interactions with the child, and discuss health and safety practices; (c) Provide written information and local resources about child development to include the major domains of cognitive, social, emotional, physical development, and approaches to learning; and (d) Provide regional contact information for FFN child care services and resources. (4) If the department is not able to successfully complete a scheduled visit with the provider in the child's home after three attempts, the provider will be deemed not in compliance with the requirements of this chapter. (5) At the annual, scheduled visit, the provider must show: (a) Proof of identity; (b) Proof of current certification for first aid and cardiopulmonary resuscitation (CPR) in the form of a card, certificate, or instructor letter; (c) Proof of vaccination against or acquired immunity for vaccine-preventable diseases for all children in care, if the provider's children are on-site at any time with the eligible children. Proof can include: (i) A current and complete department of health certificate of immunization status (CIS) or certificate of exemption (COE) or other department of health approved form; or (ii) A current immunization record from the Washington state immunization information system (WA IIS). (d) Written permission from the parent to: (i) Allow children to use a swimming pool; (ii) Administer medication for treatment of illnesses and allergies of the children in care; (iii) Provide for and accommodate developmental and special needs; and (iv) Provide transportation for care, activities, and school when applicable. (e) The written home evacuation plan required in WAC 110-16-0035 (4)(c). Policy 10.1.8 Conducting Child Care Monitoring Visits, states, in part: 1. DCYF Must Monitor Early Learning Program Not Less Than Annually Per Federal Requirements Except When A Program Is On Inactive Status Monitoring visits must occur at least once every fiscal year. Staff may do a monitoring visit at any time during the year? 2. Annual Monitoring Visit Due Dates Follow DCYF?s Fiscal Year Procedure 10.1.21 Managing Child Care Inspection Reports, states, in part: Licensor determines if health and safety recheck is required. If an issue of non-compliance is corrected during the licensing visit, a compliance verification for that specific WAC is not required. ? Immediate Concerns must verify compliance on site as soon as possible but no later than 10 business days from date of non-compliance. Discuss recheck schedule with Supervisor. ? Short Term Concerns must verify compliance within 15 business days from date of non-compliance. Long Term Concerns do not require a licensor recheck. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, and paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program

2021-040 The Department of Children, Youth, and Families did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. CFDA Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2002WAFOST; 2102WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: None Background The federal Foster Care Title IV-E (Foster Care) program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state?s child welfare agency until the children are returned home, placed with adoptive families, or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for the adults in the Foster Care program, including state agency staff, foster parents and certain private agency staff. In Washington, the Department of Children, Youth, and Families (Department) administers the Foster Care program. During fiscal year 2021, the Department spent about $121 million in federal grant funds, including approximately $4.4 million dollars for travel and family visits. Parent-child visits are a key strategy for minimizing a child?s time in out-of-home care and working toward family reunification. The Department creates a visit plan based on court documents and other information to ensure the safety of the child. The Department uploads all visit plans to an electronic database system called Sprout where cases are assigned to a provider and sent to subcontractors. When travel is completed, the subcontractors send visit reports to the provider, who then uploads them into Sprout at summary level. The Department pays the provider solely based on the summary level information it enters into Sprout. The Department conducts periodic fiscal monitoring of providers to verify payments are accurate and adequately supported. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. The Department did not follow its procedures for performing fiscal monitoring of foster care service providers to ensure federally funded payments for travel and family visits were adequately supported and only for allowable activities. We consider this internal control deficiency to be a significant deficiency. This issue was not reported as a finding in the prior audit. Cause of Condition Management decided not to perform fiscal monitoring of the Department?s providers due to the COVID-19 pandemic. Effect of Condition By not performing fiscal monitoring, the Department cannot ensure payments for travel and family visits are allowable and adequately supported. Recommendation We recommend the Department follow its fiscal monitoring procedures to ensure payments to providers for travel and family visits are allowable and adequately supported. Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor?s Office?s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. The Department is committed to strengthening internal controls and complying with grant requirements. The Department will work with Financial and Business Services Division and Foster Care Program to review the fiscal monitoring procedures to ensure payments to providers for travel and family visits are allowable and adequately supported. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance.

2021-041 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with federal requirements to ensure indirect costs charged to the Foster Care program were allowable. CFDA Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 Foster Care Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2002WAFOST; 2102WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs / Cost Principles Known Questioned Cost Amount: $16,289,333 Background In Washington, the Department of Children, Youth, and Families (Department) administers the Foster Care program. The federal government?s share of all costs incurred by or allocated to the Department can be charged to the federal grants. As a condition of receiving federal grant funds, the Department must submit a Public Assistance Cost Allocation Plan (PACAP) to the U.S. Department of Health and Human Services (DHHS) each state fiscal year. The PACAP describes how the Department allocates its administrative costs to all funding sources, including federal grants. If the state amends its PACAP and fails to submit it to DHHS, the costs will be disallowed. The Department uses the Cost Allocation System (CAS), a subsystem of the Agency Financial Reporting System (AFRS), to execute its PACAP. The Department develops methodologies, including creating bases, which automatically distribute the cost of payments to either state, local or federal funding sources. The Department keeps records of these bases in workbooks, which management review and approve before uploading or keying them to AFRS for use. As part of its cost allocation process, the Department uses bases to distribute costs to multiple funding sources. Each base consists of elements that are assigned a percentage that dictates how much of the original payment is allocated to it. For the costs to be allowable, each base must be included in the PACAP. The Department is required to submit an amended PACAP any time its cost allocation plan changes. In fiscal year 2021, the Department used CAS to allocate approximately $16.3 million in indirect costs to the Foster Care Title IV-E program. Description of Condition The Department did not have adequate internal controls over and did not comply with federal requirements to ensure indirect costs charged to the Foster Care program were allowable. We reviewed the list of six bases the Department used to allocate costs to the Foster Care program during state fiscal year 2021 and found it did not include any of them in the approved PACAP. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Management did not effectively monitor to ensure that the Department had included the six bases in the state fiscal year 2021 PACAP submission before charging costs to the Foster Care program. Effect of Condition and Questioned Costs We identified $16,289,333 of indirect costs tied to the six bases that were not included in the state fiscal year 2021 PACAP submission that the Department improperly charged to the Foster Care Title IV-E program. By not complying with federal regulations, the Department risks having to repay federal funds or having future federal funds withheld. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Strengthen internal controls to ensure it includes all bases in the approved PACAP ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges and supports the State Auditor?s Office?s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. As of July 1, 2018, the Legislature created the Department of Children, Youth, and Families (DCYF) by combining the Children?s Administration and the Department of Early Learning. The new agency assumed the responsibilities of managing the Foster Care program and created a PACAP to comply with federal regulations. The Cost Allocation and Grants Unit was under resourced due to vacancies and the hiring freeze during the time the original PACAP was established and submitted and the six bases were missed. As a newly established agency, the Department continues to work on documenting and refining internal control processes and procedures. The Department has been developing and refining internal controls to ensure that expenditures are properly allocated across the Department. The Department will verify all bases are included in the approved PACAP and communicate any updates or changes to DHHS in a timely manner. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. Title 45 U.S. Code of Federal Regulations (CFR), Subtitle A, Subchapter A, Part 95, General Administration-Grant Programs(Public Assistance, Medical Assistance and State Children?s Health Insurance Programs, states in part: 95.509 Cost allocation plan amendments and certifications. (c) The State shall promptly amend the cost allocation plan and submit the amended plan to the DCA Director when changes occur. (d) If a State has not submitted a plan or plan amendment during a given State fiscal year, an annual statement shall be submitted to the DCA Director certifying that it?s approved cost allocation plan is not outdated. This statement shall be submitted within 60 days after the end of that fiscal year. 95.517 Claims for Federal financial participation. (a) A State must claim FFP for costs associated with a program only in accordance with its approved cost allocation plan. However, if a State has submitted a plan or plan amendment for a State agency, it may, at its option claim FFP based on the proposed plan or plan amendment, unless otherwise advised by the DCA. However, where a State has claimed costs based on a proposed plan or plan amendment the State, if necessary, shall retroactively adjust its claims in accordance with the plan or amendment as subsequently approved by the Director, DCA. The State may also continue to claim FFP under its existing approved cost allocation plan for all costs not affected by the proposed amendment. 95.519 Cost disallowance. If costs under a Public Assistance program are not claimed in accordance with the approved cost allocation plan, or if the State failed to submit an amended cost allocation plan as required by ?95.509, the costs improperly claimed will be disallowed. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-042 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with some Public Assistance Cost Allocation Plan requirements. CFDA Number and Title: 93.658 Foster Care Title IV-E 93.658 COVID-19 Foster Care Title IV-E 93.659 Adoption Assistance 93.659 COVID-19 Adoption Assistance Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2002WAFOST; 2102WAFOST; 2002WAADPT; 2102WAADPT; Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: None Background The Department of Children, Youth, and Families (Department) uses the Random Moment Time Study (RMTS) to allocate costs for its headquarters and regional operations to the proper state and federal programs. Department staff generally work on multiple programs and cases throughout a workday, which makes maintaining a timesheet difficult and time consuming. The RMTS simplifies how the Department allocates the cost of time and effort to state and federal programs. The RMTS is a sampling tool that the Department uses to generate statistically valid statewide estimates of various activities employees have performed. The Department also uses a system called FamLink, which allows staff to work on client cases, document information, generate samples and compile RMTS results. The Department?s use of the RMTS is included in its Public Assistance Cost Allocation Plan (PACAP) with the federal grantor. The PACAP is approved annually and outlines the general operating policies and procedures that the RMTS staff must follow. For the RMTS to properly calculate the percentages of activities Department staff have performed, it must start by identifying a sampling universe that is accurate and complete. The sampling universe lists the eligible worker types to be included and is updated monthly to ensure all eligible workers are included in the sample. The RMTS Coordinators and RMTS Headquarters (HQ) are responsible for keeping the list of sample workers current. To ensure the sample worker population is complete, the RMTS HQ runs the worker report, filters it, and then communicates the report to the RMTS Coordinators to verify proper workers are included, excluded, or documented with the right worker type to maintain an accurate RMTS population. The RMTS Coordinators send the RMTS HQ emails informing them of the changes that need to be made to assigned workers and the unassigned workers. The RMTS HQ will then update the workers profiles in FamLink as updates come in. Sampled workers are responsible for completing an accurate and timely RMTS sample within three business days. The RMTS HQ performs a quality control review of all completed samples to ensure staff are completing them correctly. At the end of the month, the Department uses FamLink to summarize the sample results for the month. The results are then compiled and used to fill out the Cost Allocation Base Data Input Sheets for each RMTS base. The results are then entered into the Cost Allocation System (CAS). During fiscal year 2021, the Department used the RMTS to allocate about $52.7 million to the Foster Care-Title IV-E and Adoption Assistance programs. Federal regulations require recipients to establish and follow internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. In the prior two audits, we reported the Department did not have adequate internal controls over and did not comply with some PACAP requirements. The prior finding numbers are 2020-044 and 2019-044. Description of Condition The Department did not have adequate internal controls over and did not comply with some PACAP requirements. We randomly selected five out of the 12 monthly employee updates to determine whether the sampling universe was complete. RMTS HQ The RMTS HQ Program Manager is responsible for creating monthly employee reports that show current staff who are in the sampling population, as well as a report of employees who may be RMTS eligible. The Program Manager forwards these reports to the RMTS Coordinators asking for updates of employees on each report. Once the Program Manager receives the RMTS Coordinators? responses, the Program Manager updates FamLink to ensure the sampling universe is complete. For two of the five sampled months that we examined, we found the Department did not have documentation to support that it had ensured the RMTS sampling universe was complete. For one month, the Department was unable to provide the monthly employee reports or documentation of the communication of those reports to the RMTS Coordinators. For the second month, the Department was able to provide the monthly employee reports, but not evidence that it forwarded them to the RMTS Coordinators for updating. RMTS Coordinators The RMTS Coordinators receive reports from the Program Manager asking for updates on employees in the reports. The RMTS Coordinators review the reports and send updates to the Program Manager so the RMTS HQ can make updates in FamLink to ensure the sampling universe is complete. For one of the five sampled months we examined, the Department was unable to provide evidence that the RMTS Coordinators sent updates to the RMTS HQ to ensure the worker population was complete. Additionally, for four of the five months we examined, the Department did not ensure all RMTS-eligible employees were included in the sampling universe. The sampling universe was also not completely updated for four of the five months we examined. RMTS results updated incorrectly in the Cost Allocation System The Department uses FamLink to summarize the results of all RMTS samples for a given month. The RMTS HQ then export this data to an Excel file summarizing the results for all codes. The Department then uses these results to fill out the Cost Allocation Base Data Input Sheets for the RMTS bases. Each base corresponds to a specific group of employees. This information is transmitted to the Cost Allocation and Grants Management Unit, which enters the information into the automated Cost Allocation System. We examined five of the 12 base edit workbooks that staff created during the fiscal year. For two of the months we examined, there was no evidence that the Department reviewed the base edit workbooks and updates made to the automated CAS cost allfor accuracy. We also examined the Base Data Input Sheets to determine if Cost Allocation and Grants Management Unit staff updated them correctly in CAS. For the five months we examined, we found that staff did not correctly update four months in accordance with the Department?s procedures. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management said that limited staffing resources and information technology challenges affected the Department?s ability to ensure timely entry and documentation of information, as well as the ability to ensure the RMTS Coordinators sent timely updates to the RMTS HQ Program Manager. Additionally, management did not monitor sufficiently to ensure compliance with PACAP requirements. Effect of Condition The Department?s inadequate internal controls affected the integrity of its RMTS sampling universe. An erroneous sample could cause the costs the Department has charged to federally funded programs for its headquarters and regional operations to be unallowable, according to the PACAP. Additionally, when staff incorrectly enter RMTS results into the base edit workbooks, the Cost Allocation System will incorrectly allocate the cost of salaries and benefits to state and federal programs. If the Department charged unallowable or unsupported costs to federal programs, federal grantors could seek repayment for those costs. The Department used the RMTS to charge $47,791,692 in payroll costs to the Foster Care-Title IV-E program and $4,988,320 in payroll costs to the Adoption Assistance program. Recommendations We recommend the Department: ? Ensure staff follow its own established procedures to ensure RMTS sampling populations are accurate and complete ? Address the information technology challenges that prevented the RMTS Coordinators from sending timely updates to the RMTS HQ Program Manager ? Monitor to ensure that Cost Allocation and Grants Management Unit staff correctly update RMTS results into the Cost Allocation System Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor?s Office?s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. The Department does not concur with the Effect of the Condition that the sampling universe is inaccurate or incomplete. There is not a deficiency with the integrity of the RMTS sample, however we acknowledge that the bases were not updated timely in Agency Financial Reporting System (AFRS) due to staffing and information technology challenges for two months during the audit period. The Department maintains that we are in compliance with the RMTS instructions related to the sampling universe that are included in the federally approved Public Assistance Cost Allocation Plan (PACAP). The audit scope expanded beyond the approved process within the RMTS instructions and federal requirements. To provide some additional background, there is a high turnover rate of staff within the cost pools. That coupled with system limitations regarding departing workers associated to active cases prevents the immediate removal of staff from previously sent RMTS samples and responses. To address this systemic issue; faced by most states, the Department performs a 100% review of the RMTS sample responses to ensure the accuracy of responses and any staff changes within the cost pools are updated. If a sample is received by a social worker that no longer holds the position, the sample is coded based on the most currently approved RMTS codes. Further, the Department oversamples cost pools to ensure statistical validity is met while considering staffing changes. The Department?s error rate is less than +/- 1%, far below the required +/- 5% for Title IV-E. Further, communication with the Regional Coordinators occurs regularly and cost pools are updated within the parameters identified within the RMTS instructions. For these reasons, the Department maintains the position that the sampling universe complies with federal regulations and the RMTS instructions in the most current approved PACAP. The Department is currently negotiating a contract with the University of Massachusetts, effective October 2022, for the design and implementation of RMTS mechanism, which is a federally approved cost allocation methodology, to accurately claim allowable federal funds and update RMTS instructions for the new quarterly process. These changes will address the auditor?s concerns around the internal controls related to the RMTS population. In addition, the Department will review base edit form procedures with staff and verify changes are entered and reviewed in AFRS timely. Auditor?s Remarks Our audit procedures were designed to determine whether the Department charged only allowable costs to federal grants in compliance with their approved PACAP and federal law. 2 CFR 200.430 requires the sampling universe include all of the employees whose salaries and wages are to be allocated based on sample result, the entire time period involved must be covered by the sample and that the results must be statistically valid and applied to the period being sampled. During the audit period, the Department did not ensure the sampling universe was complete and therefore was not compliant with federal law. We reaffirm our finding, and we will follow up on the Department?s corrective action during the next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.430 Compensation-personal services, states in part: (5) For states, local governments and Indian tribes, substitute processes or systems for allocating salaries and wages to Federal awards may be used in place of or in addition to the records described in paragraph (1) if approved by the cognizant agency for indirect cost. Such systems may include, but are not limited to, random moment time sampling, ?rolling? time studies, case counts, or other quantifiable measures of work performed. (i) Substitute systems which use sampling methods (primarily for Temporary Assistance for Needy Families (TANF), the Supplemental Nutrition Assistance Program (SNAP), Medicaid, and other public assistance programs) must meet acceptable statistical sampling standards including: (A) The sampling universe must include all of the employees whose salaries and wages are to be allocated based on sample results except as provided in paragraph (i)(5)(iii) of this section; (B) The entire time period involved must be covered by the sample; and (C) The results must be statistically valid and applied to the period being sampled. (ii) Allocating charges for the sampled employees? supervisors, clerical and support staffs, based on the results of the sampled employees, will be acceptable (iii) Less than full compliance with the statistical sampling standards noted in subsection (5)(i) may be accepted by the cognizant agency for indirect costs if it concludes that the amounts to be allocated to Federal awards will be minimal, or if it concludes that the system proposed by the non-Federal entity will result in lower costs to Federal awards than a system which complies with the standards. (6) Cognizant agencies for indirect costs are encouraged to approve alternative proposals based on outcomes and milestones for program performance where these are clearly documented. Where approved by the Federal cognizant agency for indirect costs, these plans are acceptable as an alternative to the requirements of paragraph (i)(1) of this section. (7) For Federal awards of similar purpose activity or instances of approved blended funding, a non-Federal entity may submit performance plans that incorporate funds from multiple Federal awards and account for their combined use based on performance-oriented metrics, provided that such plans are approved in advance by all involved Federal awarding agencies. In these instances, the non-Federal entity must submit a request for waiver of the requirements based on documentation that describes the method of charging costs, relates the charging of costs to the specific activity that is applicable to all fund sources, and is based on quantifiable measures of the activity in relation to the time charged. (8) For a non-Federal entity where the records do not meet the standards described in this section, the Federal Government may require personnel activity reports, including prescribed certifications, or equivalent documentation that support the records as required in this section. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Department of Children Youth and Families Public Assistance Cost Allocation Plan, RMTS Program Instructions, page 37, states in part: Headquarters RMTS staff shall be responsible for the following actions: Overseeing the system?s monthly batching of new samples which includes three variables: ? Random Moment Starting Time ? Random Interval Time Random ? Employee List The Headquarters RMTS Staff work with the RMTS Coordinators in order to keep the list of sampled workers current. Worker employment status changes should be reported by the social workers? supervisors to RMTS Coordinators. In addition, HQ Staff need to verify that each worker has an RMTS Worker Type associated with him or her and an RMTS Group linking the worker to his or her coordinator. The Regional RMTS Coordinator shall be responsible for the following actions: Notify HQ RMTS Staff of any updates to their worker list when there is any change in employment status of a worker participating in the RMTS survey within five working days of change. In addition, the coordinator needs to provide HQ RMTS Staff with an appropriate RMTS Worker Type code for each worker added to the system.

2021-043 The Department of Children, Youth and Families improperly charged $1,850 in benefits to the Foster Care Title IV-E program. CFDA Number and Title: 93.658 Foster Care ? Title IV-E 93.658 COVID-19 Foster Care ? Title IV-E Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2002WAFOST; 2102WAFOST Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: $1,850 Background The federal Foster Care Title IV-E (Foster Care) program helps states provide safe and stable out-of-home care for children under the jurisdiction of the state?s child welfare agency until the children are returned home, placed with adoptive families, or placed in other planned, permanent arrangements. The program provides funds to reduce the costs of foster care for eligible children, reduce administrative costs to manage the program, and provide training for the adults in the Foster Care program, including state agency staff, foster parents and certain private agency staff. To be eligible to receive foster care benefits a child must meet specific eligibility requirements including the former Aid to Families with Dependent Children (AFDC) criteria. To meet the AFDC criteria, the child must be both a needy child and a child who is deprived of parental support or whose principal wage earner parent is unemployed. In Washington, the Department of Children, Youth, and Families (Department) administers the Foster Care program. During fiscal year 2021, the Department spent about $121 million in federal grant funds for the Foster Care Title IV-E program. Description of Condition The Department improperly charged $1,850 in benefits to the Foster Care Title IV-E program. We found the Department had adequate internal controls to ensure it materially complied with eligibility requirements. We used a statistical sampling method to randomly select and examine 58 out of 1,199 children to determine whether they were eligible for the Foster Care program. We found one child who was not eligible, but for whom the Department paid $1,850 in benefits on behalf of using Foster Care program funds. We are questioning these costs. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a single audit exceed $25,000. We are issuing this finding because, as stated in the Effect of Condition and Questioned Costs section of this finding, the estimated questioned costs exceed that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition The Department incorrectly applied AFDC income eligibility rules resulting in an ineligible case being charged to federal grant funds. Effect of Condition and Questioned Costs The Department improperly determined eligibility for one individual leading to known questioned costs of $1,850 dollars, which led to likely questioned costs of $38,242. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs? as required by 2 CFR 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendation We recommend the Department consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor?s Office?s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. The Department concurs with the finding. Upon validating the exception, the Department took immediate action to change the source of funds for the child from federal to state dollars in the FamLink application. In addition, the Department returned the federal portion of all payments made on behalf of the child to the grantor. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. The State Plan for Title IV-E, Section 2. Foster Care Maintenance Payments states in part: d. who: i. Either: A. received AFDC, in the home referred to in section 472(a)(1), under the State plan approved under section 402 of the Act (as in effect (7/16/96) in or for the month in which either a voluntary placement agreement was entered into or court proceedings leading to the judicial determination, referred to in section 472(a)(2)(A) of the Act, were initiated; B. would have received AFDC, in the home, in or for such month referred to in above clause if application for such aid had been made; or C. had been living with a relative specified in section 406(a) of the Act (as in effect 7/16/96) within six months prior to the month in which a voluntary placement agreement was entered into or court proceedings leading to the judicial determination, referred to in section 472(a)(2)(A) of the Act, were initiated, and would have received AFDC in or for such month if the child had been living in the home with such relative and an application had been made for AFDC under title IV-A of the Act; and ii. had resources (determined under section 402(a)(7)(B) of the Act as in effect 7/16/96) that had a combined value of not more than $10,000 consistent with section 472(a)(3)(B) of the Act; or iii. Is not required to meet the AFDC requirements in 472(a)(3) of the AFDC requirements in 472(a)(3) of the Act because the child is placed with a parent residing in a licensed residential family-based substance abuse treatment facility(Tribes, see section 7 for related requirements in section 479B(c)(1)(C)(ii)(II) of the Act.) The Department?s Title IV-E desk guide states in part: The AFDC financial need determination consists of two separate determinations, income eligibility and resource eligibility. In order to meet financial need: ? Total gross countable income of the assistance unit must not exceed the gross income (185%) standard for the number of individuals in the AU; and ? Total net countable income of the AU must not exceed the net income (100%) standard for the number of individuals in the AU; and ? Total countable resources of the assistance unit must be less than $10,000

2021-044 The Department of Children, Youth, and Families did not have adequate internal controls over its process to allocate the Adoption Assistance program expenditures to federal grants. CFDA Number and Title: 93.659 Adoption Assistance 93.659 COVID-19 Adoption Assistance Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2002WAADPT, 2102 WAADPT Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Matching Known Questioned Cost Amount: None Background The Adoption Assistance program (program) provides federal matching funds to states that provide ongoing subsidy and/or non-recurring payments to parents who adopt eligible children with special needs and enter into an adoption assistance agreement. In Washington, the Department of Children, Youth, and Families (Department) administers the program to provide funding for parents who adopt eligible children with special needs. The program provides financial and medical benefits to qualified children. Adoptive parents can receive a monthly assistance payment from the Department to care for the children, in addition to expenses related to the initial placement of the child in the home, such as court fees, payments for medical visits and transportation costs. Federal financial participation in state expenditures for the program is provided at various rates, and the Department must match federal grant funds locally. The program provides for the use of the applicable Federal Medical Assistance Percentages (FMAP) rate for allowable program expenditures. The Department assigns specific expenditure coding that correlates to the applicable FMAPs for a particular type of expenditure. The Department uses cost objective codes in the Cost Allocation System (CAS) to match every transaction with non-federal funds. The Department assigns a specific cost objective code to each transaction. When matching rates change, the Department uses edit forms to update the matching rate in the cost objective. According to Department policy, the person who edits the form must not be the same person who prepares, approves or inputs the edit form into CAS. The edit form must be approved before being input into CAS to ensure that the Department claims only the federal percentage of expenditures. Staff must review the information input into CAS to ensure it is correct. In fiscal year 2021, the Department spent about $58.6 million in federal funding for the Adoption Assistance program and about $48 million in state funds. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Department did not have adequate internal controls over its process to allocate the Adoption Assistance program expenditures to federal grants. The prior finding number was 2020-045. Description of Condition The Department did not have adequate internal controls over its process to allocate the Adoption Assistance program expenditures to federal grants. The Department edits CAS when changes to matching rates become necessary. The Department created five cost objectives during fiscal year 2021. We reviewed the supporting documentation the Department used to create the five cost objectives and found three instances when staff did not properly review and approve the federal percentages entered to ensure they were correct. We consider this internal control deficiency to be a material weakness, which may lead to material noncompliance. Cause of Condition Management said the Department processed these three cost objectives before implementing changes in response to the prior audit finding. Effect of Condition By not establishing adequate internal controls, the Department faces increased risk that it will not properly allocate costs to the federal government. Improper allocations could lead to improper payments, for which grantors could seek reimbursement from the Department. Recommendation We recommend the Department follow its established policy and: ? Ensure management reviews edit forms ? Ensure duties are segregated, with different people preparing, reviewing, and entering the edit forms Department?s Response The Department is committed to strengthening internal controls and complying with grant requirements. In response to the previous audit finding, in October 2020 the Department established a workflow for segregating duties to strengthen internal controls over processing cost allocation edit forms and ensure approvals and reviews in all steps of the process. The three instances noted by the auditor where all changes made on one edit form entered in September 2020, prior to the new work flow being implemented. All samples reviewed after October 2020 had documentation of approval and review per the new process. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance.

2021-045 The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with level of effort requirements for the Adoption Assistance program. CFDA Number and Title: 93.659 Adoption Assistance 93.659 COVID-19 Adoption Assistance Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2002WAADPT; 2102WAADPT Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Level of Effort Known Questioned Cost Amount: None Background The Adoption Assistance program is administered at the federal level by the Children?s Bureau, Administration on Children, Youth and Families, Administration for Children and Families (ACF), a component of the U.S. Department of Health and Human Services (HHS). Since federal fiscal year 2010, the Title IV-E Adoption Assistance program has provided eligibility provisions for any child who meets the expanded eligibility criteria that resulted in more children being determined as eligible for Title IV-E. The increased eligibility allows states to receive additional federal funding for adoption, thereby allowing them to reduce the level of nonfederal funds they use for these services. The reduction in nonfederal spending is referred to as ?adoption savings.? Beginning in federal fiscal year 2015, each Title IV-E agency must annually calculate and report on the amount of any adoption savings, how savings are spent, and on what services. Agencies must use their adoption savings to expand services that may be provided under Title IV-B or IV-E programs. Additionally, agencies must spend no less than 30 percent of the savings on post-adoption services, post-guardianship services, and services to support positive outcomes for children at risk of entering foster care. Agencies must also spend at least two-thirds of this 30 percent on post-adoption and post-guardianship services. In Washington, the Department of Children, Youth, and Families (Department) administers the Adoption Assistance program to encourage people to adopt children out of the foster care system. The program supports approximately 18,000 children and 10,000 families. In fiscal year 2021, the Department spent about $58.6 million in federal funding. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with level of effort requirements for the Adoption Assistance program. The Department reported to the federal government it spent $1,353,842 of the adoption savings during the audit period. However, the Department only had documentation to support $111,839 of adoption savings expenditures. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department split the responsibility for tracking and managing adoption savings expenditures between Child Welfare Program and Cost Allocation and Grant Management Unit staff. Coordination between these areas was insufficient for ensuring that staff maintained accounting records to verify adoption savings expenditures. After the audit period, the Department created a new position responsible for managing the adoption savings program. We also determined the Department did not have policies or procedures to monitor its compliance with the program?s level of effort requirements. Effect of Condition The grant agreement allows the grantor to take action for the Department?s noncompliance. This can include temporarily withholding funds, wholly or partly suspending or terminating the award, and withholding further awards from the program. Recommendations We recommend the Department: ? Develop and implement written policies and procedures to properly track adoption savings spending ? Strengthen management oversight to ensure it complies with level of effort requirements Department?s Response The Department of Children, Youth, and Families appreciates, acknowledges, and supports the State Auditor?s Office?s (SAO) mission to provide citizens with independent and transparent examinations of how state and local governments use public funds, and develops strategies to make government more efficient and effective. As stated in the Cause of Condition, the Department created a new position to manage the adoption saving program and hired for the position in February 2022. In May 2022, the Department revised the CB-496 Annual Adoption Savings report for federal fiscal year 2020 and submitted the corrected report to the Administration for Children and Families (ACF). The Department has established reoccurring meetings with impacted staff prior to and after the submission of the CB-496 financial report and reviewed the written procedures for federal adoption savings expenditure requirements and tracking. The Department will continue to take the necessary steps to improve our internal controls and accuracy in our financial reporting. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will review the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations 42 U.S. Code ? 673 - Adoption and guardianship assistance program (a)Agreements with adoptive parents of children with special needs; State payments; qualifying children; amount of payments; changes in circumstances; placement period prior to adoption; nonrecurring adoption expenses (8) (A) A State shall calculate the savings (if any) resulting from the application of paragraph (2)(A)(ii) to all applicable children for a fiscal year, using a methodology specified by the Secretary or an alternate methodology proposed by the State and approved by the Secretary. (B) A State shall annually report to the Secretary? (i) the methodology used to make the calculation described in subparagraph (a), without regard to whether any savings are found; (ii) the amount of any savings referred to in subparagraph (A); and (iii) how any such savings are spent, accounting for and reporting the spending separately from any other spending reported to the Secretary under part B or this part. (C) The Secretary shall make all information reported pursuant to subparagraph (B) available on the website of the Department of Health and Human Services in a location easily accessible to the public. (D) (i) A State shall spend an amount equal to the amount of the savings (if any) in State expenditures under this part resulting from the application of paragraph (2)(A)(ii) to all applicable children for a fiscal year, to provide to children of families any service that may be provided under part B or this part. A State shall spend not less than 30 percent of any such savings on post-adoption services, post-guardianship services, and services to support and sustain positive permanent outcomes for children who otherwise might enter into foster care under the responsibility of the State, with at least ? of the spending by the State to comply with such 30 percent requirement being spent on post-adoption and post-guardianship services. (ii) Any State spending required under clause (i) shall be used to supplement, and not supplant, any Federal or non-Federal funds used to provide any service under part B or this part. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (7) Instances where the results of audit follow-up procedures disclosed that the summary schedule of prior audit findings prepared by the auditee in accordance with ?200.511. Audit findings follow-up, paragraph (b) materially misrepresents the status of any prior audit findings. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-046 The Health Care Authority did not have adequate internal controls to ensure clients were eligible for the Children?s Health Insurance Program. CFDA Number and Title: 93.767 Children?s Health Insurance Program 93.767 COVID-19 Children?s Health Insurance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2005WA5021, 2105WA5021 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Eligibility Known Questioned Cost Amount: $10,244 Background The Health Care Authority (Authority) administers the Children?s Health Insurance Program (CHIP). CHIP is a jointly funded state and federal partnership providing insurance coverage for more than 50,000 children in families with incomes too high to qualify for Medicaid. Federal CHIP financing is capped, and each state operates under an allotment. During fiscal year 2021, the Authority spent more than $384 million in state and federal funds to administer CHIP, with over $157 million being federal. To determine initial eligibility for CHIP, families must complete an application in the Washington Health Benefit Exchange, known as HealthPlan Finder, or through a streamlined paper application. Once families complete their applications, electronic verification sources confirm their income, immigration status and Social Security Numbers (SSNs). The Authority automatically reviews applicants? eligibility first for Medicaid and then for CHIP if they are ineligible for Medicaid. Children in low-income families who are ineligible for Medicaid are enrolled in CHIP under the state CHIP plan. Washington has also elected to cover the pre-natal period of some low-income pregnant women under the state CHIP plan. CHIP clients must be either U.S. citizens or qualified noncitizens, and their eligibility is based on self-attested income in their applications; therefore, clients with verified citizenship and SSNs would be determined eligible if their reported income was between 210% and 312% of the federal poverty level. Once the Authority determines clients? initial eligibility, their start date is recorded as the first of the month in which their application was submitted, thus allowing for payments prior to approval to be processed after the fact. Children found eligible for medical assistance remain continuously eligible for a full 12 months, regardless of any changes in their household income or third-party liability. Households must report financial and nonfinancial changes, but these will not render them ineligible during the continuous eligibility period. However, if recipients? household income decreases, the Authority can move children to a more favorable program, such as Medicaid, to eliminate the premium payment requirements. Termination during the continuous eligibility period is acceptable only for the following reasons: ? Changes in residency (permanent move out of state) ? Death ? Fraud (unless it is going to prosecution) ? Failure to pay the premium in excess of three months ? The child turns 19 years old (remains eligible through the end of their birth month) ? After the end of the month in which the 60-day postpartum period ends for pregnant women ? When a client requests to be removed from the program In response to the COVID-19 pandemic, the Center for Medicare and Medicaid Services (CMS) approved waivers and disaster relief state plan amendments (SPA), effective March 1, 2020, through the end of the public health emergency declaration, allowing flexibilities to ensure the continuity of coverage through the public health emergency. The waivers and SPA allowed the Authority to implement flexibilities, including the following: ? Allow self-attestations for all eligibility requirements, excluding citizenship and immigration status, on a case-by-case basis ? Extend the redetermination timeline for current CHIP enrollees in the state to maintain continuity of coverage as permissible. From the start of the pandemic, CMS kept an ongoing Frequently Asked Questions (FAQs) document to aid state Medicaid and CHIP agencies in their response to COVID-19, including guidance on eligibility, benefits and financing regarding the pandemic. This document was finalized on January 6, 2021. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Authority did not have adequate internal controls to ensure clients were eligible for CHIP. We used a statistical sampling method to randomly select and examine 59 out of a total population of 89,527 clients who had a federally verified SSN. We also used a statistical sampling method to randomly select and examine 59 out of a total population of 7,187 clients who did not have a federally verified SSN. For the sample of clients who had a verified SSN, we identified: ? One instance where a client aged out of services and was not referred to HealthPlan Finder in order to be redetermined eligible for Medicaid during the COVID-19 pandemic as required. For the sample of clients who did not have a federally verified SSN, we identified: ? One instance where the Authority did not ensure that a client had a valid SSN or appropriate citizenship to be eligible for CHIP services. ? Two instances where the Authority continued CHIP coverage for clients after the allowable postpartum period. We consider this internal control deficiency to be a material weakness. This issue was not reported as a finding in the prior audit. Cause of Condition During the pandemic there was changing guidance from CMS and the Authority chose not to remove clients from CHIP even when they aged out of coverage. In addition, the Authority claims a system alert generation error was the cause for the client who was missing a valid SSN and HCA staff were not notified by the system to follow-up on this SSN verification. Effect of Condition and Questioned Costs By not having adequate internal controls, the Authority is at risk of not detecting or preventing ineligible payments of federal CHIP funds on behalf of recipients. We determined the following questioned costs: Audit Area Known questioned costs (state and federal) Known questioned costs ? federal portion only Likely improper payments (state and federal) Likely improper payments ? federal portion only Verified SSNs $3,992 $3,992 $6,058,049 $6,058,049 Non-Verified SSNs $7,961 $6,252 $969,792 $761,593 Totals $11,953 $10,244 $7,027,841 $6,819,642 Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs? as required by 2 CFR 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: ? Implement internal controls to ensure all clients meet CHIP eligibility requirements ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Authority?s Response The Authority will work with its federal partners to understand the interpretation of claiming CHIP federal dollars when youth age out of the program and what is allowable. The policy information over the course of the public health emergency has changed several times and we will work to ensure clear policy guidance from CMS as Washington believes this policy could be supported by its CHIP disaster state plan or an 1115 waiver. The Authority?s finance team will work to ensure it has internal processes in place during staff turnover events and that the journal vouchers are completed for any cases where CHIP dollars are used during the postpartum period. The Authority?s eligibility team is working with the Department of Social and Health Services? systems division to understand the system issue that caused alerts to not generate on cases where SSN verification needs follow up. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.1 Definitions, states in part: Improper payment means: 2) Any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. (iv) Incorrect amounts are overpayments or underpayments that are made to eligible recipients (including inappropriate denials of payment or service, any payment that does not account for credit for applicable discounts, payments that are for an incorrect amount, and duplicate payments). An improper payment also includes any payment that was made to an ineligible recipient or for an ineligible good or service, or payments for goods or services not received (except for such payments authorized by law). Note 1 to paragraph (1)(i) of this definition. Applicable discounts are only those discounts where it is both advantageous and within the agency's control to claim them. (v) When an agency's review is unable to discern whether a payment was proper as a result of insufficient or lack of documentation, this payment should also be considered an improper payment. When establishing documentation requirements for payments, agencies should ensure that all documentation requirements are necessary and should refrain from imposing additional burdensome documentation requirements. (vi) Interest or other fees that may result from an underpayment by an agency are not considered an improper payment if the interest was paid correctly. These payments are generally separate transactions and may be necessary under certain statutory, contractual, administrative, or other legally applicable requirements. (iv) A ?questioned cost? (as defined in this section) should not be considered an improper payment until the transaction has been completely reviewed and is confirmed to be improper. (v) The term ?payment? in this definition means any disbursement or transfer of Federal funds (including a commitment for future payment, such as cash, securities, loans, loan guarantees, and insurance subsidies) to any non-Federal person, non-Federal entity, or Federal employee, that is made by a Federal agency, a Federal contractor, a Federal grantee, or a governmental or other organization administering a Federal program or activity. (vi) The term ?payment? includes disbursements made pursuant to prime contracts awarded under the Federal Acquisition Regulation and Federal awards subject to this part that are expended by recipients. (2) See definition of improper payment in OMB Circular A-123 appendix C, part I A (1) ?What is an improper payment?? Questioned costs, including those identified in audits, are not an improper payment until reviewed and confirmed to be improper as defined in OMB Circular A-123 appendix C. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. Title 42 U.S. Code of Federal Regulations (CFR) Public Health Part 435 Subpart J, Eligibility in the States and District of Columbia establishes the following applicable requirements: Section 435.926 Continuous eligibility for children, states in part: (b) Eligibility. The agency may provide continuous eligibility for the period specified in paragraph (c) of this section for an individual who is: (1) Under age 19 or under a younger age specified by the agency in its State plan; and (2) Eligible and enrolled for mandatory or optional coverage under the State plan in accordance with subpart B or C of this part. (c) Continuous eligibility period. (1) The agency must specify in the State plan the length of the continuous eligibility period, not to exceed 12 months. (2) A continuous eligibility period begins on the effective date of the individual's eligibility under ? 435.915 or most recent redetermination or renewal of eligibility under ? 435.916 and ends after the period specified by the agency under paragraph (c)(1) of this section. (d) Applicability. A child's eligibility may not be terminated during a continuous eligibility period, regardless of any changes in circumstances, unless: (1) The child attains the maximum age specified in accordance with paragraph (b)(1) of this section; (2) The child or child's representative requests a voluntary termination of eligibility; (3) The child ceases to be a resident of the State; (4) The agency determines that eligibility was erroneously granted at the most recent determination, redetermination or renewal of eligibility because of agency error or fraud, abuse, or perjury attributed to the child or the child's representative; or (5) The child dies. Title 42 Public Health Part 457 establishes the following applicable requirements: Section 457.342 Continuous eligibility for children, states in part: (a) A State may provide continuous eligibility for children under a separate CHIP in accordance with the terms of ? 435.926 of this chapter, and subject to a child remaining ineligible for Medicaid, as required by section 2110(b)(1) of the Act and ? 457.310 (related to the definition and standards for being a targeted low-income child) and the requirements of section 2102(b)(3) of the Act and ? 457.350 (related to eligibility screening and enrollment). Section 457.380 Eligibility verification. (a) General requirements. Except where law requires other procedures (such as for citizenship and immigration status information), the State may accept attestation of information needed to determine the eligibility of an individual for CHIP (either self-attestation by the individual or attestation by an adult who is in the applicant's household, as defined in ? 435.603(f) of this subchapter, or family, as defined in section 36B(d)(1) of the Internal Revenue Code, an authorized representative, or if the individual is a minor or incapacitated, someone acting responsibly for the individual) without requiring further information (including documentation) from the individual. (b) Status as a citizen, national or a non-citizen. (1) Except for newborns identified in ? 435.406(a)(1)(iii)(E) of this chapter, who are exempt from any requirement to verify citizenship, the agency must ? (i) Verify citizenship or immigration status in accordance with ? 435.956(a) of this chapter, except that the reference to ? 435.945(k) is read as a reference to paragraph (i) of this section; and (ii) Provide a reasonable opportunity period to verify such status in accordance with ? 435.956(a)(5) and (b) of this chapter and provide benefits during such reasonable opportunity period to individuals determined to be otherwise eligible for CHIP. (2) [Reserved] (c) State residents. If the State does not accept self-attestation of residency, the State must verify residency in accordance with ? 435.956(c) of this chapter. (d) Income. If the State does not accept self-attestation of income, the State must verify the income of an individual by using the data sources and following standards and procedures for verification of financial eligibility consistent with ? 435.945(a), ? 435.948 and ? 435.952 of this chapter. (e) Verification of other factors of eligibility. For eligibility requirements not described in paragraphs (c) or (d) of this section, a State may adopt reasonable verification procedures, consistent with the requirements in ? 435.952 of this chapter, except that the State must accept self-attestation of pregnancy unless the State has information that is not reasonably compatible with such attestation. (f) Requesting information. The terms of ? 435.952 of this chapter apply equally to the State in administering a separate CHIP. (g) Electronic service. Except to the extent permitted under paragraph (i) of this section, to the extent that information sought under this section is available through the electronic service described in ? 435.949 of this chapter, the State must obtain the information through that service. (h) Interaction with program integrity requirements. Nothing in this section should be construed as limiting the State's program integrity measures or affecting the State's obligation to ensure that only eligible individuals receive benefits or its obligation to provide for methods of administration that are in the best interest of applicants and enrollees and are necessary for the proper and efficient operation of the plan. (i) Flexibility in information collection and verification. Subject to approval by the Secretary, the State may modify the methods to be used for collection of information and verification of information as set forth in this section, provided that such alternative source will reduce the administrative costs and burdens on individuals and States while maximizing accuracy, minimizing delay, meeting applicable requirements relating to the confidentiality, disclosure, maintenance, or use of information, and promoting coordination with other insurance affordability programs. (j) Verification plan. The State must develop, and update as modified, and submit to the Secretary, upon request, a verification plan describing the verification policies and procedures adopted by the State to implement the provisions set forth in this section in a format and manner prescribed by the Secretary. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Plan Amendment Approval Letter from CMS dated July 15, 2020 states in part: This letter is to inform you that your title XXI Children's Health Insurance Program (CHIP) state plan amendment (SPA), WA-20-0001, submitted on May 4, 2020, has been approved. This SPA has an effective date of March 1, 2020. This amendment, as it applies to the COVID-19 public health emergency (PHE), makes the following changes beginning March 18, 2020, unless otherwise noted, through the duration of the Federally-declared PHE: ? Delay acting on changes in circumstances for CHIP beneficiaries other than the required changes in circumstances described in 42 CFR 457.342(a) cross-referencing 42 CFR 435.926(d); COVID-19 Frequently Asked Questions (FAQs) for State Medicaid and Children?s Health Insurance Program (CHIP) Agencies (Last Updated January 6, 2021) Section J. Children?s Health Insurance Program (CHIP) states in part: 4. Can states continue coverage for the duration of the Public Health Emergency for individuals in a separate CHIP who are aging out of eligibility or ending their postpartum period? No. The requirement in section 6008(b)(3) of the FFCRA to maintain coverage in Medicaid in order to receive the temporary increase in the Medicaid federal medical assistance percentage does not apply to separate CHIPs. Therefore, states may not continue to provide separate CHIP coverage to young adults aging out or women ending their postpartum period. If the state determines that the individual is eligible for Medicaid, they may be transitioned to the appropriate Medicaid eligibility group. States may not transition individuals to Medicaid without first determining them eligible in accordance with 42 C.F.R ? 457.350(b). States are required to transfer the accounts of individuals losing CHIP eligibility who are determined to be ineligible for Medicaid to the Exchange, in accordance with 42 C.F.R ? 457.350(b)(3) and (i).

2021-047 The Health Care Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and Children?s Health Insurance Program. CFDA Number and Title: 93.767 Children?s Health Insurance Program 93.767 COVID-19 Children?s Health Insurance Program 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U. S. Department of Health and Human Services Federal Award/Contract Number: 1905WA5MAP; 1905WA5ADM; 2005WA5MAP; 2005WA5ADM; 2005WAINCT; 2005WAIMPL; 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; 1905WA5021; 2105WA5021 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions ? Provider Eligibility (Screening and Enrollment) Known Questioned Cost Amount: None Background The Health Care Authority (Authority) administers both Medicaid and the Children?s Health Insurance Program (CHIP). Medicaid is a jointly funded state and federal partnership providing coverage for about 2.1 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one third of the state?s federal expenditures. CHIP provides health coverage for more than 50,000 children in families with incomes too high to qualify for Medicaid. During fiscal year 2021, the Medicaid program spent over $15.3 billion in federal and state funds, and CHIP spent more than $384 million in federal and state funds. The Authority ensures medical providers for both programs are eligible to provide services for clients. Providers must continue to meet eligibility requirements in order to receive payments under the programs. Washington had more than 129,000 participating providers during fiscal year 2021. During that time, the Authority paid more than $10.6 billion to providers for direct client services under the programs. The Authority is responsible for performing screening measures appropriate for the provider type at application and initial enrollment. Federal regulations require state Medicaid agencies to revalidate the enrollment of all Medicaid and CHIP providers at least every five years. In order to meet this requirement the Authority has implemented an automated revalidation notification process that is supposed to send a revalidation letter to providers in time for them to be revalidated before they reach the end of the five-year period. Federal law also requires state Medicaid agencies to check federal databases at least monthly to confirm the identity and exclusion status of providers, as well as any person with ownership, controlling interest, or acting as an agent or managing employee of the provider. The processes for provider enrollment and revalidation are very similar. The first step in both processes is to determine the provider?s screening risk level. A provider can be designated as one of three risk levels: limited, moderate or high. Each risk level requires progressively greater scrutiny of the provider before it can be enrolled or revalidated. For providers enrolled with both Medicare and Medicaid, state Medicaid agencies must assign providers to the same or higher risk category applicable under Medicare. Additionally, certain provider behaviors require them to be moved to a higher screening level. The following are the required screening procedures for all risk types: ? Verify that the provider meets applicable federal regulations or state requirements for the provider type before making an enrollment determination ? Conduct license verifications, including for licenses in states other than where the provider is enrolling ? Conduct database checks to ensure providers continue to meet the enrollment criteria for their provider type. Such database checks include the National Plan and Provider Enumeration System (NPPES), List of Excluded Individuals/Entities (LEIE), Excluded Parties List System (EPLS), and Death Master File index. If state Medicaid agencies assess providers at a moderate or high risk, they are required to conduct onsite visits for those that did not have one as part of their Medicare enrollment. Federal regulations require a high-risk provider, or a person with a 5 percent or more direct or indirect ownership in the provider, to receive a fingerprint-based criminal background check. The deadline to fully implement a fingerprint-based criminal background check process was July 1, 2018. The Authority is also responsible for ensuring that providers obtain the proper signed attestations and disclosures. For servicing only providers, a direct link must be made to a billing provider who has an active Core Provider Agreement (CPA) on file. A CPA contains the required attestation and disclosures of the billing provider to allow for the payment of medical claims. To ensure the Authority has completed all applicable screening and enrollment or revalidation steps before enrolling or revalidating providers, staff members use checklists for each enrollment and revalidation. The staff member signs and dates the checklist to indicate the provider is eligible to render services and receive payments. In response to the COVID-19 pandemic, the Authority obtained flexibilities under blanket waivers approved by the Centers for Medicare and Medicaid Services (CMS), which were effective March 1, 2020, through the end of the emergency declaration period. These included the waiving of provider application fees and fingerprint-based criminal background checks. The CMS waivers also allowed for expedited processing of any new or pending provider applications, as well as the postponement of all revalidation actions until November 1, 2020. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it revalidated providers every five years and met screening requirements. The prior finding numbers were 2020-046, 2019-048, 2018-042, 2017-033, and 2016?035. Description of Condition The Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and CHIP programs. During the audit period, the Authority processed 7,406 new provider enrollments. During this same period, the Authority was required to perform ongoing eligibility determinations for 122,056 active providers. We used a statistical sampling method to randomly select and examine 59 newly enrolled providers and 59 active providers to determine if the Authority properly screened them based on their enrollment status and correctly determined their eligibility status. Of the 118 providers examined, we found six instances (5 percent) when the Authority did not take the appropriate actions to ensure providers met eligibility requirements. Specifically, we found: ? Staff did not conduct a proper license check for three providers. For two of these providers, a proper license check would have led staff to identify that the providers had expired licenses and, therefore, were ineligible. ? Staff enrolled two servicing only providers without properly reviewing them to ensure they were attached to a billing provider with a valid CPA. Because the billing provider did not have a CPA, the two servicing providers were improperly enrolled. ? One provider had been designated a moderate risk and required an onsite visit. However, staff did not conduct an onsite visit and only performed limited risk screening procedures. Additionally, we found staff did not complete enrollment checklists for two newly enrolled providers. A provider should not be enrolled or remain in active status without staff completing all proper enrollment and ongoing screening steps. To determine if the Authority had revalidated providers every five years or had taken actions to deactivate providers, we used a statistical sampling method to randomly select and examine 57 out of a total population of 1,058 providers that had a revalidation due date during the audit period. We found the Authority did not comply with the revalidation requirements for all 57 (100 percent) of the sampled providers. Though many providers were subsequently revalidated, the Authority did not complete the revalidations before the due date. For providers that were deactivated, the Authority did not process their deactivation until 30 days after their eligibility end date. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Although the Authority has established internal controls over screening and enrolling providers, they were ineffective for preventing or detecting noncompliance. Management also did not ensure staff consistently followed the procedures in place. Additionally, the automated revalidation notification was inadequate for ensuring the Authority complied with the five-year revalidation requirement. To comply with this requirement, the Authority should notify providers about their revalidations and ensure they are started and completed before the due date. Our audit found that the Authority?s automated system is designed to notify providers of their revalidations one day after the due date. Due to this inadequate system design, the providers? revalidations were completed after the due date. Effect of Condition By not conducting required licensing, screening, and enrollment processes in a timely manner, the Authority is at risk of not detecting or preventing ineligible providers from providing services to clients and receiving federal Medicaid and CHIP funds. Payments to providers who are ineligible are unallowable, and the Authority could be required to repay the grantor for these payments. Recommendations We recommend the Authority: ? Strengthen internal controls to ensure providers are adequately screened, licensed, enrolled, and eligible to provide and bill for services ? Implement internal controls designed to bring it into material compliance with the provider revalidation process Authority?s Response The Authority will strengthen internal controls to ensure providers are adequately screened, licensed, enrolled, and eligible to provide and bill for services. The Authority will update its automated system to ensure the notifications are sent to allow the revalidations to be completed within the five-year deadline. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will follow up on the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. Title 42 U.S. Code of Federal Regulations (CFR) Part 433, State Fiscal Administration, Subpart F, Refunding of Federal Share of Medicaid Overpayments to Providers states in part: Section 433.300 Basis. This subpart implements - (a) Section 1903(d)(2)(A) of the Act, which directs that quarterly Federal payments to the States under title XIX (Medicaid) of the Act are to be reduced or increased to make adjustment for prior overpayments or underpayments that the Secretary determines have been made. (b) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. Section 433.316 When discovery of overpayment occurs and its significance. (a) General rule. The date on which an overpayment is discovered is the beginning date of the 1-year period allowed for a State to recover or seek to recover an overpayment before a refund of the Federal share of an overpayment must be made to CMS. (b) Requirements for notification. Unless a State official or fiscal agent of the State chooses to initiate a formal recoupment action against a provider without first giving written notification of its intent, a State Medicaid agency official or other State official must notify the provider in writing of any overpayment it discovers in accordance with State agency policies and procedures and must take reasonable actions to attempt to recover the overpayment in accordance with State law and procedures. (c) Overpayments resulting from situations other than fraud. An overpayment resulting from a situation other than fraud is discovered on the earliest of - - (1) The date on which any Medicaid agency official or other State official first notifies a provider in writing of an overpayment and specifies a dollar amount that is subject to recovery; (2) The date on which a provider initially acknowledges a specific overpaid amount in writing to the medicaid agency; or (3) The date on which any State official or fiscal agent of the State initiates a formal action to recoup a specific overpaid amount from a provider without having first notified the provider in writing. (d) Overpayments resulting from fraud. (1) An overpayment that results from fraud is discovered on the date of the final written notice (as defined in ? 433.304 of this subchapter) of the State's overpayment determination. (2) When the State is unable to recover a debt which represents an overpayment (or any portion thereof) resulting from fraud within 1 year of discovery because no final determination of the amount of the overpayment has been made under an administrative or judicial process (as applicable), including as a result of a judgment being under appeal, no adjustment shall be made in the Federal payment to such State on account of such overpayment (or any portion thereof) until 30 days after the date on which a final judgment (including, if applicable, a final determination on an appeal) is made. (3) The Medicaid agency may treat an overpayment made to a Medicaid provider as resulting from fraud under subsection (d) of this section only if it has referred a provider's case to the Medicaid fraud control unit, or appropriate law enforcement agency in States with no certified Medicaid fraud control unit, as required by ? 455.15, ? 455.21, or ? 455.23 of this chapter, and the Medicaid fraud control unit or appropriate law enforcement agency has provided the Medicaid agency with written notification of acceptance of the case; or if the Medicaid fraud control unit or appropriate law enforcement agency has filed a civil or criminal action against a provider and has notified the State Medicaid agency. (e) Overpayments identified through Federal reviews. If a Federal review at any time indicates that a State has failed to identify an overpayment or a State has identified an overpayment but has failed to either send written notice of the overpayment to the provider that specified a dollar amount subject to recovery or initiate a formal recoupment from the provider without having first notified the provider in writing, CMS will consider the overpayment as discovered on the date that the Federal official first notifies the State in writing of the overpayment and specifies a dollar amount subject to recovery. (f) Effect of changes in overpayment amount. Any adjustment in the amount of an overpayment during the 1-year period following discovery (made in accordance with the approved State plan, Federal law and regulations governing Medicaid, and the appeals resolution process specified in State administrative policies and procedures) has the following effect on the 1-year recovery period: (1) A downward adjustment in the amount of an overpayment subject to recovery that occurs after discovery does not change the original 1-year recovery period for the outstanding balance. (2) An upward adjustment in the amount of an overpayment subject to recovery that occurs during the 1-year period following discovery does not change the 1-year recovery period for the original overpayment amount. A new 1-year period begins for the incremental amount only, beginning with the date of the State's written notification to the provider regarding the upward adjustment. (g) Effect of partial collection by State. A partial collection of an overpayment amount by the State from a provider during the 1-year period following discovery does not change the 1-year recovery period for the balance of the original overpayment amount due to CMS. (h) Effect of administrative or judicial appeals. Any appeal rights extended to a provider do not extend the date of discovery. Title 42 U.S. Code of Federal Regulations section 438 Subpart H ? Additional Program Integrity Safeguards, states in part: Section 438.602 State responsibilities. (a) Monitoring contractor compliance. Consistent with ? 438.66, the State must monitor the MCO's, PIHP's, PAHP's, PCCM's or PCCM entity's compliance, as applicable, with ?? 438.604, 438.606, 438.608, 438.610, 438.230, and 438.808. (b) Screening and enrollment and revalidation of providers. (1) The State must screen and enroll, and periodically revalidate, all network providers of MCOs, PIHPs, and PAHPs, in accordance with the requirements of part 455, subparts B and E of this chapter. This requirement extends to PCCMs and PCCM entities to the extent the primary care case manager is not otherwise enrolled with the State to provide services to FFS beneficiaries. This provision does not require the network provider to render services to FFS beneficiaries. (2) MCOs, PIHPs, and PAHPs may execute network provider agreements pending the outcome of the process in paragraph (b)(1) of this section of up to 120 days, but must terminate a network provider immediately upon notification from the State that the network provider cannot be enrolled, or the expiration of one 120 day period without enrollment of the provider, and notify affected enrollees. (c) Ownership and control information. The State must review the ownership and control disclosures submitted by the MCO, PIHP, PAHP, PCCM or PCCM entity, and any subcontractors as required in ? 438.608(c). (d) Federal database checks. Consistent with the requirements at ? 455.436 of this chapter, the State must confirm the identity and determine the exclusion status of the MCO, PIHP, PAHP, PCCM or PCCM entity, any subcontractor, as well as any person with an ownership or control interest, or who is an agent or managing employee of the MCO, PIHP, PAHP, PCCM or PCCM entity through routine checks of Federal databases. This includes the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the System for Award Management (SAM), and any other databases as the State or Secretary may prescribe. These databases must be consulted upon contracting and no less frequently than monthly thereafter. If the State finds a party that is excluded, it must promptly notify the MCO, PIHP, PAHP, PCCM, or PCCM entity and take action consistent with ? 438.610(c). Title 42 U.S. Code of Federal Regulations section 455 Subpart B ? Disclosure of Information by Providers and Fiscal Agents, states in part: Section 455.104 Disclosure by Medicaid providers and fiscal agents: Information on ownership and control. (a) Who must provide disclosures. The Medicaid agency must obtain disclosures from disclosing entities, fiscal agents, and managed care entities. (b) What disclosures must be provided. The Medicaid agency must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures: (1) (i) The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address. (ii) Date of birth and Social Security Number (in the case of an individual). (iii) Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest. (2) Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling. (3) The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest. (4) The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). (c) When the disclosures must be provided - (1) Disclosures from providers or disclosing entities. Disclosure from any provider or disclosing entity is due at any of the following times: (i) Upon the provider or disclosing entity submitting the provider application. (ii) Upon the provider or disclosing entity executing the provider agreement. (iii) Upon request of the Medicaid agency during the re-validation of enrollment process under ? 455.414. (iv) Within 35 days after any change in ownership of the disclosing entity. (2) Disclosures from fiscal agents. Disclosures from fiscal agents are due at any of the following times: (i) Upon the fiscal agent submitting the proposal in accordance with the State's procurement process. (ii) Upon the fiscal agent executing the contract with the State. (iii) Upon renewal or extension of the contract. (iv) Within 35 days after any change in ownership of the fiscal agent. (3) Disclosures from managed care entities. Disclosures from managed care entities (MCOs, PIHPs, PAHPs, and HIOs), except PCCMs are due at any of the following times: (i) Upon the managed care entity submitting the proposal in accordance with the State's procurement process. (ii) Upon the managed care entity executing the contract with the State. (iii) Upon renewal or extension of the contract. (iv) Within 35 days after any change in ownership of the managed care entity. (4) Disclosures from PCCMs. PCCMs will comply with disclosure requirements under paragraph (c)(1) of this section. (d) To whom must the disclosures be provided. All disclosures must be provided to the Medicaid agency. (e) Consequences for failure to provide required disclosures. Federal financial participation (FFP) is not available in payments made to a disclosing entity that fails to disclose ownership or control information as required by this section Title 42 U.S. Code of Federal Regulations section 455 Subpart E ? Provider Screening and Enrollment, states in part: Section 455.410 Enrollment and screening of providers (a) The State Medicaid agency must require all enrolled providers to be screened under to this subpart. (b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. (c) The State Medicaid agency may rely on the results of the provider screening performed by any of the following: (1) Medicare contractors. (2) Medicaid agencies or Children's Health Insurance Programs of other States. Section 455.412 Verification of provider licenses The State Medicaid agency must - (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. (b) Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. Section 455.414 Revalidation of enrollment

2021-048 The Health Care Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. CFDA Number and Title: 93.767 Children?s Health Insurance Program 93.767 COVID-19 Children?s Health Insurance Program 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 1905WA5MAP; 1905WA5ADM; 2005WA5MAP; 2005WA5ADM; 2005WAINCT; 2005WAIMPL; 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; 1905WA5021; 2105WA5021 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions ? Managed Care Financial Audit Known Questioned Cost Amount: None Background The Health Care Authority (Authority) administers both Medicaid and the Children?s Health Insurance Program (CHIP). Medicaid is a jointly funded state and federal partnership providing coverage for about 2.1 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one third of the state?s federal expenditures. CHIP provides health coverage for more than 50,000 children in families with incomes too high to qualify for Medicaid. During fiscal year 2021, the Medicaid program spent over $15.3 billion in federal and state funds, and CHIP spent more than $384 million in federal and state funds. Managed Care Organizations (MCO) contract with the Authority under a comprehensive risk contract to provide prepaid health care services to eligible enrollees under their managed care programs. In fiscal year 2021, the Authority contracted with five MCOs. Federal regulations require contracts between states and MCOs include a requirement that MCOs annually submit an audited financial report to the state. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. At least once every three years, the Authority must conduct or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by each MCO. The Authority must also post these audit results on its website. These requirements went into effect for contract years starting after July 1, 2017. In fiscal year 2021, the Authority paid over $8.6 billion to MCOs for Medicaid and CHIP services. Federal regulations require recipients to establish and follow internal controls that ensure compliance with program requirements. These controls include understanding program requirements and monitoring the effectiveness of established controls. Description of Condition The Authority did not have adequate internal controls over and did not comply with managed care financial audit requirements. Audited financial reports The Authority did not include this requirement in its MCO contracts, and it did not have internal controls in place to ensure it complied with the requirement to collect financial reports. The Authority did not obtain any audited financial reports from the MCOs. Periodic audits The Authority did not establish internal controls to ensure it complied with the periodic audit requirement of MCO encounter and financial data. To meet the periodic audit requirements, the Authority would have needed to complete MCO audits of both the encounter and financial data by December 31, 2020. The Authority did not complete these audits by the deadline. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The audited financial reports and periodic audits were new requirements that became applicable for the MCO contracts beginning January 2018. The Authority did not have policies or procedures on collecting audited financial reports or on how and when to perform periodic audits. While the Authority was in the process of implementing procedures for meeting these requirements, the implementation was delayed because of staff turnover in the leadership of the unit in charge. Effect of Condition By not collecting the audited financial reports and conducting periodic audits, the Authority increases its risk of relying on inaccurate or incomplete information. This could lead to an increased risk of making improper payments and reduced public transparency. The Authority could also be subject to sanction by the federal grantor for not meeting Medicaid requirements. Recommendations We recommend the Authority: ? Implement policies and procedures over obtaining audited financial reports ? Implement policies and procedures over conducting required periodic audits ? Update its contract language to include the requirement for MCOs to submit required reports ? Establish a process to ensure it collects audited financial reports annually ? Establish a process to conduct audits of encounter and financial data at least once every three years Authority?s Response The authority concurs with the recommendations and has taken the following steps: ? Amended managed care contracts to require annual submission of audited financial reports. The amended contract language directs managed care organizations when and where to submit audited financial reports. Failure to submit reports is sanctionable. ? Conducted an encounter data validation audit and began a financial report validation audit. Processes have been established to ensure that audits will be conducted no less than once every three years. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority?s corrective actions during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. Title 42 U.S. Code of Federal Regulations Part 483, Requirements for States and Long Term Care Facilities establishes the following applicable requirements: Section 483.3 Standard Contract Requirements states in part: (m) Audited financial reports. The contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Section 483.600 Statutory basis, basic rule, and applicability states in part: (c) Applicability. States will not be held out compliance with the following requirements of this subpart prior to the dates noted below so long as they comply with the corresponding standard(s) in 42 CFR part 438 contained in the CFR, parts 430 to 481, edition revised as of October 1, 2015: (1) States must comply with ?? 438.602(a), 438.602(c) through (h), 438.604, 438.606, 438.608(a), and 438.608(c) and (d), no later than the rating period for contracts starting on or after July 1, 2017. Section 483.602 State Responsibilities states in part: (e) Periodic audits. The State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP. (g) Transparency. The State must post on its Web site, as required in ? 438.10(c)(3), the following documents and reports: (1) The MCO, PIHP, PAHP, or PCCM entity contract. (2) The data at ? 438.604(a)(5). (3) The name and title of individuals included in ? 438.604(a)(6). (4) The results of any audits under paragraph (e) of this section. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-049 The Department of Social and Health Services, Developmental Disabilities Administration, did not have adequate internal controls over and did not comply with requirements to ensure Medicaid payments to supported living providers were allowable and adequately supported. CFDA Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 ? State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award: 1905WA5MAP; 1905WA5ADM; 2005WA5MAP; 2005WA5ADM; 2005WAINCT; 2005WAIMPL; 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $251,573,081 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.1 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one-third of the state?s federal expenditures. The program spent about $15.3 billion in federal and state funds during fiscal year 2021. The Department of Social and Health Services? (Department) Developmental Disabilities Administration administers the Home and Community-Based Services (HCBS) program for people with developmental disabilities. The HCBS is a waiver program that permits states to provide an array of community-based services to help Medicaid clients live in the community and avoid institutionalization. States have broad discretion to design waiver programs, but they must be approved by the Centers for Medicare and Medicaid Services (CMS). Supported living services support Medicaid clients to live in their own homes, generally with one to three other people, and receive instruction and support delivered by contracted service agencies (providers). Supported living clients pay their own rent, food and other personal expenses. Supported living is an option under the HCBS Core and Community Protection waivers. In fiscal year 2021, the state Medicaid program paid about $601 million in federal and state funds to supported living agencies that provided care to about 4,000 Medicaid clients. Client assessment, Person-Centered Service Plan, and tiered rate The Department uses a rate assessment tool to evaluate client support needs to live in the community. With this assessment, the Department develops a Person-Centered Service Plan (PCSP) to determine the support and instruction a client is expected to receive. The economies of scale are applied to the assessed level of care generated by the rate assessment tool to produce a daily rate in one of nine tiers that is paid to the supported living agency. The tiered rate is comprised of two components: payment for direct client services (known as instruction and support services, ISS) and administrative (known as non-ISS). A tiered rate methodology is used to allow providers more flexibility in delivering services to clients. A daily tiered rate is loaded into the Department?s payment system, and providers claim payment for each day they provide services to the clients. The supported living agency is contractually obligated to fulfill the client?s support needs outlined in the PCSP. Cost report and settlements Providers are required to prepare and submit a cost report at the end of each calendar year, with each cost report covering the last six months of one fiscal year and the first six months of the next fiscal year. Providers must attest to the accuracy of the reported information. The Department uses the cost report information to: ? Provide program cost data to regional managers and residential providers; ? Determine settlements with supported living providers; ? Provide accountability and transparency for the use of public funds. In the HCBS waiver, the Department states it reconciles purchased support services with provided support services for the calendar year. Using the cost report, the Department calculates settlements to determine if the provider received more reimbursement for ISS care than what it paid to its employees who provided the client care. Department policy states that when staff reviews a cost report to determine if a settlement is required, the following will be verified: a. All sections of the cost report are complete; b. The information in Residential Rates for Developmental Disabilities (RRDD) matches the ProviderOne payment report; c. The report conforms with generally accepted accounting principles; d. The report meets the requirements of the provider?s contract; and e. Expenses are accurately reported. If the provider does not spend all ISS reimbursement funds on costs to provide direct care to clients, then it is required to pay the Department back the difference. In the HCBS waiver, the Department states that there is no settlement for administrative or indirect client support costs. Cost report payroll verifications The Department conducts payroll verifications of the cost report for selected providers to determine the accuracy and reasonableness of the self-attested expenditures reported. Before verifying payroll, the Department requires the provider to submit supporting documentation, including detailed payroll cost support for two to three months of the calendar year. Department staff review the provider?s detailed support, which shows that it only used ISS funds received from the Department to provide ISS care. The Department?s ISS Payroll Verification Process guide outlines the payroll verification process and the documents providers must maintain to support expenditures recorded on their cost reports. The guide states: ? The payroll summary must include detail for employees who performed direct support. ? The payroll data must be by employee with job titles. ? The providers are responsible for demonstrating how their records tie to the amounts reported on the cost reports. ? If payroll summaries do not match amounts providers reported on the cost reports, then the Department will review additional months up to the entire calendar year. Provider documentation requirements According to Department policy, providers are required to maintain detailed payroll records to verify the cost of services provided to clients. Upon request, the providers must provide job descriptions for employees who are allocated to both ISS and non-ISS duties. Providers must retain detailed monthly or quarterly payroll and supporting records that support the amounts on their cost reports. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits, we reported the Department did not have adequate internal controls over and did not comply with requirements to ensure payments to supported living providers were allowable. The finding numbers were 2020-051, 2019-054, 2018-058, 2017-044, 2016-041, 2016-045, 2015-049, 2015-052, 2014-041, 2014-042, 2013-036, 2013-038 and 2012-039. After the fiscal year 2019 audit, the grantor, the Center for Medicaid and CHIP Services (CMS), issued a management decision letter in which it requested ?the state provide documentation that shows an adequate payment review process was implemented that occurs more frequently than once a year,? and it requested the state repay the questioned costs identified in the finding. After the fiscal year 2020 audit, CMS requested that the state provide documentation that justifies its position on current adequate internal controls regarding Medicaid payments to supported living providers, and it requested the state also repay the questioned costs from that finding. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure Medicaid payments to supported living providers were allowable and adequately supported. July 1 to December 31, 2020 Cost reports and settlements ? completed during audit period The Department reconciled and settled all of the 132 cost reports it received during this period. Of these reports, 78 were completed during the audit period, but they did not receive a payroll verification. For calendar year 2020, the Department did not require documentation to support the self-attested provider costs. Because of the Department?s insufficient monitoring activity, we determined the cost report reconciliation and settlement process was insufficient for ensuring payments made to providers for ISS care were for allowable activities and met cost principles. Cost report payroll verifications During the audit period, the Department verified payroll for 54 providers for calendar year 2020. We randomly selected 11 of these providers to review and found: ? Two of the 11 providers (18 percent) did not provide adequately detailed documentation to support the cost report amounts. ? Two of the 11 providers (18 percent) that the Department had identified as not having adequate documentation to support the cost report amounts. The Department adjusted the annual settlement calculation for both providers and neither resulted in provider repayment. Even though the Department identified these providers as not having adequate documentation to support their self-attested expenditures, staff did not conduct further review to ensure the remaining expenditures on their cost reports were allowable. We also identified additional issues in the cost report review process that Department staff had performed: ? The cost report payroll verifications only cover 6.8 to 10.2 percent of all months of payments in calendar year 2020. This is insufficient coverage in our judgment. ? Ten of the providers (91 percent) included overtime and seven of the providers (64 percent) included bonus payments in their ISS payroll expenditures. Department policy allows overtime and bonus payroll expenditures to be included as support for cost reports, but these are not factors considered in the tiered rate calculation. We do not believe this is appropriate because considering overtime and bonus dollars to be the same as regular pay dollars does not accurately reflect the services being provided to clients. We do not consider these reviews effective for ensuring providers? self-attested expenditures on the cost reports were allowable and supported. January 1 to June 30, 2021 Because cost reports and payroll verifications are prepared on a calendar year basis, the Department had not collected the reports and verified payroll for 2021 by the end of the audit period. The Department did not perform any other systematic review of these expenditures; therefore, we determined the Department did not have sufficient controls over this requirement during this period. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management believed that when the Department switched to using a tiered rate system, the level of monitoring it was conducting was sufficient for meeting federal requirements. However, the grantor has since informed the Department that it must implement an adequate payment review process that occurs more than once a year, but management has chosen not to do so. Cost reports and settlements The Department does not require providers to submit supporting documentation with their cost reports. Instead, the Department allows self-attested payroll expenditures as adequate support for the cost report settlements. Cost report payroll verifications Management said the Department made adjustments to the provider settlements summary when ISS expenditures did not have adequate supporting documentation. These adjustments did not result in provider repayments, and the Department determined no additional review was necessary. Additionally, while there was indication of supervisory reviews, they were ineffective because they did not consistently detect incorrect payroll verification. Effect of Condition and Questioned Costs Without establishing an adequate payment review process, the Department had little assurance that it used program funds only for allowable purposes and payments to providers were adequately supported. We are questioning: Payments made from July 1, 2020, through December 31, 2020 Cost reports and settlements ? $168,337,796 in ISS payments made to 78 providers for which the Department did not verify payroll. The federal share of these questioned costs is $94,605,841. Cost report payroll verification ? $324,909 in ISS payments for four providers that did not have adequate documentation to support payroll expenditures on the payroll verifications we tested. We used a nonstatistical sampling method and are reporting likely questioned costs of $1,595,006. The federal share of these questioned costs is $182,599 known and $896,393 likely. Payments made from January 1, 2021, through June 30, 2021 We are questioning all $278,976,230 in supported living payments during this period. The federal share of these questioned costs is $156,784,641. Summary of questioned costs The table below summarizes, by audit area, the known questioned costs and likely improper payments: Audit Area Known Questioned Costs (State and Federal) Known Questioned Costs (Federal Portion Only) Likely Improper Payments (State and Federal) Likely Improper Payments (Federal Portion Only) Costs reports reconciled, but no payroll verification performed $168,337,796 $94,605,841 $168,337,796 $94,605,841 Cost reports with payroll verification conducted $324,909 $182,599 $1,595,006 $896,393 Expenditures with no cost reports $278,976,230 $156,784,641 $278,976,230 $156,784,641 Totals $447,638,935 $251,573,081 $448,909,032 $252,286,875 We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Department: ? Implement an adequate payment review process that occurs more frequently than once a year to ensure federal funds paid to providers are used only for allowable purposes and are adequately supported ? Add detailed cost report payroll verification procedures to its policy ? Consult with its grantor about whether the questioned costs identified in the audit should be repaid Department?s Response While the Department partially concurs with the finding and $182,599 in questioned costs, we also respectfully dispute the remaining questioned costs ($251,390,482) identified in the finding. The State Auditor?s Office (SAO) has questioned large portions of the Department?s reimbursements for instruction and support services provided to supported living clients. This includes questioning all reimbursements from the second half of fiscal year 2021, and all costs from the first half of the fiscal year that are associated with the 78 providers who did not undergo a payroll verification review. The Department strongly disagrees that all of these costs should be questioned. The Department had numerous internal controls in place during the fiscal year. These controls are detailed later in this response and together they provide sufficient assurance that the services paid for were provided. It is noteworthy that the SAO did not question all the costs from the first half of the fiscal year (July 1, 2020, through December 31, 2020) that were associated with the 54 providers who were subject to the Department?s payroll verification review. In fact, the SAO apparently, and appropriately, considered the Department?s payroll verification process an internal control that is generally sufficient to ensure payments to supported living providers are allowable. For the 54 providers for whom the payroll review was performed, the questioned costs are comparatively small and based upon what the SAO considered to be deficiencies in specific verifications rather than an issue with the payroll verification process in general. For the second half of the fiscal year (January 1, 2021, through June 30, 2021) the Department had the same internal control in place. That is, the Department?s verifications were performed upon provider payroll from the second half of the year in exactly the same way that they were performed on payroll from the first half of the fiscal year. As the Department had the same internal control in place in both halves of the fiscal year, one would expect to see roughly similar questioned costs (relating to providers who received a payroll verification). Instead, the SAO questioned all of the costs from the second half of the fiscal year. The SAO appears therefore to have concluded that this internal control was non-existent for the second half of the year. This is neither true nor accurate. As stated above, the same internal control was in place, a control that the SAO appears to consider generally sufficient. The reason that the SAO did not take into account this control for the second half of the year is due to the timing of their audit cycle, rather than any question regarding the sufficiency of the control. The Department reconciles payments on a calendar year basis. This is set forth in policy and is approved by CMS as part of its waiver approval process. The SAO audits on a fiscal year basis and does not consider the control activities that fall outside of their audit period. As the SAO does not take into account the payroll verification reviews that applied to the second half of the fiscal year, the Department considers the SAO?s audit incomplete. This incompleteness results in the contradictory conclusion that payments over which the Department had sufficient controls were completely unallowable. With regard to the questioned costs pertaining to the 54 providers who received a payroll verification (as in the table below), the Department did detect the costs in question. Audit Area Known Questioned Costs (Federal Portion Only) 54 Cost reports with payroll verification conducted (7/1/20-12/31/20) $182,599 78 Costs reports reconciled, but no payroll verification performed (7/1/20-12/31/20) $94,605,841 Expenditures with no cost reports (1/1/21-6/30/21 ? Cost Reports not submitted till end of calendar year) $156,784,641 Totals $251,573,081 The Department has many significant oversight and monitoring strategies, including the payroll verification process. These oversight and monitoring strategies are as follows: ? Medicaid Service Verifications The Developmental Disabilities Administration (DDA) Quality Compliance Coordinator (QCC) team carries out Medicaid Service Verifications each month for a random sample of 79 clients who receive Medicaid services. This includes clients receiving supported living services. Clients or their legal representatives receive a service verification survey which asks if they received the services identified in their plan. If a client or their representative responds ?no? to this or any other question, a member of the QCC team follows up with a phone call to determine next steps. ? Segregation of duties Service planning and service authorization are separate duties. Case managers are responsible for service planning. Resource managers are responsible for the rate assessment. There are also separate oversight processes for each of these duties. Oversight of service planning is performed by supervisors. Oversight of the rate approval process is performed by Resource Manager Supervisors and the DDA headquarters Community Residential Services Program Manager. ? Verification and approval process Resource managers complete the rate assessment. The rate assessment process applies multiple efficiencies to achieve cost effectiveness. Oversight of the rate approval process is performed by Resource Manager Supervisors and the DDA headquarters Community Residential Services Program Manager. A rate sheet (called ?Exhibit C? in the contract) is generated, and the provider confirms and signs it as part of their contract. The rates are uploaded into the Health Care Authority?s ProviderOne payment system, allowing the provider to claim the authorized rate. Rates assessed as tier nine and single-person households require an exception to policy, which is reviewed and approved by managerial staff. ? Allowable Costs Payment Reconciliation Twice per year the Department reconciles the provider?s payments for services provided to individual clients. There is a six-month review of payments for the first half of the calendar year and then a twelve-month review at the end of the calendar year. The final payments and cost settlement are adjusted for all variances in costs as determined by the reviews. ? Rate, cost report, settlement, and reconciliation processes Supported living uses a tiered rate reimbursement methodology. The tiered rate is a daily rate for an individual client. It is based upon the client?s assessed needs and economies of scale. The tier level and rate amount are calculated by algorithms established in rule. The systems involved include the Comprehensive Assessment, Review & Evaluation (CARE) tool, Residential Rates for Developmental Disabilities (RRDD), and Provider One. ALTSA and DDA staff monitor the systems and rates for accuracy. The tier methodology was reviewed and approved by CMS. The cost report is a financial report prepared by the contracted provider that identifies the costs related to community residential habilitative services and supports provided in the calendar year. Allowable costs are detailed in DDA policy 6.04. DDA rate analysts and agency providers both receive annual training on the cost report process and accuracy in the recording of all the financial information involved. When the cost report is submitted to the Department, the provider attests to its accuracy and completeness. DDA rate analysts review the cost report, checking for accuracy and completion in accordance with generally accepted accounting rules, and DDA polices 6.02 and 6.04. The initial review includes a checklist of instructions the analyst follows to ensure the cost report is reasonable, allowable, and completed accurately. The review includes a reconciliation of payments. The reconciliation process verifies the provider claimed the correct number of days of service and rate for every client in their contract. Reconciliation is done by comparing payments in the DDA RRDD database to those claimed in the Health Care Authority ProviderOne database. Variances are corrected in ProviderOne and on the cost report settlement when they are determined and verified by both the rate section and DDA field staff. The cost report is not used to set rates. The cost report is used to calculate a financial settlement that compares payment revenue to actual expenses. When instruction and support services (ISS) payment revenue is more than the ISS expenses, a settlement is generated. The provider returns the amount owed (per the settlement) to the Department?s Office of Financial Recovery (OFR). ? Payroll verification process A sample of providers is required to submit payroll records that support the instruction and support services (ISS) expenses claimed on the cost report. In FY21 roughly 40% of providers were included in the sample. The samples are selected in mid-March, and the review process begins in mid-April after the cost reports are submitted. Providers are given two weeks to provide payroll records. DDA?s rate analyst compares the provider payroll records to the ISS expenses reported on the cost report to verify that their payroll supports their reported ISS expenses. If inaccuracies are identified, the analyst may request additional information, or that corrections be made to the documentation submitted. ? Quality Assurance Review DDA?s Residential Quality Assurance unit has one employee who provides technical assistance for certified community residential settings. With the transition from the legacy ISS hour-driven rate system to the person-centered assessment driven tiered rate system, a formalized and more holistic quality assurance oversight process was developed. It was implemented in July 2019. This new QA oversight approach includes routine reviews to ensure selected supports listed in clients? person-centered service plans (PCSPs) align with the supports provided. The PCSP is the state?s primary instruction to the provider for the provision of contracted services. The quality assurance staff conducts virtual reviews of the quality and quantity of service in relation to individuals? assessed needs across ten domains of the CARE tool (the tool which contains the algorithm that drives the tiered rate).

2021-050 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. CFDA Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 1905WA5MAP; 1905WA5ADM; 2005WA5MAP; 2005WA5ADM; 2005WAINCT; 2005WAIMPL; 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component Special Tests and Provisions ? Utilization Control and Program Integrity Known Questioned Cost Amount: None Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.1 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one-third of the state?s federal expenditures. The program spent over $15.3 billion in federal and state program funds during fiscal year 2021. Managed Care Organizations (MCO) contract with the Health Care Authority (Authority) under a comprehensive risk contract to provide prepaid healthcare services to eligible enrollees under their managed care programs. In fiscal year 2021, the Authority paid more than $8.6 billion to MCOs for Medicaid services. Under federal regulations, Medicaid state plans must include methods and procedures to safeguard against unnecessary utilization of care and services. The regulations require states to implement a statewide surveillance and utilization control program that: ? Safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments; ? Assesses the quality of those services; ? Provides for the control of the utilization of all services provided under the plan; and ? Provides for the control of the utilization of inpatient services. Multiple state agencies in Washington manage aspects of the Medicaid program. The agencies include the Authority, Department of Social and Health Services, Department of Health, Office of the Attorney General, and Department of Children, Youth, and Families. The Centers for Medicare and Medicaid Services (CMS) considers the Authority to be Washington?s official Medicaid agency. Federal regulations require the Medicaid agency: (1) Monitor the statewide utilization control program; (2) Take all necessary corrective action to ensure the effectiveness of the program; (3) Establish methods and procedures to implement this section; (4) Keep copies of these methods and procedures on file; and (5) Give copies of these methods and procedures to all staff involved in carrying out the utilization control program. Federal regulations also require the Medicaid agency have procedures for the ongoing evaluation, on a sample basis, of the need for, quality and timeliness of Medicaid services. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the last three audits, we reported the Authority did not establish adequate internal controls over and did not comply with utilization control and program integrity requirements. The prior finding numbers were 2020-047, 2020-048, 2019-052, 2019-053, and 2018-047. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed procedures to safeguard against unnecessary utilization of care and services for the Medicaid program. Washington?s Medicaid state plan does not include any methods and procedures to safeguard against unnecessary utilization of care and services. The Authority also did not implement and monitor a statewide surveillance and utilization control program. The Authority has procedures for the ongoing evaluation of the need for, quality and timeliness of Medicaid services. However, payments to MCOs are not included in this evaluation. The Authority also does not monitor the procedures that MCOs and other state agencies perform. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition In the past few years, the Authority has reorganized its Program Integrity unit several times. This unit is responsible for safeguarding against unnecessary utilization of care and services for the Medicaid program. In fiscal year 2021, the unit was working on establishing policies and procedures; however, the unit did not finalize them until the end of the audit period. In conversations with management, it was not clear they understood the Authority was responsible for implementing and monitoring the statewide utilization control program, which includes overseeing and monitoring the activities of other state agencies. Effect of Condition By not establishing methods and procedures to safeguard against unnecessary utilization of care and services, there is an increased risk of unnecessary or inappropriate use of Medicaid services and payments. Furthermore, the Authority did not meet federal program integrity requirements and could be subject to federal sanctions because it has not established a statewide surveillance and utilization program and does not describe its safeguarding methods and procedures in the Medicaid state plan. Recommendations We recommend the Authority: ? Update the Medicaid state plan with the methods and procedures it uses to safeguard against unnecessary utilization of care and services ? Implement and monitor a statewide surveillance and utilization control program ? Implement adequate internal controls to ensure it complies with utilization control and program integrity requirements Authority?s Response The Authority does not concur that it needs to update its Medicaid state plan. The current plan includes methods and procedures used to safeguard against unnecessary utilization of care and services. The Authority agrees that it needs to update and monitor its statewide surveillance and utilization control program. Additionally, the Authority is implementing a new fraud and abuse detection system which will include automated Surveillance and Utilization Review System (SURS) alerts. The Authority agrees that adequate internal controls are necessary to ensure compliance with utilization control and program integrity requirements. The Authority will memorialize its current processes and procedures related to utilization control requirements. Auditor?s Remarks We reaffirm our opinion that the Medicaid state plan does not contain the required elements in 42 CFR Subchapter C Medical Assistance Programs Part 456. We will follow up on the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. Title 42 CFR Subchapter C Medical Assistance Programs Part 456, Utilization Control, states in part: Section 456.1 Basis and purpose of part. (a) This part prescribes requirements concerning control of the utilization of Medicaid services including - (1) A statewide program of control of the utilization of all Medicaid services; (b) The requirements in this part are based on the following sections of the Act. Table 1 shows the relationship between these sections of the Act and the requirements in this part. (1) Methods and procedures to safeguard against unnecessary utilization of care and services. Section 1902(a)(30) requires that the State plan provide methods and procedures to safeguard against unnecessary utilization of care and services. Section 456.2 State plan requirements. (a) A State plan must provide that the requirements of this part are met. (b) These requirements may be met by the agency by: (1) Assuming direct responsibility for assuring that the requirements of this part are met; or (2) Deeming of medical and utilization review requirements if the agency contracts with a QIO to perform that review, which in the case of inpatient acute care review will also serve as the initial determination for QIO medical necessity and appropriateness review for patients who are dually entitled to benefits under Medicare and Medicaid. Section 456.3 Statewide surveillance and utilization control program. The Medicaid agency must implement a statewide surveillance and utilization control program that - (a) Safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments; (b) Assesses the quality of those services; (c) Provides for the control of the utilization of all services provided under the plan in accordance with subpart B of this part; and (d) Provides for the control of the utilization of inpatient services in accordance with subparts C through I of this part. Section 456.4 Responsibility for monitoring the utilization control program. (a) The agency must - (1) Monitor the statewide utilization control program; (2) Take all necessary corrective action to ensure the effectiveness of the program; (3) Establish methods and procedures to implement this section; (4) Keep copies of these methods and procedures on file; and (5) Give copies of these methods and procedures to all staff involved in carrying out the utilization control program. Section 456.5 Evaluation criteria. The agency must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. This section does not apply to services in hospitals and mental hospitals. For these facilities, see the following sections: ?? 456.122 and 456.132 of subpart C; and ? 456.232 of subpart D. Title 42 CFR Subchapter C Medical Assistance Programs Part 456, Utilization Control, Subpart B, Utilization Control: All Medicaid Services states in part: Section 456.21 Scope. This subpart prescribes utilization control requirements applicable to all services provided under a State plan. Section 456.22 Sample basis evaluation of services. To promote the most effective and appropriate use of available services and facilities the Medicaid agency must have procedures for the on-going evaluation, on a sample basis, of the need for and the quality and timeliness of Medicaid services. Section 456.23 Post-payment review process. The agency must have a post-payment review process that - (a) Allows State personnel to develop and review - (1) Beneficiary utilization profiles; (2) Provider service profiles; and (3) Exceptions criteria; and (b) Identifies exceptions so that the agency can correct misutilization practices of beneficiaries and providers. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-051 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed periodic audits of cost report data for rate setting, hospital billings and other financial and statistical records for inpatient hospital services. CFDA Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: Department of Health and Human Services Federal Award/Contract Number: 1905WA5MAP; 1905WA5ADM; 2005WA5MAP; 2005WA5ADM; 2005WAINCT; 2005WAIMPL; 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component Special Tests and Provisions ? Inpatient Hospital and Long-Term Care Facility Audits Questioned Cost Amount: None Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.1 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one-third of the state?s federal expenditures. The program spent over $15.3 billion in federal and state funds during fiscal year 2021. In fiscal year 2021, the state Medicaid program paid about $325 million to hospitals for inpatient services. The Health Care Authority (Authority), the state Medicaid agency, pays for inpatient services to hospitals by using rates that are economic, efficient, and in accordance with the state plan. The federal grantor requires the Authority to perform periodic audits of the financial and statistical records of participating providers as established in the state plan. The Medicaid State Plan, Attachment 4.19, lists the financial audit requirements for establishing payment rates for inpatient hospital services. The plan states that cost report data used for rate setting, hospital billings, and other financial and statistical records will be periodically audited. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the most recent audit, we reported the Authority did not have adequate internal controls over and did not comply with requirements to ensure it periodically audited cost report data for inpatient hospital services. The prior finding number was 2020-049. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it performed periodic audits of cost report data for rate setting, hospital billings, and other financial and statistical records for inpatient hospital services. Although the Authority did perform reconciliations of amounts paid to hospitals for inpatient services based on the amounts the facilities reported, it did not perform periodic audits of cost report data used for rate setting and hospital billings and other financial and statistical records as required in the state plan. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Authority did not establish policies and procedures to ensure it performed periodic audits of cost report data, hospital billings, and other financial and statistical records for inpatient hospital services. Effect of Condition By not ensuring that it performs periodic audits of cost report data, hospital billings, and other financial and statistical records, the Authority increases the risk that it could improperly pay for inpatient hospital services. Recommendation We recommend the Authority establish and implement adequate internal controls to ensure it meets federal inpatient hospital audit requirements. Authority?s Response The Authority has implemented internal controls to ensure compliance with federal requirements over inpatient hospital and long-term care facility audits. In May 2021, the Authority implemented a procedure to determine when audits of cost reports are deemed necessary. Effective February 2022, the State Plan was amended to reflect that while audits may be performed by the Authority as it deems necessary, there is not a requirement to do so. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will follow up on the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (b) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. Title 42 U.S. Code of Federal Regulations (CFR) Part 447, Payments for Services establishes the following applicable requirements: Section 447.253 Other requirements states in part: (g) Audit requirements. The Medicaid agency must provide for periodic audits of the financial and statistical records of participating providers The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Medicaid State Plan, Attachment 4.19-A Part I Methods and Standards for Establishing Payment Rates for Inpatient Hospital Services, page 60 states in part: 3. Financial Audit Requirements Cost report data used for rate setting will be periodically audited. In addition, hospital billings and other financial and statistical records will be periodically audited by the agency.

2021-052 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to report recoveries of fraudulent overpayments on the CMS-64 report. CFDA Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U. S. Department of Health and Human Services Federal Award/Contract Number: 1905WA5MAP; 1905WA5ADM; 2005WA5MAP; 2005WA5ADM; 2005WAINCT; 2005WAIMPL; 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions ? Medicaid Fraud Control Unit (MFCU) Known Questioned Cost Amount: $78,774 Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.1 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one-third of the state?s federal expenditures. The program spent over $15.3 billion in federal and state funds during fiscal year 2021. The Health Care Authority (Authority) is required to refer suspected fraud or other criminal violations to the Medicaid Fraud Control Division (MFCD) for investigation and prosecution. The Authority reports any overpayment recoveries resulting from MFCD actions on the CMS-64 report. The CMS-64 report is the quarterly statement of Medicaid Program expenditures that agencies use to report the actual program benefit costs and administrative expenses to the Centers for Medicare & Medicaid Services (CMS). CMS uses this information to compute the federal financial participation (FFP) for the state?s Medicaid Program costs. When MFCD completes an investigation, it sends the settlement over to the Authority for management review and signature. After a final judgement is made on an overpayment resulting from fraud, the State has 30 days to refund the entire federal share. Once the Authority receives the settlement, a Journal Voucher (JV) is created to move the federal portion of the settlement over to state-only funding, which creates a credit on the CMS-64 report. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the most recent audit, we reported the Authority did not have adequate internal controls over and did not comply with requirements to report MCFD overpayment recoveries on the CMS-64 report. The prior finding number was 2020-050. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to report recoveries of fraudulent overpayments on the CMS-64 report. Our audit found the Authority did not create a JV to move the entire federal portion of the fraud settlement over to state-only funding or report the entire overpayment on the CMS-64 report as a credit. Instead the Authority only created JVs of the payments as they were made to the State. Additionally, the Authority did not have policies and procedures in place that described the process staff should follow for creating the JV or for reporting the MFCD overpayments on the CMS-64 report. We consider these internal control deficiencies to be a material weakness, which led to material noncompliance. Cause of Condition Management did not implement sufficient internal controls to ensure the Authority returned recoveries of fraudulent overpayments to the grantor in a timely manner. Effect of Condition and Questioned Costs For fiscal year 2021, the Authority received a settlement agreement totaling $161,050 in fraudulent overpayments. The federal portion of this amount was $79,915. The Authority created JVs and reported $1,141 of the $79,915 federal portion on the CMS-64 report dated June 30, 2021. A JV for the entire federal portion should have been processed and reported on the March 31, 2021 CMS-64 report. We are questioning the costs of $78,774 that the Authority did not report on the CMS-64 report or return to CMS, as federal regulations require. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: ? Establish a formal process to ensure it properly reports recoveries of fraudulent overpayments on the quarterly CMS-64 report ? Consult with the federal grantor about whether or not the questioned costs identified in the finding should be repaid Authority?s Response The Authority concurs with the finding. We would like to point out a small correction to the amount identified as questioned costs. The Authority has returned a total of $1,365 in federal funds rather than the $1,141 identified by the auditor. $1,216 was returned in federal fiscal year 2021, and $149 was returned in federal fiscal year 2022. This is a slight reduction of $224 to the questioned cost amount that should total $78,550. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will follow up on the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.1 Definitions, states in part: Improper payment means: 4) Any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. (x) Incorrect amounts are overpayments or underpayments that are made to eligible recipients (including inappropriate denials of payment or service, any payment that does not account for credit for applicable discounts, payments that are for an incorrect amount, and duplicate payments). An improper payment also includes any payment that was made to an ineligible recipient or for an ineligible good or service, or payments for goods or services not received (except for such payments authorized by law). Note 1 to paragraph (1)(i) of this definition. Applicable discounts are only those discounts where it is both advantageous and within the agency's control to claim them. (xi) When an agency's review is unable to discern whether a payment was proper as a result of insufficient or lack of documentation, this payment should also be considered an improper payment. When establishing documentation requirements for payments, agencies should ensure that all documentation requirements are necessary and should refrain from imposing additional burdensome documentation requirements. (xii) Interest or other fees that may result from an underpayment by an agency are not considered an improper payment if the interest was paid correctly. These payments are generally separate transactions and may be necessary under certain statutory, contractual, administrative, or other legally applicable requirements. (iv) A ?questioned cost? (as defined in this section) should not be considered an improper payment until the transaction has been completely reviewed and is confirmed to be improper. (v) The term ?payment? in this definition means any disbursement or transfer of Federal funds (including a commitment for future payment, such as cash, securities, loans, loan guarantees, and insurance subsidies) to any non-Federal person, non-Federal entity, or Federal employee, that is made by a Federal agency, a Federal contractor, a Federal grantee, or a governmental or other organization administering a Federal program or activity. (vi) The term ?payment? includes disbursements made pursuant to prime contracts awarded under the Federal Acquisition Regulation and Federal awards subject to this part that are expended by recipients. (2) See definition of improper payment in OMB Circular A-123 appendix C, part I A (1) ?What is an improper payment?? Questioned costs, including those identified in audits, are not an improper payment until reviewed and confirmed to be improper as defined in OMB Circular A-123 appendix C. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. Title 42 U.S. Code of Federal Regulations Part 433, State Fiscal Administration, Subpart F ? Refunding of Federal Share of Medicaid Overpayments to Providers states in part: Section 433.300 Basis. This subpart implements - (a) Section 1903(d)(2)(A) of the Act, which directs that quarterly Federal payments to the States under title XIX (Medicaid) of the Act are to be reduced or increased to make adjustment for prior overpayments or underpayments that the Secretary determines have been made. (b) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable. (c) Section 1903(d)(3) of the Act, which provides that the Secretary will consider the pro rata Federal share of the net amount recovered by a State during any quarter to be an overpayment. Section 433.312 Basic requirements for refunds. (a) Basic rules. (1) Except as provided in paragraph (b) of this section, the State Medicaid agency has 1 year from the date of discovery of an overpayment to a provider to recover or seek to recover the overpayment before the Federal share must be refunded to CMS. (2) The State Medicaid agency must refund the Federal share of overpayments at the end of the 1-year period following discovery in accordance with the requirements of this subpart, whether or not the State has recovered the overpayment from the provider. (b) Exception. The agency is not required to refund the Federal share of an overpayment made to a provider when the State is unable to recover the overpayment amount because the provider has been determined bankrupt or out of business in accordance with ? 433.318. Section 433.316 When discovery of overpayment occurs and its significance. (a) General rule. The date on which an overpayment is discovered is the beginning date of the 1-year period allowed for a State to recover or seek to recover an overpayment before a refund of the Federal share of an overpayment must be made to CMS. (b) Requirements for notification. Unless a State official or fiscal agent of the State chooses to initiate a formal recoupment action against a provider without first giving written notification of its intent, a State Medicaid agency official or other State official must notify the provider in writing of any overpayment it discovers in accordance with State agency policies and procedures and must take reasonable actions to attempt to recover the overpayment in accordance with State law and procedures. (c) Overpayments resulting from situations other than fraud. An overpayment resulting from a situation other than fraud is discovered on the earliest of - - (1) The date on which any Medicaid agency official or other State official first notifies a provider in writing of an overpayment and specifies a dollar amount that is subject to recovery; (2) The date on which a provider initially acknowledges a specific overpaid amount in writing to the medicaid agency; or (3) The date on which any State official or fiscal agent of the State initiates a formal action to recoup a specific overpaid amount from a provider without having first notified the provider in writing. (d) Overpayments resulting from fraud. (1) An overpayment that results from fraud is discovered on the date of the final written notice (as defined in ? 433.304 of this subchapter) of the State's overpayment determination. (2) When the State is unable to recover a debt which represents an overpayment (or any portion thereof) resulting from fraud within 1 year of discovery because no final determination of the amount of the overpayment has been made under an administrative or judicial process (as applicable), including as a result of a judgment being under appeal, no adjustment shall be made in the Federal payment to such State on account of such overpayment (or any portion thereof) until 30 days after the date on which a final judgment (including, if applicable, a final determination on an appeal) is made. (3) The Medicaid agency may treat an overpayment made to a Medicaid provider as resulting from fraud under subsection (d) of this section only if it has referred a provider's case to the Medicaid fraud control unit, or appropriate law enforcement agency in States with no certified Medicaid fraud control unit, as required by ? 455.15, ? 455.21, or ? 455.23 of this chapter, and the Medicaid fraud control unit or appropriate law enforcement agency has provided the Medicaid agency with written notification of acceptance of the case; or if the Medicaid fraud control unit or appropriate law enforcement agency has filed a civil or criminal action against a provider and has notified the State Medicaid agency. (e) Overpayments identified through Federal reviews. If a Federal review at any time indicates that a State has failed to identify an overpayment or a State has identified an overpayment but has failed to either send written notice of the overpayment to the provider that specified a dollar amount subject to recovery or initiate a formal recoupment from the provider without having first notified the provider in writing, CMS will consider the overpayment as discovered on the date that the Federal official first notifies the State in writing of the overpayment and specifies a dollar amount subject to recovery. (f) Effect of changes in overpayment amount. Any adjustment in the amount of an overpayment during the 1-year period following discovery (made in accordance with the approved State plan, Federal law and regulations governing Medicaid, and the appeals resolution process specified in State administrative policies and procedures) has the following effect on the 1-year recovery period: (1) A downward adjustment in the amount of an overpayment subject to recovery that occurs after discovery does not change the original 1-year recovery period for the outstanding balance. (2) An upward adjustment in the amount of an overpayment subject to recovery that occurs during the 1-year period following discovery does not change the 1-year recovery period for the original overpayment amount. A new 1-year period begins for the incremental amount only, beginning with the date of the State's written notification to the provider regarding the upward adjustment. (g) Effect of partial collection by State. A partial collection of an overpayment amount by the State from a provider during the 1-year period following discovery does not change the 1-year recovery period for the balance of the original overpayment amount due to CMS. (h) Effect of administrative or judicial appeals. Any appeal rights extended to a provider do not extend Section 433.320 Procedures for Refunds to CMS. (a) Basic requirements. (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of - (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with ? 433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, non-refunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-053 The Department of Social and Health Services, Aging and Long-Term Support Administration, did not have adequate internal controls to ensure it complied with nursing home survey statement of deficiencies and plan of corrections timelines. CFDA Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.777 COVID-19 ? State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award Number: 1905WA5MAP; 1905WA5ADM; 2005WA5MAP; 2005WA5ADM; 2005WAINCT; 2005WAIMPL; 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions ? Provider Health and Safety Standards Known Questioned Cost Amount: None Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.1 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one-third of the State?s federal expenditures. The program spent about $15.3 billion in federal and state funds during fiscal year 2021. Residential Care Services, under the Department of Social and Health Services? Aging and Long-Term Support Administration, is the State?s nursing home survey agency. A nursing home facility is an institution with the primary purpose of providing 24-hour supervised nursing care, personal care, therapy, nutrition management, organized activities, social services, room, board and laundry to people who receive care and services under Medicaid. The survey for certifying a nursing facility is a resident-centered inspection that gathers information about the facility?s quality of service to determine whether the facility complies with state and federal requirements. The survey focuses on the nursing home?s administration and patient services. The survey also assesses compliance with federal health, safety and quality standards designed to ensure patients receive safe and quality care. The Centers for Medicare and Medicaid Services require the state to complete standard surveys for nursing facilities. If a survey uncovers deficiencies, the Department must deliver a statement of deficiency (SOD) to the facility within 10 working days of the survey date. The facility must then submit a plan of correction (POC) for all compliance issues that occurred. The Department then determines if the POC for each individual compliance issue is acceptable. If the nursing facility does not correct the issue within 60 calendar days of receiving the SOD, the facility risks forfeiting its Medicaid certification. Staff members monitor the receipt of POCs and inform team coordinators when POCs are ready for review. In addition to federal requirements, the Department has established its own policies and procedures requiring that it review a POC within five working days of receiving it. The Department uses the Electronic Plan of Correction System to monitor and track these requirements. They ensure they meet the timelines by running a weekly SOD report. The report is sent to field managers for review to ensure that SODs and POCs are sent within the appropriate timelines. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In prior audits we reported the Department did not have adequate internal controls to ensure it complied with federal requirements for completing nursing home recertification surveys in a timely manner. The prior finding number was 2020-054. Description of Condition The Department did not have adequate internal controls to ensure it complied with nursing home survey SOD and POC timelines. The Department complied with its own policies and procedures regarding sending SODs and POCs within certain timelines. However, the internal control used to track federal requirements for SODs and POCs was either not followed or not adequately documented. We used a non-statistical sampling method to randomly select 11 of the 49 weekly nursing home unit SOD reports that occurred during the audit period. During our review, we could not verify nine (82 percent) weekly SOD reports were processed and reviewed by the Field Manager as required. We consider this internal control deficiency to be a material weakness. Cause of Condition During the audit period, the Department used an outdated management bulletin procedure. Processes and procedures had changed over the years in some regions and not all regions were able to verify that the Weekly SOD reports were processed and reviewed. Effect of Condition By not establishing and following adequate internal controls, the Department is at a higher risk of not meeting federal Medicaid requirements and its own policies and could be subject to sanction by the grantor. Recommendation We recommend the Department improve its monitoring to ensure all Regions follow established policies and procedures. Department?s Response The Department partially agrees with the finding. The Department agrees we were not in compliance with Management Bulletin 15-081 which stated an AA3 will provide the SOD report to the Field Manager (FM) and the FM will review for any SODs that were not sent out within ten working days. However, we do not agree our internal controls are not adequate, as proven by the fact there were zero exceptions identified during compliance testing. The Electronic Plan of Correction (ePOC) application for nursing homes was implemented at RCS in April 2017. The ePOC application automated the distribution of the federal SOD via a secure website created by the Centers for Medicare and Medicaid Services. The implementation of ePOC eliminated the need for the AA3 to provide the SOD report to the FM because ePOC automatically sends e-mail notifications daily to the Regional Administrator, FM, and AA3, notifying them if it has been nine days past the exit date in ASPEN and a SOD has not been sent to the nursing facility. Field Managers will continue to follow up on all ePOC e-mail notifications to ensure compliance with SOD and POC deadlines. Management Bulletin 15-081 will be rescinded by June 30, 2022, as it is no longer applicable. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will follow up on the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. Title 42 U.S. Code of Federal Regulations, Subpart E Survey and Certification of Long-Term Care Facilities Section 488.308 Survey frequency, states in part: (a) Basic Period. The survey agency must conduct a standard survey of each SNF and NF not later than 15 months after the last day of the previous standard survey (b) Statewide average interval. 1. The statewide average interval between standard surveys must be 12 months or less, computed in accordance with paragraph (d) of this section (d) Computation of statewide average interval. The statewide average interval is computed at the end of each Federal fiscal year by comparing the last day of the most recent standard survey for each participating facility to the last day of each facility?s previous standard survey. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. The Centers for Medicare and Medicaid Services, State Operations Manual, Chapter 2 ? The Certification Process, states in part: 2138G ? Schedule for Recertification The SA completes a recertification survey an average of every 12 months and at least once every 15 months (see Section 2141) 2728 ? Statement of Deficiencies and Plan of Correction, Form-2567 The SA mails the provider/supplier a copy of form CMS-2567 within 10 working days after the survey. If there are deficiencies, the SA allows the provider/supplier 10 calendar days to complete and return the POC. Requirements pertaining to the submittal of the POC can be found in subsection B. The Department of Social and Health Services, Residential Care Services Division Standard Operating Procedure: Enforcement Chapter 7B3, states in part: Background The Department will review the ePOC with 5 working days of receipt and will verify that it is acceptable. The NH may specify in the ePOC that they are not in agreement with the findings within the SOD report but this does not alter the NH?s responsibility to submit an acceptable ePOC. Off-site POC Review The Surveyor will: 1. Review the ePOC within five (5) working days of receipt and confirm that the POC for each deficiency includes: a. How the NH will correct the deficiency for each numbered resident; b. How the NH will protect residents from similar situations c. Measures the NH will take or the systems it will change to ensure that the problem does not recur; d. How the NH plans to monitor its ongoing performance to sustain compliance; e. Dates corrective action will be completed; and f. Title of person responsible for correction

2021-054 The Department of Social and Health Services, Aging and Long-Term Support Administration, did not have adequate internal controls over and did not comply with requirements to ensure timely investigation of complaints of client abuse and neglect at Medicaid residential facilities. CFDA Number and Title: 93.775 State Medicaid Fraud Control Units 93.777 State Survey and Certification of Health Care Providers and Suppliers 93.778 Medical Assistance Program 93.778 COVID-19 ? Medical Assistance Program Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 1905WA5MAP; 1905WA5ADM; 2005WA5MAP; 2005WA5ADM; 2005WAINCT; 2005WAIMPL; 2105WAINCT; 2105WAIMPL; 2105WA5MAP; 2105WA5ADM; Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Special Tests and Provisions ? Provider Health and Safety Standards Known Questioned Cost Amount: None Background Medicaid is a jointly funded state and federal partnership providing coverage for about 2.1 million eligible low-income Washington residents who otherwise might go without medical care. Medicaid is Washington?s largest public assistance program and usually accounts for about one-third of the state?s federal expenditures. The program spent over $15.3 billion in federal and state funds during fiscal year 2021. The Centers for Medicare and Medicaid Services (CMS), which administers the program at the federal level, allows states to provide long-term care services to Medicaid clients that require daily nursing services. Medicaid coverage for nursing homes and intermediate care facilities for intellectually disabled clients is only authorized when services are provided in a residential facility licensed and certified by the state survey agency. The state survey agency is also responsible for investigating complaints and allegations of abuse, neglect or misappropriation. Residential Care Services, under the Department of Social and Health Services?s Aging and Long-Term Support Administration (Department), is the state?s long-term care facility survey agency. Residential Care Services manages the Complaint Resolution Unit (Unit), which is the frontline response system for providing the intake and assignment functions for complaints from staff, residents, families and the public. The Unit receives two types of complaints, also known as reports: 1) complaints from Department staff, the public, government agencies, or law enforcement and 2) reports from facilities. People can submit complaints to the Unit by phone, mail, email, fax or online. The Unit responds to complaints received on holidays and after hours on the next business day. The Unit uses the Tracking Incidents of Vulnerable Adults (TIVA) case management system to input, prioritize and track complaints. A program specialist performs an initial review of complaints before entering them into TIVA. Clinical triage nurses determine the final priority assignment of all nursing home and intermediate care facility complaints. The following table lists the five different priority levels for new complaints and the respective response times. During the COVID-19 pandemic, CMS guidance allowed states to work only on complaints with Immediate Jeopardy and Nonimmediate Jeopardy-High Priority levels. Priority levels Required response times Immediate Jeopardy Initiate investigation within 2 working days of receipt Nonimmediate Jeopardy-High Initiate investigation within 10 working days of prioritization Nonimmediate Jeopardy-Medium Initiate investigation within 20 working days of prioritization Nonimmediate Jeopardy-Low Initiate investigation within 45 working days of prioritization Quality Review Field Manager Review The CMS State Operations Manual requires each complaint to be triaged by someone who is professionally qualified to evaluate the nature of the problem based on their experience and knowledge of current clinical standards of practice and federal requirements. Unit intake staff review, research, and prioritize complaints to ensure the level of response corresponds to the severity of the allegation. If necessary, the Unit assigns complaints to the Department?s field unit offices within two working days of knowledge of the complaint. Field staff investigate the complaints and follow up on them within the specified time frame as determined by the severity of the concerns noted. In fiscal year 2021, the Department received 46,231 complaints. Of these, 14,597 were related to nursing homes and 1,155 were related to intermediate care facilities for intellectually disabled people. The following table shows the number of Immediate Jeopardy and Nonimmediate Jeopardy-High Priority complaints for both providers. Provider Type Immediate Jeopardy Complaints Received Nonimmediate Jeopardy-High Priority Complaints Received Nursing Home 1,433 3,765 Intermediate Care Facility for the Intellectually Disabled 17 187 Combined Total 1,450 3,952 Federal regulations require recipients to establish and follow internal controls that ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Department did not have adequate internal controls over and did not comply with requirements to ensure timely investigation of complaints of client abuse and neglect at Medicaid residential facilities. We evaluated all Immediate Jeopardy and Nonimmediate Jeopardy-High Priority TIVA complaints that occurred during fiscal year 2021 to ensure they met the required timelines for initiating an investigation. We found the Department did not initiate investigations timely for 42 of the Immediate Jeopardy complaints (2.9 percent) and 207 of the Nonimmediate Jeopardy-High Priority complaints (5.2 percent). For Immediate Jeopardy complaints, the Department initiated investigations between 4 to 72 days after receipt. For Nonimmediate Jeopardy-High Priority complaints, the Department initiated investigations between 12 to 131 days after receipt. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Department had limited staffing resources and received a large increase of COVID-19-related complaints. As a result, staff was unable to follow up on all complaints by the required response times. Effect of Condition When the Department does not prioritize and investigate complaints timely, vulnerable residents at nursing homes and intermediate care facilities are at a higher risk of abuse, neglect and financial exploitation. Recommendation We recommend the Department strengthen its internal controls to ensure it investigates complaints timely, as federal regulations require. Department?s Response The Department partially agrees with the finding. We agree that not all complaint investigations were initiated within the required timeframes. However, we do not agree that it is due to inadequate internal controls. Residential Care Services (RCS) has effectively used our current internal controls since FY2017, when we received the SAO Stewardship Award related to this audit area. Compliance with required timeframes declined due to the increase of 3,195 complaints from the previous fiscal year that were assigned for investigation and the staff vacancy rate. The effects of the COVID-19 pandemic including exposure, illness, and staff resignation due to vaccination mandates, increased staff vacancy to the rate of 24%. In general, a 2-day response is related to an allegation of a life-threatening situation that has caused, or is at risk of causing, substantial harm of such consequence that urgent intervention is necessary. The Department categorized all COVID-19 complaints related to the pandemic a 2-day response in TIVA for tracking purposes, which further impacted workload. Residential Care Services will continue to use our current internal controls, in addition to hiring and training new staff to fill the vacant positions. This will ensure compliance with investigation timeframes. Auditor?s Remarks We thank the Department for its cooperation and assistance throughout the audit. We will follow up on the status of the Department?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), section 516, Audit findings, establishes reporting requirements for audit findings. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (b) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follow: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. The Centers for Medicare and Medicaid Services, State Operations Manual Chapter 5 ? Complaint Procedures, states in part: Section 5010 ? General Intake Process A complaint is an allegation of noncompliance with Federal and/or State requirements. If the SA determines that the allegation(s) falls within the authority of the SA, the SA determines the severity and urgency of the allegations, so that appropriate and timely action can be pursued. Each SA is expected to have written policies and procedures to ensure that the appropriate response is taken for each complaint. This structure needs to include response timelines and a process to document actions taken by the SA in response to complaints. If a State?s time frames for the investigation of a complaint/incident are more stringent than the Federal time frames, the intake is prioritized using the State?s timeframes. The SA is expected to be able to share the logic and rationale that was utilized in prioritizing the complaint for investigation. The SA response must be designed to protect the health and safety of all residents, patients, and clients. Section 5070 ? Priority Assignment for Nursing Homes, Deemed and Non-Deemed Non-Long Term Care Providers/ Suppliers, and EMTALA An assessment of each complaint or incident intake must be made by an individual who is professionally qualified to evaluate the nature of the problem based upon his/her knowledge of Federal requirements and his/her knowledge of current clinical standards of practice. In situations where a determination is made that immediate jeopardy may be present and ongoing, the SA is required to start the on-site investigation within two working days of receipt of the complaint or incident report in the case of a deemed provider or supplier, within two working days of RO authorization for investigation. For all non-immediate jeopardy situations, the complaint/incident is prioritized within two working days of its receipt, unless there are extenuating circumstances that impede the collection of relevant information. The Department of Social and Health Services, Residential Care Services Division Standard Operating Procedure: Complaint Resolution Unit Chapter 4A20, states in part: Procedure A. CRU staff will prioritize complaint intakes using the following guidelines: 1. 2 working days (Immediate Jeopardy) ? A situation in which the provider?s noncompliance with one or more requirements of participation has caused, or is likely to cause, serious injury, harm, impairment, or death to a resident. Immediate corrective action is necessary 2. 10 working days (Non Immediate Jeopardy-High) ? The alleged noncompliance may have caused harm that negatively impacts the individual?s mental, physical and/or psychosocial status and are of such consequence to the person?s well-being, the SA conducts a rapid response. Usually, specific rather than general information (such as, descriptive identifiers, individual names, date/time/location of occurrence, description of harm, etc.) factors into the assignment of this level of priority.

2021-055 The Health Care Authority improperly charged $100,000 to the Block Grants for Prevention and Treatment of Substance Abuse. CFDA Number and Title: 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2B08TI010056-19, 1B08TI083138-01,6B08Ti083486-01M002, 1B08TI083519-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Activities Allowed or Unallowed Allowable Costs/Cost Principles Known Questioned Cost Amount: $100,000 Background The Health Care Authority (Authority), Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse. The Authority provides federal funds to counties, tribes, nonprofit organizations and other state agencies to develop prevention programs and provide treatment and support services. The Authority spent more than $48.7 million in grant funds during fiscal year 2021. The Authority is responsible for ensuring it uses grant money only for costs that are allowable, related to the grant?s purpose and incurred during the grant period, as specified in the grant?s terms and conditions. At the beginning of the federal fiscal year, and whenever the Authority receives a new federal grant, it establishes new cost objectives and allocation codes to ensure it charges expenditures to the proper grant. Before paying an invoice, program managers are responsible for reviewing supporting documentation to determine if the services were allowable for that grant. Fiscal managers are responsible for ensuring that payments are coded to the correct time period. Description of Condition We found the Authority had adequate internal controls to ensure material compliance with requirements over payments to providers. However, we found the Authority improperly charged $100,000 to the Block Grants for Prevention and Treatment of Substance Abuse. We used a statistical sampling method to randomly select and examine 57 of 694 payments to providers and contractors. We examined the supporting documentation for each payment to ensure it was allowable and for a service that took place during the period of performance. We found the Authority made one payment for a service that was provided after the period of performance for the grant. Federal regulations require the auditor to issue a finding when the known or estimated questioned costs identified in a Single Audit exceed $25,000. As stated in the Effect of Condition and Questioned Costs section below, we are issuing this finding because the known questioned costs exceed that threshold. This issue was not reported as a finding in the prior audit. Cause of Condition Staff followed procedures for approving the reimbursement. However, multiple reviews did not detect that the payment did not meet the period of allowability for the grant. Effect of Condition and Questioned Costs The Authority improperly charged the grant for a $100,000 payment to a provider. Based on this unallowable payment, we estimate the likely questioned costs for this grant to be $438,889. Our sampling methodology meets statistical sampling criteria under generally accepted auditing standards in AU-C 530.05. It is important to note that the sampling technique we used is intended to support our audit conclusions by determining if expenditures complied with program requirements in all material respects. Accordingly, we used an acceptance sampling formula designed to provide a high level of assurance, with a 95 percent confidence of whether exceptions exceeded our materiality threshold. Our audit report and finding reflects this conclusion. However, the likely improper payment projections are a point estimate and only represent our ?best estimate of total questioned costs? as required by 2 CFR 200.516(3). We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: ? Ensure payments to providers and contractors meet the period of allowability ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Authority?s Response We concur with this finding. HCA will ensure payments to providers and contracts meet the period of availability. We will also consult with the grantor regarding the questioned costs. Auditor?s Remarks We thank the Authority for its cooperation and assistance during the audit. We will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs.

2021-056 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it met the earmarking requirement for the Block Grants for Prevention and Treatment of Substance Abuse. CFDA Number and Title: 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2B08TI010056-19; 2B08TI010056-19S1 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Earmarking Known Questioned Cost Amount: $684,129 Background The Health Care Authority (Authority), Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse. The Authority provides federal funds to counties, tribes, nonprofit organizations and other state agencies to develop prevention programs and provide treatment and support services. In fiscal year 2021, the Authority spent more than $48.7 million in federal program funds. Federal regulations require the Authority to spend no more than 5 percent of the federal program funds on administrative costs of the grant. Federal regulations also require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it met the earmarking requirement for the Block Grants for Prevention and Treatment of Substance Abuse. To monitor the administrative earmarking requirement, the Authority has staff run monthly reports from its accounting system to determine if it is on track to meet the 5 percent administrative cost maximum by the time the grant closes. Upon closing a grant, the Authority also runs a final report to ensure it met the requirement. However, we found that during the audit period, the Authority closed the federal fiscal year 2019 grant while having exceeded the 5 percent administrative cost maximum. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition Throughout the year, staff ran the required monthly reports and noted the Authority was not meeting the requirement. However, management did not take action to correct the noncompliance throughout the year or before closing the federal fiscal year 2019 grant. The Authority stated the reason it did not reconcile grant expenditures to the accounting records in a timely manner was due to staff vacancies, workload and training. Effect of Condition and Questioned Costs The Authority was awarded $37,790,646 for the federal fiscal year 2019 grant. Therefore, it was allowed to spend up to $1,889,523 on administrative costs. However, it spent $2,573,652, which exceeded the administrative cost maximum by $684,129. As a result, we are questioning the $684,129 in unallowable administrative costs. By not establishing adequate internal controls, the Authority cannot ensure it meets the administrative earmarking requirement. By not complying with federal requirements, the Authority risks having to repay federal funds or having future federal funds withheld. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: ? Improve internal controls to ensure it does not exceed the maximum allowable amount for administrative costs at the end of the award period ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Authority?s Response We believe there are two different issues here. We do concur that accounting adjustments that are part of the reconciliation process were not made to the state?s records to align expenditures with the final federal report in a timely fashion. This was due to staff vacancies, workload, and training. Staff are aware of what can be reported and the corrections that are needed to the accounting records as part of reconciling the award. We do not agree that the SF-425 was reported with a 6.8% administration to SAMHSA, therefore we do not agree with the questioned costs associated with this finding. The final SF-425 was reported fully expended with an administration charge of 5% as explained to SAO. The referenced 6.8% indicated the amount of expenditures that were ineligible and needed to be moved out of the award. The expenditures were moved but not in a timely fashion. Auditor?s Remarks At the time the Authority submitted its final SF-425 report, the administrative costs that were identified as charged to the grant exceeded the allowed maximum by $684,129. In addition, the expenditures in question were still charged to the grant in the accounting system as of the end of the audit period, which was six months after the final report was submitted. As stated above, we recommend the Authority consult with the federal grantor to discuss whether the questioned cost reported in the finding need to be repaid. We reaffirm our finding and will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 45 U.S. Code of Federal Regulations Part 96.135 Restrictions on expenditure of grant, states in part: (b) The State shall limit expenditures on the following: (1) The State involved will not expend more than 5 percent of the grant to pay the costs of administering the grant Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-057 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure payments made under the Block Grants for Prevention and Treatment of Substance Abuse program met the period of performance. CFDA Number and Title: 93.959, Block grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 2B08TI010056-19; 2B08TI010056-19S1 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component: Period of Performance Known Questioned Cost Amount: $54,385 Background The Health Care Authority (Authority), Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse. The Authority provides federal funds to counties, tribes, nonprofit organizations and other state agencies to develop prevention programs and provide treatment and support services. The Authority spent more than $48.7 million in grant funds during fiscal year 2021. The Authority can use grant funds only for costs that are incurred during the period of performance, as specified in the grant?s terms and conditions. The Authority has 90 days after the last day of the period of performance to liquidate grant expenditures and close the grant. At this point, all expenditures are final, and the Authority should no longer have any activity related to the grant in its accounting system. At the beginning of each federal fiscal year and whenever the Authority receives a new federal grant, it establishes new cost objectives and allocation codes to ensure expenditures are charged to the proper grants. When the Authority receives reimbursement requests, program managers are responsible for reviewing supporting documentation to determine if the services billed meet the period of performance requirements under the grant. Fiscal managers are also responsible for ensuring that payments are coded to the correct time period. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. In the prior audit, we reported the Authority did not have adequate internal controls to ensure payments made under the Block Grants for Prevention and Treatment of Substance Abuse program met the period of performance requirements. The prior finding number was 2020-059. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure payments made under the Block Grants for Prevention and Treatment of Substance Abuse program met the period of performance. The federal fiscal year 2019 grant closed during our audit period. We judgmentally selected 15 of 900 payments the Authority made with program funds during the 90-day grant liquidation period, and examined the supporting documentation for each payment to ensure the expenditure took place during the period of performance. We found three payments (20 percent) that the Authority made during the liquidation period were for services and purchases that had occurred after the period of performance. We also determined the Authority continued to add and reduce expenditures charged to the grant after the liquidation period ended, through the remaining six months of the audit period and into the next state fiscal year. During this period, we noted the Authority made the following adjustments to the three program expenditure categories: Expenditures Added Expenditures Removed Net Change Prevention $437,670 $(789,951) $(352,281) Treatment $95,667 $(211,848) $(116,181) Administrative $262,637 $(2,510) $260,127 Total $795,974 $(1,004,309) $(208,335) We noted the administrative cost was the largest net addition to the grant expenditures and that the costs being added and reduced were not the same expenditures. Since the expenditures reduced and added were not the same, the composition of the grant expenditure population changed after the grant closed and the Authority had submitted a final report to the grantor. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. Cause of Condition The Authority did not establish an effective review and approval process to ensure the payments it made with program funds met period of performance requirements. Management allowed program staff to continue adjusting the grant accounting records despite the liquidation period ending and the award closing. Effect of Condition and Questioned Costs By not having adequate internal controls in place, the Authority is at a higher risk of making improper payments. The Authority reduced the federal fiscal year 2019 grant expenditures by $208,335 during the remaining six months of the audit period and after the grant had closed. This reduction was the result of an additional $795,974 charged to, and $1,004,309 in different expenditures reversed from the grant. Therefore, the expenditures for the federal fiscal year 2019 grant that we tested for period of performance requirements had changed after the grant closed. As a result, we are unable to conclude with confidence that we reviewed all of the Authority?s federal fiscal year 2019 grant expenditures for period of performance compliance. We also identified $54,385 in questioned costs that the Authority paid during the liquidation period even though they occurred outside the program?s period of performance. We question costs when we find an agency has not complied with grant regulations or when it does not have adequate documentation to support its expenditures. Recommendations We recommend the Authority: ? Improve its internal controls to ensure account coding is correctly applied to each transaction to ensure payments are charged to the correct grant in compliance with period of performance requirements ? Improve its internal controls to ensure staff do not continue to charge costs to a grant after it has closed ? Consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid Authority?s Response The Authority concurs with the finding and has worked to improve internal controls for the period of performance compliance requirements. The Authority has established a new process for review of payments and grant closure during FY22. Communication to all management, contract managers, and contract specialists has been disseminated. Notification of change to policy and contract terms was sent to all contractors. Contracts are being updated to include specific billing timeline language in accordance with the new policy as they are amended and newly established. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 42 United States Code 300x-62, Availability to States of grant payments establishes the following applicable requirements: Any amounts paid to a State for a fiscal year under section 300x or 300x-21 of this title shall be available for obligation and expenditure until the end of the fiscal year following the fiscal year for which the amounts were paid. Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.53 Improper Payments states: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; and (b) Improper payment includes any payment to an ineligible party, any payment for an ineligible good or service, any duplicate payment, any payment for a good or service not received (except for such payments where authorized by law), any payment that does not account for credit for applicable discounts, and any payment where insufficient or lack of documentation prevents a reviewer from discerning whether a payment was proper. Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.403 Factors affecting Allowability of costs. Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards. (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the sample purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also ?200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also ??200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Section 200.410 Collection of unallowable costs. Payments made for costs determined to be unallowable by either the Federal awarding agency, cognizant agency for indirect costs, or pass-through entity, either as direct or indirect costs, must be refunded (including interest) to the Federal Government in accordance with instructions from the Federal agency that determined the costs are unallowable unless Federal statute or regulation directs otherwise. See also Subpart D?Post Federal Award Requirements of this part, ??200.300 Statutory and national policy requirements through 200.309 Period of performance. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. (3) Known questioned costs that are greater than $25,000 for a type of compliance requirement for a major program. Known questioned costs are those specifically identified by the auditor. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned (likely questioned costs), not just the questioned costs specifically identified (known questioned costs). The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program. In reporting questioned costs, the auditor must include information to provide proper perspective for judging the prevalence and consequences of the questioned costs. (4) Known questioned costs that are greater than $25,000 for a Federal program which is not audited as a major program. Except for audit follow-up, the auditor is not required under this part to perform audit procedures for such a Federal program; therefor, the auditor will normally not find questioned costs for a program that is not audited as a major program. However, if the auditor does become aware of questioned costs for a Federal program that is not audited as a major program (e.g., as part of audit follow-up or other audit procedures) and the known questioned costs are greater than $25,000, then the auditor must report this as an audit finding. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program.

2021-058 The Health Care Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Federal Funding Accountability and Transparency Act. CFDA Number and Title: 93.959, Block Grants for Prevention and Treatment of Substance Abuse Federal Grantor Name: U.S. Department of Health and Human Services Federal Award/Contract Number: 1B08TI083138-01; 1B08TI083519-01; 6B08TI083486-01 Pass-through Entity Name: None Pass-through Award/Contract Number: None Applicable Compliance Component Reporting Known Questioned Cost Amount: None Background The Health Care Authority (Authority), Division of Behavioral Health and Recovery, administers the Block Grants for Prevention and Treatment of Substance Abuse. The Authority subawards federal funds to counties, tribes and nonprofit organizations to develop prevention programs and provide treatment and support services. In fiscal year 2021, the Authority spent more than $48.7 million in federal program funds, approximately $29.4 million of which it paid to subrecipients. Under the Federal Funding Accountability and Transparency Act (Act), the Authority is required to collect and report information on each subaward of federal funds more than $25,000 in the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS). For federal awards issued on or after November 12, 2020, the monetary threshold for reporting increased to $30,000. The Authority must report subawards by the end of the month following the month in which it made the subaward (or subaward amendment). The intent of the Act is to empower citizens with the ability to hold the federal government accountable for spending decisions and, as a result, reduce wasteful government spending. Federal regulations require recipients to establish and follow internal controls to ensure compliance with program requirements. These controls include understanding grant requirements and monitoring the effectiveness of established controls. Description of Condition The Authority did not have adequate internal controls over and did not comply with requirements to ensure it filed reports required by the Act. During the audit period, the Authority was required to report approximately $78.7 million of program funds that it awarded to nine subrecipients through 16 new and amended subawards. We found the Authority did not report any of these subawards in FSRS as required. We consider this internal control deficiency to be a material weakness, which led to material noncompliance. This issue was not reported as a finding in the prior audit. Cause of Condition The Authority did not have a process in place that would cross multiple divisions to submit FFATA reports to the federal government. In addition, management did not monitor to ensure the Authority submitted the required reports. Effect of Condition Failing to submit the required reports diminishes the federal government?s ability to ensure accountability and transparency of federal spending. Recommendations We recommend the Authority: ? Establish effective internal controls to ensure it submits required reports ? Establish policies and procedures for filing required reports ? Provide training for employees who oversee reporting and who verify the submission and accuracy of the reports ? Ensure management monitors reporting of this information so future reports are submitted completely and timely Authority?s Response We concur with the finding and recommendations. HCA is working across divisions to ensure future FFATA reports will be submitted. Auditor?s Remarks We thank the Authority for its cooperation and assistance throughout the audit. We will review the status of the Authority?s corrective action during our next audit. Applicable Laws and Regulations Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) establishes the following applicable requirements: Section 200.303 Internal controls, states in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. Section 200.516 Audit findings, states in part: (a) Audit findings reported. The auditor must report the following as audit findings in a schedule of findings and questioned costs: (1) Significant deficiencies and material weaknesses in internal control over major programs and significant instances of abuse relating to major programs. The auditor?s determination of whether a deficiency in internal control is a significant deficiency or material weakness for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the Compliance Supplement. (2) Material noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards related to a major program. The auditor?s determination of whether a noncompliance with the provisions of Federal statutes, regulations, or the terms and conditions of Federal awards is material for the purpose of reporting an audit finding is in relation to a type of compliance requirement for a major program identified in the compliance supplement. The American Institute of Certified Public Accountants defines significant deficiencies and material weaknesses in its Codification of Statements on Auditing Standards, section 935, Compliance Audits, paragraph 11 as follows: For purposes of adapting GAAS to a compliance audit, the following terms have the meanings attributed as follows: Deficiency in internal control over compliance. A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing, or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or the person performing the control does not possess the necessary authority or competence to perform the control effectively. Material weakness in internal control over compliance. A deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. In this section, a reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows: Reasonably possible. The chance of the future event or events occurring is more than remote but less than likely. Probable. The future event or events are likely to occur. Significant deficiency in internal control over compliance. A deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. Material noncompliance. In the absence of a definition of material noncompliance in the governmental audit requirement, a failure to follow compliance requirements or a violation of prohibitions included in the applicable compliance requirements that results in noncompliance that is quantitatively or qualitatively material, either individually or when aggregated with other noncompliance, to the affected government program. Title 2 U.S. Code of Federal Regulations (CFR) Part 170, Reporting Subaward and Executive Compensation Information, states in part: Appendix A to Part 170 ? Award Term I. Reporting Subawards and Executive Compensation a. Reporting of first-tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency (see definitions in paragraph e. of this award term). 2. Where and when to report. i. The non-Federal entity or Federal agency must report each obligating action described in paragraph a.1. of this award term to http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the obligation was made. (For example, if the obligation was made on November 7, 2010, the obligation must be reported by no later than December 31, 2010.) 3. What to report. You must report the information about each obligating action that the submission instructions posted at http://www.fsrs.gov specify. Notice of Substance Abuse Prevention and Treatment Bock Grant Federal Grant Award, Grant Number 1B08TI083138-01, states in part: Standard Terms and Conditions SABG FY 2020 Award Terms and Reporting Requirements 1) FFATA Reporting Requirement Please note the standard terms for FFATA Reporting Requirement has changed. Standard Terms: 7) Federal Financial Accountability and Transparency Act (FFATA) Reporting Subawards and Executive Compensation, 2 CFR, Appendix A to Part 170 a. Reporting of first tier subawards. 1. Applicability. Unless you are exempt as provided in paragraph d. of this award term, you must report each action that obligates $25,000 or more in Federal funds that does not include Recovery funds (as defined in section 1512(a)(2) of the American Recovery and Reinvestment Act of 2009, Pub. L. 111-5) for a subaward to an entity.