State of OregonState Government

Ensure ONE system correctly determines eligibility when income is below 133% Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.640 Basic Health Program FAINs and Years: Unknown Compliance Requirement: Eligibility Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: $8,000,000 (known) Criteria: CFR 42 §600.305(a)(2) To be eligible for the Basic Health Program (BHP), individuals must have a household income which exceeds 133% but does not exceed 200% of the federal poverty level. Condition: The department implemented BHP in July 2024. BHP is also known as the Oregon Health Plan Bridge program. After implementation of BHP, the department generated a report to review the income data of the recipients. Their review of the report during the fall of 2024 showed individuals were receiving BHP benefits despite having an annual income below the BHP threshold of 133% of the federal poverty level. A service ticket to fix the ONE system to include the annual income lower limit threshold was submitted to the vendor in December 2024 and the error was corrected on June 11, 2025. As of March 2026, the department indicated it is working through a process to refund the payments related to ineligible individuals. Cause: The lower annual income threshold of 133% was not correctly coded in the ONE system eligibility determination rules for BHP and was not identified by the department prior to the implementation of BHP. Per department management, system control testing was performed; however, the lower limit threshold was inadvertently removed from the testing protocol. Effect: The department provided us with a report of 3,586 individuals and the related benefit months it identified as ineligible due to income being below the 133% federal poverty level threshold. Using that report along with a download of individual payment data we obtained for audit, we estimate approximately $8 million in questioned costs related to this issue as of June 30, 2025. Recommendation: We recommend department management ensure the BHP is refunded for the payments made on behalf of ineligible individuals and ensure benefits are ended for ineligible individuals. We also recommend the department continue to monitor the ONE system to ensure it is working as intended.

Correct ONE system error and manual errors resulting in incorrect eligibility determinations Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.640 Basic Health Program FAINs and Years: Unknown Compliance Requirement: Eligibility Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: $17,733 (known); $7,000,000 (likely) Criteria: CFR 42 §600.305(a)(2); CFR 42 §600.305(a)(3) To be eligible for the Basic Health Program (BHP), individuals must have a household income which exceeds 133% but does not exceed 200% of the federal poverty level. In addition, individuals with access to affordable employer sponsored insurance (ESI) are not eligible. Condition: We randomly selected a sample of 60 BHP individuals and reviewed department documentation to test compliance with various eligibility requirements. We identified the following exceptions: • In three cases, a request for information (RFI) was sent to the individuals to verify income. Upon receipt of documentation, the individuals were determined to be financially ineligible as their income was over the 200% threshold. According to the department, the ONE system should have closed the case and ended eligibility, but the cases were not closed. This system error resulted in known questioned costs for these three cases of $7,919. • One case where eligibility continued even after documentation received from a RFI indicated the individual was over the income threshold of 200%. It is unclear if the RFI was incorrectly cleared by the eligibility worker or if it was a system error. The known questioned costs are $3,500. • One case where a data entry error incorrectly included alimony income as part of the income determination. This error resulted in an incorrect eligibility determination and known questioned costs of $5,814. • In one case, an individual reported access to ESI. In April 2025, the individual provided premium information in response to an RFI. However, the ONE system data indicates ESI affordability was unable to be determined. It appears the eligibility worker did not enter the premium information for consideration. Based on our calculations, the ESI would be considered affordable so the individual would not have been eligible resulting in known questioned costs of $500. Cause: The ONE system did not end benefits when a response to a RFI indicated the individual was over income and ineligible. The department identified this system error in May 2025. As of August 2025, an interim business process relies on eligibility workers to manually close a case in these situations. The other errors are attributable to human error. Effect: A total of $17,733 in known program benefits were paid on behalf of the ineligible individuals identified in the condition above. For the system error discussed in the first bullet of the condition, as of March 2026, the department is working to generate a report to identify the individuals impacted by the error. Using our random sample, we identified an error rate of 3.8%. We projected the likely questioned costs associated with this system error to be $7 million. Recommendation: We recommend department management refund BHP for all errors identified. In addition, the department should identify all individuals impacted by the ONE system error and refund BHP. We also recommend the department continue to provide training to eligibility workers for errors identified. Finally, we recommend the department submit a change request to fix the ONE system.

Ensure program expenditures are sufficiently maintained and readily available Federal Awarding Agency: U.S. Department of Transportation ALN and Program Name: 20.205 Highway Planning and Construction FAINs and Years: Various Compliance Requirement(s): Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Matching; Procurement and Suspension and Debarment; Special Tests and Provisions Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR § 200.302 States must maintain records sufficient to track expenditures and ensure funds have been used in accordance with Federal statutes. Records should identify the amount and source of expenditures paid with federal funds. Condition: During our audit of the fiscal year 2025 Highway Planning and Construction program, we requested expenditure data to perform required testing over key compliance requirements. The department provided transactions related to projects with federal draws during the fiscal year. However, the data included all expenditures to-date for the projects and could not be limited to the fiscal year under review. The department and auditors were unable to materially reconcile this data to the reported Schedule of Expenditures of Federal Awards (SEFA) totals for this program. Cause: The department’s accounting system attaches federal identifiers to revenue transactions but not the related expenditure(s). The department can manually review expenditures related to a project identified within an individual revenue draw. However, the department’s accounting system cannot provide a report of related fiscal year federal program expenditures. Further, because the expenditures reflect approximately 1,700 different projects, many of which are long term contracts with expenditures in multiple fiscal periods, manually identifying this detail is not practical. Effect: We were unable to perform control or compliance testing over five key compliance requirements. As a result, we were unable to obtain sufficient, appropriate audit evidence of the program’s compliance to provide an opinion. Recommendation: We recommend department management implement controls to track and identify expenditures by federal award to ensure compliance with federal regulations and ensure fiscal year expenditures data is available for audit purposes.

Implement controls and strengthen review over costs charged to program Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases; 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (COVID-19) FAINs and Years: NU50CK000541, 2019-2025 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $12,636 (known); $401,006 (likely) Criteria: 2 CFR 200.303; 2 CFR 200.403 Federal regulations require recipients of federal awards establish and maintain effective internal control over the Federal award to ensure costs are necessary and reasonable for the performance of the Federal award. Condition: In a random sample of 25 non-payroll program expenditures, two transactions were incorrectly charged to the federal program. For one exception totaling $10,326, the invoice was reviewed and approved by the appropriate manager but should have been charged to a different program. The second exception was an invoice for telecom charges for 109 employees. It was determined the federal program was charged $2,310 for 52 employees who no longer worked on the program. Cause: Review and approval of an invoice did not identify the coding number was for the wrong federal program. The department does not have an existing internal control that alerts mobile service management system coordinators when employees change job duties. Effect: A total of $12,636 was incorrectly charged to the federal program. Recommendation: We recommend department management strengthen existing controls to ensure invoices are coded to the correct federal program. We further recommend department management implement controls to ensure invoice coding is updated as employee job duties change.

Implement controls to ensure subrecipients are evaluated for risk Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases FAINs and Years: NU50CK000541, 2019-2025; NU51CK000360, 2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(c) Federal regulations require recipients of federal awards evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring needed. Condition: Although the department performed fiscal monitoring, it did not perform risk assessments for many of its subrecipients. The department does have a risk assessment tool. The department’s 21 subrecipients expended $3.1 million in federal funds during the fiscal year, which included some refunds of subawards. We selected four subrecipients and for two, the department could not locate a risk assessment or could not locate a current risk assessment. One of the subrecipients received $3.5 million in federal funds during the year. We selected five additional subrecipients that were not on the department’s fiscal monitoring list and determined four of them also did not have a risk assessment performed. Cause: The department’s list for subrecipient monitoring is incomplete and does not track if risk assessments are completed. Effect: The department is unable to determine appropriate monitoring of subrecipients without having assessed risk. Recommendation: We recommend department management implement internal controls to ensure risk assessments are performed, documented, and retained for each subrecipient.

Implement controls to submit required and accurate FFATA reports Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.268 Immunization Cooperative Agreements; 93.268 Immunization Cooperative Agreements (COVID-19); 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases; 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (COVID-19) FAINs and Years: 93.268: NH23IP922626, 2019-2025; 93.323: NU50CK000541, 2019-2025; NU51CK000360, 2024 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2022-045 Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303(a) Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: We tested FFATA reports for both the Epidemiology and Immunization federal programs. The department’s Office of Contracts and Procurement unit maintains a tracking spreadsheet of subrecipient contract amendments by execution date and amount for all Public Health division federal awards. For Epidemiology we selected four subrecipients to review for the department’s FFATA reporting. For Immunization we selected five subrecipients of which three were the same as Epidemiology. We found the department completed no FFATA reporting for the six subrecipients. We looked at the contract associated with each subrecipient which covered state fiscal years 2024 and 2025. Most contracts also had several amendments affecting subawards for each federal program. Of four Epidemiology contracts we reviewed, four subawards were not reported. Of five Immunization contracts we reviewed, 23 subawards were not reported. We also noted for Epidemiology, the federal award identification number (FAIN) in the contract was sometimes incorrect. The department’s tracking sheet is incomplete and inaccurate in some instances. For example, the tracking sheet indicated FFATA reporting was completed for 15 Epidemiology and Immunization subawards in September 2025. However, based on information on the tracking sheet, we inquired and identified five Epidemiology subawards and one Immunization subaward were incorrectly identified as related to those federal programs. In addition, subrecipient contracts are listed on the department’s tracking sheet but are not identified as related to Epidemiology or Immunization programs or do not contain the relevant details for additional subaward for amendments. Cause: The department’s tracking sheet does not contain all subawards, including amendments, broken down by FAIN and associated dollar amount. Effect: When subaward information is not reported, federal agencies and the public do not have complete and accurate information on how federal funds are being used. Recommendation: We recommend department management implement controls to ensure all subawards related to a contract are appropriately identified, tracked and reported.

Strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.958 Block Grants for Community Mental Health Services; 93.958 Block Grants for Community Mental Health Services (COVID-19); 93.959 Block Grants for Substance Use Prevention, Treatment, and Recovery Services; 93.959 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (COVID-19) FAINs and Years: 93.958: B09SM087383, 2023; B09SM089648, 2024; B09SM085378, 2021 (COVID-19); B09SM085906, 2021 (COVID-19); B09SM089372, 2023; B09SM087314, 2023. 93.959: B08TI085829, 2023; B08TI087061, 2024; B08TI083513, 2021 (COVID-19); B08TI083963, 2021 (COVID-19); B08TI084603, 2021 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2024-009; 2023-020; 2022-043 Questioned Costs: N/A Criteria: 45 CFR 75.351; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require pass-through entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The determination impacts which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. Condition: We reviewed the Oregon Health Authority’s (department) classification of a selection of recipient contracts with pass-through expenditures recorded during state fiscal year 2025. Based on the following inconsistencies, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One judgmentally selected recipient of Block Grants for Community Mental Health Services (MHBG) funds and one of eight randomly selected from 25 recipients of Block Grants for Prevention and Treatment of Substance Abuse (SUPTRS) funds were classified as subrecipients by the department, but it was unclear if they met the definition of a subrecipient. • One of eight randomly selected from 25 recipients of MHBG funds was classified as a contractor; however, payments made to this recipient were recorded as pass-through expenditures. The contract terms and conditions support the contractor classification and no subrecipient monitoring activities were performed as a result. • Three judgmentally selected recipients of SUPTRS funds did not appear to have a contractor/subrecipient determination performed by the department or have a signed contract related to pass-through expenditures. Based on the nature of the services provided it was unclear if they met the definition of a subrecipient. In addition, we noted five recipient contracts of MHBG funds and one recipient contract of SUPTRS funds that were identified as potentially misclassified as subrecipients during prior audits had passthrough expenditures reported in state fiscal year 2025. Finally, post-award monitoring was not fully completed during the contract period for two of eight randomly selected from 25 recipients of MHBG funds and two of eight randomly selected from 25 recipients of SUPTRS funds. Cause: In response to prior year findings, management designed controls to help ensure the classifications of recipients were appropriately determined, expenditures on the SEFA were consistently recorded, and post-award monitoring was performed. However, these new controls were not fully implemented during state fiscal year 2025. Effect: The above issues do not result in questioned costs. However, a total of $2,157,934 in MHBG funds and $279,367 in SUPTRS funds may be inappropriately reported as pass-through expenditures instead of direct expenditures on the SEFA. Recommendation: We recommend department management continue to strengthen controls to ensure recipients of federal funds are appropriately classified as subrecipients or contractors and the corresponding expenditures are appropriately reported as direct or pass-through on the SEFA. We further recommend department management ensure monitoring activities are completed and documented according to the monitoring plans.

Improve controls to submit required and accurate Federal Funding Accountability and Transparency Act reports Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.958 Block Grants for Community Mental Health Services; 93.958 Block Grants for Community Mental Health Services (COVID-19); 93.959 Block Grants for Substance Use Prevention, Treatment, and Recovery Services; 93.959 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (COVID-19) FAINs and Years: 93.958: B09SM087383, 2023; B09SM089648, 2024; B09SM085378, 2021 (COVID-19); B09SM085906, 2021 (COVID-19); B09SM089372, 2023; B09SM087314, 2023. 93.959: B08TI085829, 2023; B08TI087061, 2024; B08TI083513, 2021 (COVID-19); B08TI083963, 2021 (COVID-19); B08TI084603, 2021 (COVID-19) Compliance Requirements: Reporting Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2024-010; 2022-045 Questioned Costs: N/A Criteria: Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: We reviewed the reporting status of a selection of subrecipients with subaward expenditures recorded during state fiscal year 2025. Based on our review of the department’s FFATA reporting tracking spreadsheet, we determined the following: • One judgmentally selected and six of eight randomly selected from 25 Block Grants for Community Mental Health Services (MHBG) subrecipient subawards reviewed met reporting thresholds but were not reported, totaling $4 million in expenditures of subaward obligations. • Eight of eight randomly selected from 25 Block Grants for Prevention and Treatment of Substance Abuse (SUPTRS) subrecipient subawards reviewed met reporting thresholds but were not reported, totaling $1.1 million in expenditures of subaward obligations. • Additionally, two of the eight randomly selected MHBG subawards and three of the eight randomly selected SUPTRS subawards were not included in the tracking spreadsheet, one of which included both MHBG and SUPTRS subaward expenditures. Cause: The department’s tracking sheet does not contain all subawards, including amendments, broken down by FAIN and associated dollar amount. Per management, the FFATA Reporting Coordinator position vacancy was filled in April 2025 and work was started to address the backlog of unsubmitted reports for fiscal years 2021-2025 including troubleshooting missing information needed for reporting. Effect: The department is not reporting all FFATA reports per federal guidelines. Recommendation: We recommend department management improve controls to ensure all subawards related to a contract are appropriately identified, tracked and reported.

Continue to strengthen internal controls over the ONE system Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.777 and 93.778 Medicaid Cluster FAINs and Years: 2405OR5MAP, 2024; 2405OR5ADM, 2024; 2505OR5MAP, 2025; 2505OR5ADM, 2025 Compliance Requirement(s): Activities Allowed or Unallowed; Eligibility; Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2024-017 Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 42 CFR 95.621; Oregon Accounting Manual 10.60.00.PR Condition: As in the prior year’s audit, we noted the agency had not obtained a System and Organization Controls (SOC) 2 Type II report over the Oregon Eligibility System (ONE system). The ONE system determines and verifies the eligibility of Medicaid clients in Oregon, which leads to over $13.2 billion in Medicaid federal expenditures each year. The ONE system is owned by the department but administered by an external service provider. Cause: Because the ONE system is administered by an external vendor, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a SOC 2 Type II report. A Type II report provides assurance about whether the controls are functioning and effective. The department is in the process of securing a contract for the performance of a SOC 2 Type II review over the external vendor administering the ONE system. Effect: The department does not have assurance over the operating effectiveness of controls at the external service provider, which may affect the eligibility and allowability of Medicaid expenditures. Recommendation: We recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure internal controls over the ONE system at the external service provider are sufficient to meet the business needs of the Medicaid program.

Continue to strengthen Medicaid fraud hotline reporting mechanisms Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.777 and 93.778 Medicaid Cluster FAINs and Years: 2405OR5MAP, 2024; 2405OR5ADM, 2024; 2505OR5MAP, 2025; 2505OR5ADM, 2025 Compliance Requirement(s): Special Tests and Provisions – Medicaid Fraud Control Unit Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2024-018 Questioned Costs: N/A Criteria: 42 CFR 455.13(a); 42 CFR 455.14; 2 CFR 200.514 (c)(4); 2 CFR 200.303(a) Condition: The state is required to have a method and criteria for identifying suspected fraud. For all suspected fraud reported, the state must complete a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. The state is also required to maintain internal controls effective in preventing and/or detecting noncompliance. To ensure adequate compliance with these requirements, the state uses a publicly available hotline portal to collect suspected fraud details. The Oregon Department of Human Services (department) manages the state’s online hotline portal and phone line. The department works collaboratively with the Oregon Heath Authority (authority) and Department of Justice (DOJ) to complete fraud investigations and referrals within their individual jurisdictions as required by standards. Referrals from the online hotline portal are extracted and then reviewed and tracked by the individual agency with appropriate jurisdiction. During inquiries and testing of the online hotline portal and phone line as part of the prior year audit, we noted the following: • The online hotline portal instructions and term definitions were vague, and not all fields were available. • The online hotline portal does not contain any case tracking details. Per department management, work is underway to improve the website and set up a case tracking system. Cause: Management has not established procedures to ensure current systems operate in a manner that allows the agencies to meet compliance standards. Effect: Vague online hotline portal instructions and definitions and unavailable fields could lead to a higher number of cases being closed for insufficient information. Additionally, without tracking details the online hotline portal does not support any reporting to assist the department in ensuring all cases have had preliminary investigations. As such, we were unable to perform testing procedures over preliminary investigations. Recommendation: We recommend department management continue to work to ensure public access to provide fraud referrals is not limited, and that a referral tracking mechanism is created to ensure all referrals are given preliminary investigations.

Continue to ensure compliance with federal Medicaid hospital audit requirements Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.777 and 93.778 Medicaid Cluster FAINs and Years: 2405OR5MAP, 2024; 2405OR5ADM, 2024; 2505OR5MAP, 2025; 2505OR5ADM, 2025 Compliance Requirement(s): Special Tests and Provisions – Inpatient Hospital and Long-term Care Facility Audits Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2023-022 Questioned Costs: N/A Criteria: 42 CFR 447.253(g); 2 CFR 200.303(a) Condition: Federal regulations require management to establish and maintain effective internal controls to ensure compliance with federal program requirements. As part of its system of internal control, federal regulations require the Oregon Health Authority (authority) to conduct periodic audits of the financial and statistical records of participating hospitals. Inpatient hospitals are required to report actual costs to the authority who conducts audits of the reported costs. During state fiscal year 2023, the authority did not conduct any cost settlement audits of the 61 hospitals that received Medicaid federal funds in the fiscal year. The auditors reported a finding (2023-022) during the audit of state fiscal year 2023 which remains uncorrected. As of March 12, 2026, the authority is working on completing 2018 cost settlements. To be timely, the authority should be working on 2022/2023 cost settlements at this time. There are currently 28 cost settlements completed that cannot be finalized while the authority waits for an updated cost settlement form from the authority’s shared services Office of Financial Services. Cause: The department experienced a restructuring and unexpected turnover from 2023 through 2025, including the loss of the program manager. New staff were hired to fill some of the vacancies, but staffing has remained problematic. Per management, training for updated requirements and updating agency tools has also caused delays in the completion of audits. Effect: By failing to complete required audits, the authority does not have assurance that participating hospitals use program funds properly, which could lead to inappropriate payments to the hospitals. Recommendation: We recommend management ensure compliance with federal program requirements by continuing to prioritize the completion and documentation of hospital audits.

Strengthen and document controls over employee timesheet review Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.777, 93.778 Medicaid Cluster; 93.268 Immunization Cooperative Agreements; 93.268 Immunization Cooperative Agreements (COVID-19); 93.659 Adoption Assistance; 96.001 Disability Insurance/SSI Cluster; 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases; 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (COVID-19); 93.958 Block Grants for Community Mental Health Services; 93.959 Block Grants for Substance Use Prevention, Treatment and Recovery Services; 66.468 Drinking Water State Revolving Fund FAINs and Years: Multiple Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303; 2 CFR 200.400; 2 CFR 200.430 (g) Federal regulations require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Personnel expenses must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable and properly allocated. Condition: The Oregon Department of Human Services (ODHS) administers separate federally approved cost allocation plans for itself and the Oregon Health Authority (OHA). The plans outline the methods used to allocate the various cost pools to federal programs. The cost allocation plans include compensation for ODHS and OHA (departments) employees whose roles provide shared benefit to multiple grants and programs. Timesheets related to these payroll expenditures require supervisor review and approval in accordance with payroll deadlines to ensure coding is appropriate for the employee’s role, cost sharing and program billing. We reviewed the payroll expenditures processed through Workday payroll and allocated to grants through the cost allocation system based on employee cost coding during state fiscal year 2025 and found seven of sixty randomly selected timesheets where no evidence of managerial review or approval was present. Cause: Management does not have a complete process in place to ensure timely review of timesheets and related cost coding. Effect: Timesheets that are not appropriately reviewed and approved may result in employee time being incorrectly charged to federal programs and shared cost pools. Recommendation: We recommend each departments’ management strengthen and document controls to ensure all employee timesheets are reviewed for cost coding and accuracy and are approved timely.

Strengthen existing processes and controls over employee timesheet review Federal Awarding Agency: U.S. Environmental Protection Agency ALN and Program Name: 66.468 Drinking Water State Revolving Fund FAINs and Years: FS-98009022, 2022; 4E-02J50601, 2022; FS-02J58701, 2023; 4D-02J97801, 2024 Compliance Requirement(s): Activities Allowed/Unallowed Allowable Costs/Cost Principles Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR Part 200.430 Federal regulations allow costs related to compensation for personal services (i.e., salaries and wages) associated with the federal program. To help ensure these costs are accurately applied to the program, the state accounting policy requires managers to review and approve employee timesheets timely (Oregon Accounting Manual (OAM) 45.07.00.103). If the direct supervisor is absent or unavailable, an alternate or delegate manager should be authorized to approve the employee's timesheet (OAM 45.07.00.106). Condition: During testing of payroll charged to the Drinking Water State Revolving Fund (DWSRF), we reviewed the timesheets of 16 employees who recorded hours worked on the program for the months of August 2024 and February 2025. We reviewed the timesheets to ensure they were appropriately reviewed and approved by management. We found management had not approved one timesheet from August 2024 and six from February 2025. Based on these results, we expanded our testing and reviewed all timesheets submitted by the 16 employees during state fiscal year 2025. We identified an additional two timesheets from September 2024, and one timesheet each from October 2024, December 2024, May 2025, and June 2025 that had not been reviewed or approved by management. Timesheets that are not approved by the payroll cutoff date in the State’s payroll system are "mass approved." The mass approval enables payroll to process but does not provide assurance the timesheets are accurate or that costs charged to the DWSRF program are appropriate. As a compensating control, fiscal staff review program payroll costs with management during the monthly management meeting. This additional review is designed to help ensure payroll costs are not incorrectly charged to the DWSRF program. However, the review is not documented unless errors are noted and corrections are required. As a result, we could not test this control for effectiveness. Despite multiple timesheets not being reviewed, testing found no uncorrected payroll costs that were inappropriately charged to the DWSRF program. Cause: Management does not have a complete process in place to address timesheets, and related payroll costs, that are not reviewed and approved prior to the payroll cutoff date. Effect: If timesheets are not reviewed, there is a risk employees incorrectly charged time to the federal program and incorrect payroll in certain situations (e.g. overtime). Recommendation: We recommend management strengthen existing processes and controls to ensure all employee timesheets are reviewed and approved timely. We also recommend management document its monthly review of payroll costs charged to the DWSRF program.

Strengthen existing controls to ensure compliance with suspension and debarment requirements Federal Awarding Agency: U.S. Environmental Protection Agency ALN and Program Name: 66.468 Drinking Water State Revolving Fund FAINs and Years: FS-98009021, 2021; FS-98009022, 2022; 4E-02J50601, 2022; 4D-02J27501, 2022; FS-02J58701, 2023; 4D-02J58601, 2023; 4E-02J64001, 2023; 4L-02J84701, 2023; 4D-02J97801, 2024 Compliance Requirement(s): Procurement, Suspension and Debarment Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR part 180.300 Federal regulations require a grant award recipient, entering into a covered transaction with another entity, to verify the entity is not suspended or debarred. Condition: As the state’s primary grant award recipient of the Drinking Water State Revolving Fund (DWSRF) federal program, the department is responsible for ensuring compliance with federal suspension and debarment program requirements. In that role, the department receives applications for DWSRF projects from other governmental entities (i.e., cities, counties, local water districts, etc.), reviews the project proposals, and verifies the entity submitting the proposal is neither suspended nor debarred. During testing, we found the department had not verified suspension and debarment on five of 12 entities selected for testing. Upon review, we discovered the five entities had received grant agreements funded with DWSRF set aside monies. We learned the department’s current process does not include verification of suspension and debarment for entities with projects funded with set aside monies. A total of 27 (23%) projects within the population were funded with set aside monies. Despite the lack of verification, testing found no instances of noncompliance with federal suspension and debarment DWSRF program requirements. Cause: Management was not aware that suspension and debarment requirements applied to grant agreements funded by DWSRF set aside monies. Effect: Without proper suspension and debarment verification procedures, the department may unknowingly award program monies to entities that are excluded from participation in federal programs. Recommendation: We recommend department management strengthen existing controls to ensure recipients of grant agreements funded by set aside monies are not suspended or debarred.

Implement control to ensure complete FFATA reporting Federal Awarding Agency: U.S. Department of Commerce ALN and Program Name: 11.438 Pacific Coast Salmon Recovery – Pacific Salmon Treaty FAINs and Years: NA20NMF4380248, 2020; NA21NMF4380455, 2021; NA22NMF4380209, 2022; NA23NMF4380389, 2023; NA24NMFX438G0048, 2024 Compliance Requirement: Reporting Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR §170 Appendix A; 2 CFR §200.303 Pacific Coast Salmon Recovery Funds are subject to the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require direct recipients of Federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and compliance requirements. Condition: The Oregon Watershed Enhancement Board (department) receives federal funding from two sources, National Oceanic and Atmospheric Administration (NOAA) and Infrastructure Investment and Jobs Act (IIJA), which must be reported in SAM.gov. The department maintains subaward information and generates FFATA reports in its grant management system. Our audit procedures included testing 9 subawards totaling $18,825,012 in obligations. During our testing we noted 2 IIJA-funded subawards were not reported totaling $3,577,666, and reports for 8 of 9 subawards were not submitted timely. Cause: According to department management, the query used to identify new subawards for FFATA reporting did not include all funding sources, leaving the IIJA funding excluded from the reporting. Additionally, department management cited a staffing shortage as the reason why the FFATA reports were untimely. Effect: When subaward information is not reported or is not reported timely, federal agencies and the public do not have complete and accurate information on how federal funds are being used. Recommendation: We recommend department management implement procedures and controls to ensure complete and accurate capture of subawards for FFATA reporting. We also recommend the department dedicate the necessary staffing resources to ensure timely submission of monthly FFATA reports.

Implement controls and follow up on incomplete inventory counts Federal Awarding Agency: U.S. Department of the Interior ALN and Program Name: 15.611 Wildlife Restoration and Basic Hunter Education FAINs and Years: F24AF02402, 2024 Compliance Requirement: Equipment and Real Property Management Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: Per 2 CFR 200.313(d)(2), a physical inventory of the property must be conducted and the results must be reconciled with the property records at least once every two years. In addition, ODFW Policy ASD_210_PO Asset Management Policy states a physical count of all fixed assets and high-risk inventory shall be carried out once per year at the request of the Fixed Asset Accountant. Condition: We tested the fall 2024 inventory at nine field offices. One field office did not account for three assets that were acquired prior to the inventory. Additionally, this same field office did not complete any inventory in the fall 2025 and no agency follow up has been performed. Cause: The agency does not have a written policy requiring follow-up of non-compliant inventory for field offices. Effect: If a physical inventory is not taken in a timely manner the agency could face significant financial and operational risks, including inaccurate financial reporting and misappropriation of assets. Additionally, failure to comply with federal regulations may result in a loss of Fish and Wildlife Cluster funding. Recommendation: We recommend department management implement a written policy for inventory follow-up and ensure incomplete or missing inventory counts are conducted.

Improve controls over payroll Federal Awarding Agency: U.S. Department of Health and Human Services ALN and Program Name: 93.575, 93.596 Child Care and Development Fund Cluster FAINs and Years: 2402ORCCDD, 2024; 2502ORCCDD, 2025 Compliance Requirement(s): Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2020-029, 2023-037 Questioned Costs: $155,524(known) Criteria: 45 CFR 98.54; 2 CFR 200.430; 2 CFR 200.413 Federal regulations state that personal services costs are based on records that accurately reflect the work performed. The records must be accurate for costs to be allowable and properly allocated. Payroll costs directly related to a federal award are allowable costs, provided they are reasonable for the services rendered and are supported. Condition: The department has implemented a procedure to ensure allowable payroll costs are charged to the program. Managers approve monthly timesheets submitted by the employees in the state’s payroll system. If time is not reviewed by the manager by a specific date, the payroll system will approve the timesheet with the words “mass approval.” Exempt employees are required to enter only leave time and other exceptions for the month, while non-exempt employees enter daily time. We reviewed 25 employees to ensure costs were appropriately charged to the CCDF program. We found that an IT help desk employee was charging 100% of their time to the program. As this position is not directly working on the CCDF program, costs should not be directly charged to the program. Additionally, we reviewed 25 employee timesheets and found that three had “mass approval” by the system for the month. These employees were all exempt employees. Cause: Department management did not review all timesheets monthly. Additionally, per the agency, the help desk employee’s time was set in the system to charge to the CCDF program as they are part of the CCDF 5% administrative cap. Effect: If timesheets are not reviewed, there is a risk that unallowable program costs will be charged to the program. Questioned costs for the helpdesk employee total $155,524 encompassing all salary and benefits for state fiscal year 2025. Recommendation: We recommend department management improve its review of timesheets. We also recommend department management ensure employees appropriately charge to the program. Finally, we recommend department management reimburse the federal agency for any unallowable costs.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-010 Oregon Health Authority Submit required Federal Funding Accountability and Transparency Act reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR 93.958 Block Grants for Community Mental Health Services 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.788: H79TI085732, 2023; H79TI085732, 2024 93.958: B09SM086032, 2022; B09SM087383, 2023 93.959: B08TI084667, 2022; B08TI085829, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-045 Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. We identified and reviewed the reporting status of all the department’s new subawards subject to FFATA reporting during the audit period. We determined: • 12 of 12 Opioid STR subawards were not reported, totaling $750,000 in obligations. • 7 of 7 Block Grants for Mental Health Services subawards were not reported, totaling $4.4 million in obligations. • 13 of 13 Block Grants for Substance Use Prevention, Treatment, and Recovery Services subawards were not reported, totaling $2.8 million in obligations. The department utilizes a spreadsheet to track and maintain subaward information needed to comply with FFATA reporting requirements. However, we found the tracking spreadsheet had not been updated to include information for the majority of new contracts initiated during state fiscal year 2024. Per management, FFATA reporting was not completed due to the FFATA Reporting Coordinator position being vacant since July 2024. We recommend department management resume FFATA reporting as soon as feasible and ensure all necessary subawards are reported. We further recommend department management strengthen existing controls to ensure all subawards are appropriately tracked and reported.

2024-010 Oregon Health Authority Submit required Federal Funding Accountability and Transparency Act reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR 93.958 Block Grants for Community Mental Health Services 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.788: H79TI085732, 2023; H79TI085732, 2024 93.958: B09SM086032, 2022; B09SM087383, 2023 93.959: B08TI084667, 2022; B08TI085829, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-045 Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. We identified and reviewed the reporting status of all the department’s new subawards subject to FFATA reporting during the audit period. We determined: • 12 of 12 Opioid STR subawards were not reported, totaling $750,000 in obligations. • 7 of 7 Block Grants for Mental Health Services subawards were not reported, totaling $4.4 million in obligations. • 13 of 13 Block Grants for Substance Use Prevention, Treatment, and Recovery Services subawards were not reported, totaling $2.8 million in obligations. The department utilizes a spreadsheet to track and maintain subaward information needed to comply with FFATA reporting requirements. However, we found the tracking spreadsheet had not been updated to include information for the majority of new contracts initiated during state fiscal year 2024. Per management, FFATA reporting was not completed due to the FFATA Reporting Coordinator position being vacant since July 2024. We recommend department management resume FFATA reporting as soon as feasible and ensure all necessary subawards are reported. We further recommend department management strengthen existing controls to ensure all subawards are appropriately tracked and reported.

2024-011 Oregon Health Authority Strengthen existing controls to ensure only those costs incurred during the period of performance are charged to the grant Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: B08TI084667, 2022 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $82,315 Criteria: 2 CFR 200.303; 42 USC 300x-62 Federal regulations provide for amounts awarded to the department be available for obligation and expenditure until the end of the fiscal year following the fiscal year for which the amounts were awarded. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. During state fiscal year 2024, one grant award under the Block Grants for Substance Use Prevention, Treatment, and Recovery Services closed. The period of performance for this grant was October 1, 2021 through September 30, 2023. During the closeout process, the grant accountant reviews program expenditures recorded in the state accounting system and shifts expenditures incurred after the period of performance to a subsequent grant. During testing, we reviewed all grant expenditures recorded in the state accounting system after the period of performance. We found indirect expenditures for October and November 2023, totaling $82,315, had been charged to the closed grant. Upon inquiry, we learned the query used to identify transactions incurred after the period of performance was inadvertently filtered to identify only direct expenditures. As a result, some indirect expenditures were not identified in the query and were not appropriately moved to the subsequent grant. We recommend department management strengthen existing controls to ensure only those expenditures incurred during the period of performance are charged to the grant.

2024-011 Oregon Health Authority Strengthen existing controls to ensure only those costs incurred during the period of performance are charged to the grant Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: B08TI084667, 2022 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $82,315 Criteria: 2 CFR 200.303; 42 USC 300x-62 Federal regulations provide for amounts awarded to the department be available for obligation and expenditure until the end of the fiscal year following the fiscal year for which the amounts were awarded. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. During state fiscal year 2024, one grant award under the Block Grants for Substance Use Prevention, Treatment, and Recovery Services closed. The period of performance for this grant was October 1, 2021 through September 30, 2023. During the closeout process, the grant accountant reviews program expenditures recorded in the state accounting system and shifts expenditures incurred after the period of performance to a subsequent grant. During testing, we reviewed all grant expenditures recorded in the state accounting system after the period of performance. We found indirect expenditures for October and November 2023, totaling $82,315, had been charged to the closed grant. Upon inquiry, we learned the query used to identify transactions incurred after the period of performance was inadvertently filtered to identify only direct expenditures. As a result, some indirect expenditures were not identified in the query and were not appropriately moved to the subsequent grant. We recommend department management strengthen existing controls to ensure only those expenditures incurred during the period of performance are charged to the grant.

2024-012 Oregon Health Authority Ensure MMIS rates are accurate and updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $9 (known) Criteria: 42 CFR 433.32; 42 CRF 477.45(f)(1)(iv) The Oregon Health Authority (authority) administers client-based payments for the Medicaid program. For some clients, Medicaid allows the authority to make payments for outpatient services based on approved rates published by the Centers for Medicare and Medicaid Services (CMS). These rates must be updated within the Medicaid Management Information System (MMIS) each time they are updated by CMS. The authority uses MMIS as the state’s payment system to calculate payments due to providers based on CMS-approved rates stored in the system. We randomly selected 62 clients, and one service payment associated with each client from a statistically valid sample. Our testing identified one service payment where the Outpatient Prospective Payment System (OPPS) rate had not been updated within MMIS to the approved CMS rate for services during calendar year 2023. As a result, the service payment selected in our sample was overpaid by $9. This exception also applies to all claims of a similar nature and time period where the CMS rates were not correctly updated in MMIS. Per the authority’s actuarial unit, this error resulted due to confusion surrounding the announcement of final rule making and updated final OPPS rates. Recent CMS OPPS publications have made it easier to locate the correct final rates. We recommend authority management obtain a listing of all impacted claims, adjust all claims accordingly, and return related federal funds. We also recommend that management ensure rate tables are updated timely and accurately when notified by CMS.

2024-012 Oregon Health Authority Ensure MMIS rates are accurate and updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $9 (known) Criteria: 42 CFR 433.32; 42 CRF 477.45(f)(1)(iv) The Oregon Health Authority (authority) administers client-based payments for the Medicaid program. For some clients, Medicaid allows the authority to make payments for outpatient services based on approved rates published by the Centers for Medicare and Medicaid Services (CMS). These rates must be updated within the Medicaid Management Information System (MMIS) each time they are updated by CMS. The authority uses MMIS as the state’s payment system to calculate payments due to providers based on CMS-approved rates stored in the system. We randomly selected 62 clients, and one service payment associated with each client from a statistically valid sample. Our testing identified one service payment where the Outpatient Prospective Payment System (OPPS) rate had not been updated within MMIS to the approved CMS rate for services during calendar year 2023. As a result, the service payment selected in our sample was overpaid by $9. This exception also applies to all claims of a similar nature and time period where the CMS rates were not correctly updated in MMIS. Per the authority’s actuarial unit, this error resulted due to confusion surrounding the announcement of final rule making and updated final OPPS rates. Recent CMS OPPS publications have made it easier to locate the correct final rates. We recommend authority management obtain a listing of all impacted claims, adjust all claims accordingly, and return related federal funds. We also recommend that management ensure rate tables are updated timely and accurately when notified by CMS.

2024-013 Oregon Health Authority Improve documentation and controls over client eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-054 Questioned Costs: N/A Criteria: 42 CFR 435.907(f) Federal regulations require that certain conditions are met, including obtaining signed applications, for the Department of Human Services (department) and Oregon Health Authority (authority) to receive Medicaid funding for medical claims. We randomly selected 62 clients and one authority service payment associated with each client from a statistically valid sample. We reviewed agency documentation to test compliance related to eligibility. During our testing, we noted one client did not have a signed application on file. However, because the client is an SSI recipient, we were able to determine the client was eligible and are not questioning any costs. This oversight occurred due to administrative error. We recommend authority management obtain a signed application for this client and strengthen controls to ensure the required documentation is obtained and maintained.

2024-013 Oregon Health Authority Improve documentation and controls over client eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-054 Questioned Costs: N/A Criteria: 42 CFR 435.907(f) Federal regulations require that certain conditions are met, including obtaining signed applications, for the Department of Human Services (department) and Oregon Health Authority (authority) to receive Medicaid funding for medical claims. We randomly selected 62 clients and one authority service payment associated with each client from a statistically valid sample. We reviewed agency documentation to test compliance related to eligibility. During our testing, we noted one client did not have a signed application on file. However, because the client is an SSI recipient, we were able to determine the client was eligible and are not questioning any costs. This oversight occurred due to administrative error. We recommend authority management obtain a signed application for this client and strengthen controls to ensure the required documentation is obtained and maintained.

2024-014 Oregon Department of Human Services/Oregon Health Authority Implement control procedures around cost allocation system inputs Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $32,522 (known) Criteria: 2 CFR 200.400(e) The Department of Human Services (department) administers separate federally approved cost allocation plans for both the department and the Oregon Health Authority. The plans outline the methods used to allocate the various cost pools to federal programs. The department uses a series of processes for allocating shared services and pooled expenditures. We recalculated one month, January 2024, of shared services and pooled expenditures using tables from the cost allocation system, and identified differences between the recalculation and the amounts recorded in the state accounting system for various grants. After inquiry, the department identified an error related to coding of payroll costs starting in November 2023, which continued through January 2024. Payroll coding corrections were made in January 2024, but did not correct the cost allocation as those types of documents are excluded from the process. The errors identified in the testing month resulted in questioned costs of $32,522 for the Medicaid grant and immaterial allocations in approximately thirty other grants. We recommend department management implement control procedures to verify the cost allocation system inputs are appropriately identified and processed.

2024-014 Oregon Department of Human Services/Oregon Health Authority Implement control procedures around cost allocation system inputs Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $32,522 (known) Criteria: 2 CFR 200.400(e) The Department of Human Services (department) administers separate federally approved cost allocation plans for both the department and the Oregon Health Authority. The plans outline the methods used to allocate the various cost pools to federal programs. The department uses a series of processes for allocating shared services and pooled expenditures. We recalculated one month, January 2024, of shared services and pooled expenditures using tables from the cost allocation system, and identified differences between the recalculation and the amounts recorded in the state accounting system for various grants. After inquiry, the department identified an error related to coding of payroll costs starting in November 2023, which continued through January 2024. Payroll coding corrections were made in January 2024, but did not correct the cost allocation as those types of documents are excluded from the process. The errors identified in the testing month resulted in questioned costs of $32,522 for the Medicaid grant and immaterial allocations in approximately thirty other grants. We recommend department management implement control procedures to verify the cost allocation system inputs are appropriately identified and processed.

2024-015 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $28,869 (known) Criteria: 2 CFR 200.1; 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services is provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors that were not identified during the department’s and authority’s review process, which resulted in improper payments of Medicaid expenditures: • One department payment included interest related to past due amounts charged to the Medicaid program, resulting in known federally funded questioned costs of $3. The agency performed a review of all payments to the vendor and identified an additional $65 other known questioned costs. • One authority payment included cash incentives for surveys taken. Management was unable to provide allowability support, resulting in known federally funded questioned costs of $28,801. The above errors occurred due to human error and were not identified during review, leading to unallowed activities/costs being charged to the Medicaid program. We recommend department and authority management strengthen controls over review and ensure transactions are adequately supported. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2024-015 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $28,869 (known) Criteria: 2 CFR 200.1; 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services is provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors that were not identified during the department’s and authority’s review process, which resulted in improper payments of Medicaid expenditures: • One department payment included interest related to past due amounts charged to the Medicaid program, resulting in known federally funded questioned costs of $3. The agency performed a review of all payments to the vendor and identified an additional $65 other known questioned costs. • One authority payment included cash incentives for surveys taken. Management was unable to provide allowability support, resulting in known federally funded questioned costs of $28,801. The above errors occurred due to human error and were not identified during review, leading to unallowed activities/costs being charged to the Medicaid program. We recommend department and authority management strengthen controls over review and ensure transactions are adequately supported. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2024-016 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-023 Questioned Costs: $13,740 (known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.414 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type, including but not limited to, database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organization (CCO) providers and selected a random sample of 60 non-CCO providers. The 15 CCO providers and 39 non-CCO providers were enrolled by the authority, and 21 non-CCO providers enrolled by the department. For one CCO provider we noted the following: • For one authority provider, the Ownership and Control disclosure was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority subsequently obtained the missing support. For five non-CCO providers we noted the following: • For one authority provider, the Managing Employee disclosure was missing. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. • For one department provider the I-9 provided was incomplete, and the agreement and disclosures were unsigned. However, the department subsequently obtained completed documentation, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form was not completed. We were unable to determine eligibility for this provider, resulting in federal questioned costs for the fiscal year totaling $13,740. • For one department provider, the I-9 form was incomplete. However, the department subsequently obtained a completed I-9 form, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form could not be located. However, this provider has been terminated, and we will not question costs related to this provider. The above issues occurred due to human error and inadequate record maintenance, which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers.

2024-016 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-023 Questioned Costs: $13,740 (known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.414 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type, including but not limited to, database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organization (CCO) providers and selected a random sample of 60 non-CCO providers. The 15 CCO providers and 39 non-CCO providers were enrolled by the authority, and 21 non-CCO providers enrolled by the department. For one CCO provider we noted the following: • For one authority provider, the Ownership and Control disclosure was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority subsequently obtained the missing support. For five non-CCO providers we noted the following: • For one authority provider, the Managing Employee disclosure was missing. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. • For one department provider the I-9 provided was incomplete, and the agreement and disclosures were unsigned. However, the department subsequently obtained completed documentation, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form was not completed. We were unable to determine eligibility for this provider, resulting in federal questioned costs for the fiscal year totaling $13,740. • For one department provider, the I-9 form was incomplete. However, the department subsequently obtained a completed I-9 form, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form could not be located. However, this provider has been terminated, and we will not question costs related to this provider. The above issues occurred due to human error and inadequate record maintenance, which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers.

2024-017 Oregon Department of Human Services/Oregon Health Authority Strengthen internal controls over the ONE system Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed; Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 42 CFR 95.621; Oregon Accounting Manual 10.60.00.PR We noted the agency had not obtained a System and Organization Controls (SOC) 2 Type II report over the Oregon Eligibility System (ONE system). The ONE system determines and verifies the eligibility of over 1.4 million Medicaid clients in Oregon, which leads to over $12.4 billion in Medicaid federal expenditures each year. The ONE system is owned by the department but administered by an external service provider. Because the ONE system is administered by an external vendor, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a SOC 2 Type II report. A Type II report provides assurance about whether the controls are functioning and effective. During the fiscal year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider, which may affect the eligibility and allowability of Medicaid expenditures. We recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure internal controls over the ONE system at the external service provider are sufficient to meet the business needs of the Medicaid program.

2024-017 Oregon Department of Human Services/Oregon Health Authority Strengthen internal controls over the ONE system Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed; Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 42 CFR 95.621; Oregon Accounting Manual 10.60.00.PR We noted the agency had not obtained a System and Organization Controls (SOC) 2 Type II report over the Oregon Eligibility System (ONE system). The ONE system determines and verifies the eligibility of over 1.4 million Medicaid clients in Oregon, which leads to over $12.4 billion in Medicaid federal expenditures each year. The ONE system is owned by the department but administered by an external service provider. Because the ONE system is administered by an external vendor, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a SOC 2 Type II report. A Type II report provides assurance about whether the controls are functioning and effective. During the fiscal year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider, which may affect the eligibility and allowability of Medicaid expenditures. We recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure internal controls over the ONE system at the external service provider are sufficient to meet the business needs of the Medicaid program.

2024-018 Oregon Department of Human Services Strengthen Medicaid fraud hotline reporting mechanisms Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 455.13(a); 42 CFR 455.14; 2 CFR 200.514 (c)(4) The state is required to have a method and criteria for identifying suspected fraud. For all suspected fraud reported the state must complete a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. The state is also required to maintain internal controls effective in preventing and/ or detecting noncompliance. To ensure adequate compliance with these requirements, the state uses a publicly available hotline portal to collect suspected fraud details. The Department of Human Services (department) manages the state’s online hotline portal and phone line. The department works collaboratively with the Oregon Heath Authority (authority) and Department of Justice (DOJ) to complete fraud investigations and referrals within their individual jurisdictions as required by standards. Referrals from the online hotline portal are extracted and then reviewed and tracked by the individual agency with appropriate jurisdiction. During inquiries and testing of the online hotline portal and phone line we noted the following: • The phone line recording provided inaccurate directions on how and where to report Medicaid fraud. The phone line instructions were not updated after changes to the department’s website, creating barriers to reporting. • The online hotline portal instructions and term definitions were vague, and not all fields were available. This could lead to a higher number of cases being closed for insufficient information. • The online hotline portal does not contain any case tracking details. As such the online hotline portal does not support any reporting to assist the department in ensuring all cases have had preliminary investigations. Without tracking details, we were unable to perform testing procedures over preliminary investigations. Per department management, the department has operated the hotline phone line and online portal for many years and strives for continuous improvement. However, management has not established procedures to ensure current systems operate in a manner that allows the agencies to meet compliance standards. We recommend department management ensure public access to provide fraud referrals is not limited and that a referral tracking mechanism is created to ensure all referrals are given preliminary investigations.

2024-018 Oregon Department of Human Services Strengthen Medicaid fraud hotline reporting mechanisms Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 455.13(a); 42 CFR 455.14; 2 CFR 200.514 (c)(4) The state is required to have a method and criteria for identifying suspected fraud. For all suspected fraud reported the state must complete a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. The state is also required to maintain internal controls effective in preventing and/ or detecting noncompliance. To ensure adequate compliance with these requirements, the state uses a publicly available hotline portal to collect suspected fraud details. The Department of Human Services (department) manages the state’s online hotline portal and phone line. The department works collaboratively with the Oregon Heath Authority (authority) and Department of Justice (DOJ) to complete fraud investigations and referrals within their individual jurisdictions as required by standards. Referrals from the online hotline portal are extracted and then reviewed and tracked by the individual agency with appropriate jurisdiction. During inquiries and testing of the online hotline portal and phone line we noted the following: • The phone line recording provided inaccurate directions on how and where to report Medicaid fraud. The phone line instructions were not updated after changes to the department’s website, creating barriers to reporting. • The online hotline portal instructions and term definitions were vague, and not all fields were available. This could lead to a higher number of cases being closed for insufficient information. • The online hotline portal does not contain any case tracking details. As such the online hotline portal does not support any reporting to assist the department in ensuring all cases have had preliminary investigations. Without tracking details, we were unable to perform testing procedures over preliminary investigations. Per department management, the department has operated the hotline phone line and online portal for many years and strives for continuous improvement. However, management has not established procedures to ensure current systems operate in a manner that allows the agencies to meet compliance standards. We recommend department management ensure public access to provide fraud referrals is not limited and that a referral tracking mechanism is created to ensure all referrals are given preliminary investigations.

2024-019 Oregon Department of Human Services Improve controls and compliance over long-term care facility audits Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 435.10; OAR 411-070-0315; OAR 411-070-0359(s); 2 CFR 200.303(a) The Oregon Medicaid state plan requires each long-term care facility to submit annual financial statements reporting actual costs to the Department of Human Services (department). Each statement is subject to a desk audit by the department. Procedures performed by the department include, but are not limited to, verifying administrator payroll costs do not exceed the maximum amount and legal costs are only related to Medicaid resident services. We selected a random sample of 11 out of 107 long-term care facilities. We identified 9 facilities where we were unable to determine if the administrator compensation for the year was greater than the maximum allowable compensation. Administrator paid time off hours were reported on a separate line with all other administrative staff paid time off, and were not factored into the calculation. The department’s current template does not require these costs to be separated for the administrator. We also identified 2 facilities where immaterial legal costs were unsupported and not adjusted. Current guidance for unallowable costs does not clearly describe how immaterial differences should be addressed. Excess costs that exceed the maximum compensation limit or are unallowable may result in the facility’s cost per resident per day being incorrectly calculated. We recommend department management strengthen controls to ensure the long-term care facility’s total administrator compensation is clearly identified and does not exceed the maximum allowed, and that unallowable costs are adjusted in line with applicable guidance.

2024-019 Oregon Department of Human Services Improve controls and compliance over long-term care facility audits Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 435.10; OAR 411-070-0315; OAR 411-070-0359(s); 2 CFR 200.303(a) The Oregon Medicaid state plan requires each long-term care facility to submit annual financial statements reporting actual costs to the Department of Human Services (department). Each statement is subject to a desk audit by the department. Procedures performed by the department include, but are not limited to, verifying administrator payroll costs do not exceed the maximum amount and legal costs are only related to Medicaid resident services. We selected a random sample of 11 out of 107 long-term care facilities. We identified 9 facilities where we were unable to determine if the administrator compensation for the year was greater than the maximum allowable compensation. Administrator paid time off hours were reported on a separate line with all other administrative staff paid time off, and were not factored into the calculation. The department’s current template does not require these costs to be separated for the administrator. We also identified 2 facilities where immaterial legal costs were unsupported and not adjusted. Current guidance for unallowable costs does not clearly describe how immaterial differences should be addressed. Excess costs that exceed the maximum compensation limit or are unallowable may result in the facility’s cost per resident per day being incorrectly calculated. We recommend department management strengthen controls to ensure the long-term care facility’s total administrator compensation is clearly identified and does not exceed the maximum allowed, and that unallowable costs are adjusted in line with applicable guidance.

2024-020 Oregon Department of Human Services Ensure nursing facility recertification surveys are completed Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 488.308(a) & (b)(1) Federal regulations require recertification surveys to be performed at each nursing facility no later than 15 months after the last day of the previous survey. Federal regulations also require the statewide average interval between surveys to be 12 months or less. We reviewed recertification surveys for 13 of 128 nursing facilities. We found surveys for two (15%) nursing facilities were completed after the established 15-month recertification window. Survey dates are tracked in the federal ASPEN system. Staff access the list of nursing facilities due for recertification using the department’s PowerBI tool. This tool pulls nursing facility information, such as survey dates, directly from ASPEN. Management reported 12 (26%) survey staff vacancies during the audit period which significantly contributed to the untimely surveys. Failure to perform timely recertification surveys may result in nursing facilities operating in violation of federal regulations, putting residents of the facilities at greater risk of inappropriate care or harm. Despite the noncompliance described above, our testing sample complied with the federal 12-month statewide average interval requirement. We recommend department management ensure recertification surveys are performed timely.

2024-020 Oregon Department of Human Services Ensure nursing facility recertification surveys are completed Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 488.308(a) & (b)(1) Federal regulations require recertification surveys to be performed at each nursing facility no later than 15 months after the last day of the previous survey. Federal regulations also require the statewide average interval between surveys to be 12 months or less. We reviewed recertification surveys for 13 of 128 nursing facilities. We found surveys for two (15%) nursing facilities were completed after the established 15-month recertification window. Survey dates are tracked in the federal ASPEN system. Staff access the list of nursing facilities due for recertification using the department’s PowerBI tool. This tool pulls nursing facility information, such as survey dates, directly from ASPEN. Management reported 12 (26%) survey staff vacancies during the audit period which significantly contributed to the untimely surveys. Failure to perform timely recertification surveys may result in nursing facilities operating in violation of federal regulations, putting residents of the facilities at greater risk of inappropriate care or harm. Despite the noncompliance described above, our testing sample complied with the federal 12-month statewide average interval requirement. We recommend department management ensure recertification surveys are performed timely.

2024-021 Oregon Department of Human Services Obtain accurate information from the ONE application Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-025; 2022-036 Questioned Costs: N/A Criteria: 45 CFR 265.3(a), (b), (d); 45 CFR 265.7(a)-(c) Federal regulations require the department to report certain financial and non-financial data elements for services paid with Temporary Assistance for Needy Families (TANF) federal funding in the quarterly ACF 199 TANF Data Report. Federal regulations also require the department to report certain financial and non financial data elements for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the quarterly ACF 209 SSP MOE Data Report. Both data reports should be supported by applicable performance records. During fiscal year 2021, the department transitioned key aspects of the TANF program to Oregon Eligibility (ONE) for case management, while TANF child welfare payments continued to be recorded in OR Kids, the child welfare system. The department contracts with an external service provider to extract data from ONE and OR Kids to populate the data reports. Program staff currently work with the external service provider to obtain comprehensive data reports prior to submission to review them for errors and when found, each issue is logged as a defect for the external service provider to correct. During fiscal year 2023, the department and the U.S. Administration for Children and Families (U.S. ACF) identified data reports submitted for fiscal year 2023 were incorrect and the department was unable to provide corrected data to auditors. Over the past year, the department has made progress in improving the accuracy and completeness of the data reported in the ACF 199 and ACF 209 reports. Reports were submitted by the department and accepted by U.S. ACF for the reporting periods during fiscal year 2024. We judgmentally tested the reports prepared and submitted for the quarter ended June 30, 2024. Based on our review of a random selection of 80 cases reported in the ACF 199 and ACF 209 reports, we noted the following errors: • For one case reported in the ACF 199, we noted a defect in the reporting logic for the line item containing the federal time-limit exemption status resulting in the reporting of an invalid code. • For two cases reported in the ACF 199 and four cases reported in the ACF 209, we noted discrepancies between the data reported for the Work Participation Status, related Work Participation Activities, and the case documentation. The data reported for each case indicated the client was required to participate but not participating in countable activities. However, case narratives supported the client was engaged in countable activities during the reporting period. For the two ACF 199 cases, we also noted a Personal Development Plan (PDP) where attendance hours should have been recorded was not appropriately established according to policy. As the reporting process relies on the attendance hours recorded in the PDP to populate the work participation line items, the absence of a PDP resulted in the report incompletely capturing the client’s JOBS activity. • For four cases reported in the ACF 209, we noted discrepancies between the case documentation and the hours reported as Unsubsidized Employment. In each case, the hours reported could not be substantiated by the available case documentation. Additionally, for one case, the Work Participation Status was incorrectly reported as not meeting minimum participation requirements when case documentation supported minimum participation had been met. Although improvements to the reporting have been made, the presence of errors in the current year indicates continued efforts are needed to ensure the reports accurately reflect the information within the case management system. We also noted documentation supporting the completion of the data review following the department’s procedures could be strengthened. Accurate reporting is necessary to ensure U.S. ACF can make appropriate determinations on the state’s compliance with required work participation rates. Additionally, as the ONE system is administered by an external service provider, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a System and Organization Controls (SOC) 2 Type II report which addresses the suitability of the design and operating effectiveness of controls. During the past year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider that may affect the department’s operations and reporting applicable to the TANF program. We recommend department management continue to review ACF 199 and ACF 209 reports prior to submission, monitor known compilation defects to ensure performance data reports submitted are complete and accurate, and ensure documentation is maintained supporting the completion of the data review procedures. We also recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure that the internal controls over the ONE system at the external service provider are sufficient to meet the business needs of ODHS and OHA.

2024-021 Oregon Department of Human Services Obtain accurate information from the ONE application Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-025; 2022-036 Questioned Costs: N/A Criteria: 45 CFR 265.3(a), (b), (d); 45 CFR 265.7(a)-(c) Federal regulations require the department to report certain financial and non-financial data elements for services paid with Temporary Assistance for Needy Families (TANF) federal funding in the quarterly ACF 199 TANF Data Report. Federal regulations also require the department to report certain financial and non financial data elements for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the quarterly ACF 209 SSP MOE Data Report. Both data reports should be supported by applicable performance records. During fiscal year 2021, the department transitioned key aspects of the TANF program to Oregon Eligibility (ONE) for case management, while TANF child welfare payments continued to be recorded in OR Kids, the child welfare system. The department contracts with an external service provider to extract data from ONE and OR Kids to populate the data reports. Program staff currently work with the external service provider to obtain comprehensive data reports prior to submission to review them for errors and when found, each issue is logged as a defect for the external service provider to correct. During fiscal year 2023, the department and the U.S. Administration for Children and Families (U.S. ACF) identified data reports submitted for fiscal year 2023 were incorrect and the department was unable to provide corrected data to auditors. Over the past year, the department has made progress in improving the accuracy and completeness of the data reported in the ACF 199 and ACF 209 reports. Reports were submitted by the department and accepted by U.S. ACF for the reporting periods during fiscal year 2024. We judgmentally tested the reports prepared and submitted for the quarter ended June 30, 2024. Based on our review of a random selection of 80 cases reported in the ACF 199 and ACF 209 reports, we noted the following errors: • For one case reported in the ACF 199, we noted a defect in the reporting logic for the line item containing the federal time-limit exemption status resulting in the reporting of an invalid code. • For two cases reported in the ACF 199 and four cases reported in the ACF 209, we noted discrepancies between the data reported for the Work Participation Status, related Work Participation Activities, and the case documentation. The data reported for each case indicated the client was required to participate but not participating in countable activities. However, case narratives supported the client was engaged in countable activities during the reporting period. For the two ACF 199 cases, we also noted a Personal Development Plan (PDP) where attendance hours should have been recorded was not appropriately established according to policy. As the reporting process relies on the attendance hours recorded in the PDP to populate the work participation line items, the absence of a PDP resulted in the report incompletely capturing the client’s JOBS activity. • For four cases reported in the ACF 209, we noted discrepancies between the case documentation and the hours reported as Unsubsidized Employment. In each case, the hours reported could not be substantiated by the available case documentation. Additionally, for one case, the Work Participation Status was incorrectly reported as not meeting minimum participation requirements when case documentation supported minimum participation had been met. Although improvements to the reporting have been made, the presence of errors in the current year indicates continued efforts are needed to ensure the reports accurately reflect the information within the case management system. We also noted documentation supporting the completion of the data review following the department’s procedures could be strengthened. Accurate reporting is necessary to ensure U.S. ACF can make appropriate determinations on the state’s compliance with required work participation rates. Additionally, as the ONE system is administered by an external service provider, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a System and Organization Controls (SOC) 2 Type II report which addresses the suitability of the design and operating effectiveness of controls. During the past year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider that may affect the department’s operations and reporting applicable to the TANF program. We recommend department management continue to review ACF 199 and ACF 209 reports prior to submission, monitor known compilation defects to ensure performance data reports submitted are complete and accurate, and ensure documentation is maintained supporting the completion of the data review procedures. We also recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure that the internal controls over the ONE system at the external service provider are sufficient to meet the business needs of ODHS and OHA.

2024-022 Oregon Department of Human Services Improve controls to ensure eligibility criteria are met Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-027; 2022-039; 2022-040 Questioned Costs: $5,187 (known); $4,499,112 (likely) Criteria: 42 USC 602(a)(1)(A) & (B)(iii); 45 CFR 264.10; 2 CFR 200.303 Federal regulations state the department is responsible for creating and submitting a state plan that outlines how the program will be conducted to meet the objectives of the Temporary Assistance for Needy Families (TANF) program. This includes the criteria used to determine the eligibility of TANF applicants. Additionally, federal regulations require each state must meet the requirements of the Income Eligibility and Verification System (IEVS) and request certain information from the Internal Revenue Service, State Wage Information Collections Agency, Social Security Administration, and Immigration and Naturalization Service when making TANF eligibility determinations. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. To help ensure eligibility determinations are made in accordance with the approved state plan, the department’s Program Integrity Unit (PIU) performs approximately 17 case eligibility reviews per month. These reviews confirm the appropriateness of eligibility determinations based on client information documented in the case management system. Identified errors are referred to the applicable branch office for correction and to determine if additional training is needed. We tested a random sample of 18 of 173 PIU case eligibility reviews performed during fiscal year 2024 specific to federally funded TANF cases to determine the effectiveness of the control. One case review identified an eligibility error which was not referred to the branch office. According to the department, this case review was on the schedule of findings; however, the communication to the branch office was not completed for unknown reasons. Failure to communicate issues identified during the case reviews reduces the control’s effectiveness in ensuring eligibility determinations are appropriately made and potential training opportunities are identified at the branch office. We also tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and the department performed the appropriate IEVS data checks in accordance with federal requirements. We identified the following errors, which were the result of caseworker errors in documenting the completion of the required eligibility steps in accordance with established enrollment procedures: • For one case, unearned income from an unemployment claim was not factored into the initial eligibility determination and subsequent benefit month calculations as required resulting in known questioned costs of $2,754. • For one case, the procedure regarding the non-financial eligibility requirement for pursuit of available assets was not followed to either obtain the client’s statement of intent to pursue unemployment or document good cause for the client’s non-pursuit of the asset resulting in known questioned costs of $2,433. • For one case, the department did not document the required IEVS check during the initial eligibility determination. However, we did not identify questioned costs associated with this case, as case documentation supported the applicant’s eligibility. The likely questioned costs total $4,499,112 based on the known questioned costs identified in our sample test. We recommend department management ensure case eligibility reviews are performed in accordance with the established procedures. We also recommend department management ensure caseworkers are adequately trained on TANF enrollment procedures to ensure all applicable requirements are met.

2024-022 Oregon Department of Human Services Improve controls to ensure eligibility criteria are met Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-027; 2022-039; 2022-040 Questioned Costs: $5,187 (known); $4,499,112 (likely) Criteria: 42 USC 602(a)(1)(A) & (B)(iii); 45 CFR 264.10; 2 CFR 200.303 Federal regulations state the department is responsible for creating and submitting a state plan that outlines how the program will be conducted to meet the objectives of the Temporary Assistance for Needy Families (TANF) program. This includes the criteria used to determine the eligibility of TANF applicants. Additionally, federal regulations require each state must meet the requirements of the Income Eligibility and Verification System (IEVS) and request certain information from the Internal Revenue Service, State Wage Information Collections Agency, Social Security Administration, and Immigration and Naturalization Service when making TANF eligibility determinations. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. To help ensure eligibility determinations are made in accordance with the approved state plan, the department’s Program Integrity Unit (PIU) performs approximately 17 case eligibility reviews per month. These reviews confirm the appropriateness of eligibility determinations based on client information documented in the case management system. Identified errors are referred to the applicable branch office for correction and to determine if additional training is needed. We tested a random sample of 18 of 173 PIU case eligibility reviews performed during fiscal year 2024 specific to federally funded TANF cases to determine the effectiveness of the control. One case review identified an eligibility error which was not referred to the branch office. According to the department, this case review was on the schedule of findings; however, the communication to the branch office was not completed for unknown reasons. Failure to communicate issues identified during the case reviews reduces the control’s effectiveness in ensuring eligibility determinations are appropriately made and potential training opportunities are identified at the branch office. We also tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and the department performed the appropriate IEVS data checks in accordance with federal requirements. We identified the following errors, which were the result of caseworker errors in documenting the completion of the required eligibility steps in accordance with established enrollment procedures: • For one case, unearned income from an unemployment claim was not factored into the initial eligibility determination and subsequent benefit month calculations as required resulting in known questioned costs of $2,754. • For one case, the procedure regarding the non-financial eligibility requirement for pursuit of available assets was not followed to either obtain the client’s statement of intent to pursue unemployment or document good cause for the client’s non-pursuit of the asset resulting in known questioned costs of $2,433. • For one case, the department did not document the required IEVS check during the initial eligibility determination. However, we did not identify questioned costs associated with this case, as case documentation supported the applicant’s eligibility. The likely questioned costs total $4,499,112 based on the known questioned costs identified in our sample test. We recommend department management ensure case eligibility reviews are performed in accordance with the established procedures. We also recommend department management ensure caseworkers are adequately trained on TANF enrollment procedures to ensure all applicable requirements are met.

2024-023 Oregon Department of Human Services Strengthen controls over program expenditures Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $2,962 (known); $415,856 (likely) Criteria: 2 CFR 200.303 The Temporary Assistance for Needy Families (TANF) program provides time limited cash assistance to eligible needy families with children. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. We identified two instances during our testing where expenditures were inappropriately charged to the TANF program: • We tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the payments made to the clients during those months were for allowable activities under the TANF program. One transaction was determined to be a duplicate payment for housing support services assistance. A check was issued to a participant for two months of rent and late fees to assist the family in maintaining stable housing. According to a case narrative in the case management system, the check was stated to have been lost and a second check was issued directly to the participant’s landlord. However, the original check was cashed prior to being canceled resulting in the duplicate expenditure for the same assistance payment. The duplicate payment resulted in known questioned costs of $2,419 and likely questioned costs of $415,856. • We tested a random sample of 25 of 37,987 child welfare TANF transactions during fiscal year 2024 to determine if the transactions were for allowable activities under the TANF program. One child welfare TANF transaction was determined to be a correction that did not refund the TANF program as intended. We identified known questioned costs of $543 due to the error. The known questioned costs were not projected to the population due to the uncommon nature of canceled and refunded transactions. We recommend department management strengthen controls to ensure program expenditures and corrections are properly recorded.

2024-023 Oregon Department of Human Services Strengthen controls over program expenditures Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $2,962 (known); $415,856 (likely) Criteria: 2 CFR 200.303 The Temporary Assistance for Needy Families (TANF) program provides time limited cash assistance to eligible needy families with children. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. We identified two instances during our testing where expenditures were inappropriately charged to the TANF program: • We tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the payments made to the clients during those months were for allowable activities under the TANF program. One transaction was determined to be a duplicate payment for housing support services assistance. A check was issued to a participant for two months of rent and late fees to assist the family in maintaining stable housing. According to a case narrative in the case management system, the check was stated to have been lost and a second check was issued directly to the participant’s landlord. However, the original check was cashed prior to being canceled resulting in the duplicate expenditure for the same assistance payment. The duplicate payment resulted in known questioned costs of $2,419 and likely questioned costs of $415,856. • We tested a random sample of 25 of 37,987 child welfare TANF transactions during fiscal year 2024 to determine if the transactions were for allowable activities under the TANF program. One child welfare TANF transaction was determined to be a correction that did not refund the TANF program as intended. We identified known questioned costs of $543 due to the error. The known questioned costs were not projected to the population due to the uncommon nature of canceled and refunded transactions. We recommend department management strengthen controls to ensure program expenditures and corrections are properly recorded.

2024-024 Oregon Department of Human Services Improve controls relating to client non-cooperation with child support requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-026 Questioned Costs: N/A Criteria: 45 CFR 264.30-.31 Federal regulations require the department to refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency. If the department determines referred individuals are not cooperating, without good cause, in establishing, modifying, or enforcing a support order with respect to the child, then the department must reduce or deny assistance in the Temporary Assistance for Needy Families (TANF) program. We tested a random sample of 40 of 4,615 child support non cooperation tasks submitted to the department by the Oregon Department of Justice’s Department of Child Support (DCS) to determine if the department took appropriate action to move the client into compliance or to decrease benefits as required by federal regulations. We found for two of the 40 cases tested, department policies were not followed to ensure child support cooperation was verified with DCS prior to closing the task. In both cases, department staff relied on client statements to establish their cooperation status. No fiscal year 2024 questioned costs are associated with either case due to the following circumstances: • For one case, the DCS child support non cooperation task was received mid June 2024. Although this task was inappropriately closed during the same month, we would not expect a sanction to be applied until the following month at the earliest which would be outside of our audit period. • For the other case, a DCS child support non cooperation task was received and closed inappropriately in March 2024. However, due to separate circumstances, TANF eligibility was terminated the following month. We recommend management ensure department employees are adequately trained on applicable procedures and requirements relating to child support cooperation with DCS.

2024-024 Oregon Department of Human Services Improve controls relating to client non-cooperation with child support requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-026 Questioned Costs: N/A Criteria: 45 CFR 264.30-.31 Federal regulations require the department to refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency. If the department determines referred individuals are not cooperating, without good cause, in establishing, modifying, or enforcing a support order with respect to the child, then the department must reduce or deny assistance in the Temporary Assistance for Needy Families (TANF) program. We tested a random sample of 40 of 4,615 child support non cooperation tasks submitted to the department by the Oregon Department of Justice’s Department of Child Support (DCS) to determine if the department took appropriate action to move the client into compliance or to decrease benefits as required by federal regulations. We found for two of the 40 cases tested, department policies were not followed to ensure child support cooperation was verified with DCS prior to closing the task. In both cases, department staff relied on client statements to establish their cooperation status. No fiscal year 2024 questioned costs are associated with either case due to the following circumstances: • For one case, the DCS child support non cooperation task was received mid June 2024. Although this task was inappropriately closed during the same month, we would not expect a sanction to be applied until the following month at the earliest which would be outside of our audit period. • For the other case, a DCS child support non cooperation task was received and closed inappropriately in March 2024. However, due to separate circumstances, TANF eligibility was terminated the following month. We recommend management ensure department employees are adequately trained on applicable procedures and requirements relating to child support cooperation with DCS.

2024-025 Oregon Department of Human Services Ensure work participation rate calculation uses verified and accurate data Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2022-038 Questioned Costs: N/A Criteria: 45 CFR 261.61-.62, .65 Federal regulations require each state maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Each state must have procedures to count and verify reported hours of work and must comply with its Work Verification Plan as approved by the U.S. Administration for Children and Families (U.S. ACF). Oregon’s Work Verification Plan outlines a system of controls for how reported hours will be verified and documented, and for reviews and monitoring procedures to identify errors. The Program Integrity Unit (PIU) is responsible for performing monthly reviews on a sample of cases to determine the accuracy of attendance hour reports by activity. However, during fiscal year 2024, the department stated the monthly reviews were delayed due to staffing constraints. At the time of our audit procedures in December 2024, the department had completed reviews for ten months of the fiscal year. Without the timely completion of reviews, the effectiveness of the department’s control to ensure the accuracy of work participation data is reduced and may result in a higher risk of inclusion of inaccurate data in reports submitted to U.S. ACF. We tested a random sample of 40 of 213,356 case benefit months (one case for one benefit month) identified in the ACF 199 and ACF 209 data reports to determine if work participation data was accurately reported and supported by case management records. We identified the following: • Two cases reported on the ACF 199 did not have adequate documentation supporting the verification of attendance hours recorded for the participants. • One case reported on the ACF 209 did not have adequate documentation supporting the work hours calculated and recorded for the participants. These inaccurate or unverified hours were reported to U.S. ACF for use in calculating the work participation rate. If the state fails to follow the approved Work Verification Plan, U.S. ACF may penalize the state. We recommend department management ensure JOBS reviews are performed in accordance with the established procedures. We also recommend department management ensure the work participation rate is calculated appropriately using verified and accurate participation data in adherence to the department’s Work Verification Plan.

2024-025 Oregon Department of Human Services Ensure work participation rate calculation uses verified and accurate data Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2022-038 Questioned Costs: N/A Criteria: 45 CFR 261.61-.62, .65 Federal regulations require each state maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Each state must have procedures to count and verify reported hours of work and must comply with its Work Verification Plan as approved by the U.S. Administration for Children and Families (U.S. ACF). Oregon’s Work Verification Plan outlines a system of controls for how reported hours will be verified and documented, and for reviews and monitoring procedures to identify errors. The Program Integrity Unit (PIU) is responsible for performing monthly reviews on a sample of cases to determine the accuracy of attendance hour reports by activity. However, during fiscal year 2024, the department stated the monthly reviews were delayed due to staffing constraints. At the time of our audit procedures in December 2024, the department had completed reviews for ten months of the fiscal year. Without the timely completion of reviews, the effectiveness of the department’s control to ensure the accuracy of work participation data is reduced and may result in a higher risk of inclusion of inaccurate data in reports submitted to U.S. ACF. We tested a random sample of 40 of 213,356 case benefit months (one case for one benefit month) identified in the ACF 199 and ACF 209 data reports to determine if work participation data was accurately reported and supported by case management records. We identified the following: • Two cases reported on the ACF 199 did not have adequate documentation supporting the verification of attendance hours recorded for the participants. • One case reported on the ACF 209 did not have adequate documentation supporting the work hours calculated and recorded for the participants. These inaccurate or unverified hours were reported to U.S. ACF for use in calculating the work participation rate. If the state fails to follow the approved Work Verification Plan, U.S. ACF may penalize the state. We recommend department management ensure JOBS reviews are performed in accordance with the established procedures. We also recommend department management ensure the work participation rate is calculated appropriately using verified and accurate participation data in adherence to the department’s Work Verification Plan.

2024-026 Oregon Department of Human Services Ensure refugee status is verified and documented and income information is updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.566 Refugee and Entrant Assistance-State/Replacement Designee-Administered Programs Federal Award Numbers and Years: 2301ORRCMA-05, 2023; 2403ORRCMA-02, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $14,346 (known); $96,638 (likely) Criteria: 45 CFR 400 The objective of the Refugee Assistance Program is to provide for resettlement of refugees and to assist them in attaining economic self-sufficiency as soon as possible after their initial placement in the United States. To be eligible, an applicant for assistance must provide proof of their refugee status in the form of documentation issued by the Immigration and Naturalization Service. Also, as a condition of the receipt of refugee cash assistance, the client is required to register for various employment services unless there is good cause for non-participation. The state agency must operate its refugee cash assistance program consistent with the provisions of the Temporary Assistance for Needy Families (TANF) program with regard to the treatment of income in the determination of initial and on-going eligibility. We tested a random sample of 60 of 71,233 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and provided the proof of refugee status in accordance with federal requirements. We identified the following: • In two cases, there was no evidence that the caseworker verified non-citizen status during the initial eligibility determination. • In five cases, the caseworker did not update income information timely when the client obtained employment. • In one case, the client was employment authorized and required to register for various employment services; however, there is no evidence of participation or good cause for non-participation. As a result of the errors listed above, we determined the program has known and likely questions costs for the Eligibility compliance requirement of $14,346 and $96,638, respectively. We recommend department management ensure refugee status and compliance with work requirements is verified and documented. We also recommend department management ensure income information is updated timely to avoid overpayments.

2024-026 Oregon Department of Human Services Ensure refugee status is verified and documented and income information is updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.566 Refugee and Entrant Assistance-State/Replacement Designee-Administered Programs Federal Award Numbers and Years: 2301ORRCMA-05, 2023; 2403ORRCMA-02, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $14,346 (known); $96,638 (likely) Criteria: 45 CFR 400 The objective of the Refugee Assistance Program is to provide for resettlement of refugees and to assist them in attaining economic self-sufficiency as soon as possible after their initial placement in the United States. To be eligible, an applicant for assistance must provide proof of their refugee status in the form of documentation issued by the Immigration and Naturalization Service. Also, as a condition of the receipt of refugee cash assistance, the client is required to register for various employment services unless there is good cause for non-participation. The state agency must operate its refugee cash assistance program consistent with the provisions of the Temporary Assistance for Needy Families (TANF) program with regard to the treatment of income in the determination of initial and on-going eligibility. We tested a random sample of 60 of 71,233 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and provided the proof of refugee status in accordance with federal requirements. We identified the following: • In two cases, there was no evidence that the caseworker verified non-citizen status during the initial eligibility determination. • In five cases, the caseworker did not update income information timely when the client obtained employment. • In one case, the client was employment authorized and required to register for various employment services; however, there is no evidence of participation or good cause for non-participation. As a result of the errors listed above, we determined the program has known and likely questions costs for the Eligibility compliance requirement of $14,346 and $96,638, respectively. We recommend department management ensure refugee status and compliance with work requirements is verified and documented. We also recommend department management ensure income information is updated timely to avoid overpayments.

2024-027 Oregon Department of Human Services Strengthen controls around background checks Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.658 Foster Care – Title IV-E Federal Award Numbers and Years: 2401ORFOST, 2024; 2301ORFOST 2023 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $4,491 (known) Criteria: 42 USC 671(a)(20)(A) Providers participating in the foster care program, whether a foster care family or a child-care institution, must be fully licensed by the proper state foster care licensing authority to be considered eligible for federal program funding. To be fully licensed, foster family home providers must satisfactorily have met a criminal records check, including a fingerprint-based check. We selected a random sample of 40 out of 23,622 expenditure transactions, representing maintenance payments made to providers caring for children in the foster care program. In our testing, we identified one provider that did not have all necessary background checks documented, including a fingerprint-based check. Department management indicated the certifying office did not follow requirements for completing and maintaining evidence of fingerprint-based background checks. The sample item was $142 in error; when reviewing the provider for the year, we identified $4,491 in known questioned costs. When projected to the population, questioned costs exceeded $25,000. We recommend department management ensure fingerprint-based background checks are completed and evidence is properly maintained.

2024-027 Oregon Department of Human Services Strengthen controls around background checks Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.658 Foster Care – Title IV-E Federal Award Numbers and Years: 2401ORFOST, 2024; 2301ORFOST 2023 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $4,491 (known) Criteria: 42 USC 671(a)(20)(A) Providers participating in the foster care program, whether a foster care family or a child-care institution, must be fully licensed by the proper state foster care licensing authority to be considered eligible for federal program funding. To be fully licensed, foster family home providers must satisfactorily have met a criminal records check, including a fingerprint-based check. We selected a random sample of 40 out of 23,622 expenditure transactions, representing maintenance payments made to providers caring for children in the foster care program. In our testing, we identified one provider that did not have all necessary background checks documented, including a fingerprint-based check. Department management indicated the certifying office did not follow requirements for completing and maintaining evidence of fingerprint-based background checks. The sample item was $142 in error; when reviewing the provider for the year, we identified $4,491 in known questioned costs. When projected to the population, questioned costs exceeded $25,000. We recommend department management ensure fingerprint-based background checks are completed and evidence is properly maintained.

2024-028 Oregon Department of Human Services Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A230054, 2023; H126A240054, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-028 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 15 out of 25,740 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we identified the following: • The department could not provide documentation of the hourly wage and start date of employment at exit for one client when the report was submitted. • The reported application date for one client was 22 days after the date of the application per the supporting documentation. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-028 Oregon Department of Human Services Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A230054, 2023; H126A240054, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-028 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 15 out of 25,740 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we identified the following: • The department could not provide documentation of the hourly wage and start date of employment at exit for one client when the report was submitted. • The reported application date for one client was 22 days after the date of the application per the supporting documentation. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-029 Oregon Commission for the Blind Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A240055, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-031 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 5 out of 768 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we found the department could not provide documentation of the hourly wage and start date of employment at exit for two clients. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. This issue was identified during the audit for the year ended June 30, 2023. In response to the prior year’s finding, department management took corrective action in September 2024. Our audit procedures were specific to the fiscal year ended June 30, 2024, and during the audit period the department had not yet taken corrective action to ensure the accuracy of the data report and verify compliance was achieved. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-029 Oregon Commission for the Blind Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A240055, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-031 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 5 out of 768 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we found the department could not provide documentation of the hourly wage and start date of employment at exit for two clients. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. This issue was identified during the audit for the year ended June 30, 2023. In response to the prior year’s finding, department management took corrective action in September 2024. Our audit procedures were specific to the fiscal year ended June 30, 2024, and during the audit period the department had not yet taken corrective action to ensure the accuracy of the data report and verify compliance was achieved. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-030 Oregon Department of Education Perform regular fiscal monitoring as part of subrecipient monitoring Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.027 Special Education Grants to States (Special Education Cluster) Federal Award Numbers and Years: H027A230095, 2024; H027A230095-23A, 2024 Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e) As part of our audit of the Special Education Grants to States program (program) at the Oregon Department of Education (department), we reviewed the department’s procedures for monitoring subrecipients to ensure program compliance. The department has several layers to the subrecipient monitoring requirements and has procedures to perform programmatic reviews, fiscal reviews, and other reviews based upon a risk assessment. For the fiscal monitoring, the department has a procedure in place to ensure that every subrecipient is reviewed at least once every three years, with approximately one-third of the subrecipients reviewed each year. In our testing, we reviewed a sample of seven of the 67 subrecipients that were scheduled for review in fiscal year 2024. In our initial sample, we found that one of the seven was not monitored during the year. We expanded our testing by selecting another ten subrecipients and the department could not provide support that the review was completed for nine of the ten. Per discussion with department staff, the specific subrecipient in our original sample had not had a fiscal review since January 2021. The fiscal monitoring was not performed as the subrecipient had not drawn funds from a specific grant period prior to the review process, although they had drawn from previous grant awards during the year. Failure to adequately monitor subrecipient compliance and supporting documentation increases the risk of inappropriate spending and noncompliance with federal requirements. We recommend department management ensure subrecipient fiscal monitoring is performed on the schedule set by department policy. We also recommend the department develop a procedure to track the completion of fiscal monitoring.

2024-030 Oregon Department of Education Perform regular fiscal monitoring as part of subrecipient monitoring Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.027 Special Education Grants to States (Special Education Cluster) Federal Award Numbers and Years: H027A230095, 2024; H027A230095-23A, 2024 Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e) As part of our audit of the Special Education Grants to States program (program) at the Oregon Department of Education (department), we reviewed the department’s procedures for monitoring subrecipients to ensure program compliance. The department has several layers to the subrecipient monitoring requirements and has procedures to perform programmatic reviews, fiscal reviews, and other reviews based upon a risk assessment. For the fiscal monitoring, the department has a procedure in place to ensure that every subrecipient is reviewed at least once every three years, with approximately one-third of the subrecipients reviewed each year. In our testing, we reviewed a sample of seven of the 67 subrecipients that were scheduled for review in fiscal year 2024. In our initial sample, we found that one of the seven was not monitored during the year. We expanded our testing by selecting another ten subrecipients and the department could not provide support that the review was completed for nine of the ten. Per discussion with department staff, the specific subrecipient in our original sample had not had a fiscal review since January 2021. The fiscal monitoring was not performed as the subrecipient had not drawn funds from a specific grant period prior to the review process, although they had drawn from previous grant awards during the year. Failure to adequately monitor subrecipient compliance and supporting documentation increases the risk of inappropriate spending and noncompliance with federal requirements. We recommend department management ensure subrecipient fiscal monitoring is performed on the schedule set by department policy. We also recommend the department develop a procedure to track the completion of fiscal monitoring.

2024-031 Oregon Department of Education Implement controls to ensure FFATA reporting is completed for all required subawards Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 10.582 Fresh Fruit and Vegetable Program (Child Nutrition Cluster) Federal Award Numbers and Years: 202322L160347, 2023; 202423L160347, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Child Nutrition Cluster is subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. For the Child Nutrition Program, only the Fresh Fruit and Vegetable program is subject to FFATA reporting. Our audit procedures included the testing of 20 Fresh Fruit and Vegetable subawards/subaward modifications totaling $647,311 in obligations. During our testing we noted 9 subawards were not reported to FSRS totaling $213,992. According to department management, it had initially overlooked FFATA reporting for the Fresh Fruit and Vegetable subaward so was still working on submitting the subaward in FSRS. We recommend department management strengthen controls to ensure the monthly FFATA reports are submitted.

2024-031 Oregon Department of Education Implement controls to ensure FFATA reporting is completed for all required subawards Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 10.582 Fresh Fruit and Vegetable Program (Child Nutrition Cluster) Federal Award Numbers and Years: 202322L160347, 2023; 202423L160347, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Child Nutrition Cluster is subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. For the Child Nutrition Program, only the Fresh Fruit and Vegetable program is subject to FFATA reporting. Our audit procedures included the testing of 20 Fresh Fruit and Vegetable subawards/subaward modifications totaling $647,311 in obligations. During our testing we noted 9 subawards were not reported to FSRS totaling $213,992. According to department management, it had initially overlooked FFATA reporting for the Fresh Fruit and Vegetable subaward so was still working on submitting the subaward in FSRS. We recommend department management strengthen controls to ensure the monthly FFATA reports are submitted.

2024-032 Oregon Department of Justice Ensure program expenditures are supported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.563 Child Support Services Federal Award Numbers and Years: 2401ORSCSS, 2024 Compliance Requirements: Allowable Costs/Cost Principles; Matching, Level of Effort, Earmarking Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $1,138 (known); $173,028 (likely) Criteria: 2 CFR 200.403(g); 42 USC 655(a)(2)(C) Federal regulations require that program expenditures must be adequately supported to be allowable. Additionally, the Child Support Enforcement program requires a 34% state match for most expenditures. We tested a random sample of 40 program expenditures to determine whether they were for allowable costs and the state match was met. We identified one expenditure where the amount entered in the state’s financial accounting system did not agree to supporting documentation. This was caused by a combination of unclear supporting documentation and insufficient review of the expenditure prior to processing. As a result, excess federal reimbursement was received for $1,138 which, projected to the population, resulted in likely questioned costs exceeding $25,000. However, once notified, department management promptly corrected the error. Without clear support and sufficient review of expenditures, errors could go undetected in the state’s financial accounting system causing federal reimbursement to be overstated. We recommend that department management ensure controls verify expenditures are adequately supported and accurately processed.

2024-032 Oregon Department of Justice Ensure program expenditures are supported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.563 Child Support Services Federal Award Numbers and Years: 2401ORSCSS, 2024 Compliance Requirements: Allowable Costs/Cost Principles; Matching, Level of Effort, Earmarking Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $1,138 (known); $173,028 (likely) Criteria: 2 CFR 200.403(g); 42 USC 655(a)(2)(C) Federal regulations require that program expenditures must be adequately supported to be allowable. Additionally, the Child Support Enforcement program requires a 34% state match for most expenditures. We tested a random sample of 40 program expenditures to determine whether they were for allowable costs and the state match was met. We identified one expenditure where the amount entered in the state’s financial accounting system did not agree to supporting documentation. This was caused by a combination of unclear supporting documentation and insufficient review of the expenditure prior to processing. As a result, excess federal reimbursement was received for $1,138 which, projected to the population, resulted in likely questioned costs exceeding $25,000. However, once notified, department management promptly corrected the error. Without clear support and sufficient review of expenditures, errors could go undetected in the state’s financial accounting system causing federal reimbursement to be overstated. We recommend that department management ensure controls verify expenditures are adequately supported and accurately processed.

2024-033 Oregon Housing and Community Services Federal reports should contain accurate information Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program Federal Award Numbers and Years: 2302ORLIEI, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302(b)(2); 2 CFR 200.303 Federal regulations require that federal reports are accurate and supported by applicable accounting records. Federal regulations also require management to establish and maintain effective internal control over the federal award. Based on our testing, we identified multiple reports where the amount of obligated funds for the Infrastructure Investment and Jobs Act (IIJA) was not appropriately reported. Funds for this grant were obligated through separate contracts, which differed from the department’s standard process of obligating funds through their grant management system application. At the time these reports were completed, the preparing staff did not have a summary of the IIJA obligations, which resulted in errors in the following September 2023 report line items: • SF-425, Federal Share of Unliquidated Obligations • LIHEAP Performance Data Form, Unobligated Infrastructure Act Funds Carried Over to next FFY • LIHEAP Carryover and Reallotment Report, Carryover Amount • LIHEAP Quarterly Performance and Management Report, Amount of Funds Obligated. Additionally, documentation was not retained to show this report was approved. Based on submitted reports, it appeared the department did not obligate at least 90% of the award by September 30, 2023, as required. However, based on our testing we determined the department had obligated over 90% of the award by September 30, 2023. We recommend department management strengthen internal controls to ensure the required LIHEAP reports contain accurate information.

2024-033 Oregon Housing and Community Services Federal reports should contain accurate information Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program Federal Award Numbers and Years: 2302ORLIEI, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302(b)(2); 2 CFR 200.303 Federal regulations require that federal reports are accurate and supported by applicable accounting records. Federal regulations also require management to establish and maintain effective internal control over the federal award. Based on our testing, we identified multiple reports where the amount of obligated funds for the Infrastructure Investment and Jobs Act (IIJA) was not appropriately reported. Funds for this grant were obligated through separate contracts, which differed from the department’s standard process of obligating funds through their grant management system application. At the time these reports were completed, the preparing staff did not have a summary of the IIJA obligations, which resulted in errors in the following September 2023 report line items: • SF-425, Federal Share of Unliquidated Obligations • LIHEAP Performance Data Form, Unobligated Infrastructure Act Funds Carried Over to next FFY • LIHEAP Carryover and Reallotment Report, Carryover Amount • LIHEAP Quarterly Performance and Management Report, Amount of Funds Obligated. Additionally, documentation was not retained to show this report was approved. Based on submitted reports, it appeared the department did not obligate at least 90% of the award by September 30, 2023, as required. However, based on our testing we determined the department had obligated over 90% of the award by September 30, 2023. We recommend department management strengthen internal controls to ensure the required LIHEAP reports contain accurate information.

2024-034 Oregon Housing and Community Services Quarterly Performance Report should include all expenditures incurred to date Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii Federal Award Numbers and Years: B-21-DZ-41-0001, 2021 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.328(c), DRGR User Manual, Chapter 19, p. 15 CDBG recipients are required to provide a quarterly performance report (QPR) including expenditures incurred period-to-date and in total for each activity. Activity expenditures should be equal to the amount of funds the grantee expended that quarter, regardless of the amount drawn. We found the June 30, 2024 report filed with HUD did not contain accurate information regarding funds expended for the CDBG-Disaster Recovery (CDBG-DR) program as a whole, or for individual activities within the program. OHCS hired a management consultant to provide consulting services, including assistance with preparation of the quarterly reports to HUD for the CDBG-DR grant. Although the department provided the consultant with a report detailing all expenditures for the program, the consultant's approach to QPR reporting did not take into account expenditures the department does not pre-draw for, such as direct and indirect payroll, and services and supplies costs. As a result, only costs for the Homeowner Assistance and Reconstruction Program (HARP) activity and admin costs were reported, although costs were incurred for other program activities. Overall costs were understated by $6.4 million to date and $5.3 million for the period. HARP costs were underreported by $4.3 million to date and $3.8 million for the quarter, and admin costs were underreported by $1 million to date and $0.6 million for the quarter. We recommend quarterly performance reports are prepared to include all expenditures incurred for the period and to date regardless of whether funds have been drawn.

2024-034 Oregon Housing and Community Services Quarterly Performance Report should include all expenditures incurred to date Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii Federal Award Numbers and Years: B-21-DZ-41-0001, 2021 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.328(c), DRGR User Manual, Chapter 19, p. 15 CDBG recipients are required to provide a quarterly performance report (QPR) including expenditures incurred period-to-date and in total for each activity. Activity expenditures should be equal to the amount of funds the grantee expended that quarter, regardless of the amount drawn. We found the June 30, 2024 report filed with HUD did not contain accurate information regarding funds expended for the CDBG-Disaster Recovery (CDBG-DR) program as a whole, or for individual activities within the program. OHCS hired a management consultant to provide consulting services, including assistance with preparation of the quarterly reports to HUD for the CDBG-DR grant. Although the department provided the consultant with a report detailing all expenditures for the program, the consultant's approach to QPR reporting did not take into account expenditures the department does not pre-draw for, such as direct and indirect payroll, and services and supplies costs. As a result, only costs for the Homeowner Assistance and Reconstruction Program (HARP) activity and admin costs were reported, although costs were incurred for other program activities. Overall costs were understated by $6.4 million to date and $5.3 million for the period. HARP costs were underreported by $4.3 million to date and $3.8 million for the quarter, and admin costs were underreported by $1 million to date and $0.6 million for the quarter. We recommend quarterly performance reports are prepared to include all expenditures incurred for the period and to date regardless of whether funds have been drawn.

2024-035 Oregon Business Development Department Ensure CDBG expenditures are recorded in SFMA under the appropriate grant year Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302 The department is required under 2 CFR 200.302 to have a financial management system sufficient to permit the preparation of reports required under the terms and conditions of the CDBG grant; and to track expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Program staff tracked the obligation of grant funds and used this information to prepare the December 31, 2023 PR28 report. However, because of significant turnover in accounting, there was no review from accounting staff to ensure the program tracking reconciled to the State’s financial management application (SFMA). We audited the December 31, 2023 PR28 reports filed for awards from 2020 (including a COVID-19 award), 2021, 2022, and 2023. The expenditures reported in HUD’s Integrated Disbursement and Information System (IDIS) did not materially agree to expenditures or draws recorded in the state’s financial management application (SFMA) for those grants. Variances between cumulative expenditures in SFMA and cumulative expenditures reported ranged between $1.6 million underreported for 2020 to $4.5 million overreported for the 2020 COVID award. In total, cumulative expenditures for those grant awards were overreported by $6.5 million. The CDBG state grants are required to be expended within eight years. Failure to properly account for expenditures for a specific grant year could result in the loss of funds if not obligated and expended within the period of performance of the grant. We recommend the agency reconcile SFMA to amounts in IDIS and make adjustments as necessary to ensure CDBG expenditure reports are accurate and agree to accounting records.

2024-035 Oregon Business Development Department Ensure CDBG expenditures are recorded in SFMA under the appropriate grant year Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302 The department is required under 2 CFR 200.302 to have a financial management system sufficient to permit the preparation of reports required under the terms and conditions of the CDBG grant; and to track expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Program staff tracked the obligation of grant funds and used this information to prepare the December 31, 2023 PR28 report. However, because of significant turnover in accounting, there was no review from accounting staff to ensure the program tracking reconciled to the State’s financial management application (SFMA). We audited the December 31, 2023 PR28 reports filed for awards from 2020 (including a COVID-19 award), 2021, 2022, and 2023. The expenditures reported in HUD’s Integrated Disbursement and Information System (IDIS) did not materially agree to expenditures or draws recorded in the state’s financial management application (SFMA) for those grants. Variances between cumulative expenditures in SFMA and cumulative expenditures reported ranged between $1.6 million underreported for 2020 to $4.5 million overreported for the 2020 COVID award. In total, cumulative expenditures for those grant awards were overreported by $6.5 million. The CDBG state grants are required to be expended within eight years. Failure to properly account for expenditures for a specific grant year could result in the loss of funds if not obligated and expended within the period of performance of the grant. We recommend the agency reconcile SFMA to amounts in IDIS and make adjustments as necessary to ensure CDBG expenditure reports are accurate and agree to accounting records.

2024-036 Oregon Business Development Department Implement controls and submit delinquent FFATA reports Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-18-DC-41-0001, 2018; B-19-DC-41-0001, 2019; B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170, Appendix A The State CDBG and CDBG-CV (COVID) programs are subject to the Federal Funding Accountability and Transparency Act of 2006. The "Transparency Act" requires direct recipients of grants to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). We found nearly $45 million in subawards made for CDBG projects since 2020 were not reported on the federal reporting system. The department has not prepared FFATA reports since 2020 due to fiscal staff turnover and no staff formally assigned to perform the task. As a result, information regarding subawards of CDBG funds was not made available publicly as required. We recommend the department report all delinquent subaward reports for the CDBG program as required. We further recommend the department develop and implement written procedures and assign staff to ensure subaward reporting occurs timely in the future.

2024-036 Oregon Business Development Department Implement controls and submit delinquent FFATA reports Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-18-DC-41-0001, 2018; B-19-DC-41-0001, 2019; B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170, Appendix A The State CDBG and CDBG-CV (COVID) programs are subject to the Federal Funding Accountability and Transparency Act of 2006. The "Transparency Act" requires direct recipients of grants to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). We found nearly $45 million in subawards made for CDBG projects since 2020 were not reported on the federal reporting system. The department has not prepared FFATA reports since 2020 due to fiscal staff turnover and no staff formally assigned to perform the task. As a result, information regarding subawards of CDBG funds was not made available publicly as required. We recommend the department report all delinquent subaward reports for the CDBG program as required. We further recommend the department develop and implement written procedures and assign staff to ensure subaward reporting occurs timely in the future.

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure their subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned OBDD to review 24 of the state’s 369 subrecipients’ audits, receiving a total of $42.3 million in pass-through funding from 11 state agencies. OBDD did not review any of these entities due to staff turnover. We reviewed two of these subrecipients and found neither had audit findings. This does not preclude the remaining 22 subrecipients from having audit findings requiring communication We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure their subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned OBDD to review 24 of the state’s 369 subrecipients’ audits, receiving a total of $42.3 million in pass-through funding from 11 state agencies. OBDD did not review any of these entities due to staff turnover. We reviewed two of these subrecipients and found neither had audit findings. This does not preclude the remaining 22 subrecipients from having audit findings requiring communication We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.

2024-038 Oregon Business Development Department Implement controls over reporting Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Reporting Type of Finding: Significant Deficiency Prior Year Findings: 2023-043 Questioned Costs: N/A Criteria: 2 CFR 200.303 Department management is responsible for establishing and maintaining effective internal controls that provide reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Recipients of Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) are required to provide quarterly project and expenditure reports to the Department of Administrative Services’ Coronavirus Fiscal Relief Team (DAS CFRT), who compiles the statewide report and submits it to the Department of the Treasury. The quarterly CSLFRF reports require several types of information and updates to be included each quarter, including project descriptions, completion status, and contracted entity details. The report also includes information on obligations and expenditures, provided by the fiscal staff. An Infrastructure Program Specialist works directly with the project management team assigned to the projects and compiles the information into a report spreadsheet. Once compiled, it is transmitted directly to DAS with no additional internal review. The report submitted for infrastructure projects under interagency agreement 6203 and 6252 for the quarter ending June 30, 2024, reported $46.7 million in cumulative expenditures, but $48.3 million were recorded in accounting records, resulting in an under-reporting of expenditures by $1.6 million, or 3.4%. CSLFRF awards must be used for costs incurred (obligated) by December 31, 2024, and expended for those incurred costs by December 31, 2026. Any funds not expended must be returned to the Department of the Treasury at the end of the grant. Because the department’s reporting process did not include a review by fiscal staff prior to submission to DAS to ensure the report included accurate expenditure and obligation information, the department risks the potential loss of CSLFRF funds. We recommend the department implement a review by fiscal staff of expenditure and obligation amounts on CSLFRF quarterly reports before submission to DAS CFRT to ensure the reports agree to the accounting records.

2024-038 Oregon Business Development Department Implement controls over reporting Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Reporting Type of Finding: Significant Deficiency Prior Year Findings: 2023-043 Questioned Costs: N/A Criteria: 2 CFR 200.303 Department management is responsible for establishing and maintaining effective internal controls that provide reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Recipients of Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) are required to provide quarterly project and expenditure reports to the Department of Administrative Services’ Coronavirus Fiscal Relief Team (DAS CFRT), who compiles the statewide report and submits it to the Department of the Treasury. The quarterly CSLFRF reports require several types of information and updates to be included each quarter, including project descriptions, completion status, and contracted entity details. The report also includes information on obligations and expenditures, provided by the fiscal staff. An Infrastructure Program Specialist works directly with the project management team assigned to the projects and compiles the information into a report spreadsheet. Once compiled, it is transmitted directly to DAS with no additional internal review. The report submitted for infrastructure projects under interagency agreement 6203 and 6252 for the quarter ending June 30, 2024, reported $46.7 million in cumulative expenditures, but $48.3 million were recorded in accounting records, resulting in an under-reporting of expenditures by $1.6 million, or 3.4%. CSLFRF awards must be used for costs incurred (obligated) by December 31, 2024, and expended for those incurred costs by December 31, 2026. Any funds not expended must be returned to the Department of the Treasury at the end of the grant. Because the department’s reporting process did not include a review by fiscal staff prior to submission to DAS to ensure the report included accurate expenditure and obligation information, the department risks the potential loss of CSLFRF funds. We recommend the department implement a review by fiscal staff of expenditure and obligation amounts on CSLFRF quarterly reports before submission to DAS CFRT to ensure the reports agree to the accounting records.

2024-039 Oregon Department of Emergency Management Continue FFATA reporting improvements and make inquiries on FSRS functionality Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4499-DR-OR, 2020; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021; FEMA-4768-DR-OR, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-033 Questioned Costs: N/A Criteria: 2 CFR 200.303(a)-(d); 2 CFR 170, Appendix A I(a) The Federal Funding Accountability and Transparency Act (FFATA) requires federal award recipients to submit key data elements for any subaward obligation that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Oregon Department of Emergency Management (department) reported the prior year FFATA finding as partially corrected. We judgmentally selected 10 of 383 subaward obligations for review. • We found eight were submitted with the applicable data elements but were not submitted timely, as based on guidance from FEMA the department was catching up with past due reports from the previous year. • We found one obligation was on the department’s tracking sheet, but support was not retained and FSRS did not show evidence of the submission. • We found one obligation to be among 30 for which the agency stated FSRS prevented them from entering. We recommend department management continue with its improvement on the timeliness of FFATA submissions and also make inquiries to the operators of FSRS regarding the inability to enter certain submissions.

2024-039 Oregon Department of Emergency Management Continue FFATA reporting improvements and make inquiries on FSRS functionality Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4499-DR-OR, 2020; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021; FEMA-4768-DR-OR, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-033 Questioned Costs: N/A Criteria: 2 CFR 200.303(a)-(d); 2 CFR 170, Appendix A I(a) The Federal Funding Accountability and Transparency Act (FFATA) requires federal award recipients to submit key data elements for any subaward obligation that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Oregon Department of Emergency Management (department) reported the prior year FFATA finding as partially corrected. We judgmentally selected 10 of 383 subaward obligations for review. • We found eight were submitted with the applicable data elements but were not submitted timely, as based on guidance from FEMA the department was catching up with past due reports from the previous year. • We found one obligation was on the department’s tracking sheet, but support was not retained and FSRS did not show evidence of the submission. • We found one obligation to be among 30 for which the agency stated FSRS prevented them from entering. We recommend department management continue with its improvement on the timeliness of FFATA submissions and also make inquiries to the operators of FSRS regarding the inability to enter certain submissions.

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: Multiple Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure its subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned the Oregon Department of Emergency Management (department) to review 27 of the state’s 369 subrecipients’ audits, receiving a total of $176.2 million in pass-through funding from 20 state agencies. The department did not review any of these entities because they determined their other commitments were higher priorities. We reviewed two of these subrecipients and found one expended a total of $36 million and had one audit finding that may affect various federal programs. This subrecipient received pass-through funding from five other contributing agencies who were not informed of the finding. This does not preclude the remaining 25 subrecipients from having audit findings requiring communication to the contributing agencies. We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: Multiple Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure its subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned the Oregon Department of Emergency Management (department) to review 27 of the state’s 369 subrecipients’ audits, receiving a total of $176.2 million in pass-through funding from 20 state agencies. The department did not review any of these entities because they determined their other commitments were higher priorities. We reviewed two of these subrecipients and found one expended a total of $36 million and had one audit finding that may affect various federal programs. This subrecipient received pass-through funding from five other contributing agencies who were not informed of the finding. This does not preclude the remaining 25 subrecipients from having audit findings requiring communication to the contributing agencies. We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.

2024-041 Oregon Military Department Ensure undisbursed obligation extension support is retained Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV (multiple appendices and years) Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: National Guard Regulation 5-1, Chapter 11-10 Federal regulations state only costs obligated during the period of the federal fiscal year or period of performance identified in the cooperative agreement, are reimbursable. If undisbursed obligations remain 90 days after the close of the federal fiscal year, the recipient shall submit an extension, a detailed listing of un-cleared obligations and a projected timetable for their liquidation and disbursement, no later than December 31. We identified 18 state fiscal year 2024 expenditures recorded to agreements with federal fiscal years 2020-2023. As the original periods of performance would have ended, these expenditures should have been detailed on submitted extensions. The department provided support for five extensions although some did not include the listing of un-cleared obligations. The department could not provide support that extensions were made for the remaining 13 agreements. Without retaining adequate documentation for extensions, the department risks losing federal funding for undisbursed obligations which would then be reimbursed with state funds. The department provided a lack of management oversight and lack of codified processes as the cause of these exceptions. We recommend department management ensure support is retained for all submitted cooperative agreement extensions including the listings of un-cleared obligations.

2024-041 Oregon Military Department Ensure undisbursed obligation extension support is retained Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV (multiple appendices and years) Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: National Guard Regulation 5-1, Chapter 11-10 Federal regulations state only costs obligated during the period of the federal fiscal year or period of performance identified in the cooperative agreement, are reimbursable. If undisbursed obligations remain 90 days after the close of the federal fiscal year, the recipient shall submit an extension, a detailed listing of un-cleared obligations and a projected timetable for their liquidation and disbursement, no later than December 31. We identified 18 state fiscal year 2024 expenditures recorded to agreements with federal fiscal years 2020-2023. As the original periods of performance would have ended, these expenditures should have been detailed on submitted extensions. The department provided support for five extensions although some did not include the listing of un-cleared obligations. The department could not provide support that extensions were made for the remaining 13 agreements. Without retaining adequate documentation for extensions, the department risks losing federal funding for undisbursed obligations which would then be reimbursed with state funds. The department provided a lack of management oversight and lack of codified processes as the cause of these exceptions. We recommend department management ensure support is retained for all submitted cooperative agreement extensions including the listings of un-cleared obligations.

2024-042 Oregon Military Department Ensure payroll expenditures are coded to the correct period and errors are corrected timely Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV-23-2-1021, 2023; W912JV-23-2-1024, 2023; W912JV-23-2-1001, 2023; W912JV-19-2-1001, 2019 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $35,820 (known) Criteria: National Guard Regulation 5-1, Chapter 11-2 Federal regulations require that grantees must obligate funds in the federal fiscal year specified in the relevant appendix to be reimbursable by federal funds. We queried the Oregon Military Department’s (department) accounting records and identified 12 awards by federal fiscal year 2019-2023 with payroll expenditures charged in federal fiscal year 2024, which is outside the period of performance. We analyzed these awards and included any correcting entries. After corrections, five awards still had payroll recorded outside the period of performance. For activity in two awards, the department provided support that although the accounting records still had not been corrected as of March 2025, the department had not sought reimbursement. For four awards, we question costs of $35,280. The department may have not sought reimbursement but could not easily locate the supporting documentation. According to department management, these errors were due to incorrect coding in the payroll system. While the department is aware of some of these errors, it is not timely correcting the errors as several of the uncorrected errors are more than a year old. If the underlying accounting records do not properly account for transactions, the department could inappropriately request reimbursement for obligations that are outside of the period of performance for the grant. We recommend department management implement controls to ensure payroll expenditures are coded correctly and timely correct errors when identified.

2024-042 Oregon Military Department Ensure payroll expenditures are coded to the correct period and errors are corrected timely Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV-23-2-1021, 2023; W912JV-23-2-1024, 2023; W912JV-23-2-1001, 2023; W912JV-19-2-1001, 2019 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $35,820 (known) Criteria: National Guard Regulation 5-1, Chapter 11-2 Federal regulations require that grantees must obligate funds in the federal fiscal year specified in the relevant appendix to be reimbursable by federal funds. We queried the Oregon Military Department’s (department) accounting records and identified 12 awards by federal fiscal year 2019-2023 with payroll expenditures charged in federal fiscal year 2024, which is outside the period of performance. We analyzed these awards and included any correcting entries. After corrections, five awards still had payroll recorded outside the period of performance. For activity in two awards, the department provided support that although the accounting records still had not been corrected as of March 2025, the department had not sought reimbursement. For four awards, we question costs of $35,280. The department may have not sought reimbursement but could not easily locate the supporting documentation. According to department management, these errors were due to incorrect coding in the payroll system. While the department is aware of some of these errors, it is not timely correcting the errors as several of the uncorrected errors are more than a year old. If the underlying accounting records do not properly account for transactions, the department could inappropriately request reimbursement for obligations that are outside of the period of performance for the grant. We recommend department management implement controls to ensure payroll expenditures are coded correctly and timely correct errors when identified.

2024-043 Oregon Department of Veterans’ Affairs Ensure accuracy of per diem recalculations Federal Awarding Agency: U.S. Department of Veterans Affairs Assistance Listing Number and Name: 64.015 Veterans State Nursing Home Care Federal Award Numbers and Years: 648-Y37190, 2023; 648-Y37191, 2023; 648-Y47191, 2024; 648-Y48191, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303; 38 CFR 51.40 Federal regulations allow for the department to request a per diem from the federal awarding agency each month for every day an eligible veteran resides in a veteran state nursing home. Federal regulations require the department establish, document, and maintain effective internal control over the federal award that provides reasonable assurance they are managing the federal award in compliance with federal statutes. The department performs a recalculation for each per diem to provide reasonable assurance they are managing the award in compliance with federal statutes. We selected a total of eight out of 24 per diem requests for review. Of the eight requests we reviewed, we identified four requests where the recalculation performed was not accurate. The recalculated per diem totals did not agree to the actual amount requested, due to differences in the number of resident per diem days or per diem amounts used in the recalculation. Department staff has indicated the recalculation has been updated over the past year as staff has become more familiar with the recalculation process, but additional updates are still needed. Without an appropriate recalculation, the department may request a per diem for ineligible individuals residing in the nursing home, or the per diem may be for an incorrect number of days. We recommend department management strengthen internal controls to ensure per diem requests are accurately recalculated.

2024-043 Oregon Department of Veterans’ Affairs Ensure accuracy of per diem recalculations Federal Awarding Agency: U.S. Department of Veterans Affairs Assistance Listing Number and Name: 64.015 Veterans State Nursing Home Care Federal Award Numbers and Years: 648-Y37190, 2023; 648-Y37191, 2023; 648-Y47191, 2024; 648-Y48191, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303; 38 CFR 51.40 Federal regulations allow for the department to request a per diem from the federal awarding agency each month for every day an eligible veteran resides in a veteran state nursing home. Federal regulations require the department establish, document, and maintain effective internal control over the federal award that provides reasonable assurance they are managing the federal award in compliance with federal statutes. The department performs a recalculation for each per diem to provide reasonable assurance they are managing the award in compliance with federal statutes. We selected a total of eight out of 24 per diem requests for review. Of the eight requests we reviewed, we identified four requests where the recalculation performed was not accurate. The recalculated per diem totals did not agree to the actual amount requested, due to differences in the number of resident per diem days or per diem amounts used in the recalculation. Department staff has indicated the recalculation has been updated over the past year as staff has become more familiar with the recalculation process, but additional updates are still needed. Without an appropriate recalculation, the department may request a per diem for ineligible individuals residing in the nursing home, or the per diem may be for an incorrect number of days. We recommend department management strengthen internal controls to ensure per diem requests are accurately recalculated.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: B09SM086032, 2022; B09SM087383, 2023; B09SM085378, 2022 (COVID-19) 93.959: B08TI084667, 2022; B08TI085829, 2023; B08TI083963, 2022 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Findings: 2023-020; 2022-043 Questioned Costs: N/ACriteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require passthrough entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of recipient contracts with expenditures recorded during state fiscal year 2024. The sample included 7 of 34 Block Grants for Community Mental Health (MHBG) and 13 of 76 Block Grants for Substance Use Prevention, Treatment, and Recovery Services (SUPTRS). Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • One recipient of SUPTRS funds was classified as a subrecipient by the department, but it was unclear if it met the definition of a subrecipient. • Two recipients of MHBG funds and 2 recipients of SUPTRS funds were classified as contractors; however, payments made to these recipients were recorded as passthrough expenditures. In each case, the recipient appeared to meet the definition of a subrecipient. In addition, we followed up on similar errors noted during the prior fiscal year. Six recipients of MHBG funds and 1 recipient of SUPTRS funds appeared to be inappropriately categorized as subrecipients in the prior fiscal year yet reported passthrough expenditures in state fiscal year 2024. Finally, post-award monitoring was not completed for 5 of 7 MHBG and 8 of 13 SUPTRS subrecipients selected for testing. The above issues did not result in questioned costs. However, a total of $3,875,104 in MHBG funds and $357,406 in SUPTRS funds may be inappropriately reported as passthrough expenditures instead of direct expenditures. We inquired about the department’s risk assessment and monitoring activities for subrecipients. During state fiscal year 2024, the department began to develop and implement new processes and controls to help staff better distinguish recipients as subrecipients or contractors and ensure compliance with federal subrecipient monitoring requirements. Specifically, the department developed a determination checklist using the subrecipient determination criteria in 2 CFR 200.331. Staff are to complete the determination checklist for each new contract. Identified subrecipients are then required to complete a self-risk assessment tool, the result of which generates a monitoring plan outlining what monitoring procedures department staff will perform. In addition, the department is working with another entity to develop subrecipient monitoring training videos. Implementation of the above processes and controls was initiated near the end of state fiscal year 2024 with full implementation planned the end of state fiscal year 2025. We recommend department management continue to implement and strengthen controls to ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, continue to develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to the risk assessment results.

2024-010 Oregon Health Authority Submit required Federal Funding Accountability and Transparency Act reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR 93.958 Block Grants for Community Mental Health Services 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.788: H79TI085732, 2023; H79TI085732, 2024 93.958: B09SM086032, 2022; B09SM087383, 2023 93.959: B08TI084667, 2022; B08TI085829, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-045 Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. We identified and reviewed the reporting status of all the department’s new subawards subject to FFATA reporting during the audit period. We determined: • 12 of 12 Opioid STR subawards were not reported, totaling $750,000 in obligations. • 7 of 7 Block Grants for Mental Health Services subawards were not reported, totaling $4.4 million in obligations. • 13 of 13 Block Grants for Substance Use Prevention, Treatment, and Recovery Services subawards were not reported, totaling $2.8 million in obligations. The department utilizes a spreadsheet to track and maintain subaward information needed to comply with FFATA reporting requirements. However, we found the tracking spreadsheet had not been updated to include information for the majority of new contracts initiated during state fiscal year 2024. Per management, FFATA reporting was not completed due to the FFATA Reporting Coordinator position being vacant since July 2024. We recommend department management resume FFATA reporting as soon as feasible and ensure all necessary subawards are reported. We further recommend department management strengthen existing controls to ensure all subawards are appropriately tracked and reported.

2024-010 Oregon Health Authority Submit required Federal Funding Accountability and Transparency Act reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR 93.958 Block Grants for Community Mental Health Services 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.788: H79TI085732, 2023; H79TI085732, 2024 93.958: B09SM086032, 2022; B09SM087383, 2023 93.959: B08TI084667, 2022; B08TI085829, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-045 Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. We identified and reviewed the reporting status of all the department’s new subawards subject to FFATA reporting during the audit period. We determined: • 12 of 12 Opioid STR subawards were not reported, totaling $750,000 in obligations. • 7 of 7 Block Grants for Mental Health Services subawards were not reported, totaling $4.4 million in obligations. • 13 of 13 Block Grants for Substance Use Prevention, Treatment, and Recovery Services subawards were not reported, totaling $2.8 million in obligations. The department utilizes a spreadsheet to track and maintain subaward information needed to comply with FFATA reporting requirements. However, we found the tracking spreadsheet had not been updated to include information for the majority of new contracts initiated during state fiscal year 2024. Per management, FFATA reporting was not completed due to the FFATA Reporting Coordinator position being vacant since July 2024. We recommend department management resume FFATA reporting as soon as feasible and ensure all necessary subawards are reported. We further recommend department management strengthen existing controls to ensure all subawards are appropriately tracked and reported.

2024-011 Oregon Health Authority Strengthen existing controls to ensure only those costs incurred during the period of performance are charged to the grant Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: B08TI084667, 2022 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $82,315 Criteria: 2 CFR 200.303; 42 USC 300x-62 Federal regulations provide for amounts awarded to the department be available for obligation and expenditure until the end of the fiscal year following the fiscal year for which the amounts were awarded. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. During state fiscal year 2024, one grant award under the Block Grants for Substance Use Prevention, Treatment, and Recovery Services closed. The period of performance for this grant was October 1, 2021 through September 30, 2023. During the closeout process, the grant accountant reviews program expenditures recorded in the state accounting system and shifts expenditures incurred after the period of performance to a subsequent grant. During testing, we reviewed all grant expenditures recorded in the state accounting system after the period of performance. We found indirect expenditures for October and November 2023, totaling $82,315, had been charged to the closed grant. Upon inquiry, we learned the query used to identify transactions incurred after the period of performance was inadvertently filtered to identify only direct expenditures. As a result, some indirect expenditures were not identified in the query and were not appropriately moved to the subsequent grant. We recommend department management strengthen existing controls to ensure only those expenditures incurred during the period of performance are charged to the grant.

2024-011 Oregon Health Authority Strengthen existing controls to ensure only those costs incurred during the period of performance are charged to the grant Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: B08TI084667, 2022 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $82,315 Criteria: 2 CFR 200.303; 42 USC 300x-62 Federal regulations provide for amounts awarded to the department be available for obligation and expenditure until the end of the fiscal year following the fiscal year for which the amounts were awarded. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. During state fiscal year 2024, one grant award under the Block Grants for Substance Use Prevention, Treatment, and Recovery Services closed. The period of performance for this grant was October 1, 2021 through September 30, 2023. During the closeout process, the grant accountant reviews program expenditures recorded in the state accounting system and shifts expenditures incurred after the period of performance to a subsequent grant. During testing, we reviewed all grant expenditures recorded in the state accounting system after the period of performance. We found indirect expenditures for October and November 2023, totaling $82,315, had been charged to the closed grant. Upon inquiry, we learned the query used to identify transactions incurred after the period of performance was inadvertently filtered to identify only direct expenditures. As a result, some indirect expenditures were not identified in the query and were not appropriately moved to the subsequent grant. We recommend department management strengthen existing controls to ensure only those expenditures incurred during the period of performance are charged to the grant.

2024-012 Oregon Health Authority Ensure MMIS rates are accurate and updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $9 (known) Criteria: 42 CFR 433.32; 42 CRF 477.45(f)(1)(iv) The Oregon Health Authority (authority) administers client-based payments for the Medicaid program. For some clients, Medicaid allows the authority to make payments for outpatient services based on approved rates published by the Centers for Medicare and Medicaid Services (CMS). These rates must be updated within the Medicaid Management Information System (MMIS) each time they are updated by CMS. The authority uses MMIS as the state’s payment system to calculate payments due to providers based on CMS-approved rates stored in the system. We randomly selected 62 clients, and one service payment associated with each client from a statistically valid sample. Our testing identified one service payment where the Outpatient Prospective Payment System (OPPS) rate had not been updated within MMIS to the approved CMS rate for services during calendar year 2023. As a result, the service payment selected in our sample was overpaid by $9. This exception also applies to all claims of a similar nature and time period where the CMS rates were not correctly updated in MMIS. Per the authority’s actuarial unit, this error resulted due to confusion surrounding the announcement of final rule making and updated final OPPS rates. Recent CMS OPPS publications have made it easier to locate the correct final rates. We recommend authority management obtain a listing of all impacted claims, adjust all claims accordingly, and return related federal funds. We also recommend that management ensure rate tables are updated timely and accurately when notified by CMS.

2024-012 Oregon Health Authority Ensure MMIS rates are accurate and updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $9 (known) Criteria: 42 CFR 433.32; 42 CRF 477.45(f)(1)(iv) The Oregon Health Authority (authority) administers client-based payments for the Medicaid program. For some clients, Medicaid allows the authority to make payments for outpatient services based on approved rates published by the Centers for Medicare and Medicaid Services (CMS). These rates must be updated within the Medicaid Management Information System (MMIS) each time they are updated by CMS. The authority uses MMIS as the state’s payment system to calculate payments due to providers based on CMS-approved rates stored in the system. We randomly selected 62 clients, and one service payment associated with each client from a statistically valid sample. Our testing identified one service payment where the Outpatient Prospective Payment System (OPPS) rate had not been updated within MMIS to the approved CMS rate for services during calendar year 2023. As a result, the service payment selected in our sample was overpaid by $9. This exception also applies to all claims of a similar nature and time period where the CMS rates were not correctly updated in MMIS. Per the authority’s actuarial unit, this error resulted due to confusion surrounding the announcement of final rule making and updated final OPPS rates. Recent CMS OPPS publications have made it easier to locate the correct final rates. We recommend authority management obtain a listing of all impacted claims, adjust all claims accordingly, and return related federal funds. We also recommend that management ensure rate tables are updated timely and accurately when notified by CMS.

2024-013 Oregon Health Authority Improve documentation and controls over client eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-054 Questioned Costs: N/A Criteria: 42 CFR 435.907(f) Federal regulations require that certain conditions are met, including obtaining signed applications, for the Department of Human Services (department) and Oregon Health Authority (authority) to receive Medicaid funding for medical claims. We randomly selected 62 clients and one authority service payment associated with each client from a statistically valid sample. We reviewed agency documentation to test compliance related to eligibility. During our testing, we noted one client did not have a signed application on file. However, because the client is an SSI recipient, we were able to determine the client was eligible and are not questioning any costs. This oversight occurred due to administrative error. We recommend authority management obtain a signed application for this client and strengthen controls to ensure the required documentation is obtained and maintained.

2024-013 Oregon Health Authority Improve documentation and controls over client eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2022-054 Questioned Costs: N/A Criteria: 42 CFR 435.907(f) Federal regulations require that certain conditions are met, including obtaining signed applications, for the Department of Human Services (department) and Oregon Health Authority (authority) to receive Medicaid funding for medical claims. We randomly selected 62 clients and one authority service payment associated with each client from a statistically valid sample. We reviewed agency documentation to test compliance related to eligibility. During our testing, we noted one client did not have a signed application on file. However, because the client is an SSI recipient, we were able to determine the client was eligible and are not questioning any costs. This oversight occurred due to administrative error. We recommend authority management obtain a signed application for this client and strengthen controls to ensure the required documentation is obtained and maintained.

2024-014 Oregon Department of Human Services/Oregon Health Authority Implement control procedures around cost allocation system inputs Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $32,522 (known) Criteria: 2 CFR 200.400(e) The Department of Human Services (department) administers separate federally approved cost allocation plans for both the department and the Oregon Health Authority. The plans outline the methods used to allocate the various cost pools to federal programs. The department uses a series of processes for allocating shared services and pooled expenditures. We recalculated one month, January 2024, of shared services and pooled expenditures using tables from the cost allocation system, and identified differences between the recalculation and the amounts recorded in the state accounting system for various grants. After inquiry, the department identified an error related to coding of payroll costs starting in November 2023, which continued through January 2024. Payroll coding corrections were made in January 2024, but did not correct the cost allocation as those types of documents are excluded from the process. The errors identified in the testing month resulted in questioned costs of $32,522 for the Medicaid grant and immaterial allocations in approximately thirty other grants. We recommend department management implement control procedures to verify the cost allocation system inputs are appropriately identified and processed.

2024-014 Oregon Department of Human Services/Oregon Health Authority Implement control procedures around cost allocation system inputs Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $32,522 (known) Criteria: 2 CFR 200.400(e) The Department of Human Services (department) administers separate federally approved cost allocation plans for both the department and the Oregon Health Authority. The plans outline the methods used to allocate the various cost pools to federal programs. The department uses a series of processes for allocating shared services and pooled expenditures. We recalculated one month, January 2024, of shared services and pooled expenditures using tables from the cost allocation system, and identified differences between the recalculation and the amounts recorded in the state accounting system for various grants. After inquiry, the department identified an error related to coding of payroll costs starting in November 2023, which continued through January 2024. Payroll coding corrections were made in January 2024, but did not correct the cost allocation as those types of documents are excluded from the process. The errors identified in the testing month resulted in questioned costs of $32,522 for the Medicaid grant and immaterial allocations in approximately thirty other grants. We recommend department management implement control procedures to verify the cost allocation system inputs are appropriately identified and processed.

2024-015 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $28,869 (known) Criteria: 2 CFR 200.1; 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services is provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors that were not identified during the department’s and authority’s review process, which resulted in improper payments of Medicaid expenditures: • One department payment included interest related to past due amounts charged to the Medicaid program, resulting in known federally funded questioned costs of $3. The agency performed a review of all payments to the vendor and identified an additional $65 other known questioned costs. • One authority payment included cash incentives for surveys taken. Management was unable to provide allowability support, resulting in known federally funded questioned costs of $28,801. The above errors occurred due to human error and were not identified during review, leading to unallowed activities/costs being charged to the Medicaid program. We recommend department and authority management strengthen controls over review and ensure transactions are adequately supported. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2024-015 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $28,869 (known) Criteria: 2 CFR 200.1; 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services is provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors that were not identified during the department’s and authority’s review process, which resulted in improper payments of Medicaid expenditures: • One department payment included interest related to past due amounts charged to the Medicaid program, resulting in known federally funded questioned costs of $3. The agency performed a review of all payments to the vendor and identified an additional $65 other known questioned costs. • One authority payment included cash incentives for surveys taken. Management was unable to provide allowability support, resulting in known federally funded questioned costs of $28,801. The above errors occurred due to human error and were not identified during review, leading to unallowed activities/costs being charged to the Medicaid program. We recommend department and authority management strengthen controls over review and ensure transactions are adequately supported. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2024-016 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-023 Questioned Costs: $13,740 (known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.414 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type, including but not limited to, database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organization (CCO) providers and selected a random sample of 60 non-CCO providers. The 15 CCO providers and 39 non-CCO providers were enrolled by the authority, and 21 non-CCO providers enrolled by the department. For one CCO provider we noted the following: • For one authority provider, the Ownership and Control disclosure was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority subsequently obtained the missing support. For five non-CCO providers we noted the following: • For one authority provider, the Managing Employee disclosure was missing. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. • For one department provider the I-9 provided was incomplete, and the agreement and disclosures were unsigned. However, the department subsequently obtained completed documentation, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form was not completed. We were unable to determine eligibility for this provider, resulting in federal questioned costs for the fiscal year totaling $13,740. • For one department provider, the I-9 form was incomplete. However, the department subsequently obtained a completed I-9 form, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form could not be located. However, this provider has been terminated, and we will not question costs related to this provider. The above issues occurred due to human error and inadequate record maintenance, which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers.

2024-016 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-023 Questioned Costs: $13,740 (known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.414 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type, including but not limited to, database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organization (CCO) providers and selected a random sample of 60 non-CCO providers. The 15 CCO providers and 39 non-CCO providers were enrolled by the authority, and 21 non-CCO providers enrolled by the department. For one CCO provider we noted the following: • For one authority provider, the Ownership and Control disclosure was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority subsequently obtained the missing support. For five non-CCO providers we noted the following: • For one authority provider, the Managing Employee disclosure was missing. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. • For one department provider the I-9 provided was incomplete, and the agreement and disclosures were unsigned. However, the department subsequently obtained completed documentation, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form was not completed. We were unable to determine eligibility for this provider, resulting in federal questioned costs for the fiscal year totaling $13,740. • For one department provider, the I-9 form was incomplete. However, the department subsequently obtained a completed I-9 form, and we were able to determine this provider to be eligible. • For one department provider, the I-9 form could not be located. However, this provider has been terminated, and we will not question costs related to this provider. The above issues occurred due to human error and inadequate record maintenance, which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers.

2024-017 Oregon Department of Human Services/Oregon Health Authority Strengthen internal controls over the ONE system Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed; Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 42 CFR 95.621; Oregon Accounting Manual 10.60.00.PR We noted the agency had not obtained a System and Organization Controls (SOC) 2 Type II report over the Oregon Eligibility System (ONE system). The ONE system determines and verifies the eligibility of over 1.4 million Medicaid clients in Oregon, which leads to over $12.4 billion in Medicaid federal expenditures each year. The ONE system is owned by the department but administered by an external service provider. Because the ONE system is administered by an external vendor, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a SOC 2 Type II report. A Type II report provides assurance about whether the controls are functioning and effective. During the fiscal year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider, which may affect the eligibility and allowability of Medicaid expenditures. We recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure internal controls over the ONE system at the external service provider are sufficient to meet the business needs of the Medicaid program.

2024-017 Oregon Department of Human Services/Oregon Health Authority Strengthen internal controls over the ONE system Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Activities Allowed or Unallowed; Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 42 CFR 95.621; Oregon Accounting Manual 10.60.00.PR We noted the agency had not obtained a System and Organization Controls (SOC) 2 Type II report over the Oregon Eligibility System (ONE system). The ONE system determines and verifies the eligibility of over 1.4 million Medicaid clients in Oregon, which leads to over $12.4 billion in Medicaid federal expenditures each year. The ONE system is owned by the department but administered by an external service provider. Because the ONE system is administered by an external vendor, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a SOC 2 Type II report. A Type II report provides assurance about whether the controls are functioning and effective. During the fiscal year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider, which may affect the eligibility and allowability of Medicaid expenditures. We recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure internal controls over the ONE system at the external service provider are sufficient to meet the business needs of the Medicaid program.

2024-018 Oregon Department of Human Services Strengthen Medicaid fraud hotline reporting mechanisms Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 455.13(a); 42 CFR 455.14; 2 CFR 200.514 (c)(4) The state is required to have a method and criteria for identifying suspected fraud. For all suspected fraud reported the state must complete a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. The state is also required to maintain internal controls effective in preventing and/ or detecting noncompliance. To ensure adequate compliance with these requirements, the state uses a publicly available hotline portal to collect suspected fraud details. The Department of Human Services (department) manages the state’s online hotline portal and phone line. The department works collaboratively with the Oregon Heath Authority (authority) and Department of Justice (DOJ) to complete fraud investigations and referrals within their individual jurisdictions as required by standards. Referrals from the online hotline portal are extracted and then reviewed and tracked by the individual agency with appropriate jurisdiction. During inquiries and testing of the online hotline portal and phone line we noted the following: • The phone line recording provided inaccurate directions on how and where to report Medicaid fraud. The phone line instructions were not updated after changes to the department’s website, creating barriers to reporting. • The online hotline portal instructions and term definitions were vague, and not all fields were available. This could lead to a higher number of cases being closed for insufficient information. • The online hotline portal does not contain any case tracking details. As such the online hotline portal does not support any reporting to assist the department in ensuring all cases have had preliminary investigations. Without tracking details, we were unable to perform testing procedures over preliminary investigations. Per department management, the department has operated the hotline phone line and online portal for many years and strives for continuous improvement. However, management has not established procedures to ensure current systems operate in a manner that allows the agencies to meet compliance standards. We recommend department management ensure public access to provide fraud referrals is not limited and that a referral tracking mechanism is created to ensure all referrals are given preliminary investigations.

2024-018 Oregon Department of Human Services Strengthen Medicaid fraud hotline reporting mechanisms Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 455.13(a); 42 CFR 455.14; 2 CFR 200.514 (c)(4) The state is required to have a method and criteria for identifying suspected fraud. For all suspected fraud reported the state must complete a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. The state is also required to maintain internal controls effective in preventing and/ or detecting noncompliance. To ensure adequate compliance with these requirements, the state uses a publicly available hotline portal to collect suspected fraud details. The Department of Human Services (department) manages the state’s online hotline portal and phone line. The department works collaboratively with the Oregon Heath Authority (authority) and Department of Justice (DOJ) to complete fraud investigations and referrals within their individual jurisdictions as required by standards. Referrals from the online hotline portal are extracted and then reviewed and tracked by the individual agency with appropriate jurisdiction. During inquiries and testing of the online hotline portal and phone line we noted the following: • The phone line recording provided inaccurate directions on how and where to report Medicaid fraud. The phone line instructions were not updated after changes to the department’s website, creating barriers to reporting. • The online hotline portal instructions and term definitions were vague, and not all fields were available. This could lead to a higher number of cases being closed for insufficient information. • The online hotline portal does not contain any case tracking details. As such the online hotline portal does not support any reporting to assist the department in ensuring all cases have had preliminary investigations. Without tracking details, we were unable to perform testing procedures over preliminary investigations. Per department management, the department has operated the hotline phone line and online portal for many years and strives for continuous improvement. However, management has not established procedures to ensure current systems operate in a manner that allows the agencies to meet compliance standards. We recommend department management ensure public access to provide fraud referrals is not limited and that a referral tracking mechanism is created to ensure all referrals are given preliminary investigations.

2024-019 Oregon Department of Human Services Improve controls and compliance over long-term care facility audits Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 435.10; OAR 411-070-0315; OAR 411-070-0359(s); 2 CFR 200.303(a) The Oregon Medicaid state plan requires each long-term care facility to submit annual financial statements reporting actual costs to the Department of Human Services (department). Each statement is subject to a desk audit by the department. Procedures performed by the department include, but are not limited to, verifying administrator payroll costs do not exceed the maximum amount and legal costs are only related to Medicaid resident services. We selected a random sample of 11 out of 107 long-term care facilities. We identified 9 facilities where we were unable to determine if the administrator compensation for the year was greater than the maximum allowable compensation. Administrator paid time off hours were reported on a separate line with all other administrative staff paid time off, and were not factored into the calculation. The department’s current template does not require these costs to be separated for the administrator. We also identified 2 facilities where immaterial legal costs were unsupported and not adjusted. Current guidance for unallowable costs does not clearly describe how immaterial differences should be addressed. Excess costs that exceed the maximum compensation limit or are unallowable may result in the facility’s cost per resident per day being incorrectly calculated. We recommend department management strengthen controls to ensure the long-term care facility’s total administrator compensation is clearly identified and does not exceed the maximum allowed, and that unallowable costs are adjusted in line with applicable guidance.

2024-019 Oregon Department of Human Services Improve controls and compliance over long-term care facility audits Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 435.10; OAR 411-070-0315; OAR 411-070-0359(s); 2 CFR 200.303(a) The Oregon Medicaid state plan requires each long-term care facility to submit annual financial statements reporting actual costs to the Department of Human Services (department). Each statement is subject to a desk audit by the department. Procedures performed by the department include, but are not limited to, verifying administrator payroll costs do not exceed the maximum amount and legal costs are only related to Medicaid resident services. We selected a random sample of 11 out of 107 long-term care facilities. We identified 9 facilities where we were unable to determine if the administrator compensation for the year was greater than the maximum allowable compensation. Administrator paid time off hours were reported on a separate line with all other administrative staff paid time off, and were not factored into the calculation. The department’s current template does not require these costs to be separated for the administrator. We also identified 2 facilities where immaterial legal costs were unsupported and not adjusted. Current guidance for unallowable costs does not clearly describe how immaterial differences should be addressed. Excess costs that exceed the maximum compensation limit or are unallowable may result in the facility’s cost per resident per day being incorrectly calculated. We recommend department management strengthen controls to ensure the long-term care facility’s total administrator compensation is clearly identified and does not exceed the maximum allowed, and that unallowable costs are adjusted in line with applicable guidance.

2024-020 Oregon Department of Human Services Ensure nursing facility recertification surveys are completed Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 488.308(a) & (b)(1) Federal regulations require recertification surveys to be performed at each nursing facility no later than 15 months after the last day of the previous survey. Federal regulations also require the statewide average interval between surveys to be 12 months or less. We reviewed recertification surveys for 13 of 128 nursing facilities. We found surveys for two (15%) nursing facilities were completed after the established 15-month recertification window. Survey dates are tracked in the federal ASPEN system. Staff access the list of nursing facilities due for recertification using the department’s PowerBI tool. This tool pulls nursing facility information, such as survey dates, directly from ASPEN. Management reported 12 (26%) survey staff vacancies during the audit period which significantly contributed to the untimely surveys. Failure to perform timely recertification surveys may result in nursing facilities operating in violation of federal regulations, putting residents of the facilities at greater risk of inappropriate care or harm. Despite the noncompliance described above, our testing sample complied with the federal 12-month statewide average interval requirement. We recommend department management ensure recertification surveys are performed timely.

2024-020 Oregon Department of Human Services Ensure nursing facility recertification surveys are completed Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777, 93.778 Medicaid Cluster Federal Award Numbers and Years: 2305OR5MAP, 2023; 2305OR5ADM, 2023; 2405OR5MAP, 2024; 2405OR05ADM, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 42 CFR 488.308(a) & (b)(1) Federal regulations require recertification surveys to be performed at each nursing facility no later than 15 months after the last day of the previous survey. Federal regulations also require the statewide average interval between surveys to be 12 months or less. We reviewed recertification surveys for 13 of 128 nursing facilities. We found surveys for two (15%) nursing facilities were completed after the established 15-month recertification window. Survey dates are tracked in the federal ASPEN system. Staff access the list of nursing facilities due for recertification using the department’s PowerBI tool. This tool pulls nursing facility information, such as survey dates, directly from ASPEN. Management reported 12 (26%) survey staff vacancies during the audit period which significantly contributed to the untimely surveys. Failure to perform timely recertification surveys may result in nursing facilities operating in violation of federal regulations, putting residents of the facilities at greater risk of inappropriate care or harm. Despite the noncompliance described above, our testing sample complied with the federal 12-month statewide average interval requirement. We recommend department management ensure recertification surveys are performed timely.

2024-021 Oregon Department of Human Services Obtain accurate information from the ONE application Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-025; 2022-036 Questioned Costs: N/A Criteria: 45 CFR 265.3(a), (b), (d); 45 CFR 265.7(a)-(c) Federal regulations require the department to report certain financial and non-financial data elements for services paid with Temporary Assistance for Needy Families (TANF) federal funding in the quarterly ACF 199 TANF Data Report. Federal regulations also require the department to report certain financial and non financial data elements for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the quarterly ACF 209 SSP MOE Data Report. Both data reports should be supported by applicable performance records. During fiscal year 2021, the department transitioned key aspects of the TANF program to Oregon Eligibility (ONE) for case management, while TANF child welfare payments continued to be recorded in OR Kids, the child welfare system. The department contracts with an external service provider to extract data from ONE and OR Kids to populate the data reports. Program staff currently work with the external service provider to obtain comprehensive data reports prior to submission to review them for errors and when found, each issue is logged as a defect for the external service provider to correct. During fiscal year 2023, the department and the U.S. Administration for Children and Families (U.S. ACF) identified data reports submitted for fiscal year 2023 were incorrect and the department was unable to provide corrected data to auditors. Over the past year, the department has made progress in improving the accuracy and completeness of the data reported in the ACF 199 and ACF 209 reports. Reports were submitted by the department and accepted by U.S. ACF for the reporting periods during fiscal year 2024. We judgmentally tested the reports prepared and submitted for the quarter ended June 30, 2024. Based on our review of a random selection of 80 cases reported in the ACF 199 and ACF 209 reports, we noted the following errors: • For one case reported in the ACF 199, we noted a defect in the reporting logic for the line item containing the federal time-limit exemption status resulting in the reporting of an invalid code. • For two cases reported in the ACF 199 and four cases reported in the ACF 209, we noted discrepancies between the data reported for the Work Participation Status, related Work Participation Activities, and the case documentation. The data reported for each case indicated the client was required to participate but not participating in countable activities. However, case narratives supported the client was engaged in countable activities during the reporting period. For the two ACF 199 cases, we also noted a Personal Development Plan (PDP) where attendance hours should have been recorded was not appropriately established according to policy. As the reporting process relies on the attendance hours recorded in the PDP to populate the work participation line items, the absence of a PDP resulted in the report incompletely capturing the client’s JOBS activity. • For four cases reported in the ACF 209, we noted discrepancies between the case documentation and the hours reported as Unsubsidized Employment. In each case, the hours reported could not be substantiated by the available case documentation. Additionally, for one case, the Work Participation Status was incorrectly reported as not meeting minimum participation requirements when case documentation supported minimum participation had been met. Although improvements to the reporting have been made, the presence of errors in the current year indicates continued efforts are needed to ensure the reports accurately reflect the information within the case management system. We also noted documentation supporting the completion of the data review following the department’s procedures could be strengthened. Accurate reporting is necessary to ensure U.S. ACF can make appropriate determinations on the state’s compliance with required work participation rates. Additionally, as the ONE system is administered by an external service provider, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a System and Organization Controls (SOC) 2 Type II report which addresses the suitability of the design and operating effectiveness of controls. During the past year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider that may affect the department’s operations and reporting applicable to the TANF program. We recommend department management continue to review ACF 199 and ACF 209 reports prior to submission, monitor known compilation defects to ensure performance data reports submitted are complete and accurate, and ensure documentation is maintained supporting the completion of the data review procedures. We also recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure that the internal controls over the ONE system at the external service provider are sufficient to meet the business needs of ODHS and OHA.

2024-021 Oregon Department of Human Services Obtain accurate information from the ONE application Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-025; 2022-036 Questioned Costs: N/A Criteria: 45 CFR 265.3(a), (b), (d); 45 CFR 265.7(a)-(c) Federal regulations require the department to report certain financial and non-financial data elements for services paid with Temporary Assistance for Needy Families (TANF) federal funding in the quarterly ACF 199 TANF Data Report. Federal regulations also require the department to report certain financial and non financial data elements for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the quarterly ACF 209 SSP MOE Data Report. Both data reports should be supported by applicable performance records. During fiscal year 2021, the department transitioned key aspects of the TANF program to Oregon Eligibility (ONE) for case management, while TANF child welfare payments continued to be recorded in OR Kids, the child welfare system. The department contracts with an external service provider to extract data from ONE and OR Kids to populate the data reports. Program staff currently work with the external service provider to obtain comprehensive data reports prior to submission to review them for errors and when found, each issue is logged as a defect for the external service provider to correct. During fiscal year 2023, the department and the U.S. Administration for Children and Families (U.S. ACF) identified data reports submitted for fiscal year 2023 were incorrect and the department was unable to provide corrected data to auditors. Over the past year, the department has made progress in improving the accuracy and completeness of the data reported in the ACF 199 and ACF 209 reports. Reports were submitted by the department and accepted by U.S. ACF for the reporting periods during fiscal year 2024. We judgmentally tested the reports prepared and submitted for the quarter ended June 30, 2024. Based on our review of a random selection of 80 cases reported in the ACF 199 and ACF 209 reports, we noted the following errors: • For one case reported in the ACF 199, we noted a defect in the reporting logic for the line item containing the federal time-limit exemption status resulting in the reporting of an invalid code. • For two cases reported in the ACF 199 and four cases reported in the ACF 209, we noted discrepancies between the data reported for the Work Participation Status, related Work Participation Activities, and the case documentation. The data reported for each case indicated the client was required to participate but not participating in countable activities. However, case narratives supported the client was engaged in countable activities during the reporting period. For the two ACF 199 cases, we also noted a Personal Development Plan (PDP) where attendance hours should have been recorded was not appropriately established according to policy. As the reporting process relies on the attendance hours recorded in the PDP to populate the work participation line items, the absence of a PDP resulted in the report incompletely capturing the client’s JOBS activity. • For four cases reported in the ACF 209, we noted discrepancies between the case documentation and the hours reported as Unsubsidized Employment. In each case, the hours reported could not be substantiated by the available case documentation. Additionally, for one case, the Work Participation Status was incorrectly reported as not meeting minimum participation requirements when case documentation supported minimum participation had been met. Although improvements to the reporting have been made, the presence of errors in the current year indicates continued efforts are needed to ensure the reports accurately reflect the information within the case management system. We also noted documentation supporting the completion of the data review following the department’s procedures could be strengthened. Accurate reporting is necessary to ensure U.S. ACF can make appropriate determinations on the state’s compliance with required work participation rates. Additionally, as the ONE system is administered by an external service provider, best practices would include procedures to verify the internal controls at the external service provider are adequate to meet the business needs of the department. Such assurances are typically provided through a System and Organization Controls (SOC) 2 Type II report which addresses the suitability of the design and operating effectiveness of controls. During the past year the department obtained a SOC 2 Type I report; however, the Type I report only identifies and evaluates the design of controls and does not conclude on the operating effectiveness of controls. As a result, the department does not have assurance over the operating effectiveness of controls at the external service provider that may affect the department’s operations and reporting applicable to the TANF program. We recommend department management continue to review ACF 199 and ACF 209 reports prior to submission, monitor known compilation defects to ensure performance data reports submitted are complete and accurate, and ensure documentation is maintained supporting the completion of the data review procedures. We also recommend department management obtain an annual SOC 2 Type II report over the service organization’s internal controls for the ONE application or perform other alternative procedures to ensure that the internal controls over the ONE system at the external service provider are sufficient to meet the business needs of ODHS and OHA.

2024-022 Oregon Department of Human Services Improve controls to ensure eligibility criteria are met Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-027; 2022-039; 2022-040 Questioned Costs: $5,187 (known); $4,499,112 (likely) Criteria: 42 USC 602(a)(1)(A) & (B)(iii); 45 CFR 264.10; 2 CFR 200.303 Federal regulations state the department is responsible for creating and submitting a state plan that outlines how the program will be conducted to meet the objectives of the Temporary Assistance for Needy Families (TANF) program. This includes the criteria used to determine the eligibility of TANF applicants. Additionally, federal regulations require each state must meet the requirements of the Income Eligibility and Verification System (IEVS) and request certain information from the Internal Revenue Service, State Wage Information Collections Agency, Social Security Administration, and Immigration and Naturalization Service when making TANF eligibility determinations. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. To help ensure eligibility determinations are made in accordance with the approved state plan, the department’s Program Integrity Unit (PIU) performs approximately 17 case eligibility reviews per month. These reviews confirm the appropriateness of eligibility determinations based on client information documented in the case management system. Identified errors are referred to the applicable branch office for correction and to determine if additional training is needed. We tested a random sample of 18 of 173 PIU case eligibility reviews performed during fiscal year 2024 specific to federally funded TANF cases to determine the effectiveness of the control. One case review identified an eligibility error which was not referred to the branch office. According to the department, this case review was on the schedule of findings; however, the communication to the branch office was not completed for unknown reasons. Failure to communicate issues identified during the case reviews reduces the control’s effectiveness in ensuring eligibility determinations are appropriately made and potential training opportunities are identified at the branch office. We also tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and the department performed the appropriate IEVS data checks in accordance with federal requirements. We identified the following errors, which were the result of caseworker errors in documenting the completion of the required eligibility steps in accordance with established enrollment procedures: • For one case, unearned income from an unemployment claim was not factored into the initial eligibility determination and subsequent benefit month calculations as required resulting in known questioned costs of $2,754. • For one case, the procedure regarding the non-financial eligibility requirement for pursuit of available assets was not followed to either obtain the client’s statement of intent to pursue unemployment or document good cause for the client’s non-pursuit of the asset resulting in known questioned costs of $2,433. • For one case, the department did not document the required IEVS check during the initial eligibility determination. However, we did not identify questioned costs associated with this case, as case documentation supported the applicant’s eligibility. The likely questioned costs total $4,499,112 based on the known questioned costs identified in our sample test. We recommend department management ensure case eligibility reviews are performed in accordance with the established procedures. We also recommend department management ensure caseworkers are adequately trained on TANF enrollment procedures to ensure all applicable requirements are met.

2024-022 Oregon Department of Human Services Improve controls to ensure eligibility criteria are met Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2023-027; 2022-039; 2022-040 Questioned Costs: $5,187 (known); $4,499,112 (likely) Criteria: 42 USC 602(a)(1)(A) & (B)(iii); 45 CFR 264.10; 2 CFR 200.303 Federal regulations state the department is responsible for creating and submitting a state plan that outlines how the program will be conducted to meet the objectives of the Temporary Assistance for Needy Families (TANF) program. This includes the criteria used to determine the eligibility of TANF applicants. Additionally, federal regulations require each state must meet the requirements of the Income Eligibility and Verification System (IEVS) and request certain information from the Internal Revenue Service, State Wage Information Collections Agency, Social Security Administration, and Immigration and Naturalization Service when making TANF eligibility determinations. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. To help ensure eligibility determinations are made in accordance with the approved state plan, the department’s Program Integrity Unit (PIU) performs approximately 17 case eligibility reviews per month. These reviews confirm the appropriateness of eligibility determinations based on client information documented in the case management system. Identified errors are referred to the applicable branch office for correction and to determine if additional training is needed. We tested a random sample of 18 of 173 PIU case eligibility reviews performed during fiscal year 2024 specific to federally funded TANF cases to determine the effectiveness of the control. One case review identified an eligibility error which was not referred to the branch office. According to the department, this case review was on the schedule of findings; however, the communication to the branch office was not completed for unknown reasons. Failure to communicate issues identified during the case reviews reduces the control’s effectiveness in ensuring eligibility determinations are appropriately made and potential training opportunities are identified at the branch office. We also tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and the department performed the appropriate IEVS data checks in accordance with federal requirements. We identified the following errors, which were the result of caseworker errors in documenting the completion of the required eligibility steps in accordance with established enrollment procedures: • For one case, unearned income from an unemployment claim was not factored into the initial eligibility determination and subsequent benefit month calculations as required resulting in known questioned costs of $2,754. • For one case, the procedure regarding the non-financial eligibility requirement for pursuit of available assets was not followed to either obtain the client’s statement of intent to pursue unemployment or document good cause for the client’s non-pursuit of the asset resulting in known questioned costs of $2,433. • For one case, the department did not document the required IEVS check during the initial eligibility determination. However, we did not identify questioned costs associated with this case, as case documentation supported the applicant’s eligibility. The likely questioned costs total $4,499,112 based on the known questioned costs identified in our sample test. We recommend department management ensure case eligibility reviews are performed in accordance with the established procedures. We also recommend department management ensure caseworkers are adequately trained on TANF enrollment procedures to ensure all applicable requirements are met.

2024-023 Oregon Department of Human Services Strengthen controls over program expenditures Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $2,962 (known); $415,856 (likely) Criteria: 2 CFR 200.303 The Temporary Assistance for Needy Families (TANF) program provides time limited cash assistance to eligible needy families with children. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. We identified two instances during our testing where expenditures were inappropriately charged to the TANF program: • We tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the payments made to the clients during those months were for allowable activities under the TANF program. One transaction was determined to be a duplicate payment for housing support services assistance. A check was issued to a participant for two months of rent and late fees to assist the family in maintaining stable housing. According to a case narrative in the case management system, the check was stated to have been lost and a second check was issued directly to the participant’s landlord. However, the original check was cashed prior to being canceled resulting in the duplicate expenditure for the same assistance payment. The duplicate payment resulted in known questioned costs of $2,419 and likely questioned costs of $415,856. • We tested a random sample of 25 of 37,987 child welfare TANF transactions during fiscal year 2024 to determine if the transactions were for allowable activities under the TANF program. One child welfare TANF transaction was determined to be a correction that did not refund the TANF program as intended. We identified known questioned costs of $543 due to the error. The known questioned costs were not projected to the population due to the uncommon nature of canceled and refunded transactions. We recommend department management strengthen controls to ensure program expenditures and corrections are properly recorded.

2024-023 Oregon Department of Human Services Strengthen controls over program expenditures Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $2,962 (known); $415,856 (likely) Criteria: 2 CFR 200.303 The Temporary Assistance for Needy Families (TANF) program provides time limited cash assistance to eligible needy families with children. Department management is responsible for establishing and maintaining effective internal controls to provide reasonable assurance the program is being operated in accordance with federal regulations. We identified two instances during our testing where expenditures were inappropriately charged to the TANF program: • We tested a random sample of 60 of 193,547 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the payments made to the clients during those months were for allowable activities under the TANF program. One transaction was determined to be a duplicate payment for housing support services assistance. A check was issued to a participant for two months of rent and late fees to assist the family in maintaining stable housing. According to a case narrative in the case management system, the check was stated to have been lost and a second check was issued directly to the participant’s landlord. However, the original check was cashed prior to being canceled resulting in the duplicate expenditure for the same assistance payment. The duplicate payment resulted in known questioned costs of $2,419 and likely questioned costs of $415,856. • We tested a random sample of 25 of 37,987 child welfare TANF transactions during fiscal year 2024 to determine if the transactions were for allowable activities under the TANF program. One child welfare TANF transaction was determined to be a correction that did not refund the TANF program as intended. We identified known questioned costs of $543 due to the error. The known questioned costs were not projected to the population due to the uncommon nature of canceled and refunded transactions. We recommend department management strengthen controls to ensure program expenditures and corrections are properly recorded.

2024-024 Oregon Department of Human Services Improve controls relating to client non-cooperation with child support requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-026 Questioned Costs: N/A Criteria: 45 CFR 264.30-.31 Federal regulations require the department to refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency. If the department determines referred individuals are not cooperating, without good cause, in establishing, modifying, or enforcing a support order with respect to the child, then the department must reduce or deny assistance in the Temporary Assistance for Needy Families (TANF) program. We tested a random sample of 40 of 4,615 child support non cooperation tasks submitted to the department by the Oregon Department of Justice’s Department of Child Support (DCS) to determine if the department took appropriate action to move the client into compliance or to decrease benefits as required by federal regulations. We found for two of the 40 cases tested, department policies were not followed to ensure child support cooperation was verified with DCS prior to closing the task. In both cases, department staff relied on client statements to establish their cooperation status. No fiscal year 2024 questioned costs are associated with either case due to the following circumstances: • For one case, the DCS child support non cooperation task was received mid June 2024. Although this task was inappropriately closed during the same month, we would not expect a sanction to be applied until the following month at the earliest which would be outside of our audit period. • For the other case, a DCS child support non cooperation task was received and closed inappropriately in March 2024. However, due to separate circumstances, TANF eligibility was terminated the following month. We recommend management ensure department employees are adequately trained on applicable procedures and requirements relating to child support cooperation with DCS.

2024-024 Oregon Department of Human Services Improve controls relating to client non-cooperation with child support requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-026 Questioned Costs: N/A Criteria: 45 CFR 264.30-.31 Federal regulations require the department to refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency. If the department determines referred individuals are not cooperating, without good cause, in establishing, modifying, or enforcing a support order with respect to the child, then the department must reduce or deny assistance in the Temporary Assistance for Needy Families (TANF) program. We tested a random sample of 40 of 4,615 child support non cooperation tasks submitted to the department by the Oregon Department of Justice’s Department of Child Support (DCS) to determine if the department took appropriate action to move the client into compliance or to decrease benefits as required by federal regulations. We found for two of the 40 cases tested, department policies were not followed to ensure child support cooperation was verified with DCS prior to closing the task. In both cases, department staff relied on client statements to establish their cooperation status. No fiscal year 2024 questioned costs are associated with either case due to the following circumstances: • For one case, the DCS child support non cooperation task was received mid June 2024. Although this task was inappropriately closed during the same month, we would not expect a sanction to be applied until the following month at the earliest which would be outside of our audit period. • For the other case, a DCS child support non cooperation task was received and closed inappropriately in March 2024. However, due to separate circumstances, TANF eligibility was terminated the following month. We recommend management ensure department employees are adequately trained on applicable procedures and requirements relating to child support cooperation with DCS.

2024-025 Oregon Department of Human Services Ensure work participation rate calculation uses verified and accurate data Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2022-038 Questioned Costs: N/A Criteria: 45 CFR 261.61-.62, .65 Federal regulations require each state maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Each state must have procedures to count and verify reported hours of work and must comply with its Work Verification Plan as approved by the U.S. Administration for Children and Families (U.S. ACF). Oregon’s Work Verification Plan outlines a system of controls for how reported hours will be verified and documented, and for reviews and monitoring procedures to identify errors. The Program Integrity Unit (PIU) is responsible for performing monthly reviews on a sample of cases to determine the accuracy of attendance hour reports by activity. However, during fiscal year 2024, the department stated the monthly reviews were delayed due to staffing constraints. At the time of our audit procedures in December 2024, the department had completed reviews for ten months of the fiscal year. Without the timely completion of reviews, the effectiveness of the department’s control to ensure the accuracy of work participation data is reduced and may result in a higher risk of inclusion of inaccurate data in reports submitted to U.S. ACF. We tested a random sample of 40 of 213,356 case benefit months (one case for one benefit month) identified in the ACF 199 and ACF 209 data reports to determine if work participation data was accurately reported and supported by case management records. We identified the following: • Two cases reported on the ACF 199 did not have adequate documentation supporting the verification of attendance hours recorded for the participants. • One case reported on the ACF 209 did not have adequate documentation supporting the work hours calculated and recorded for the participants. These inaccurate or unverified hours were reported to U.S. ACF for use in calculating the work participation rate. If the state fails to follow the approved Work Verification Plan, U.S. ACF may penalize the state. We recommend department management ensure JOBS reviews are performed in accordance with the established procedures. We also recommend department management ensure the work participation rate is calculated appropriately using verified and accurate participation data in adherence to the department’s Work Verification Plan.

2024-025 Oregon Department of Human Services Ensure work participation rate calculation uses verified and accurate data Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2301ORTANF, 2023; 2401ORTANF, 2024 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: 2022-038 Questioned Costs: N/A Criteria: 45 CFR 261.61-.62, .65 Federal regulations require each state maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Each state must have procedures to count and verify reported hours of work and must comply with its Work Verification Plan as approved by the U.S. Administration for Children and Families (U.S. ACF). Oregon’s Work Verification Plan outlines a system of controls for how reported hours will be verified and documented, and for reviews and monitoring procedures to identify errors. The Program Integrity Unit (PIU) is responsible for performing monthly reviews on a sample of cases to determine the accuracy of attendance hour reports by activity. However, during fiscal year 2024, the department stated the monthly reviews were delayed due to staffing constraints. At the time of our audit procedures in December 2024, the department had completed reviews for ten months of the fiscal year. Without the timely completion of reviews, the effectiveness of the department’s control to ensure the accuracy of work participation data is reduced and may result in a higher risk of inclusion of inaccurate data in reports submitted to U.S. ACF. We tested a random sample of 40 of 213,356 case benefit months (one case for one benefit month) identified in the ACF 199 and ACF 209 data reports to determine if work participation data was accurately reported and supported by case management records. We identified the following: • Two cases reported on the ACF 199 did not have adequate documentation supporting the verification of attendance hours recorded for the participants. • One case reported on the ACF 209 did not have adequate documentation supporting the work hours calculated and recorded for the participants. These inaccurate or unverified hours were reported to U.S. ACF for use in calculating the work participation rate. If the state fails to follow the approved Work Verification Plan, U.S. ACF may penalize the state. We recommend department management ensure JOBS reviews are performed in accordance with the established procedures. We also recommend department management ensure the work participation rate is calculated appropriately using verified and accurate participation data in adherence to the department’s Work Verification Plan.

2024-026 Oregon Department of Human Services Ensure refugee status is verified and documented and income information is updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.566 Refugee and Entrant Assistance-State/Replacement Designee-Administered Programs Federal Award Numbers and Years: 2301ORRCMA-05, 2023; 2403ORRCMA-02, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $14,346 (known); $96,638 (likely) Criteria: 45 CFR 400 The objective of the Refugee Assistance Program is to provide for resettlement of refugees and to assist them in attaining economic self-sufficiency as soon as possible after their initial placement in the United States. To be eligible, an applicant for assistance must provide proof of their refugee status in the form of documentation issued by the Immigration and Naturalization Service. Also, as a condition of the receipt of refugee cash assistance, the client is required to register for various employment services unless there is good cause for non-participation. The state agency must operate its refugee cash assistance program consistent with the provisions of the Temporary Assistance for Needy Families (TANF) program with regard to the treatment of income in the determination of initial and on-going eligibility. We tested a random sample of 60 of 71,233 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and provided the proof of refugee status in accordance with federal requirements. We identified the following: • In two cases, there was no evidence that the caseworker verified non-citizen status during the initial eligibility determination. • In five cases, the caseworker did not update income information timely when the client obtained employment. • In one case, the client was employment authorized and required to register for various employment services; however, there is no evidence of participation or good cause for non-participation. As a result of the errors listed above, we determined the program has known and likely questions costs for the Eligibility compliance requirement of $14,346 and $96,638, respectively. We recommend department management ensure refugee status and compliance with work requirements is verified and documented. We also recommend department management ensure income information is updated timely to avoid overpayments.

2024-026 Oregon Department of Human Services Ensure refugee status is verified and documented and income information is updated timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.566 Refugee and Entrant Assistance-State/Replacement Designee-Administered Programs Federal Award Numbers and Years: 2301ORRCMA-05, 2023; 2403ORRCMA-02, 2024 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: $14,346 (known); $96,638 (likely) Criteria: 45 CFR 400 The objective of the Refugee Assistance Program is to provide for resettlement of refugees and to assist them in attaining economic self-sufficiency as soon as possible after their initial placement in the United States. To be eligible, an applicant for assistance must provide proof of their refugee status in the form of documentation issued by the Immigration and Naturalization Service. Also, as a condition of the receipt of refugee cash assistance, the client is required to register for various employment services unless there is good cause for non-participation. The state agency must operate its refugee cash assistance program consistent with the provisions of the Temporary Assistance for Needy Families (TANF) program with regard to the treatment of income in the determination of initial and on-going eligibility. We tested a random sample of 60 of 71,233 client benefit months (one client for one benefit month) during fiscal year 2024 to determine if the clients met the applicable eligibility requirements and provided the proof of refugee status in accordance with federal requirements. We identified the following: • In two cases, there was no evidence that the caseworker verified non-citizen status during the initial eligibility determination. • In five cases, the caseworker did not update income information timely when the client obtained employment. • In one case, the client was employment authorized and required to register for various employment services; however, there is no evidence of participation or good cause for non-participation. As a result of the errors listed above, we determined the program has known and likely questions costs for the Eligibility compliance requirement of $14,346 and $96,638, respectively. We recommend department management ensure refugee status and compliance with work requirements is verified and documented. We also recommend department management ensure income information is updated timely to avoid overpayments.

2024-027 Oregon Department of Human Services Strengthen controls around background checks Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.658 Foster Care – Title IV-E Federal Award Numbers and Years: 2401ORFOST, 2024; 2301ORFOST 2023 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $4,491 (known) Criteria: 42 USC 671(a)(20)(A) Providers participating in the foster care program, whether a foster care family or a child-care institution, must be fully licensed by the proper state foster care licensing authority to be considered eligible for federal program funding. To be fully licensed, foster family home providers must satisfactorily have met a criminal records check, including a fingerprint-based check. We selected a random sample of 40 out of 23,622 expenditure transactions, representing maintenance payments made to providers caring for children in the foster care program. In our testing, we identified one provider that did not have all necessary background checks documented, including a fingerprint-based check. Department management indicated the certifying office did not follow requirements for completing and maintaining evidence of fingerprint-based background checks. The sample item was $142 in error; when reviewing the provider for the year, we identified $4,491 in known questioned costs. When projected to the population, questioned costs exceeded $25,000. We recommend department management ensure fingerprint-based background checks are completed and evidence is properly maintained.

2024-027 Oregon Department of Human Services Strengthen controls around background checks Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.658 Foster Care – Title IV-E Federal Award Numbers and Years: 2401ORFOST, 2024; 2301ORFOST 2023 Compliance Requirements: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $4,491 (known) Criteria: 42 USC 671(a)(20)(A) Providers participating in the foster care program, whether a foster care family or a child-care institution, must be fully licensed by the proper state foster care licensing authority to be considered eligible for federal program funding. To be fully licensed, foster family home providers must satisfactorily have met a criminal records check, including a fingerprint-based check. We selected a random sample of 40 out of 23,622 expenditure transactions, representing maintenance payments made to providers caring for children in the foster care program. In our testing, we identified one provider that did not have all necessary background checks documented, including a fingerprint-based check. Department management indicated the certifying office did not follow requirements for completing and maintaining evidence of fingerprint-based background checks. The sample item was $142 in error; when reviewing the provider for the year, we identified $4,491 in known questioned costs. When projected to the population, questioned costs exceeded $25,000. We recommend department management ensure fingerprint-based background checks are completed and evidence is properly maintained.

2024-028 Oregon Department of Human Services Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A230054, 2023; H126A240054, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-028 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 15 out of 25,740 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we identified the following: • The department could not provide documentation of the hourly wage and start date of employment at exit for one client when the report was submitted. • The reported application date for one client was 22 days after the date of the application per the supporting documentation. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-028 Oregon Department of Human Services Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A230054, 2023; H126A240054, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-028 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 15 out of 25,740 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we identified the following: • The department could not provide documentation of the hourly wage and start date of employment at exit for one client when the report was submitted. • The reported application date for one client was 22 days after the date of the application per the supporting documentation. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-029 Oregon Commission for the Blind Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A240055, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-031 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 5 out of 768 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we found the department could not provide documentation of the hourly wage and start date of employment at exit for two clients. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. This issue was identified during the audit for the year ended June 30, 2023. In response to the prior year’s finding, department management took corrective action in September 2024. Our audit procedures were specific to the fiscal year ended June 30, 2024, and during the audit period the department had not yet taken corrective action to ensure the accuracy of the data report and verify compliance was achieved. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-029 Oregon Commission for the Blind Strengthen internal controls to ensure performance data reports are accurate Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A240055, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-031 Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The department is required to submit quarterly program performance reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment, services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed 5 out of 768 clients from the December 2023 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we found the department could not provide documentation of the hourly wage and start date of employment at exit for two clients. Without adequate internal controls to ensure the accuracy of the case information reported, the department may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 is used by the Federal government to evaluate and monitor the programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. This issue was identified during the audit for the year ended June 30, 2023. In response to the prior year’s finding, department management took corrective action in September 2024. Our audit procedures were specific to the fiscal year ended June 30, 2024, and during the audit period the department had not yet taken corrective action to ensure the accuracy of the data report and verify compliance was achieved. We recommend department management strengthen internal controls to ensure information reported in the RSA-911 client performance data report is accurate.

2024-030 Oregon Department of Education Perform regular fiscal monitoring as part of subrecipient monitoring Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.027 Special Education Grants to States (Special Education Cluster) Federal Award Numbers and Years: H027A230095, 2024; H027A230095-23A, 2024 Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e) As part of our audit of the Special Education Grants to States program (program) at the Oregon Department of Education (department), we reviewed the department’s procedures for monitoring subrecipients to ensure program compliance. The department has several layers to the subrecipient monitoring requirements and has procedures to perform programmatic reviews, fiscal reviews, and other reviews based upon a risk assessment. For the fiscal monitoring, the department has a procedure in place to ensure that every subrecipient is reviewed at least once every three years, with approximately one-third of the subrecipients reviewed each year. In our testing, we reviewed a sample of seven of the 67 subrecipients that were scheduled for review in fiscal year 2024. In our initial sample, we found that one of the seven was not monitored during the year. We expanded our testing by selecting another ten subrecipients and the department could not provide support that the review was completed for nine of the ten. Per discussion with department staff, the specific subrecipient in our original sample had not had a fiscal review since January 2021. The fiscal monitoring was not performed as the subrecipient had not drawn funds from a specific grant period prior to the review process, although they had drawn from previous grant awards during the year. Failure to adequately monitor subrecipient compliance and supporting documentation increases the risk of inappropriate spending and noncompliance with federal requirements. We recommend department management ensure subrecipient fiscal monitoring is performed on the schedule set by department policy. We also recommend the department develop a procedure to track the completion of fiscal monitoring.

2024-030 Oregon Department of Education Perform regular fiscal monitoring as part of subrecipient monitoring Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.027 Special Education Grants to States (Special Education Cluster) Federal Award Numbers and Years: H027A230095, 2024; H027A230095-23A, 2024 Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency, Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e) As part of our audit of the Special Education Grants to States program (program) at the Oregon Department of Education (department), we reviewed the department’s procedures for monitoring subrecipients to ensure program compliance. The department has several layers to the subrecipient monitoring requirements and has procedures to perform programmatic reviews, fiscal reviews, and other reviews based upon a risk assessment. For the fiscal monitoring, the department has a procedure in place to ensure that every subrecipient is reviewed at least once every three years, with approximately one-third of the subrecipients reviewed each year. In our testing, we reviewed a sample of seven of the 67 subrecipients that were scheduled for review in fiscal year 2024. In our initial sample, we found that one of the seven was not monitored during the year. We expanded our testing by selecting another ten subrecipients and the department could not provide support that the review was completed for nine of the ten. Per discussion with department staff, the specific subrecipient in our original sample had not had a fiscal review since January 2021. The fiscal monitoring was not performed as the subrecipient had not drawn funds from a specific grant period prior to the review process, although they had drawn from previous grant awards during the year. Failure to adequately monitor subrecipient compliance and supporting documentation increases the risk of inappropriate spending and noncompliance with federal requirements. We recommend department management ensure subrecipient fiscal monitoring is performed on the schedule set by department policy. We also recommend the department develop a procedure to track the completion of fiscal monitoring.

2024-031 Oregon Department of Education Implement controls to ensure FFATA reporting is completed for all required subawards Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 10.582 Fresh Fruit and Vegetable Program (Child Nutrition Cluster) Federal Award Numbers and Years: 202322L160347, 2023; 202423L160347, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Child Nutrition Cluster is subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. For the Child Nutrition Program, only the Fresh Fruit and Vegetable program is subject to FFATA reporting. Our audit procedures included the testing of 20 Fresh Fruit and Vegetable subawards/subaward modifications totaling $647,311 in obligations. During our testing we noted 9 subawards were not reported to FSRS totaling $213,992. According to department management, it had initially overlooked FFATA reporting for the Fresh Fruit and Vegetable subaward so was still working on submitting the subaward in FSRS. We recommend department management strengthen controls to ensure the monthly FFATA reports are submitted.

2024-031 Oregon Department of Education Implement controls to ensure FFATA reporting is completed for all required subawards Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 10.582 Fresh Fruit and Vegetable Program (Child Nutrition Cluster) Federal Award Numbers and Years: 202322L160347, 2023; 202423L160347, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Child Nutrition Cluster is subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. For the Child Nutrition Program, only the Fresh Fruit and Vegetable program is subject to FFATA reporting. Our audit procedures included the testing of 20 Fresh Fruit and Vegetable subawards/subaward modifications totaling $647,311 in obligations. During our testing we noted 9 subawards were not reported to FSRS totaling $213,992. According to department management, it had initially overlooked FFATA reporting for the Fresh Fruit and Vegetable subaward so was still working on submitting the subaward in FSRS. We recommend department management strengthen controls to ensure the monthly FFATA reports are submitted.

2024-032 Oregon Department of Justice Ensure program expenditures are supported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.563 Child Support Services Federal Award Numbers and Years: 2401ORSCSS, 2024 Compliance Requirements: Allowable Costs/Cost Principles; Matching, Level of Effort, Earmarking Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $1,138 (known); $173,028 (likely) Criteria: 2 CFR 200.403(g); 42 USC 655(a)(2)(C) Federal regulations require that program expenditures must be adequately supported to be allowable. Additionally, the Child Support Enforcement program requires a 34% state match for most expenditures. We tested a random sample of 40 program expenditures to determine whether they were for allowable costs and the state match was met. We identified one expenditure where the amount entered in the state’s financial accounting system did not agree to supporting documentation. This was caused by a combination of unclear supporting documentation and insufficient review of the expenditure prior to processing. As a result, excess federal reimbursement was received for $1,138 which, projected to the population, resulted in likely questioned costs exceeding $25,000. However, once notified, department management promptly corrected the error. Without clear support and sufficient review of expenditures, errors could go undetected in the state’s financial accounting system causing federal reimbursement to be overstated. We recommend that department management ensure controls verify expenditures are adequately supported and accurately processed.

2024-032 Oregon Department of Justice Ensure program expenditures are supported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.563 Child Support Services Federal Award Numbers and Years: 2401ORSCSS, 2024 Compliance Requirements: Allowable Costs/Cost Principles; Matching, Level of Effort, Earmarking Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $1,138 (known); $173,028 (likely) Criteria: 2 CFR 200.403(g); 42 USC 655(a)(2)(C) Federal regulations require that program expenditures must be adequately supported to be allowable. Additionally, the Child Support Enforcement program requires a 34% state match for most expenditures. We tested a random sample of 40 program expenditures to determine whether they were for allowable costs and the state match was met. We identified one expenditure where the amount entered in the state’s financial accounting system did not agree to supporting documentation. This was caused by a combination of unclear supporting documentation and insufficient review of the expenditure prior to processing. As a result, excess federal reimbursement was received for $1,138 which, projected to the population, resulted in likely questioned costs exceeding $25,000. However, once notified, department management promptly corrected the error. Without clear support and sufficient review of expenditures, errors could go undetected in the state’s financial accounting system causing federal reimbursement to be overstated. We recommend that department management ensure controls verify expenditures are adequately supported and accurately processed.

2024-033 Oregon Housing and Community Services Federal reports should contain accurate information Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program Federal Award Numbers and Years: 2302ORLIEI, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302(b)(2); 2 CFR 200.303 Federal regulations require that federal reports are accurate and supported by applicable accounting records. Federal regulations also require management to establish and maintain effective internal control over the federal award. Based on our testing, we identified multiple reports where the amount of obligated funds for the Infrastructure Investment and Jobs Act (IIJA) was not appropriately reported. Funds for this grant were obligated through separate contracts, which differed from the department’s standard process of obligating funds through their grant management system application. At the time these reports were completed, the preparing staff did not have a summary of the IIJA obligations, which resulted in errors in the following September 2023 report line items: • SF-425, Federal Share of Unliquidated Obligations • LIHEAP Performance Data Form, Unobligated Infrastructure Act Funds Carried Over to next FFY • LIHEAP Carryover and Reallotment Report, Carryover Amount • LIHEAP Quarterly Performance and Management Report, Amount of Funds Obligated. Additionally, documentation was not retained to show this report was approved. Based on submitted reports, it appeared the department did not obligate at least 90% of the award by September 30, 2023, as required. However, based on our testing we determined the department had obligated over 90% of the award by September 30, 2023. We recommend department management strengthen internal controls to ensure the required LIHEAP reports contain accurate information.

2024-033 Oregon Housing and Community Services Federal reports should contain accurate information Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program Federal Award Numbers and Years: 2302ORLIEI, 2023 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302(b)(2); 2 CFR 200.303 Federal regulations require that federal reports are accurate and supported by applicable accounting records. Federal regulations also require management to establish and maintain effective internal control over the federal award. Based on our testing, we identified multiple reports where the amount of obligated funds for the Infrastructure Investment and Jobs Act (IIJA) was not appropriately reported. Funds for this grant were obligated through separate contracts, which differed from the department’s standard process of obligating funds through their grant management system application. At the time these reports were completed, the preparing staff did not have a summary of the IIJA obligations, which resulted in errors in the following September 2023 report line items: • SF-425, Federal Share of Unliquidated Obligations • LIHEAP Performance Data Form, Unobligated Infrastructure Act Funds Carried Over to next FFY • LIHEAP Carryover and Reallotment Report, Carryover Amount • LIHEAP Quarterly Performance and Management Report, Amount of Funds Obligated. Additionally, documentation was not retained to show this report was approved. Based on submitted reports, it appeared the department did not obligate at least 90% of the award by September 30, 2023, as required. However, based on our testing we determined the department had obligated over 90% of the award by September 30, 2023. We recommend department management strengthen internal controls to ensure the required LIHEAP reports contain accurate information.

2024-034 Oregon Housing and Community Services Quarterly Performance Report should include all expenditures incurred to date Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii Federal Award Numbers and Years: B-21-DZ-41-0001, 2021 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.328(c), DRGR User Manual, Chapter 19, p. 15 CDBG recipients are required to provide a quarterly performance report (QPR) including expenditures incurred period-to-date and in total for each activity. Activity expenditures should be equal to the amount of funds the grantee expended that quarter, regardless of the amount drawn. We found the June 30, 2024 report filed with HUD did not contain accurate information regarding funds expended for the CDBG-Disaster Recovery (CDBG-DR) program as a whole, or for individual activities within the program. OHCS hired a management consultant to provide consulting services, including assistance with preparation of the quarterly reports to HUD for the CDBG-DR grant. Although the department provided the consultant with a report detailing all expenditures for the program, the consultant's approach to QPR reporting did not take into account expenditures the department does not pre-draw for, such as direct and indirect payroll, and services and supplies costs. As a result, only costs for the Homeowner Assistance and Reconstruction Program (HARP) activity and admin costs were reported, although costs were incurred for other program activities. Overall costs were understated by $6.4 million to date and $5.3 million for the period. HARP costs were underreported by $4.3 million to date and $3.8 million for the quarter, and admin costs were underreported by $1 million to date and $0.6 million for the quarter. We recommend quarterly performance reports are prepared to include all expenditures incurred for the period and to date regardless of whether funds have been drawn.

2024-034 Oregon Housing and Community Services Quarterly Performance Report should include all expenditures incurred to date Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii Federal Award Numbers and Years: B-21-DZ-41-0001, 2021 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.328(c), DRGR User Manual, Chapter 19, p. 15 CDBG recipients are required to provide a quarterly performance report (QPR) including expenditures incurred period-to-date and in total for each activity. Activity expenditures should be equal to the amount of funds the grantee expended that quarter, regardless of the amount drawn. We found the June 30, 2024 report filed with HUD did not contain accurate information regarding funds expended for the CDBG-Disaster Recovery (CDBG-DR) program as a whole, or for individual activities within the program. OHCS hired a management consultant to provide consulting services, including assistance with preparation of the quarterly reports to HUD for the CDBG-DR grant. Although the department provided the consultant with a report detailing all expenditures for the program, the consultant's approach to QPR reporting did not take into account expenditures the department does not pre-draw for, such as direct and indirect payroll, and services and supplies costs. As a result, only costs for the Homeowner Assistance and Reconstruction Program (HARP) activity and admin costs were reported, although costs were incurred for other program activities. Overall costs were understated by $6.4 million to date and $5.3 million for the period. HARP costs were underreported by $4.3 million to date and $3.8 million for the quarter, and admin costs were underreported by $1 million to date and $0.6 million for the quarter. We recommend quarterly performance reports are prepared to include all expenditures incurred for the period and to date regardless of whether funds have been drawn.

2024-035 Oregon Business Development Department Ensure CDBG expenditures are recorded in SFMA under the appropriate grant year Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302 The department is required under 2 CFR 200.302 to have a financial management system sufficient to permit the preparation of reports required under the terms and conditions of the CDBG grant; and to track expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Program staff tracked the obligation of grant funds and used this information to prepare the December 31, 2023 PR28 report. However, because of significant turnover in accounting, there was no review from accounting staff to ensure the program tracking reconciled to the State’s financial management application (SFMA). We audited the December 31, 2023 PR28 reports filed for awards from 2020 (including a COVID-19 award), 2021, 2022, and 2023. The expenditures reported in HUD’s Integrated Disbursement and Information System (IDIS) did not materially agree to expenditures or draws recorded in the state’s financial management application (SFMA) for those grants. Variances between cumulative expenditures in SFMA and cumulative expenditures reported ranged between $1.6 million underreported for 2020 to $4.5 million overreported for the 2020 COVID award. In total, cumulative expenditures for those grant awards were overreported by $6.5 million. The CDBG state grants are required to be expended within eight years. Failure to properly account for expenditures for a specific grant year could result in the loss of funds if not obligated and expended within the period of performance of the grant. We recommend the agency reconcile SFMA to amounts in IDIS and make adjustments as necessary to ensure CDBG expenditure reports are accurate and agree to accounting records.

2024-035 Oregon Business Development Department Ensure CDBG expenditures are recorded in SFMA under the appropriate grant year Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302 The department is required under 2 CFR 200.302 to have a financial management system sufficient to permit the preparation of reports required under the terms and conditions of the CDBG grant; and to track expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Program staff tracked the obligation of grant funds and used this information to prepare the December 31, 2023 PR28 report. However, because of significant turnover in accounting, there was no review from accounting staff to ensure the program tracking reconciled to the State’s financial management application (SFMA). We audited the December 31, 2023 PR28 reports filed for awards from 2020 (including a COVID-19 award), 2021, 2022, and 2023. The expenditures reported in HUD’s Integrated Disbursement and Information System (IDIS) did not materially agree to expenditures or draws recorded in the state’s financial management application (SFMA) for those grants. Variances between cumulative expenditures in SFMA and cumulative expenditures reported ranged between $1.6 million underreported for 2020 to $4.5 million overreported for the 2020 COVID award. In total, cumulative expenditures for those grant awards were overreported by $6.5 million. The CDBG state grants are required to be expended within eight years. Failure to properly account for expenditures for a specific grant year could result in the loss of funds if not obligated and expended within the period of performance of the grant. We recommend the agency reconcile SFMA to amounts in IDIS and make adjustments as necessary to ensure CDBG expenditure reports are accurate and agree to accounting records.

2024-036 Oregon Business Development Department Implement controls and submit delinquent FFATA reports Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-18-DC-41-0001, 2018; B-19-DC-41-0001, 2019; B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170, Appendix A The State CDBG and CDBG-CV (COVID) programs are subject to the Federal Funding Accountability and Transparency Act of 2006. The "Transparency Act" requires direct recipients of grants to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). We found nearly $45 million in subawards made for CDBG projects since 2020 were not reported on the federal reporting system. The department has not prepared FFATA reports since 2020 due to fiscal staff turnover and no staff formally assigned to perform the task. As a result, information regarding subawards of CDBG funds was not made available publicly as required. We recommend the department report all delinquent subaward reports for the CDBG program as required. We further recommend the department develop and implement written procedures and assign staff to ensure subaward reporting occurs timely in the future.

2024-036 Oregon Business Development Department Implement controls and submit delinquent FFATA reports Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii; 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (COVID-19) Federal Award Numbers and Years: B-18-DC-41-0001, 2018; B-19-DC-41-0001, 2019; B-20-DC-41-0001, 2020; B-21-DC-41-0001, 2021; B-22-DC-41-0001, 2022; B-23-DC-41-0001, 2023; B-20-DW-41-0001, 2020 (COVID-19); Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 170, Appendix A The State CDBG and CDBG-CV (COVID) programs are subject to the Federal Funding Accountability and Transparency Act of 2006. The "Transparency Act" requires direct recipients of grants to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). We found nearly $45 million in subawards made for CDBG projects since 2020 were not reported on the federal reporting system. The department has not prepared FFATA reports since 2020 due to fiscal staff turnover and no staff formally assigned to perform the task. As a result, information regarding subawards of CDBG funds was not made available publicly as required. We recommend the department report all delinquent subaward reports for the CDBG program as required. We further recommend the department develop and implement written procedures and assign staff to ensure subaward reporting occurs timely in the future.

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure their subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned OBDD to review 24 of the state’s 369 subrecipients’ audits, receiving a total of $42.3 million in pass-through funding from 11 state agencies. OBDD did not review any of these entities due to staff turnover. We reviewed two of these subrecipients and found neither had audit findings. This does not preclude the remaining 22 subrecipients from having audit findings requiring communication We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.

2024-037 Oregon Business Development Department Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure their subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned OBDD to review 24 of the state’s 369 subrecipients’ audits, receiving a total of $42.3 million in pass-through funding from 11 state agencies. OBDD did not review any of these entities due to staff turnover. We reviewed two of these subrecipients and found neither had audit findings. This does not preclude the remaining 22 subrecipients from having audit findings requiring communication We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.

2024-038 Oregon Business Development Department Implement controls over reporting Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Reporting Type of Finding: Significant Deficiency Prior Year Findings: 2023-043 Questioned Costs: N/A Criteria: 2 CFR 200.303 Department management is responsible for establishing and maintaining effective internal controls that provide reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Recipients of Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) are required to provide quarterly project and expenditure reports to the Department of Administrative Services’ Coronavirus Fiscal Relief Team (DAS CFRT), who compiles the statewide report and submits it to the Department of the Treasury. The quarterly CSLFRF reports require several types of information and updates to be included each quarter, including project descriptions, completion status, and contracted entity details. The report also includes information on obligations and expenditures, provided by the fiscal staff. An Infrastructure Program Specialist works directly with the project management team assigned to the projects and compiles the information into a report spreadsheet. Once compiled, it is transmitted directly to DAS with no additional internal review. The report submitted for infrastructure projects under interagency agreement 6203 and 6252 for the quarter ending June 30, 2024, reported $46.7 million in cumulative expenditures, but $48.3 million were recorded in accounting records, resulting in an under-reporting of expenditures by $1.6 million, or 3.4%. CSLFRF awards must be used for costs incurred (obligated) by December 31, 2024, and expended for those incurred costs by December 31, 2026. Any funds not expended must be returned to the Department of the Treasury at the end of the grant. Because the department’s reporting process did not include a review by fiscal staff prior to submission to DAS to ensure the report included accurate expenditure and obligation information, the department risks the potential loss of CSLFRF funds. We recommend the department implement a review by fiscal staff of expenditure and obligation amounts on CSLFRF quarterly reports before submission to DAS CFRT to ensure the reports agree to the accounting records.

2024-038 Oregon Business Development Department Implement controls over reporting Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2020 (COVID-19) Compliance Requirements: Reporting Type of Finding: Significant Deficiency Prior Year Findings: 2023-043 Questioned Costs: N/A Criteria: 2 CFR 200.303 Department management is responsible for establishing and maintaining effective internal controls that provide reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Recipients of Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) are required to provide quarterly project and expenditure reports to the Department of Administrative Services’ Coronavirus Fiscal Relief Team (DAS CFRT), who compiles the statewide report and submits it to the Department of the Treasury. The quarterly CSLFRF reports require several types of information and updates to be included each quarter, including project descriptions, completion status, and contracted entity details. The report also includes information on obligations and expenditures, provided by the fiscal staff. An Infrastructure Program Specialist works directly with the project management team assigned to the projects and compiles the information into a report spreadsheet. Once compiled, it is transmitted directly to DAS with no additional internal review. The report submitted for infrastructure projects under interagency agreement 6203 and 6252 for the quarter ending June 30, 2024, reported $46.7 million in cumulative expenditures, but $48.3 million were recorded in accounting records, resulting in an under-reporting of expenditures by $1.6 million, or 3.4%. CSLFRF awards must be used for costs incurred (obligated) by December 31, 2024, and expended for those incurred costs by December 31, 2026. Any funds not expended must be returned to the Department of the Treasury at the end of the grant. Because the department’s reporting process did not include a review by fiscal staff prior to submission to DAS to ensure the report included accurate expenditure and obligation information, the department risks the potential loss of CSLFRF funds. We recommend the department implement a review by fiscal staff of expenditure and obligation amounts on CSLFRF quarterly reports before submission to DAS CFRT to ensure the reports agree to the accounting records.

2024-039 Oregon Department of Emergency Management Continue FFATA reporting improvements and make inquiries on FSRS functionality Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4499-DR-OR, 2020; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021; FEMA-4768-DR-OR, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-033 Questioned Costs: N/A Criteria: 2 CFR 200.303(a)-(d); 2 CFR 170, Appendix A I(a) The Federal Funding Accountability and Transparency Act (FFATA) requires federal award recipients to submit key data elements for any subaward obligation that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Oregon Department of Emergency Management (department) reported the prior year FFATA finding as partially corrected. We judgmentally selected 10 of 383 subaward obligations for review. • We found eight were submitted with the applicable data elements but were not submitted timely, as based on guidance from FEMA the department was catching up with past due reports from the previous year. • We found one obligation was on the department’s tracking sheet, but support was not retained and FSRS did not show evidence of the submission. • We found one obligation to be among 30 for which the agency stated FSRS prevented them from entering. We recommend department management continue with its improvement on the timeliness of FFATA submissions and also make inquiries to the operators of FSRS regarding the inability to enter certain submissions.

2024-039 Oregon Department of Emergency Management Continue FFATA reporting improvements and make inquiries on FSRS functionality Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4499-DR-OR, 2020; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021; FEMA-4768-DR-OR, 2024 Compliance Requirements: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: 2023-033 Questioned Costs: N/A Criteria: 2 CFR 200.303(a)-(d); 2 CFR 170, Appendix A I(a) The Federal Funding Accountability and Transparency Act (FFATA) requires federal award recipients to submit key data elements for any subaward obligation that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Oregon Department of Emergency Management (department) reported the prior year FFATA finding as partially corrected. We judgmentally selected 10 of 383 subaward obligations for review. • We found eight were submitted with the applicable data elements but were not submitted timely, as based on guidance from FEMA the department was catching up with past due reports from the previous year. • We found one obligation was on the department’s tracking sheet, but support was not retained and FSRS did not show evidence of the submission. • We found one obligation to be among 30 for which the agency stated FSRS prevented them from entering. We recommend department management continue with its improvement on the timeliness of FFATA submissions and also make inquiries to the operators of FSRS regarding the inability to enter certain submissions.

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: Multiple Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure its subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned the Oregon Department of Emergency Management (department) to review 27 of the state’s 369 subrecipients’ audits, receiving a total of $176.2 million in pass-through funding from 20 state agencies. The department did not review any of these entities because they determined their other commitments were higher priorities. We reviewed two of these subrecipients and found one expended a total of $36 million and had one audit finding that may affect various federal programs. This subrecipient received pass-through funding from five other contributing agencies who were not informed of the finding. This does not preclude the remaining 25 subrecipients from having audit findings requiring communication to the contributing agencies. We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.

2024-040 Oregon Department of Emergency Management Assign responsibility to ensure review of subrecipient audit reports Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) Federal Award Numbers and Years: Multiple Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(e)(2), (e)(3), (g), (h), (i); 2 CFR 200.521(a), (c), (d) Federal regulations require recipients of federal awards ensure its subrecipients expending $750,000 or more during fiscal years prior to October 1, 2024, are audited according to requirements in 2 CFR 200 Subpart F, and then to perform certain actions dependent upon audit results. To satisfy this requirement, the Department of Administrative Services assigns Oregon state departments to be audit agencies. An audit agency is to: • Ensure the subrecipient received an audit or consider sanctions per 2 CFR 200.339. • Ensure the subrecipient takes corrective action on all findings negatively affecting subawards. • Issue a management decision within six months of the Federal Audit Clearinghouse’s acceptance of the subrecipient’s audit report if there were findings pertaining to the agency’s subawards. • Contact other state agencies that have also passed through funds to the subrecipients (contributing agencies), alerting them to findings related to their programs. In fiscal year 2024, DAS assigned the Oregon Department of Emergency Management (department) to review 27 of the state’s 369 subrecipients’ audits, receiving a total of $176.2 million in pass-through funding from 20 state agencies. The department did not review any of these entities because they determined their other commitments were higher priorities. We reviewed two of these subrecipients and found one expended a total of $36 million and had one audit finding that may affect various federal programs. This subrecipient received pass-through funding from five other contributing agencies who were not informed of the finding. This does not preclude the remaining 25 subrecipients from having audit findings requiring communication to the contributing agencies. We recommend department management complete its review of subrecipient audits as soon as possible to ensure its monitoring procedures are sufficient, and to inform contributing agencies of any deficiencies that may affect their programs.

2024-041 Oregon Military Department Ensure undisbursed obligation extension support is retained Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV (multiple appendices and years) Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: National Guard Regulation 5-1, Chapter 11-10 Federal regulations state only costs obligated during the period of the federal fiscal year or period of performance identified in the cooperative agreement, are reimbursable. If undisbursed obligations remain 90 days after the close of the federal fiscal year, the recipient shall submit an extension, a detailed listing of un-cleared obligations and a projected timetable for their liquidation and disbursement, no later than December 31. We identified 18 state fiscal year 2024 expenditures recorded to agreements with federal fiscal years 2020-2023. As the original periods of performance would have ended, these expenditures should have been detailed on submitted extensions. The department provided support for five extensions although some did not include the listing of un-cleared obligations. The department could not provide support that extensions were made for the remaining 13 agreements. Without retaining adequate documentation for extensions, the department risks losing federal funding for undisbursed obligations which would then be reimbursed with state funds. The department provided a lack of management oversight and lack of codified processes as the cause of these exceptions. We recommend department management ensure support is retained for all submitted cooperative agreement extensions including the listings of un-cleared obligations.

2024-041 Oregon Military Department Ensure undisbursed obligation extension support is retained Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV (multiple appendices and years) Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: N/A Criteria: National Guard Regulation 5-1, Chapter 11-10 Federal regulations state only costs obligated during the period of the federal fiscal year or period of performance identified in the cooperative agreement, are reimbursable. If undisbursed obligations remain 90 days after the close of the federal fiscal year, the recipient shall submit an extension, a detailed listing of un-cleared obligations and a projected timetable for their liquidation and disbursement, no later than December 31. We identified 18 state fiscal year 2024 expenditures recorded to agreements with federal fiscal years 2020-2023. As the original periods of performance would have ended, these expenditures should have been detailed on submitted extensions. The department provided support for five extensions although some did not include the listing of un-cleared obligations. The department could not provide support that extensions were made for the remaining 13 agreements. Without retaining adequate documentation for extensions, the department risks losing federal funding for undisbursed obligations which would then be reimbursed with state funds. The department provided a lack of management oversight and lack of codified processes as the cause of these exceptions. We recommend department management ensure support is retained for all submitted cooperative agreement extensions including the listings of un-cleared obligations.

2024-042 Oregon Military Department Ensure payroll expenditures are coded to the correct period and errors are corrected timely Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV-23-2-1021, 2023; W912JV-23-2-1024, 2023; W912JV-23-2-1001, 2023; W912JV-19-2-1001, 2019 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $35,820 (known) Criteria: National Guard Regulation 5-1, Chapter 11-2 Federal regulations require that grantees must obligate funds in the federal fiscal year specified in the relevant appendix to be reimbursable by federal funds. We queried the Oregon Military Department’s (department) accounting records and identified 12 awards by federal fiscal year 2019-2023 with payroll expenditures charged in federal fiscal year 2024, which is outside the period of performance. We analyzed these awards and included any correcting entries. After corrections, five awards still had payroll recorded outside the period of performance. For activity in two awards, the department provided support that although the accounting records still had not been corrected as of March 2025, the department had not sought reimbursement. For four awards, we question costs of $35,280. The department may have not sought reimbursement but could not easily locate the supporting documentation. According to department management, these errors were due to incorrect coding in the payroll system. While the department is aware of some of these errors, it is not timely correcting the errors as several of the uncorrected errors are more than a year old. If the underlying accounting records do not properly account for transactions, the department could inappropriately request reimbursement for obligations that are outside of the period of performance for the grant. We recommend department management implement controls to ensure payroll expenditures are coded correctly and timely correct errors when identified.

2024-042 Oregon Military Department Ensure payroll expenditures are coded to the correct period and errors are corrected timely Federal Awarding Agency: U.S. Department of Defense Assistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Numbers and Years: W912JV-23-2-1021, 2023; W912JV-23-2-1024, 2023; W912JV-23-2-1001, 2023; W912JV-19-2-1001, 2019 Compliance Requirements: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Findings: N/A Questioned Costs: $35,820 (known) Criteria: National Guard Regulation 5-1, Chapter 11-2 Federal regulations require that grantees must obligate funds in the federal fiscal year specified in the relevant appendix to be reimbursable by federal funds. We queried the Oregon Military Department’s (department) accounting records and identified 12 awards by federal fiscal year 2019-2023 with payroll expenditures charged in federal fiscal year 2024, which is outside the period of performance. We analyzed these awards and included any correcting entries. After corrections, five awards still had payroll recorded outside the period of performance. For activity in two awards, the department provided support that although the accounting records still had not been corrected as of March 2025, the department had not sought reimbursement. For four awards, we question costs of $35,280. The department may have not sought reimbursement but could not easily locate the supporting documentation. According to department management, these errors were due to incorrect coding in the payroll system. While the department is aware of some of these errors, it is not timely correcting the errors as several of the uncorrected errors are more than a year old. If the underlying accounting records do not properly account for transactions, the department could inappropriately request reimbursement for obligations that are outside of the period of performance for the grant. We recommend department management implement controls to ensure payroll expenditures are coded correctly and timely correct errors when identified.

2024-043 Oregon Department of Veterans’ Affairs Ensure accuracy of per diem recalculations Federal Awarding Agency: U.S. Department of Veterans Affairs Assistance Listing Number and Name: 64.015 Veterans State Nursing Home Care Federal Award Numbers and Years: 648-Y37190, 2023; 648-Y37191, 2023; 648-Y47191, 2024; 648-Y48191, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303; 38 CFR 51.40 Federal regulations allow for the department to request a per diem from the federal awarding agency each month for every day an eligible veteran resides in a veteran state nursing home. Federal regulations require the department establish, document, and maintain effective internal control over the federal award that provides reasonable assurance they are managing the federal award in compliance with federal statutes. The department performs a recalculation for each per diem to provide reasonable assurance they are managing the award in compliance with federal statutes. We selected a total of eight out of 24 per diem requests for review. Of the eight requests we reviewed, we identified four requests where the recalculation performed was not accurate. The recalculated per diem totals did not agree to the actual amount requested, due to differences in the number of resident per diem days or per diem amounts used in the recalculation. Department staff has indicated the recalculation has been updated over the past year as staff has become more familiar with the recalculation process, but additional updates are still needed. Without an appropriate recalculation, the department may request a per diem for ineligible individuals residing in the nursing home, or the per diem may be for an incorrect number of days. We recommend department management strengthen internal controls to ensure per diem requests are accurately recalculated.

2024-043 Oregon Department of Veterans’ Affairs Ensure accuracy of per diem recalculations Federal Awarding Agency: U.S. Department of Veterans Affairs Assistance Listing Number and Name: 64.015 Veterans State Nursing Home Care Federal Award Numbers and Years: 648-Y37190, 2023; 648-Y37191, 2023; 648-Y47191, 2024; 648-Y48191, 2024 Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency Prior Year Findings: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303; 38 CFR 51.40 Federal regulations allow for the department to request a per diem from the federal awarding agency each month for every day an eligible veteran resides in a veteran state nursing home. Federal regulations require the department establish, document, and maintain effective internal control over the federal award that provides reasonable assurance they are managing the federal award in compliance with federal statutes. The department performs a recalculation for each per diem to provide reasonable assurance they are managing the award in compliance with federal statutes. We selected a total of eight out of 24 per diem requests for review. Of the eight requests we reviewed, we identified four requests where the recalculation performed was not accurate. The recalculated per diem totals did not agree to the actual amount requested, due to differences in the number of resident per diem days or per diem amounts used in the recalculation. Department staff has indicated the recalculation has been updated over the past year as staff has become more familiar with the recalculation process, but additional updates are still needed. Without an appropriate recalculation, the department may request a per diem for ineligible individuals residing in the nursing home, or the per diem may be for an incorrect number of days. We recommend department management strengthen internal controls to ensure per diem requests are accurately recalculated.

2023-015 Oregon Housing and Community Services Fully implement controls to ensure subrecipients are in compliance with program requirements Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Equipment and Real Property Management; Matching, Level of Effort, Earmarking; Procurement, Suspension, and Debarment, Special Tests and Provisions Type of Finding: Material Weakness Prior Year Findings: 2022-018, 2022-019, 2022-020, 2022-021, 2022-024 Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 2 CFR 200.311; 2 CFR 200.313; 2 CFR 200.317 - .327; 24 CFR 576.100; 24 CFR 576.101(c); 24 CFR 576.102(c) The Emergency Solutions Grants (ESG/ESG-CV) program is operated by the department via pass-through funds to subrecipients. With the significant influx of pandemic relief funds, the department expanded the number of subrecipients partnered with from 17 longstanding community action agencies (CAAs) to a total of 45 CAA and non-CAA subrecipients. During fiscal year 2023, 98% of program expenditures were passed through to 40 of these subrecipients. Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance program expenditures are in compliance with the terms and conditions of the federal award. However, the significant increases to federal funding the creation and implementation of a new award system for non-CAA recipients, and the increase in the number of subrecipients, along with a period of high employee turnover led to delays in the department’s development and implementation of sufficient subrecipient monitoring processes that would meet this objective. Department management subsequently contracted with a private auditing firm to assist in the monitoring of the program activities and expenditures of funds passed through to the subrecipients to remedy the noted control weaknesses. Department staff and the private auditing firm are currently working through the monitoring backlog. However, at the time of the audit, monitoring of only 16 of the 40 subrecipients had been completed which represents 58% of the fiscal year 2023 pass-through expenditures. Additionally, the completed monitoring was only performed over fiscal year 2022 expenditures as the department works to catch up on monitoring of prior year expenditures. Incomplete monitoring could lead to program noncompliance. We recommend department management complete the review and monitoring of program funds passed through to subrecipients for compliance with all applicable program requirements.

2023-016 Oregon Housing and Community Services Verification that subrecipients have not been suspended or debarred needs to be retained Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirements: Procurement and Suspension and Debarment Type of Finding: Material Weakness Prior Year Finding: 2022-022 Questioned Costs: N/A Criteria: 2 CFR 200.317 - .327 The prior-year audit noted that procurement processes were not followed. Specifically, evidence the department verified non-community action agencies receiving Emergency Solutions Grant Program and ESG-CV money were not suspended or debarred was not retained. During the audit, we attempted to review the suspension and debarment status of those entities that had received ESG and ESG-CV funds in 2023. We found the department did not retain evidence the suspension and debarment status of subrecipients was verified. Management stated this was due to the contracts being executed prior to fiscal year 2023. Due to employee turnover, it was unclear whether the verifications had not been performed or documentation had not been retained. Current procurement staff have since developed procedures to ensure future compliance with suspension and debarment requirements. We recommend department management perform and retain evidence of checks of suspension and debarment for all new and existing contracts.

2023-017 Oregon Housing and Community Services Ensure review of federal cash draws are adequately documented to support the draws are for the immediate cash needs of the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Cash Management Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2022-034 Questioned Costs: $14,831.23 (known); $27,652.04 (likely) Criteria: 31 CFR § 205.33(a); 2 CFR § 200.303 Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Cash draws on federal awards should be limited to the minimum amount needed for the immediate cash needs of operating the program. We reviewed 60 randomly selected subrecipient requests for funds, five randomly selected cash draws for the reimbursement of central administrative costs, and one judgmentally selected cash draw for disbursements to subrecipients. We noted the following based on our review: • Five of the subrecipient requests for funds totaling $44,166.54 were for advance payments that did not have sufficient documentation supporting the immediate cash needs of the requests. Without adequate verification of cash needs, the department is at risk of sending funds to subrecipients that are not for the immediate cash needs of the program. • Two of the cash draws for central administrative costs and the one cash draw for disbursements to subrecipients did not have evidence of separate review and approval prior to the drawdown of funds. One of these draws resulted in inadvertently drawing $14,831.23 in funds from the incorrect award. We recommend department management ensure controls are implemented and documented to verify cash draws are for the immediate cash needs of the program and are made on the correct awards.

2023-018 Oregon Housing and Community Services Ensure grant management report control is performed and documented Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2022ORLIEI, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Earmarking; Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR § 200.303; 45 CFR § 96.14(a)(2) The department is subject to various Earmarking and Period of Performance requirements as a condition of their awards under the Low-Income Home Energy Assistance Program (LIHEAP). Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Additionally, management is responsible for evaluating and monitoring the department’s compliance with the terms and conditions of federal awards and taking prompt action when instances of noncompliance are identified. The department’s monthly preparation of the Grant Management Report serves as the control that helps provide assurance over compliance with the Earmarking and Period of Performance requirements. However, according to department management, staffing challenges led to the Grant Management Reports not being consistently prepared throughout state fiscal year 2023. No instances of noncompliance were noted during our testing of the Earmarking requirement. However, we identified one award where the Period of Performance deadline for the obligation of 90% of the award was not met. Without a consistently performed control, the department is subject to increased risk of noncompliance. We recommend department management ensure controls are performed and documented as intended by their established process.

2023-019 Oregon Housing and Community Services Ensure documentation is retained to support amounts reported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2102ORE5C6, 2021 (COVID-19); 2102ORLIEA, 2021; 2202ORLIEA, 2022; 2302ORLIEA, 2023; 2302ORLIEE, 2023; 2302ORLIEI, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. The department is required to submit the Quarterly Performance and Management (Quarterly) Report that contains various data and information including the obligation of funding. During our testing of the Quarterly reports submitted during the state fiscal year 2023 audit period, we identified discrepancies in the obligation totals reported by the department compared to auditor recalculations for two of the four quarters. However, the department was not able to locate documentation supporting the obligation totals included in the reports. We recommend department management ensure adequate controls are in place over reporting and documentation is retained to support the amounts reported.

2023-020 Oregon Health Authority Implement controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services 93.958 Block Grants for Community Mental Health Services (COVID-19) 93.959 Block Grants for Prevention and Treatment of Substance Abuse 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023; 1B09SM085378, 2021 (COVID-19); 1B09SM085906, 2021 (COVID-19); 1B09SM083994, 2021 (COVID-19) 93.959: 1B08TI083472, 2021; 1B08TI084667, 2022; 1B08TI085829, 2023; B08TI083963, 2021 (COVID-19); B08TI084603, 2021 (COVID-19); B08TI083513, 2021 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2022-043 Questioned Costs: N/A Criteria: 45 CFR 75.351(a); 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require pass-through entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient’s determined risk to ensure subawards are used appropriately. We reviewed the department’s classification of a sample of eight of 58 Mental Health Block Grant (MHBG) and 16 of 126 Substance Abuse Block Grant (SABG) recipient contracts with expenditures recorded during state fiscal year 2023. Based on the following inconsistencies identified during our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and whether the related expenditures are reported accordingly. • Two recipients of MHBG funds were classified as subrecipients by the department, but it was unclear if each met the definition of a subrecipient. • One recipient of MHBG funds and three recipients of SABG funds were classified as a contractor and appeared to meet the definition of a contractor; however, payments made to these recipients were recorded as passthrough expenditures. • One recipient of MHBG funds was not included in the department’s Federal Funding Accountability and Transparency Act (FFATA) reporting. The oversight is due to the recipient being categorized as a subrecipient in the contract but as a contractor in the department’s database used to track subrecipients requiring FFATA reporting. In addition, we followed up on similar errors noted during the prior fiscal year. Two recipients of MHBG funds and one recipient of SABG funds were inappropriately categorized as subrecipients in the prior fiscal year and reported passthrough expenditures in state fiscal year 2023. During the prior audit, the department agreed one of the entities in question should be a contractor and the related expenditures should be reported as direct rather than passthrough. We also noted both direct and passthrough expenditures were reported for two counties receiving MHBG funds; however, the contracts did not clearly indicate what expenditures would be considered direct expenditures, and which would be considered passthrough to the counties. The above issues did not result in questioned costs. However, a total of $724,634 in MHBG funds and $235,000 in SABG funds were reported as passthrough expenditures and should have been reported as direct expenditures. Finally, we inquired of the department’s risk assessment and monitoring activities for subrecipients. Based on our inquiries, the department does not have a formal implemented process for performing risk assessments to determine appropriate monitoring activities. Moreover, the department has not implemented a formal process to ensure subrecipients comply with federal regulations, terms, and conditions of the subaward, and subaward performance goals are achieved. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals may not be met. We recommend department management ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or passthrough expenditures. We further recommend department management comply with subrecipient monitoring requirements, develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to risk assessment results.

2023-021 Oregon Health Authority Implement controls to ensure earmarked expenditures are tracked and compliance achieved Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services Federal Award Numbers and Years: 93.958: 1B09SM083823, 2021; 1B09SM086032, 2022; 1B09SM087383, 2023 Compliance Requirement: Matching, Level of Effort, Earmarking Type of Finding: Significant Deficiency Prior Year Finding: 2022-044 Questioned Costs: N/A Criteria: 42 USC 300x-9(c)(1); 42 USC 300x-9(d)(1); 2 CFR 200.303 The Mental Health Block Grant (MHBG) is subject to various Earmarking requirements. These requirements ensure the department meets minimum expenditure thresholds. Federal regulations require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department is required to expend 10% of the MHBG federal award for early serious mental illness, including psychotic disorders. It is also required to expend 5% of the federal award for serious mental illnesses and children with serious mental and emotional disturbances. These set asides are calculated and budgeted when the federal awards are granted. Based on testing performed, we concluded the department complied with all applicable Earmarking requirements during state fiscal year 2023. However, during the audit period, the department did not have controls in place to track applicable expenditures to ensure compliance was achieved. Upon inquiry, staff reported the department has now set up structure within the state accounting system, and going forward will track the expenditures. The lack of controls in place to track earmarked expenditures increases the department’s risk of noncompliance with federal program requirements. This was also reported in fiscal year 2022. We recommend department management implement controls to ensure applicable expenditures are adequately tracked and reviewed for compliance with federal Earmarking requirements.

2023-022 Oregon Department of Human Services/Oregon Health Authority Ensure compliance with federal Medicaid hospital audit requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Special Tests and Provisions – Inpatient Hospital and Long-Term Care Facility Audits Type of Finding: Significant Deficiency; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 42 CFR 447.253(g); 2 CFR 303(a) Federal regulations require management to establish and maintain effective internal control to ensure compliance with federal program requirements. As part of its system of internal control, federal regulations require the Oregon Health Authority (authority) to conduct periodic audits of the financial and statistical records of participating hospitals. Inpatient hospitals are required to report actual costs to the authority who conducts audits of the reported costs. However, during state fiscal year 2023, the authority did not conduct any audits of the 61 hospitals that received Medicaid federal funds. The department had unexpected turnover during the audit period. New staff were hired to fill the vacancy; however, per management training and updating agency tools caused a delay in the completion of audits. As of March 2024, staff started sending out initial report for fiscal years 2021 and 2022 but no cost settlements have been completed. Additionally, the authority still has two outstanding settlements going back to fiscal year 2016. By failing to complete required audits, the authority does not have assurance that participating hospitals use program funds properly, which could lead to inappropriate payments to the hospitals. During the prior audit of state fiscal year 2021, the auditors reported a finding (2021-017) related to missing documentation supporting completed cost settlements. During state fiscal year 2023, the authority reported that corrective action had been taken to address the issue. However, we were unable to verify the status as no cost settlements were completed. We recommend management ensure compliance with federal program requirements by prioritizing the completion and documentation of hospital audits.

2023-023 Oregon Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Special Tests and Provisions – Provider Eligibility Type of Finding: Material Weakness; Noncompliance Prior Year Finding: 2022-057 Questioned Costs: $3,629(known) Criteria: 42 CFR 438.602; 8 CFR 274a.2; 42 CFR 431.107; 42 CFR 455.102 to 455.106; 42 CFR 455.412; 42 CFR 455.414; 42 CFR 455.436 Provider eligibility requirements for the Medicaid program differ depending on the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulation agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, the federal regulations require that the Oregon Health Authority (authority) and the Department of Human Services (department) redetermine eligibility for Medicaid providers at least every five years by performing revalidation activities as determined by provider type including but not limited to database and licensing checks to ensure providers are still eligible to participate in the Medicaid program. We tested all 15 Coordinated Care Organizations (CCO) providers and selected a random sample of 62 non-CCO providers. The 15 CCO providers and 34 non-CCO providers were enrolled by the authority, and 28 non-CCO providers enrolled by the department. For two CCO providers we noted the following issues: • Ownership and Control disclosure for one authority CCO was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. The authority has since obtained the missing support. • Managing Employee disclosures for one authority CCO was incomplete. Based on our review of available support, we were able to determine this to be an eligible provider during the fiscal year. For seven non-CCO providers we noted the following issues: • Ownership and Control and Managing Employee disclosures for one authority provider was incomplete. Based on our review of available support we were able to determine these to be eligible providers. • I-9 forms for two authority providers and one department provider were not complete. Based on our review of available support we were able to determine these to be eligible providers. • I-9 form and Ownership and Control disclosure was incomplete for one department provider. Based on our review of other available support we were able to determine this to be an eligible provider during the fiscal year. • I-9 form for one department provider could not be located. The department has since obtained a completed I-9 form. • I-9 form, agreement, and disclosures for one department provider could not be located. Auditor was unable to determine eligibility for this provider resulting in federal questioned costs for the fiscal year totaling $1,786. Additionally, in prior year finding number 2022-057 we noted one department provider with an incomplete I-9 form. The department did not obtain an updated I-9 form during fiscal year 2023 resulting in federal questions costs for the fiscal year 2023 totaling $1,843. The above issues occurred due to human error and inadequate record maintenance which could lead to ineligible providers receiving Medicaid funding. We recommend department and authority management strengthen controls over review to ensure documentation supporting a provider’s eligibility determination and revalidation is complete. Additionally, we recommend the authority reimburse the federal agency for questioned costs related to ineligible providers including ineligible providers identified in prior year findings.

2023-024 Oregon Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2205OR5MAP, 2022; 2205OR5ADM, 2022; 2305OR5MAP, 2023; 2305OR05ADM, 2023 Compliance Requirement: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $3,849 (known) Criteria: 2 CFR 200.1(1); 2 CFR 200.400(a); 42 CFR § 433.32(a) Federal regulations only allow the Medicaid program to charge allowable and supported program expenditures for various program costs at the time of payment for services provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state’s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following errors, which the department did not identify during their review process, that resulted in improper payment of Medicaid expenditures: • For one payment, management was unable to provide documentation to support charges related to the Medicaid program, resulting in known federally funded questioned costs of $2,153. • For one payment the expenditure was not related to Medicaid services, resulting in known federally funded questioned costs of $1,697. The above issues occurred due to human error and inadequate record maintenance which could lead to unallowed activities/costs being charged to the Medicaid program. We recommend department management strengthen controls over review to ensure transactions are adequately supported and reviewed. Additionally, we recommend the department reimburse the federal agency for unallowable costs.

2023-025 Department of Human Services Obtain accurate information from the ONE application Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF) Federal Award Numbers and Years: 2022G996115, 2022; 2023G996115, 2023 Compliance Requirements: Matching, Level of Effort, Earmarking; Reporting; Special Tests and Provisions Type of Finding: Material Weakness, Material Noncompliance Prior Year Finding: 2022 035, 2022 036, 2022 038, 2021 009, 2021 010 Questioned Costs: N/A Criteria: 45 CFR 265.3(b), 45 CFR 265.9; 45 CFR 261.1 Federal regulations require the department to collect monthly and report quarterly certain financial and non-financial data elements for services paid with Temporary Assistance for Needy Families (TANF) federal funding in the ACF-199 TANF data report. Federal regulations also require the department to report data quarterly for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the ACF-209 SSP-MOE data report. Both data reports should be supported by applicable performance records. During fiscal year 2021, the department transitioned key aspects of the TANF program to Oregon Eligibility (ONE) for case management, while TANF child welfare payments continued to be recorded in OR-Kids, the child welfare system. The department contracts with a service provider to extract data from ONE and OR-Kids to populate the data reports. Program staff currently work with the service provider to obtain comprehensive data reports prior to submission to review them for errors and when found, each issue is logged as a defect for the service provider to correct. The department and the U.S. Administration for Children and Families identified data reports submitted for state fiscal year 2023 were incorrect and the department was unable to provide corrected data during our audit. As the performance data reports are known to be incomplete and inaccurate, we are unable to test the reports for compliance with multiple program requirements. Specifically, we were unable to perform testing for • Earmarking requirements to ensure less than 20% of clients have been enrolled in the program for over 60 months; • Reporting requirements relating to the ACF 199R and ACF 209R reports on program performance; • Special tests and provisions relating to client penalties for refusal to work; • Special tests and provisions relating to lack of child care for single custodial parents of children under the age of six, and; • Special tests and provisions relating to client penalties for failure to comply with work verification plans. To date, the implementation of ONE has not resolved findings related to performance data reporting, which have been ongoing since fiscal year 2010. Though the department has yet to receive a Service Organization Control (SOC) report from the service organization administering ONE and compiling data reports, the department expects the report to be completed within the next year. Without an annual SOC report, the department does not have assurance controls are functioning as intended at the service organization for the TANF program. We recommend department management continue to review ACF-199 and ACF-209 reports prior to submission and monitor known compilation defects to ensure performance data reports submitted are complete and accurate. We also recommend department management obtain an annual SOC report over the service organization’s internal controls for the ONE application. Additionally, we recommend department management consider contractual and/or legal remedies if the contractor is unable to provide accurate and reliable information from the ONE system within a reasonable time frame necessary for the business needs of the department.

2023-026 Department of Human Services Improve controls relating to client not cooperating with child support requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF) Federal Award Numbers and Years: 2022G996115, 2022; 2023G996115, 2023 Compliance Requirements: Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2022-037 Questioned Costs: $790 (known) Criteria: 45 CFR 264.30-31 Federal regulations require the department to refer all appropriate individuals in the family of a child to the child support enforcement agency. If the department determines referred individuals are not cooperating, without good cause, in establishing, modifying, or enforcing a support order with respect to the child, then the department must reduce or deny assistance in the Temporary Assistance for Needy Families (TANF) program. Due to control weaknesses in obtaining reliable information from the ONE application discussed in the finding titled “Obtain accurate information from the ONE application,” we based our testing upon a population provided by the Oregon Department of Justice’s Department of Child Support (DCS). We tested a random sample of 40 of 3,947 clients identified by DCS as non-cooperative with child support enforcement to determine if the department took appropriate action to get the client into compliance or decrease benefits as required by federal regulations. We found for three of the 40 clients, the department did not take timely action to move the client into compliance, did not identify good cause for the client to be exempted, and did not appropriately reduce benefits as required. For each of the three sample items, department staff did not follow established polices and requirements to reduce or suspend client benefits for non-cooperation. For the three items identified, we calculated the known questioned costs of $790 based upon the payments issued from the time DCS notified the department of the non-cooperation (with a one month grace period to allow the department reasonable time to take action) until the benefits were cancelled. We assumed good cause would not have been granted as we could not otherwise find evidence of good cause in the department documentation. Because the information came from DCS, rather than the ONE application, we do not have sufficient information available to reasonably project the questioned costs to the population. We recommend management ensure department employees are adequately trained on applicable procedures and requirements relating to child support cooperation with DCS.

2023-027 Department of Human Services Improve controls to ensure eligibility criteria are met Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF) Federal Award Numbers and Years: 2022G996115, 2022; 2023G996115, 2023 Compliance Requirements: Eligibility; Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2022-039, 2022-040, 2021-011 Questioned Costs: $3,491 (known), $1,281,622 (likely) Criteria: 45 CFR 264.10; 45 CFR 261.11 Federal regulations require each state to participate in the Income Eligibility and Verification System (IEVS), which for Oregon, includes using income and benefit screens accessible through Oregon Employment Department, Internal Revenue Service, and Social Security Administration, when making Temporary Assistance for Needy Families (TANF) eligibility determinations. The department’s current procedure instructs caseworkers to narrate “IEVS checked” in the case management system, Oregon Eligibility (ONE), after reviewing all appropriate IEVS screens at the time of eligibility determination. We tested 60 of 179,990 client benefit months during the year to determine if the clients met the applicable eligibility requirements and the department had performed appropriate data checks in accordance with federal requirements. We identified the following: • For four clients, the department did not document completion of eligibility checks in the Income Eligibility and Verification System (IEVS) prior to issuing the payment. Although control deviations were identified, we did not identify questioned costs for these sample items. • For one client, the department did not complete the required JOBS program enrollment application when the client entered the program. We question costs totaling $3,491 as the amount of benefit payments issued from the initial TANF enrollment date through the date the JOBS screening was completed. The projected questioned costs total $1,281,622. The items above were the result of caseworker errors in completing required enrollment procedures. We recommend department management ensure caseworkers are adequately trained on TANF enrollment procedures to ensure all applicable requirements are completed.

2023-028 Department of Human Services Strengthen controls to ensure adequate supporting documentation and accuracy over reporting Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220054, 2022; H126A230054, 2023 Compliance Requirement: Reporting Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 29 USC 721(a)(10); 2 CFR 200.303 The department is required to submit quarterly performance and financial program reports. The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State Vocational Rehabilitation (VR) agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment (IPE), services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the agency to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. The Vocational Rehabilitation Financial Report (RSA-17) is a quarterly report of cumulative VR financial data on an award by award basis. Federal regulations require financial reports include all activity of the reporting period and be supported by applicable accounting records. We reviewed 15 out of 24,176 clients from the September 2022 RSA-911 report to ensure the information contained in selected fields agreed to supporting documentation. During our testing, we identified the following: • Three clients receiving pre-employment transition services without documentation supporting the type of service provided. • The date of application reported for two clients did not agree to supporting documentation. • The date of eligibility determination for two clients did not agree to supporting documentation. Additionally, the department could not provide documentation to support the date of eligibility determination for a third client. • The department could not provide documentation for three clients to support the start date of employment in primary occupation. • The department could not provide documentation for five clients to support the hourly wage at exit. In fiscal year 2023, eight RSA-17 reports were submitted for fiscal year 2023; two were selected for review. During our testing, we identified one report did not provide the appropriate federal share of allowable expenditures, overstating the line item by $2,859,149. Without maintaining supporting documentation that substantiates the accuracy of the case information reported, the agency may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. Data collected through the RSA-911 and RSA-17 reports are used by the Federal government to evaluate and monitor the financial and programmatic performance of the VR program. As such, it is important that the data be accurately collected and reported. We recommend department management strengthen internal controls to ensure adequate supporting documentation is maintained to support information reported in the RSA-911 client case information report. We also recommend department management strengthen internal controls to ensure the reviews of the RSA-17 financial report are documented and the report contains accurate information.

2023-029 Department of Human Services Strengthen controls over program expenditures Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220054, 2022; H126A230054, 2023 Compliance Requirement(s): Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Material Weakness; Noncompliance Prior Year Finding: N/A Questioned Costs: $149 (known); $871,943 (likely) Criteria: 29 USC 723(a); 29 USC 702(b); OAM 10.15.00.po The Vocational Rehabilitation (VR) program provides services to clients to assist in preparing for, securing, retaining, or regaining employment. VR funds may be used to carry out the purpose of the program, pay personnel, and administer the VR program. All transactions paid for with VR funds must be supported by appropriate documentation. We selected a random sample of 21 out of 14,436 expenditures, representing payments made for client services and payments to administer the program, and identified the following: • Three transactions where the department was unable to provide supporting documentation, resulting in $139 of actual questioned cost. • One transaction where the department was unable to provide documentation showing the transaction was approved. • One transaction where the expenditure exceeded the actual cost of the client service, resulting in $10 of actual questioned cost. These transactions resulted in $149 of actual questioned costs and when projected to the population resulted in $871,943 of likely questioned costs. We recommend department management strengthen internal controls to ensure supporting documentation is maintained, reviews are documented, and transactions agree to supporting documentation.

2023-030 Department of Human Services Strengthen controls over payroll expenditures Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220054, 2022; H126A230054, 2023 Compliance Requirement(s): Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $3,521 (known) Criteria: 29 USC 723(a); 29 USC 702(b) The Vocational Rehabilitation (VR) program provides services to clients to assist in preparing for, securing, retaining, or regaining employment. Accordingly, funds may be used to carry out the purpose of the program, pay personnel, and administer the VR program. From a population of 2,368 monthly payroll costs, we selected a random sample of 21 to verify monthly time was approved by management and employees directly work on the VR award. Of those 21 costs, we identified one paid with VR funds but was a board member for a program other than VR. We expanded our review to include all board members paid with VR funds, and identified a total of two board members who were charging time to VR inappropriately, resulting in total actual questioned cost of $3,521. The board members’ time was coded incorrectly and a separate monthly review of employees charging time to the VR program failed to identify these board members were inappropriately paid with VR funds. We recommend department management implement and document additional internal controls to ensure only VR employees are paid with VR funding.

2023-031 Oregon Commission for the Blind Improve controls over compliance reporting Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220055, 2022; H126A230055, 2023 Compliance Requirement(s): Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 29 USC 721(a)(10) The Vocational Rehabilitation Case Service Report (RSA-911) is a quarterly report of client case information. State VR agencies are required to maintain supporting documentation in an individual’s case file, particularly regarding eligibility determinations, development of the Individualized Plan for Employment (IPE), services provided, and case closure. It is important to note that the use of an electronic case management system does not remove the requirement for the commission to maintain either hard copies or scanned copies of required supporting documentation in the individual’s service record. An electronic case management system is merely a data entry process that is susceptible to data entry errors. We reviewed five clients out of 737 from the September 2022 report to ensure the information contained in selected fields agreed to supporting documentation. Testing results identified two clients where the commission could not provide documentation to support the start date of employment in the primary occupation and the hourly wage at exit as reported and contained in the case management system. Without maintaining supporting documentation of the case information reported, the commission may not be reporting accurate information to the federal awarding agency and is unable to demonstrate its compliance with the reporting requirements. We recommend commission management strengthen internal controls to ensure the RSA-911 client case information report contains accurate information and is supported.

2023-032 Oregon Commission for the Blind Seek clarification from federal awarding agency on appropriateness of legal fees Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.126 Rehabilitation Services-Vocational Rehabilitation Grants to States Federal Award Numbers and Years: H126A220055, 2022; H126A230055, 2023 Compliance Requirement(s): Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Noncompliance Prior Year Finding: N/A Questioned Costs: $10,289 (known) Criteria: 29 USC 702(b); 29 USC 723(a) The Vocational Rehabilitation (VR) program provides services to clients to assist in preparing for, securing, retaining, or regaining employment. VR funds may be used to carry out the purpose of the program, pay personnel, and administer the VR program. During our review, we noted VR funds were being used to pay for legal fees. The use of federal funds to pay for legal fees is allowable in specific situations. Due to attorney client privilege, we were unable to obtain sufficient, appropriate audit evidence to determine if the use of VR funds to pay for these legal fees is appropriate. As a result, we are questioning $10,289 in expenditures related to the payment of legal fees. We recommend commission management request clarification from the federal awarding agency regarding the appropriateness of using VR funds for legal fees.

2023-033 Oregon Department of Emergency Management Implement controls over FFATA reporting Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021; FEMA-4499-DR-OR, 2020 (COVID-19) Compliance Requirement: Reporting Type of Finding: Material Weakness; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a), (c)-(d); 2 CFR 170, Appendix A I(a) The Federal Funding Accountability and Transparency Act (FFATA) requires the department to submit information for any subaward action that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Department management stated there were no established internal controls over FFATA reporting that would ensure accurate, complete, and timely submission or tracking of subrecipient data. As a result, we were unable to perform tests of controls. We judgmentally selected five of the 678 subawards identified by ODEM as meeting the threshold for FFATA reporting in fiscal year 2023 for compliance review. The department indicated that none of the five selections had been reported as required; however, auditors independently verified on USAspending.gov that one of the subawards had been submitted. Department management stated that noncompliance with FFATA reporting requirements during the fiscal year was due to multiple factors, including a departmental restructuring, lack of established controls and procedures for identifying, reporting, and tracking the status of projects meeting the reporting threshold; turnover of key personnel; and inadequate training of the compliance requirements for staff. There is a risk the federal awarding agency could withhold grant funding if the department is not compliant with reporting requirements. We recommend department management implement controls to ensure all subawards are appropriately tracked and reported. The department should also work with the federal awarding agency to determine what actions it should take for older reports not submitted.

2023-034 Oregon Department of Emergency Management Fully implement subrecipient risk assessments Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Number and Name: 97.036 Disaster Grants – Public Assistance (Presidentially Declared) 97.036 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR-OR, 2019; FEMA-4519-DR-OR, 2020; FEMA-4562-DR-OR, 2020; FEMA-4599-DR-OR, 2021 FEMA-4499-DR-OR, 2020 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-033 Questioned Costs: N/A Criteria: Criteria: 2 CFR 200.332(b) Federal regulations stipulate that pass-through entities evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring. Monitoring activities should be completed based on the results of the subrecipient’s determined risk. In fiscal year 2020, we noted the department did not have systematic policies and procedures in place to adequately evaluate subrecipients’ risk for noncompliance with federal subrecipient monitoring requirements. In response, the department developed a subrecipient risk assessment policy and procedures, which included risk assessment questionnaires, a scoring matrix, and a tracking mechanism to track distribution and receipt of the questionnaires as well as the subrecipients’ overall risk level. We selected a random sample of 36 subrecipients who had received a payment during the fiscal year and reviewed the department’s February 2024 tracking spreadsheet. Four of the subrecipients had not returned the questionnaire or been evaluated for risk of noncompliance using other available information. One of the four was not listed as a subrecipient on the tracking spreadsheet. Management indicated that due to agency restructuring and the significant turnover of key management and staff during that period, full implementation of the subrecipient risk assessment procedures was still in process. Risk assessments help guide the agency in determining the appropriate level of monitoring for each subrecipient and the nature and extent of procedures to be applied. Without this guidance, the department may not provide an adequate level of monitoring. We recommend department management fully develop and implement its policies and procedures to ensure risk assessments are performed and documented for each subrecipient.

2023-035 Department of Early Learning and Care Use restricted indirect cost rate when required Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCCC5, 2021 (COVID-19);2101ORCCDD, 2021; 2101ORCDC6, 2021 (COVID-19); 90YE020004, 2021; 2101ORCSC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2301ORCCDD, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $400,369 (known) Criteria: 45 CFR 98.57; 34 CFR 75.563 During fiscal year 2023, the Child Care and Development (CCDF) program was with the Early Learning Division within the Oregon Department of Education (ODE). Effective July 1, 2023, the Department of Early Learning and Care (department) was created and administers the CCDF program. ODE’s indirect rate agreement approved by the U.S. Department of Education was effective during fiscal year 2023. This rate agreement includes two different rates to be used, an unrestricted rate if there is not a supplement restriction and a lower restricted rate if there is. In our review of the indirect rates used by ODE, we identified that ODE only entered the unrestricted rate into their system, while the terms and conditions for the CARES, CRRSA, ARP and Discretionary CCDF awards identified a supplement not supplant restriction. This resulted in ODE requesting reimbursement for the indirect expenditures at a higher rate. As a result of this, ODE incorrectly claimed an additional $400,369 in indirect cost reimbursement. We recommend department management ensure the appropriate indirect cost rate is used in fiscal year 2024. We also recommend the department work with ODE to determine if there are any additional questioned costs from prior fiscal years and work with the federal awarding agency to reimburse the federal agency for any unallowable costs.

2023-036 Department of Early Learning and Care Improve controls over family copay and child care hour calculations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2101ORCCDD, 2021; 2101ORCCC5, 2021 (COVID-19); 2101ORCCDM, 2021; 2101ORCDC6, 2021 (COVID-19); 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-025 Questioned Costs: $6,310 (known); $18,291 (likely) Criteria: 45 CFR 98.45(b)(5); 42 USC 9858 The Child Care and Development Fund program offers federal funding to states to increase the availability, affordability, and quality of child care services. As required by federal regulations, the department has developed a sliding fee scale, based on family size and income that provides for cost sharing by families that receive child care services (monthly copay). The monthly copay is included on the provider’s monthly bill form provided by the department. If a family has more than one child care provider, one is designated the primary provider based on amount of care provided and receives the copay from the family. The authorized monthly child care hours are calculated based on parent work schedules, commute time, and other factors. The department relies on the ONE eligibility system to verify eligibility, calculate child care hours and monthly copay based on information entered into the system. Payments to providers are based on the returned and completed billing forms. The department allows providers to submit for reimbursement any time during the month. We tested a random sample of 50 families for client eligibility and verification of one monthly benefit payment to the child care provider. As part of the provider payment, we verified the accuracy of the monthly copay and the authorized child care hours. If errors in copay or provider payments were identified, we reviewed additional months to capture all known questioned costs. We identified errors in 13 of 50 sample items resulting in the following errors: • For one case we identified $5,700 in known questioned costs. The client changed child care providers in August 2022. The new provider’s billing form had prorated authorized hours and was correct. The prior provider submitted and was paid for full authorized hours for all children early in August prior to client’s notification. The client changed child care providers again in January 2023 but did not notify the department until late March 2023. The new provider’s billing forms were appropriate. However, the prior provider billed for full time child care in January, February and March. The department should have identified these overpayments when setting up the new child care provider. • Six cases where copay was calculated incorrectly. Four cases were due to human error when entering income in the ONE system. In two cases, the ONE system correctly calculated the copay but the final amount was increased or reduced for reasons unknown. These errors resulted in known questioned costs of $575. • One case where the copay was calculated correctly. However, the client had multiple child care providers and the $5 copay was not attached to the billing form for the providers reimbursed for October 2022 through April 2023 resulting in known questioned costs of $35. • Seven cases in which the authorized child care hours were calculated incorrectly. Errors did not cause any incorrect provider payments. In two cases, it appears the ONE system calculated correctly but the arithmetic is incorrect in final authorized hours. The department could not explain how the final hours were determined. In two cases, when the client end/start of jobs occurred in the same month, the ONE system incorrectly includes hours from the old job in the calculation resulting in authorized hours being too high. The other three cases were caused by human entry errors. • One case where the department was unable to locate either a signed paper application signature or a phone signature. Human entry errors and system errors can lead to errors in determining eligibility and the accuracy of the monthly copay and the authorized child care hours. These errors may lead to improper payments to child care provider by the program. We recommend department management ensure a client’s monthly copay and child care hours are correctly calculated and identify any potential system issues. In addition, when a change in provider occurs, the department should verify the accuracy of payments to the prior provider. We also recommend department management reimburse the federal agency for unallowable costs.

2023-037 Department of Early Learning and Care Improve controls over payroll Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDD, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2020-029 Questioned Costs: $297 (known); $18,975 (likely) Criteria: 45 CFR 75.403(a); 45 CFR 75.430(a) Federal regulations state that allowable costs are costs necessary and reasonable for the performance of federal awards. Payroll costs directly related to a federal award are allowable costs, provided they are reasonable for the services rendered and are supported. The department has implemented the following procedures to ensure allowable payroll costs are charged to the program. Managers approve monthly timesheets submitted by employees in the state’s payroll system. The department sets cost centers in the payroll system based on position. The State switched to a new payroll system, effective December 2022. With this change, managers no longer review cost center codes when reviewing an employee’s timesheet. Additionally, if a manager has not reviewed a timesheet by a specified date, the payroll system will automatically approve the timesheet, shown with the words “mass approval.” We tested a random sample of 25 employees and judgmentally selected 2 employees to ensure payroll for a month was appropriately charged to the program. We verified whether payroll timesheets were reviewed by a manager and signed position descriptions were retained per state guidelines, and identified the following exceptions: • Position descriptions could not be located for two employees. Both of these employees were terminated and the position descriptions were not retained after they left employment. • Four timesheets, under the new payroll system, were not fully approved by a manager and contained instances of “mass approval” with no other verification that the manager reviewed and approved the employees time for the month. • For two employees, the new payroll system incorrectly charged minimal time to the federal program resulting in questioned costs of $297. The employees’ regular pay was not charged to the program. This occurred as the cost code was not set up and the system defaulted to a previously used cost code. We recommend department management improve its review of timesheets and ensure position descriptions are retained. We also recommend department management develop a report to identify when payroll system incorrectly charges time to a federal program. Finally, we recommend department management reimburse the federal agency for any unallowable costs.

2023-038 Department of Early Learning and Care Retain support and improve controls over reporting Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.575, 93.596 Child Care and Development Fund Cluster 93.575, 93.596 Child Care and Development Fund Cluster (COVID-19) Federal Award Numbers and Years: 2001ORCCC3, 2019 (COVID-19); 2001ORCCDD, 2020; 2001ORCCDF, 2020; 2101ORCCC5, 2021 (COVID-19); 2101ORCDC6, 2021 (COVID-19); 2101ORCCDD, 2021; 2101ORCSC6, 2021 (COVID-19); 2101ORCCDF, 2021; 2101ORCCDM, 2021; 90YE020004, 2021; 2201ORCCDD, 2022; 2201ORCCDF, 2022; 2201ORCCDM, 2022; 2301ORCCDD, 2023; 2301ORCCDF, 2023; 2301ORCCDM, 2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a) The department is required to submit quarterly ACF 696 reports for each open grant. To ensure the accuracy and completeness of these two reports, the department’s control process requires a review of reports prior to submission. We reviewed three of 12 ACF 696 reports submitted during fiscal year 2023. For all three reports, the department was initially unable to provide the support for the Department of Revenue (DOR) Working Family/Child Care Tax Credits used to help meet the matching and maintenance of effort requirements. The department could not locate the support used to prepare the reports for the DOR tax credits and needed to have DOR provide documentation. Additionally, one of the reports had matching fields that were left blank when the report was submitted even though expenditures were incurred and should have been reported. The department does not have detailed procedures around the use of the tax credits in preparation of the reports and sources of information used in the preparation. Additionally, the review process did not identify the blank fields or missing documentation. These reports provide the federal awarding agency with key information related to the program and errors in reports could alter the amount of funding received by the department in future years. We recommend department management further develop its procedures for claiming the tax credit in the ACF-696 reports. We also recommend the department ensure documentation is maintained with the reports in future years.

2023-039 Oregon Health Authority Ensure program payroll costs are incurred only for program staff Federal Awarding Agency: U.S. Department of Agriculture Assistance Listing Number and Name: 10.557 Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Federal Award Numbers and Years: 237OROR7W1003, 2023; 237OROR7W1006, 2023 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $18,002 (known) Criteria: 2 CFR 200.413(b) Federal regulations permit costs charged directly to a Federal award, such as compensation of employees who work on that award and their related fringe benefit costs. Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) management is responsible for ensuring employees with payroll related costs charged directly to the Federal award are employees who work on that award. From a population of 550 monthly payroll costs for 57 employees, we randomly selected a sample of 25 to verify monthly time was approved by management and employees directly work on the WIC award. We found one employee who should not have recorded payroll costs to the WIC program, as the employee was on a job rotation outside the program. The employee’s time was properly approved, but the review did not identify the costs were charged to program. We reviewed all payroll related costs for the employee and identified questioned costs of $7,970 for fiscal year 2023. We expanded our review and identified two additional employees who were charging their time to the WIC program inappropriately, resulting in total actual questioned costs of $18,002. We recommend program management implement additional internal controls over payroll related costs to ensure all costs charged to the program are related to employees who work directly on the award.

2023-040 Oregon Department of Education State did not meet maintenance of effort requirement Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425U Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425U210049, 2021 (COVID-19) Compliance Requirement: Matching, Level of Effort, Earmarking Type of Finding: Material Weakness; Noncompliance Prior Year Finding: 2022-065 Questioned Costs: N/A Criteria: Section 2004(a)(1) of the American Rescue Plan (ARP) ACT; 2 CFR 200.303 The ARP ACT require the State to maintain support for both elementary and secondary education and for higher education in fiscal year 2023 at least at the proportional level of the state’s support for elementary and secondary education and for higher education relative to the state’s overall spending, averaged over fiscal years 2017, 2018 and 2019. The Department of Education (department) did not meet the maintenance of effort provisions for fiscal year 2023 for elementary and secondary education. Although the state’s overall funding increased for education, its proportional level relative to Oregon’s overall spending declined. The department is reliant on the legislative budget process. On July 31, 2023, the federal agency approved the State’s request for a waiver for maintenance of effort for fiscal year 2022 but did not approve waiver request for fiscal year 2023. The department submitted a new waiver request to the U.S. Department of Education dated March 14, 2024. According to department management, budget changes and obtaining a clearer understanding of the State’s Other Fund amount delayed the calculation for maintenance of effort. The total federal expenditures for the Education Stabilization Fund program for the fiscal year ended June 30, 2023 were $407 million. If the waiver is not approved, the department may be asked to return some of the funds. We recommend department management continue to actively track whether it will meet the maintenance of effort requirement and communicate with the federal awarding agency.

2023-041 Oregon Department of Education Improve FFATA reporting controls Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U 84.425V & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048, 2020 (COVID-19); S425C210048, 2021 (COVID-19); S425D200049, 2020 (COVID-19); S425D210049, 2021 (COVID-19); S425R210047, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425V210047, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2021-025 Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department maintains written procedures that document the steps for completing the monthly FFATA reporting. Our audit procedures included the testing of 45 Education Stabilization Fund subawards/subaward modifications totaling $6.3 million in obligations. During our testing we noted the following: • For nine subawards obligated in January 2023 totaling more than $1.8 million were not reported in the FFATA system until May 2023. According to the department, the query tool did not pull in all the information. • For one subaward modification, the sub awardee name is incorrect. According to the department, the unique entity identifier information was incorrect for the sub awardee and therefore incorrectly reported in the FFATA report. • For one subaward modification, the amount of the subaward is incorrect. The FFATA shows zero while the obligation is $143,286. According to the department, the data was not filtered correctly when pulling the information for the FFATA report. We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information.

2023-042 Oregon Department of Education Retain support for pre-approval of equipment purchases Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D 84.425U & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C210048, 2021 (COVID-19); S425D210049, 2021 (COVID-19); S425U210049, 2021 (COVID-19); S425W210038, 2021 (COVID-19) Compliance Requirement: Equipment Type of Finding: Significant Deficiency: Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.439; 2 CFR 200.303 Capital expenditures for general and special purpose equipment purchases are subject to prior approval by the state agency. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Education Stabilization Funds can be used to purchase equipment that meets the overall purpose of the Education Stabilization Fund, which is to prevent, prepare for, and respond to the COVID-19 pandemic. Department procedure is for subrecipients to submit a capital request forms to the department for approval. Education will email an approval to the subrecipient. We tested 61 equipment purchases made during fiscal year 2023 and found that for one an approval could not be located. As no approval could be found, we were unable to determine if prior approval was made for the equipment. According to department management, documentation could not be located. If documentation is not retained, there is a risk that funds expended are not in compliance with federal requirements. We recommend the department retain documentation regarding every equipment approval.

2023-043 Oregon Business Development Department Management should implement accounting review of quarterly reports before submitting to DAS Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: SLFRP4454, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR § 200.303(a) Recipients of Coronavirus State and Local Fiscal Recovery Funds (SLFRF) are required to provide quarterly project and expenditure reports to the Department of Administrative Services (DAS) who then compile the information and submit it to the US Department of Treasury. Each report contains detailed project information, including current period obligation, cumulative obligation, current period expenditure, and cumulative expenditure. Department management is responsible for establishing and maintaining effective internal controls that provide reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. The department’s reporting process did not include a review by accounting staff to ensure reports included all activity of the reporting period and agreed to accounting records. As a result, reports were submitted to DAS with inaccurate information resulting in reporting errors. Failure to report accurate expenditures and obligations could result in a loss of SLFRF funds. We recommend the department include an accounting review of SLFRF reports prior to submitting to DAS.

2023-044 Oregon Housing and Community Services Ensure that the nature of program applicants' financial hardship is documented Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.026 Homeowner’s Assistance Fund (COVID-19) Federal Award Numbers and Years: HAF0027, 2023 (COVID-19) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: U.S. Department of the Treasury Homeowners Assistance Fund: Guidance on Participant Compliance and Reporting Responsibilities (dated 5/9/22 and revised 1/12/24); Homeowners Assistance Fund Guidance (dated 6/12/23) Prior to disbursing Homeowners’ Assistance Fund (HAF) awards, the Department is required to obtain and document applicants’ attestations that they have endured a financial hardship due to the pandemic. Additionally, the attestations must include a description of the nature of the applicants’ financial hardship (e.g. loss/reduction of income or risk of home foreclosure). The Department requires pre-qualification checklists to be completed during the application process to ensure, in addition to several other requirements, that the applicants’ attestations of financial hardship due to the pandemic are obtained. In our testing of HAF eligibility compliance requirements, we randomly selected 40 HAF applicants that received program assistance from the department during fiscal year 2023. We found that for three sample items, while pre-qualification checklists were completed and attestations of financial hardship were obtained, program staff did not ensure a description of the nature of applicants’ financial hardship was documented. However, no income determination exceptions were identified; all applicants tested were under the program income limit. Not requiring and documenting the nature of the financial hardship could result in program benefits being awarded to ineligible applicants. We recommend management implement controls to ensure that the nature of HAF applicants’ financial hardship is documented as required by federal guidance.

2023-045 Oregon Housing and Community Services Obtain documentation to support expenditures or pursue cost recovery Federal Awarding Agency: U.S. Department of Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance (COVID-19) Federal Award Numbers and Years: ERA 1, 2021 (COVID-19); ERA 2, 2021 (COVID-19) Compliance Requirements: Activities Allowed or Unallowed, Eligibility, Period of Performance Type of Finding: Noncompliance Prior Year Finding: N/A Questioned Costs: $96,624 (known) Criteria: 2 CFR 200.332(d); 2 CFR 200.501(g) Department management is responsible for monitoring the activities of subrecipients to ensure subawards are used for authorized purposes and are compliant with federal requirements. Additionally, department management is responsible for ensuring compliance when a contractor is responsible for program compliance. The department passed through funds to 17 community action agencies (subrecipients) and a third-party vendor (contractor) to provide program delivery. Program delivery included determining client eligibility and making payments for direct client assistance for rent, utilities, internet, and other housing related costs. During the fiscal year, the department performed program reviews for each of the subrecipients and the contractor to determine whether funds were paid to eligible clients for allowable activities. We selected eight subrecipient program reviews and the contractor review for testing. The department reviewed 175 client applications that were processed and approved for payment across the eight selected subrecipients. We reviewed the department’s program monitoring reports and identified 91 client applications with potential exceptions related to federal requirements. Our testing found 67 client applications with exceptions totaling $74,857 in questioned costs. The department reviewed a total of 60 individual client applications processed and approved for payment by the contractor. We reviewed the department’s program monitoring report and identified 16 client applications with potential exceptions related to federal requirements. Our testing found five client applications with exceptions totaling $21,767 in questioned costs. The majority of exceptions were due to a lack of sufficient documentation being maintained to ensure assistance was only provided to eligible clients for allowable costs within the applicable time period. We recommend department management coordinate with their subrecipients and contractor to obtain additional documentation to ensure compliance with federal requirements or to recover amounts paid that are not in compliance with federal requirements.

2022-018 Oregon Housing and Community Services Controls are needed to ensure program expenditures are allowable Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: $245,362 (known) (COVID-19) Criteria: 24 CFR 576.100; CPD-21-08 III.E.3 Emergency Solutions Grants-Cares Act (ESG-CV) funds may be used for the five regular Emergency Solutions Grants (ESG) program components, as well as administrative activities: street outreach, emergency shelter, homelessness prevention, rapid re-housing, and homeless management information systems (HMIS). They may also be used for additional activities including, but not limited to, temporary emergency shelter, hazard pay, handwashing stations, cell phones and internet, personal protective equipment, and laundry. The funds are disbursed to the subrecipients after reimbursement requests are submitted.? Federal funds totaling $31,894,565 were distributed to 44 subrecipients during fiscal year 2022. We randomly selected 61 individual distributions made by the department to subrecipients. Subsequently, we randomly selected an expenditure from each disbursement request and then judgmentally selected additional expenditures from select disbursements. While gaining an understanding of the department?s internal control process, we learned the review process for subrecipient disbursement requests did not include a detailed verification that underlying expenditures were for allowable activities and costs. Given the department?s incomplete review process, we were unable to verify compliance by testing those reviews. The department requested supporting documentation from the subrecipients, documentation that should have been reviewed and retained by the department, for the required audit procedures to be performed. Our audit procedures were performed in three stages. First, we randomly selected 61 individual distributions made by the department to subrecipients, totaling $5,580,560. These disbursements generally consisted of reimbursement for multiple expenditures made by a subrecipient. Next, we asked the department to request a listing of expenditures from the subrecipients related to those disbursements. Finally, if provided, we agreed the listings to the disbursement and randomly and judgmentally selected individual expenditures from the listings for testing. We were unable to perform any review of 20 disbursements either because we did not receive a listing of the subrecipient?s expenditures, or the listing did not agree to the disbursement selected for testing. These disbursements related to 10 of the 44?subrecipients receiving funds in fiscal year 2022 and $1,475,345 of the $5,580,560 in disbursements selected for testing noted above. From the expenditure listings we did receive, we randomly and judgmentally selected individual expenditures to determine whether the supporting documentation agreed to the amount requested for reimbursement by the subrecipient. Of those 41 individual transactions selected for testing, there was inadequate or no supporting documentation provided for 29 items, and one instance where the request exceeded the support. These exceptions resulted in total questioned costs of $245,362. If requests for funds are not supported by documented expenditures, the department could be unknowingly reimbursing subrecipients for unallowable costs and activities. We recommend management implement internal controls to ensure subrecipient reimbursements are for allowable expenditures.

2022-019 Oregon Housing and Community Services Controls are needed to ensure subrecipients? compliance with equipment and real property requirements Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirement: Equipment and Real Property Management Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.311; 2 CFR 200.313 There are specific requirements when equipment is purchased using federal funds and in use. At a minimum, procedures for managing equipment must meet the following requirements: ? Property records must be maintained that include key details (e.g. property description, ID number, Title, etc); ? A physical inventory of the property must be taken, and the results reconciled with the property records at least once every two years; ? A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated; and ? Adequate maintenance procedures must be developed to keep the property in good condition. Real property purchased must be used for the originally authorized purpose as long as needed for that purpose. When real property is no longer needed for the originally authorized purpose, the non-federal entity must obtain disposition instructions from either the federal awarding agency or pass through entity. During our review, we determined OHCS was not monitoring its subrecipients to ensure the equipment and real property requirements were being met. Because subrecipients were not being monitored, we were unable to determine if there was a population of equipment and real property on which to perform our audit testing procedure. As a result, the department may not be in compliance with federal equipment and real property requirements. We recommend department management develop internal controls to ensure compliance with federal requirements for equipment and real property.

2022-020 Oregon Housing and Community Services Controls are needed to ensure buildings renovated for use as emergency homeless shelters are maintained as shelters for the period required Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirement: Special Tests and Provisions Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 24 CFR 576.102(c) Federal regulations require that buildings renovated with ESG-CV funds for use as emergency homeless shelters must be maintained as shelters for not less than a period of 3 or 10 years, depending on the type of renovation and value of the building. Initial inquiries with program staff determined that the department was not aware whether its subrecipients were using program funds to renovate buildings for use as emergency homeless shelters. Subsequently, program staff indicated the information may be contained in subrecipient implementation reports. However, there were no known procedures or processes in place to monitor the use of funds during the fiscal period. Therefore, it is possible buildings renovated with program funds may not be maintained as emergency shelters for the minimum required time period. We recommend agency management develop internal controls to ensure buildings renovated for use as emergency homeless shelters are maintained as shelters for the period required.

2022-021 Oregon Housing and Community Services Controls are needed to ensure compliance with level of effort requirements Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirement: Matching, Level of Effort, Earmarking Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 24 CFR 576.101(c) When a subrecipient is a unit of general-purpose local government, its ESG-CV program funds may not be used to replace funds the local government provided for street outreach and emergency shelter services during the preceding 12-month period unless U.S. Dept. of Housing and Urban Development determines the local government is in a severe financial deficit. ESG-CV funds should be used to supplement, not replace those funds. We determined the department was not monitoring its subrecipients for compliance with level of effort requirements during our review. Documentation was not available for review, and we were unable to determine the department?s compliance with this requirement. As a result, local governments could be using program funds to replace their funding allocated to street outreach and emergency shelter services. We recommend department management develop procedures to ensure compliance with federal requirements for level of effort and maintain documentation.

2022-022 Oregon Housing and Community Services Documentation verifying subrecipients have not been suspended or debarred needs to be retained Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirement: Procurement and Suspension and Debarment Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 180.300; 2 CFR 180.305 Federal regulations require the department verify subrecipients are not suspended or debarred from receiving federal funds prior to making any disbursements. We randomly selected a sample of 14 subrecipients to verify whether they were federally suspended or debarred and determine whether the department performed a verification prior to disbursing program funds. Department management stated subrecipients? suspension/debarment status was reviewed in the federal database but was unable to provide documentation demonstrating the review was performed. Without performing this verification, the department could unknowingly pass federal funds to a subrecipient that has been federally suspended or debarred. Our independent verification confirmed the 14 subrecipients selected for testing were not suspended or debarred. We recommend department management maintain documentation demonstrating subrecipients have not been suspended or debarred.

2022-023 Oregon Housing and Community Services Controls need to be strengthened to ensure the required expenditures are spent timely Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirement: Special Tests and Provisions Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: CPD 21-08(III)(B)(2)(c) Emergency Solutions Grants-Cares Act (ESG-CV) funds were intended to be spent quickly on allowable activities to address the public health and economic crisis stemming from COVID-19. At least 20% of the total award was to be spent by September 30, 2021. Based on our testing, the department was not adequately tracking the percentage or timeliness of expenditures and did not reach the expenditure milestone. Approximately 18% of the total award was expended by September 30, 2021. If the 20% milestone is not achieved, HUD is able to recapture up to 20%, or $11.2 million, of the total award. We recommend agency management develop procedures to ensure grant expenditures are adequately tracked and spent within the required time period.

2022-024 Oregon Housing and Community Services Subrecipients need to be monitored to ensure compliance with procurement standards Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Number and Name: 14.231 Emergency Solutions Grants Program (COVID-19) Federal Award Numbers and Years: E-20-DW-41-0001, 2020 (COVID-19) Compliance Requirement: Procurement, and Suspension and Debarment Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.317 - .327; 2 CFR 200.332(d) Federal regulations state that non-federal entities, including subrecipients, are required to have and use procurement procedures consistent with state and local laws and regulations and that conform to the federal procurement standards identified in 2 CFR 200.317 - .327. Pass-through entities, like the department, are required to monitor subrecipients for compliance with federal regulations and the terms and conditions of the award. Inquiries and testing determined the department?s fiscal monitoring procedures, which normally include review of compliance with procurement standards, were not fully performed during the fiscal year and only 6 of 45 subrecipients were reviewed. As a result, subrecipients could be out of compliance with procurement requirements. We recommend the department ensure subrecipients are monitored for compliance with procurement requirements.

2022-025 Oregon Housing and Community Services Perform fiscal monitoring for subrecipients administrative expenditures to ensure compliance Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance Program (COVID-19) Federal Award Numbers and Years: ERA 1, 2021 (COVID-19) Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: $121,463 (known) (COVID-19) Criteria: 2 CFR 200.332(a)(5) and (d) Department management is responsible for monitoring the activities of subrecipients to ensure subawards are used for authorized purposes and in compliance with federal requirements. Additionally, department management is responsible for communicating to subrecipients that they are required to permit the department and auditors access to their records as necessary to ensure the department is in compliance with program requirements. The department passed through program funds to community action agencies (subrecipients) to provide program delivery, including administrative costs. The department performed fiscal monitoring for only five of their 18 subrecipients during the audit period due to staff turnover. Fiscal monitoring includes procedures to address compliance with activities allowed and allowable cost requirements for administrative costs. Due to the limited fiscal monitoring performed, auditors performed additional procedures at the subrecipient level to determine whether the department was compliant with program requirements. We tested a total of 82 transactions, 70 randomly selected and 12 judgmentally selected from the 13 subrecipients that did not receive subrecipient monitoring during the fiscal year. We noted the following: ? One subrecipient did not respond to audit requests for documentation, resulting in an inability to test four transactions totaling $4,114. ? One subrecipient did not provide sufficiently detailed documentation to determine whether 7 transactions were for accurate amounts totaling $117,349. Of those seven transactions, we were unable to determine whether two transactions were for allowable activities or appropriately categorized as administrative expenditures. Without adequate monitoring of subrecipients, the department?s ability to ensure compliance with program requirements is diminished. We recommend department management perform fiscal monitoring to ensure subrecipients are expending administrative funds in accordance with program requirements.

2022-026 Oregon Housing and Community Services Department Implement program monitoring over client assistance payments to ensure compliance Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance Program (COVID-19) Federal Award Numbers and Years: ERA 1, 2021; ERA 2, 2021 (COVID-19) Compliance Requirement: Activities Allowed or Unallowed; Eligibility Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: $21,624 (known); $11,067,350 (likely) (COVID-19) Criteria: 2 CFR 200.332(d); 2 CFR 200.501(g) Department management is responsible for monitoring the activities of subrecipients to ensure subawards are used for authorized purposes and are compliant with federal requirements. Additionally, department management is responsible for ensuring compliance when a contractor is responsible for program compliance or the contractor?s records must be reviewed to determine program compliance. The department provided $140 million and $46 million of phase one program funds to community action agencies (subrecipients) and a third-party vendor (contractor) to provide program delivery, respectively; and $132 million phase two program funds to only the contractor. Program delivery included determining client eligibility and making payments for direct client assistance for rent, utilities, internet, and other housing related costs. During implementation of the program, the department provided program manuals to the subrecipients and contractor. Due to the department?s limited staff, they focused on updating policies and procedures to address systemic issues identified; however, if a particularly challenging application required the department?s review, they were available to provide direct assistance. The department did not implement any predefined, systemic program monitoring of the subrecipients or contractor to ensure direct client assistance payments were paid to only eligible clients for only allowable and supported amounts. Therefore, auditors performed additional procedures at the subrecipient and contractor level to determine whether direct client assistance payments were paid to eligible clients for allowable activities. We tested a total of 62 randomly selected direct client assistance payments at 16 subrecipients totaling $183,515, and found the following: ? One subrecipient did not respond to audit requests for documentation, resulting in an inability to test one transaction in the amount of $360. ? One subrecipient did not obtain documentation to support that there was a lease agreement in place, resulting in questioned costs of $5,775. When extrapolated to the total population, these errors result in over $2.3 million in likely questioned costs. We tested 61 randomly selected contractor direct client assistance payments totaling $374,274, and found the following: ? One payment where an incorrect landlord was paid in the amount of $2,700. Attempts to recover the funds have been unsuccessful as of the date of the finding. ? Two payments where the rental amount was doubled, resulting in overpayments totaling $5,910. ? Seven payments where amounts already paid were not accurately reflected in the calculation of assistance provided, resulting in overpayments totaling $4,191. ? Three payments where amounts did not agree to supporting documentation, resulting in overpayments of $2,181. ? Three payments where there was insufficient documentation for amounts paid, resulting in overpayments of $432. ? One payment where costs were paid for the same household on alternate applications, resulting in an overpayment of $73. When extrapolated to the total population, these errors result in over $8.7 million in likely questioned costs. We recommend department management implement predefined, systemic program monitoring to ensure the subrecipients and contractor are administering program funds in accordance with program requirements.

2022-027 Oregon Housing and Community Services Ensure Monthly and Quarterly reports are accurate and adequately supported Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance Program (COVID-19) Federal Award Numbers and Years: ERA 1, 2021 (COVID-19); ERA 2, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302(a) and (b)(3); 2 CFR 200.303(a), (c)-(d) Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing, evaluating, and monitoring the federal award in compliance with the terms and conditions of the award and taking prompt action when instances of noncompliance are identified. Additionally, the department is responsible for maintaining records to allow for submission of reports that are accurate and adequately supported. We tested four randomly selected monthly reports and found one report did not accurately report the number of unique households assisted and the amount of the assistance based on the supporting documentation. The department stated the differences were likely due to a transition in subsystem reporting formats and delays in report processing. We tested four quarterly reports, two of which were randomly selected and two of which were judgmentally selected. We found one report where the cumulative obligation amount did not agree to supporting documentation and were not accurate, and one report where the cumulative obligation and cumulative expenditures amounts did not agree to supporting documentation and were not accurate. The department stated these errors were due to erroneously entered information in the federal awarding agency?s reporting portal. Information included in these reports is used by the federal awarding agency to determine whether the department qualifies for receiving reallocation payments, as well as how much of a reallocation would be awarded to the department. Errors in these reports could result in errors in the federal awarding agency?s determination of eligibility for funding, and/or the reallocation formula. We recommend department management update and correct erroneous reports and establish controls to ensure reported amounts are accurate and adequately supported.

2022-028 Oregon Housing and Community Services Ensure Federal Funding Accountability and Transparency Act reporting is completed Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance Program (COVID-19) Federal Award Numbers and Years: ERA 1, 2021 (COVID-19); ERA 2, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Material Weakness, Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a), (c)-(d); 2 CFR 170, Appendix A I(a) Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing, evaluating, and monitoring the federal award in compliance with the terms and conditions of the award and taking prompt action when instances of noncompliance are identified. The Federal Funding Accountability and Transparency Act (FFATA) requires the department to submit information for any subaward action that equals or exceeds $30,000. Program guidance required the department to report detailed subaward information directly to the federal awarding agency. This detailed subaward information encompassed all requirements related to FFATA, and the federal awarding agency gave the department the option of filing required FFATA reports on their behalf. The department stated they did not provide the detailed subaward information to the federal awarding agency to complete FFATA reporting on their behalf, and they did not complete any alternate FFATA submissions during the fiscal year due to grant award information not being available on the federal website to file their reports. As a result, the department is not in compliance with FFATA reporting requirements. We recommend department management ensure FFATA reporting is completed.

2022-029 Oregon Housing and Community Services Ensure accessible documentation to evidence compliance with program requirements Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance Program (COVID-19) Federal Award Numbers and Years: ERA 1, 2021 (COVID-19) Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility Type of Finding: Material Weakness Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302(a); 2 CFR 200.332(a)(5) Department management is responsible for communicating to subrecipients that they are required to permit the department and auditors access to their records as necessary to ensure the department is compliant with program requirements. To ensure compliance with program requirements, subrecipient records must also be sufficiently detailed. The department passed through $140 million phase one program funds to community action agencies (subrecipients) to provide program delivery. The department performed limited fiscal monitoring during the audit period which included procedures to address compliance with activities allowed and allowable cost requirements for administrative costs. The department did not perform any program monitoring during the audit period which primarily addresses compliance with eligibility requirements. To determine whether the department complied with program requirements for the fiscal year, auditors attempted to reconcile detailed subrecipient ledgers with the intent of selecting and testing sample items at each individual subrecipient organization. We noted issues with two individual subrecipients, resulting in an inability to perform testing procedures over a total of $21,438,521 in program expenditures. For the first subrecipient we were able to reconcile their detailed ledgers to the department?s financial records, however their detailed ledger included pass-through payments to a third organization for program delivery. As a result of the combination of direct and pass-through payments, we were unable to obtain sufficiently detailed data that also reconciled to the department?s financial records to select individual transactions for testing. This subrecipient represents $19,877,962 of the unaudited expenditures. For the second subrecipient we were able to reconcile their detailed ledgers to the department?s financial records and select administrative and program transactions for testing. However, the subrecipient was unresponsive to documentation requests to substantiate expenditures. This subrecipient accounted for $1,560,559 of the unaudited expenditures. We recommend department management obtain and reconcile sufficiently detailed subrecipient ledgers and support to substantiate expenditures to allow for fiscal and program monitoring to ensure subrecipients are administering program funds in accordance with program requirements.

2022-030 Oregon Housing and Community Services Ensure controls over administrative expenditure limits are properly designed and sufficiently detailed to ensure compliance Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.023 Emergency Rental Assistance Program (COVID-19) Federal Award Numbers and Years: ERA 1, 2021 (COVID-19); ERA 2, 2021 (COVID-19) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Material Weakness Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a), (c)-(d); 15 U.S.C. 9058a(c)(5)(A); 15 U.S.C. 9058c(d)(1)(C) Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing, evaluating, and monitoring the federal award in compliance with the terms and conditions of the award and taking prompt action when instances of noncompliance are identified. Federal regulations limit the amount of federal funds that can be used for administrative expenditures. The department periodically prepared tracking spreadsheets during the fiscal year to monitor spending and ensure administrative expenditure limitations were not exceeded. We reviewed four randomly selected tracking spreadsheets and noted two tracking spreadsheets where there was insufficient detail to determine what category expenditures were associated with (administrative versus programmatic); and three tracking spreadsheets where there was no indication that the expenditures were within administrative expenditures limitations due to the periodic nature of the tracking. Without sufficiently designed and implemented controls, the department is at risk for exceeding their allowable administrative cost limits. We recommend department management ensure tracking spreadsheets are properly designed and sufficiently detailed to ensure compliance with administrative expenditures limitations.

2022-031 Oregon Housing and Community Services Comply with subrecipient monitoring requirements Federal Awarding Agency: U.S. Department of the Treasury Assistance Listing Number and Name: 21.027 Coronavirus State and Local Fiscal Recovery Fund (COVID-19) Federal Award Numbers and Years: OMB Approved No. 1505-0271, 2022 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness, Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 45 CFR 75.351; 45 CFR 75.352(b); 45 CFR 75.352(d) When recipients of Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) provide award funds to an entity to carry out objectives of program on behalf of the CSLFRF recipient, the entities receiving such funding are subrecipients. The recipient has the responsibility to monitor expenditures and activities subrecipients. Nearly all the department?s CSLFRF expenditures are comprised of payments to a private organization. Per the contract, the organization was hired to conduct eligibility assessments for the Emergency Rental Assistance program and be responsible to ensure only eligible applicants receive rental and utility assistance payments. CLSFRF funds were used for emergency rental assistance; therefore, the organization is carrying out a program on behalf of the department. The department then has the responsibility to monitor the expenditures and activities of the organization. The department incorrectly identified the organization as a vendor rather than a subrecipient during the contracting process. Per the guidance above, this was not an appropriate determination because the organization carries out eligibility determinations of the program. Management acknowledged no monitoring of the organization was performed during the audit period; therefore, there are no related key controls for the fiscal year ended June 30, 2022. Although program staff maintain a close working relationship with the organization, these interactions are not formalized and documented for the purpose of subrecipient monitoring. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals not met. We recommend department management reassess the department?s contracting process to appropriately identify whether an organization is a vendor or a subrecipient. If a subrecipient, we recommend the department comply with subrecipient monitoring requirements, including developing related internal controls and processes to monitor the expenditures and activities of the organization.

2022-032 Oregon Housing and Community Services Ensure subrecipient risk assessments and fiscal monitoring are performed and required grant information is communicated timely to subrecipients Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program, 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2001ORE5C3, 2020 (COVID-19); 2102ORLIEA, 2021; 2102ORE5C6 , 2021 (COVID-19); 2202ORLIEA, 2022 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR ? 200.332(a) ? (h) Federal regulations require that pass-through entities evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward to determine the extent and scope of subrecipient monitoring activities. Monitoring activities should be based on the results of a given subrecipient?s determined risk. Pass-through entities must also communicate certain award information to subrecipients as the time of the subaward. The department, as the pass-through entity, has long-established subrecipient monitoring procedures broken into two categories: program and fiscal monitoring. Program monitoring is performed by program-specific staff and focuses on requirements related to certain aspects of Activities Allowed and Client Eligibility. During FY2022, the department performed program monitoring activities as planned. Fiscal monitoring reviews compliance requirements related to Allowable Costs, Activities Allowed, and Earmarking. However, fiscal monitoring activities were limited due to staff turnover. As a result, limited fiscal monitoring procedures were performed for 5 of 17 subrecipients, and fiscal monitoring risk assessments were not performed for any of the 17 subrecipients. Without the performance of subrecipient risk assessments and adequate fiscal monitoring, the department risks distributing program funds to subrecipients out of compliance with federal program requirements. Additionally, we reviewed 5 randomly selected subrecipients to determine whether all required grant award information was communicated at the time of the subaward. For all of the 5 subrecipients reviewed, only some of the required information was communicated at the time of the award. The required information missing in the original grant agreements was communicated via agreement amendments several months later. Without timely communication of required grant information, subrecipients may not have all the information they need for the subaward they received. We recommend department management ensure subrecipient risk assessments are performed for all subrecipients and ensure required fiscal monitoring activities are performed based on the results of the risk assessments. We also recommend department management ensure all required award information is communicated to subrecipients at the time of the subawards.

2022-033 Oregon Housing and Community Services Ensure financial reports are submitted Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program, 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2002ORLIEA, 2020; 2102ORE5C6, 2021 (COVID-19) Compliance Requirement: Reporting Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2021 ? 012 Questioned Costs: N/A Criteria: 2 CFR ? 200.303(a), (c)-(d); 2 CFR ? 200.328 Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the federal award. Additionally, management is responsible for evaluating and monitoring the department?s compliance with the terms and conditions of federal awards and taking prompt action when instances of noncompliance are identified. Federal Financial Reports, SF-425?s, are required to be submitted annually for each open grant award ninety days after the end of the federal fiscal year. The department did not submit SF-425?s for two of the four open grants for the federal fiscal period ended September 30, 2021. This is an improvement from the prior fiscal year when the department hadn?t submitted any of the SF-425 reports for open grants. Department management cited a federal reporting system issue where awards are not appropriately tied to the correct grant identification number, which has hindered their ability to submit financial reports. As a result, the department was not in compliance with financial reporting requirements in accordance with the terms and conditions of their grant agreements. We recommend department management work with their federal partners to determine if unsubmitted reports should be completed and to ensure reporting compliance in future fiscal periods.

2022-034 Oregon Housing and Community Services Ensure review of subrecipient requests for funds verifies immediate cash needs are supported Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program, 93.568 Low-Income Home Energy Assistance Program (COVID-19) Federal Award Numbers and Years: 2001ORE5C3, 2020 (COVID-19); 2102ORLIEA, 2021; 2102ORE5C6, 2021 (COVID-19); 2202ORLIEA, 2022 Compliance Requirement: Cash Management Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR ? 200.305(b), (b)(1); 2 CFR ? 200.508 Federal regulations require that auditees maintain documentation as needed for the performance of audit procedures related to the Single Audit. Additionally, regulations require payment advances should be limited to the minimum amounts needed and be timed to be in accordance with the actual, immediate cash requirements of the subrecipient for carrying out the approved program. We reviewed 60 sample cash draws and were unable to obtain adequate supporting documentation for 4 subrecipient requests for reimbursement/advances demonstrating they were appropriate and for immediate cash needs. We also identified an advance payment for which there was not an adequate explanation indicating why an advance was needed. These 5 exceptions totaled $124,304 in expenditures. Department management cited a breakdown in control process and communicated their intention to train relevant staff to ensure adequate support is obtained. Without adequate verification of cash needs, the department could be sending funds to subrecipients that are not for a reimbursement of expenditures or immediate cash needs. We recommend department management strengthen internal controls to ensure support for subrecipient requests for funds adequately documents they are appropriate and for immediate cash needs.

2022-035 Department of Human Services Improve controls over benefit time tracking and discontinuance of federal funding Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2021G996115, 2021; 2022G996115, 2022 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Material Weakness; Noncompliance Prior Year Finding: N/A Questioned Costs: $1,866 known Criteria: 45 CFR 264.1 Federal regulations prohibit federal funding to families that include an adult head-of-household who has received federal assistance for a cumulative of 60 months, and who do not have an allowed exception. The Oregon Department of Human Services? (department) case management system, Oregon Eligibility (ONE), tracks months counting towards the federal limit. When 60 months is reached, ONE sends an indicator to the financial subsystem containing funding coding. If Temporary Assistance for Needy Families (TANF) benefits continue, they are to be funded with state funds. The population of cases identified in ONE as having reached 60 cumulative federal months is obtained from the quarterly performance data reports compiled by a service provider. As stated in a separate finding, titled `Ensure performance data reports are complete and accurate,? we determined the data reports are not complete or accurate, therefore, the population of cases over 60 federal months is also incomplete. However, we tested some cases in the reports to verify ONE was accurately counting federal months and to determine if federal funding was appropriately discontinued. We randomly selected ten cases from an incomplete population of 3,193 and found one case where federal funding inappropriately continued after reaching 60 months due to a coding issue within the financial subsystem, resulting in federal overpayments of $1,944 for recurring monthly cash assistance benefits, and $1,866 for expenses related to seeking employment (JOBS) in fiscal year 2022. The department was aware of the cash assistance coding issue and the JOBS coding issue as early as October 2021. A $5.6 million correction for regular cash assistance was made in accounting records in September 30, 2022, which corrected the cash assistance benefits portion of the error noted above. The JOBS coding issue has yet to be corrected in accounting records and the department did not have an adjustment total readily available. As the regular cash assistance correction surpassed $5 million, we have reasonable assurance that the uncorrected federal JOBS payments also exceed $25,000 in likely questioned costs. We recommend department management make timely corrections to federal/state coding splits in the financial subsystem and also make timely corrections in state accounting records. We also recommend the department reimburse the federal agency for unallowable costs.

2022-036 Department of Human Services Ensure performance data reports are complete and accurate Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2021G996115, 2021; 2022G996115, 2022 Compliance Requirement: Reporting Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2021-009, 2020-013, 2019-008 Questioned Costs: N/A Criteria: 45 CFR 265.7(a) and (b) and (f) Federal regulations require the department to collect monthly and report quarterly certain financial and non-financial data elements for services paid with Temporary Assistance for Needy Families (TANF) federal funding in the ACF-199 TANF data report. Federal regulations also require the department to report data quarterly for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the ACF-209 SSP-MOE data report. Both data reports should be supported by applicable performance records. During fiscal year 2021, the department transitioned key aspects of the TANF program to Oregon Eligibility (ONE) for case management, while TANF child welfare payments continued to be recorded in OR-Kids the child welfare system. The department contracts with a service provider to extract data from ONE and OR-Kids to populate the data reports. Program staff currently work with the service provider to obtain comprehensible data reports prior to submission to review them for errors and when found, each issue is logged as a defect for the service provider to correct. The department and the U.S. Administration for Children and Families identified data reports submitted for state fiscal year 2022 were incorrect. The federal quarterly report ended September 30, 2021, was revised and resubmitted but still had likely errors according to program staff. Quarterly reports ended December 31, 2021 (Q1), March 31, 2022 (Q2), and June 30, 2022 (Q3), were corrected and resubmitted in February 2023. Data reports are comprised of individual component reports identified by ?T? for ACF-199 TANF and ?M? for ACF-209 MOE. We reviewed the resubmitted Q1, Q2, and Q3 reports and found: ? The Q1 TANF T2 and MOE M2 reports corrected a prior known defect. The fields identifying work participation have populated associated fields with job type and hours. ? The Q3 T6 report showing number of applications, number and types of families, and amount of assistance, reported $4.5 million more than supported by accounting records. ? The April 2022 T1 report contained 4,035 case numbers not found in the underlying system records, and 1,081 from system records not reported in the T1 report. ? OR-Kids cases in the Q1, Q2, and Q3 T1 24 of 45 fields left blank. ? In 10 of 21,171 cases recorded as having surpassed the federal funding limit of 60 months in the Q1, Q2, and Q3 T2 reports, we found three where the T2 reports did not agree to support in ONE. As the performance data reports are known to be incomplete and inaccurate, we are unable to test them for compliance with federal reporting requirements. To date, the implementation of ONE has not resolved findings related to performance data reporting, which have been ongoing since fiscal year 2010. Though the department has yet to receive a Service Organization Control (SOC) report from the service organization administering ONE and compiling data reports the department is in the process of contracting for a SOC report. Without an annual SOC report, the department does not have assurance controls are functioning as intended at the service organization for the TANF program. We recommend department management continue to review ACF-199 and ACF-209 reports prior to submission and monitor known compilation defects to ensure performance data reports submitted are complete and accurate. We also recommend department management obtain an annual SOC report over the service organization?s internal controls for the ONE application.

2022-037 Department of Human Services Improve accuracy of cases reported as noncooperating with child support Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2021G996115, 2021; 2022G996115, 2022 Compliance Requirement: Special Tests and Provisions Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 45 CFR 264.30-31 Federal regulations require the department to refer all appropriate individuals in the family of a child to the child support enforcement agency. If the department determines referred individuals are not cooperating, without good cause, in establishing, modifying, or enforcing a support order with respect to the child, then the department must reduce or deny assistance in the Temporary Assistance for Needy Families (TANF) program. The department faces reduced State family assistance grant payments for failure to enforce penalties against noncompliant individuals. In March 2020, the department established good cause exemptions due to Covid for all individuals. Noncooperation sanctions were reinstated in April 2021, by which time the department had moved its case management system to Oregon Eligibility (ONE). When a caseworker enters a child support noncooperation code in ONE, the system should automatically reduce TANF benefits. The population of cases identified in ONE as not cooperating with child support is obtained from the quarterly performance data reports compiled by a service provider. As stated in a separate finding, titled `Ensure performance data reports are complete and accurate,? we determined the data reports are not complete or accurate, therefore, the population of cases not cooperating with child support is also incomplete. However, we tested some cases in the reports to verify ONE was appropriately reducing benefits. The quarterly performance data reports for periods October 1, 2021, through June 30, 2022, consisted of 133 unique cases identified as not cooperating with child support. We randomly selected 14 cases and could not find support in ONE for noncooperation. The department identified one case entered in ONE incorrectly by a caseworker and the remaining cases had various nuances causing the performance data reports to retrieve the information incorrectly. All 14 cases were either cooperating with or not applicable to child support. The department also identified at least eight defects in child support data retrieval it reported to the service provider. We are unable to determine if ONE is correctly reducing TANF benefits when a case is not cooperating with child support. We recommend department management ensure noncooperative child support cases from ONE are completely and accurately reported in its performance data reports.

2022-038 Department of Human Services Ensure work participation rate calculation uses verified and accurate data Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2021G996115, 2021; 2022G996115, 2022 Compliance Requirement: Special Test and Provisions Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: 2021-010, 2020-014, 2019-009 Questioned Costs: N/A Criteria: 45 CFR 261.61-62, 65 Federal regulations require each state maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Each state must have procedures to count and verify reported hours of work and must comply with its Work Verification Plan as approved by the U.S. Department of Health and Human Services (DHHS). Oregon?s Work Verification Plan outlines a system of controls for how reported hours will be verified and documented, and for reviews and monitoring procedures to identify errors. Work participation hours are reported via the quarterly Temporary Assistance for Needy Families (TANF) ACF-199 data reports and for benefits paid with designated state funds called maintenance of effort (MOE), the ACF-209 reports. As stated in a separate finding, titled `Ensure performance data reports are complete and accurate,? we determined the data reports are not complete or accurate. However, we found the department did correct a previous issue in which work participation hours on the ACF-199 report were left blank. Although reports were known to be incomplete, we reviewed the reporting periods October 1, 2021, through June 30, 2022, to test for compliance of the Work Verification Plan. We reviewed 20 randomly selected ACF-199 cases from a population of 16,249, and 20 randomly selected ACF-209 cases from a population of 146,324 of participating clients for verification of work activity participation. We found: ? Five of 20 ACF-199 cases with reported participation hours did not agree with hours in the system of record TRACS. ? 14 of 20 ACF-199 cases lacked support for the reported hours. ? 9 of 20 ACF-209 cases lacked support for the reported hours. These inaccurate or unverified hours were reported to DHHS for use in calculating the work participation rate. If the state fails to follow the approved Work Verification Plan, DHHS may penalize the state. We recommend TANF program management ensure the work participation rate is calculated appropriately using verified and accurate participation data in adherence to the department?s Work Verification Plan. We also recommend program management review the system of controls and identify where improvements are needed to ensure compliance with the work verification plan.

2022-039 Department of Human Services Improve documentation of required income and benefit verifications Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2021G996115, 2021; 2022G996115, 2022 Compliance Requirement: Special Tests and Provisions Type of Finding: Material Weakness Prior Year Finding: 2021-011 Questioned Costs: N/A Criteria: 45 CFR 205.55 Federal regulations require each state to participate in the Income Eligibility and Verification System (IEVS), which for Oregon, includes using income and benefit screens accessible through Oregon Employment Department, Internal Revenue Service, and Social Security Administration, when making Temporary Assistance for Needy Families (TANF) eligibility determinations. The department?s current procedure instructs caseworkers to narrate ?IEVS checked? in the case management system, Oregon Eligibility (ONE), after reviewing all appropriate IEVS screens at the time of eligibility determination. The department submitted change requests to the eligibility system?s service provider that would prohibit ONE from paying benefits until all IEVS screens are checked; however, the system change has not yet been completed. From a population of 105,267 TANF benefit payments recorded in ONE we randomly selected a sample of 40 and two additional individually significant payments for testing. We found in 16 cases, there was no narration of the IEVS check by caseworkers, in either ONE or the former narrative system. We verified these clients did meet the TANF eligibility criteria related to IEVS screens, however, by not providing assurance of verification of the use of IEVS screens, the department increases the risk of providing benefits to TANF ineligible applicants. We recommend department management ensure verification of income and benefits with IEVS screens is clearly documented in client case files when determining client eligibility.

2022-040 Department of Human Services Improve controls to ensure eligibility criteria are met Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families Federal Award Numbers and Years: 2021G996115, 2021; 2022G996115, 2022 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $9,569 (known); $931,750 (likely) Criteria: 45 CFR 264.1; Oregon TANF State Plan The State of Oregon Temporary Assistance for Needy Families (TANF) State Plan (Plan) defines financial neediness criteria with its adjusted income limit tables. Federal regulations establish 60 cumulative months as the length of time a client may receive federal TANF assistance. The department uses its case management system, Oregon Eligibility (ONE), to count federal-eligible benefit months, and when 60 months is reached, an indicator is sent to the financial subsystem to change federal funding to state funding. From a population of 105,267 TANF benefit payments recorded in ONE, we randomly selected a sample of 40 and two additional individually significant payments for testing. We found: ? One sample?s financial eligibility information included a disaster relief benefit without details showing the date of payment and the covered time period. As a result, auditors and the department are unable to determine if this case met financial eligibility criteria, resulting in questioned costs of $1,311. ? One individually significant case?s child support and spousal support were entered incorrectly into ONE. The countable income at time of certification did not meet the adjusted income limit, making the client ineligible for TANF benefits. Questioned costs for this case total $8,258. We recommend department management ensure federally-funded client benefits are paid on behalf of eligible individuals, and documentation is retained to support eligibility decisions. We also recommend department management correct the identified error cases and reimburse the federal agency for questioned costs.

2022-041 Oregon Health Authority Ensure expenditures of federal funds are recorded to the appropriate program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services (COVID-19), 93.959 Block Grants for Prevention and Treatment of Substance Abuse (COVID-19) Federal Award Numbers and Years: 93.958: 1B09SM083994, 1B09SM085378 (COVID-19); 93.959: 1B08TI083513, 1B08TI083963 (COVID-19) Compliance Requirement: Activities Allowed or Unallowed Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: 93.958 - $2,268,421 (known COVID-19) Criteria: 2 CFR 200.303; 42 USC 300x-1 The department was required to submit a spending plan documenting the intended use of the awarded COVID-19 funding allocations under the Mental Health Block Grant (MHBG) and Substance Abuse Block Grant (SABG). The expenditure of COVID-19 funding should align with each block grant?s approved spending plan. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal statutes, regulations, and terms and conditions of the Federal award. Our testing of state fiscal year 2022 MHBG COVID-19 expenditures identified $10.4 million in workforce development incentive payments inappropriately recorded under the MHBG. Further inquiry into the payments revealed the department determined during state fiscal year 2023 these expenditures were not included in the MHBG COVID-19 spending plans and were not allowable activities under the MHBG. The department determined incentive payments totaling $8.1 million in COVID-19 expenditures should have been recorded under the SABG in accordance with the SABG COVID-19 spending plans. The department subsequently moved the $8.1 million of the combined $10.4 million total COVID-19 incentive payment expenditures to the SABG; however, the remaining $2.3 million in incentive payment expenditures were left in the MHBG as a funding source had yet to be determined. An adjustment to the Schedule of Expenditures of Federal Awards (SEFA) was required to move the $8.1 million in COVID-19 spending from the MHBG to SABG. The remaining $2.3 million is considered questioned costs under the MHBG. We recommend department management ensure controls are properly designed and implemented to record only allowable expenditures to the appropriate federal programs.

2022-042 Oregon Health Authority Ensure expenditures of federal funds are for allowed activities Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services Federal Award Numbers and Years: 1B09SM083823, 2021 Compliance Requirement: Activities Allowed or Unallowed Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: $525,272 (known) Criteria: 42 USC 300x-5(a)(3) Mental Health Block Grant (MHBG) funds may not be expended on the purchase, construction, or permanent improvement of any building or other facility other than minor remodeling. Substance Abuse and Mental Health Services Administration?s (SAMHSA) standard funding restriction guidance defines minor alterations and renovations as the lesser of 25% of the budget period or $150 thousand. Additionally, all minor alterations and renovations must be approved by SAMHSA. During our testing of MHBG subrecipient contracts entered into during state fiscal year 2022, we noted one contract included payment for the remodeling of an existing building owned by the subrecipient. A payment of $525,272 was processed in December 2021 for the remodeling expenses as specified in the contract's payment provisions. However, this amount exceeds SAMHSA's threshold for minor alterations and renovations and is not allowed under the MHBG. We recommend department management ensure controls are properly designed and implemented to record only allowable expenditures to the MHBG. We further recommend department management seek SAMHSA approval for minor alterations and renovations.

2022-043 Oregon Health Authority Implement controls to ensure subrecipients are appropriately identified and monitored Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services; 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.958: 1B09SM082625, 2020; 1B09SM083823, 2021; 1B09SM086032, 2022; 93.959: 1B08TI083068, 2020; 6B08TI083472, 2021; 6B08TI084667, 2022 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness; Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.331; 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require pass-through entities to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact which federal compliance requirements recipients are subject to and how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). For recipients meeting the definition of a subrecipient, federal regulations require pass-through entities to evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient?s determined risk to ensure subawards are used appropriately. We reviewed the department?s classification of a sample of eight of 40 Mental Health Block Grant (MHBG) and 11 of 76 Substance Abuse Block Grant (SABG) recipients of federal funds. We judgmentally selected an additional 11 MHBG and 30 SABG recipients for review after our review of the initial sample of recipients identified inconsistencies in the classification of recipients. Based on the following inconsistencies identified in our review, it is unclear if the department correctly classified recipients as subrecipients or contractors and the related expenditures are reported accordingly. As a result, the SEFA may incorrectly report pass-through or direct expenditures. ? One recipient of MHBG funds and 13 recipients of SABG funds were classified as contractors by the department; however, other recipients providing the same services were classified as subrecipients. As they were identified as contractors, a SEFA correction of $1.4 million was made to report as direct expenditures rather than pass-through expenditures. ? Three recipients of MHBG funds and one recipient of SABG funds were classified as subrecipients by the department, but it was unclear if each met the definition of a subrecipient. ? One recipient of MHBG funds was classified as a contractor and appeared to meet the definition of a contractor; however, payments made to this recipient were recorded as pass-through expenditures. A SEFA correction of $329 thousand was made to report as direct expenditures rather than pass-through expenditures. ? One recipient of SABG funds was classified as neither contractor nor subrecipient. A SEFA correction of $215 thousand was made to report as direct expenditures rather than pass-through expenditures. We also inquired of the department?s risk assessment and monitoring activities for subrecipients. Based on our inquiries, the department does not have a formal implemented process for performing risk assessments to determine appropriate monitoring activities. Moreover, the department has not implemented a formal process to ensure subrecipients comply with federal regulations, terms and conditions of the subaward, and that subaward performance goals are achieved. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals not met. We recommend department management ensure recipients of federal funds are appropriately identified as subrecipients or contractors and the corresponding disbursement of federal funds are appropriately reported as direct or pass-through expenditures. We further recommend department management comply with subrecipient monitoring requirements, develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented according to risk assessment results.

2022-044 Oregon Health Authority Implement a consistent methodology for calculation of maintenance of effort Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.958 Block Grants for Community Mental Health Services; 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.958: 1B09SM082625, 2020; 1B09SM083823, 2021; 1B09SM086032, 2022; 93.959: 1B08TI083068, 2020; 6B08TI083472, 2021; 6B08TI084667, 2022 Compliance Requirement: Matching, Level of Effort, Earmarking Type of Finding: Material Weakness Prior Year Finding: N/A Questioned Costs: N/A Criteria: 42 USC 300x-2(a)(1)(C); 42 USC 300x-4(b)(1); 42 USC 300x-9(c)(1); 42 USC 300x-22(b)(1)(C); 42 USC 300x-30(a); 2 CFR 200.303 The Mental Health Block Grant and Substance Abuse Block Grant are subject to various Maintenance of Effort and Earmarking requirements. These requirements ensure the department meets minimum expenditure thresholds. Federal regulations require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Based on auditor recalculations, we determined the department was in compliance with the applicable Maintenance of Effort and Earmarking requirements during state fiscal year 2022. However, we noted the following control weaknesses in the department?s calculations and demonstration of their compliance with the requirements: ? The department is required to expend 10% of the federal award for early serious mental illness and a first episode psychosis treatment services under the Mental Health Block Grant. The 10% set aside is calculated and budgeted when federal awards are granted. However, tracking of expenditures is not performed to ensure compliance is achieved. ? The department is required to maintain state expenditures for community mental health services and authorized substance abuse activities at a level not less than the average expenditures of the prior two state fiscal years. The department is also required to ensure expenditures for systems of integrated services for children with serious emotional disturbance and substance abuse treatment for pregnant women and women with dependent children is not less than the amount expended for these services in fiscal year 1994. The applicable expenditures were not consistently or accurately calculated by the department in each of the state fiscal years included in the Maintenance of Effort determinations. Additionally, no written procedures exist for the calculations. The department is at risk of noncompliance without controls in place to help ensure expenditures are tracked and calculations are consistently applied across fiscal years. We recommend department management implement controls to ensure applicable expenditures are adequately tracked and calculations applicable to the maintenance of effort requirements are consistently performed across fiscal years. We further recommend department management work with the federal awarding agency to submit corrected maintenance of effort totals to ensure appropriateness of future maintenance of effort determinations.

2022-045 Oregon Health Authority Submit required FFATA reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.268 Immunization Cooperative Agreements; 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases; 93.958 Block Grants for Community Mental Health Services; 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 93.268: 5 NH23IP922626; 6 NH23IP922626; 93.323: 6 NU50CK000541; 93.958: 1B09SM083823, 2021; 93.959: 6B08TI083472, 2021; 6B08TI084667, 2022 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 170 Appendix A; 2 CFR 200.303 Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. We identified and reviewed the reporting status of all the department?s subawards subject to FFATA reporting during the audit period. We determined: ? Five of 30 Mental Health Block Grant (MHBG) subawards were not reported, totaling $4.2 million in obligations. ? 12 of 65 Substance Abuse Block Grant (SABG) subawards were not reported, totaling $6.2 million in obligations. ? Four of 37 Epidemiology and Laboratory Capacity (ELC) subawards were not reported, totaling almost $55.5 million in obligations. ? Five of 39 Immunization Cooperative Agreements subawards were not reported, totaling $6.3 million in obligations. Of the total not reported, one SABG, one ELC, and two Immunization subawards were not reported in the FSRS due to oversights in the department?s reporting process. The remaining unreported subawards resulted from the department?s suspension of FFATA reporting stemming from the federal replacement of the DUNS number with the Unique Entity Identifier (UEI) in May 2022. The department did not have UEI numbers for all subrecipients at the time of the replacement which prevented the department from submitting accurate reports. FFATA reporting was suspended through the end of state fiscal year 2022 and into the following state fiscal year. Although the department suspended FFATA reporting in the FSRS, a tracking spreadsheet was maintained that included all subaward award information needed for reporting once reporting is resumed. We recommend department management resume FFATA reporting as soon as feasible and ensure all necessary subawards are reported. We further recommend department management implement controls to ensure all subawards are appropriately tracked and reported.

2022-046 Oregon Health Authority Ensure cash draws are made only for immediate cash needs Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.959 Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 6B08TI083472, 2021 Compliance Requirement: Cash Management Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 31 CFR 205.33 The Substance Abuse Block Grant is subject to federal cash management requirements. Federal regulations require the state minimize the time between the drawdown and disbursement of federal funds. The department?s normal draw procedure for the block grant is designed to request federal funds on a reimbursement basis. The amount to be drawn is calculated based on a comparison between previously drawn revenue amounts and program expenditures at the time of the draw. During our testing of a sample of three of the 15 cash draws performed during state fiscal year 2022, we identified an error in the calculation of a draw performed in April 2022 for the 2021 award. The process used to identify program revenues and expenditures for the draw calculation was incorrectly updated when the department transitioned to a new data analysis tool. As a result, the April 2022 draw requested $1 million in federal funds in excess of actual expenditures. The error in the query was not identified by the department through the end of the fiscal year. The total drawn on the award at the end of state fiscal year 2022 was in excess of expenditures by $847 thousand. Although the 2021 award was drawn in excess of expenditures at times after April 2022, the total revenues and expenditures were balanced at the close out of the award in December 2022. Additionally, according to Federal regulations no interest liability is incurred even though the draws were in excess of the immediate cash needs of operating the program. We recommend management ensure controls over the draw process are designed and implemented to review and identify calculation errors.

2022-047 Oregon Health Authority Implement controls to comply with subrecipient monitoring requirements Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR (Non-major program) Federal Award Numbers and Years: H79TI081716, 2020; H79TI083316, 2021 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: 2019-019 Questioned Costs: N/A Criteria: 45 CFR 75.303(d); 45 CFR 75.351; 45 CFR 75.352(b) and (d) Federal regulations require that pass-through entities evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient?s determined risk. Federal regulations also require grantees take prompt action when instances of noncompliance are identified in audit findings. The Health Systems Division of the Oregon Health Authority (department) developed a formal process for performing risk assessments to determine appropriate monitoring activities and developed a tool to document post award monitoring in March of 2020, and for three years, the department has pointed to these procedures as actions taken to partially correct the original 2019 finding. However, the department has yet to implement these or other procedures, and the Opioid program has no documented monitoring plan in place. Federal regulations require the department, as a pass-through entity, to determine if the recipients of disbursements of federal funds are subrecipients or contractors. The subrecipient and contractor determination will impact how program expenditures are reported on the Schedule of Expenditures of Federal Awards (SEFA). Out of 75 contracts with 59 subrecipients, we reviewed 15 contracts with 10 subrecipients and based on the contracts? listed deliverables, we determined five of them did not appear to meet the definition of a subrecipient. Department management could not support its subrecipient determinations and could not identify who made the decisions. As a result, the SEFA may incorrectly report $751,911 as pass-through funds instead of direct expenditures. We recommend department management comply with subrecipient monitoring requirements by implementing and documenting a procedure that evaluates each subrecipient?s risk of noncompliance for the purpose of determining and performing the appropriate monitoring for each subrecipient. We also recommend department management implement procedures to ensure federal subrecipient versus contractor determinations result in accurate reporting on the SEFA.

2022-048 Oregon Health Authority Improve review of federal performance progress reports Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.788 Opioid STR (Non-major program) Federal Award Numbers and Years: H79TI081716, 2020; H79TI083316, 2021 Compliance Requirement: Reporting Type of Finding: Significant Deficiency Prior Year Finding: 2019-020 Questioned Costs: N/A Criteria: 45 CFR 75.303(a); 45 CFR 75.342(b); Opioid STR Notice of Awards Federal regulations require performance progress reports (reports) be submitted semi-annually and include an overview of the goals and objectives accomplished during the funding period as stated in the grants? funding opportunity announcements. In addition, federal regulations require award grantees to establish and maintain effective internal control that provides reasonable assurance the award is managed in compliance with regulations and terms and conditions of the award. Effective controls may include review and approval of reports for completeness and accuracy. The Health Systems Division of the Oregon Health Authority (department) developed a tool to document post award monitoring in March of 2020, and for three years, the department has pointed to this tool as an action taken to ensure reports are complete and accurate. Although the department has yet to implement this tool, we found evidence of other internal controls that were partially implemented. Program now utilizes collaborative online software called Smartsheet which allows a contracted evaluator to compile subrecipient performance data the department can monitor and edit in real time. The department uses the Smartsheet as support for progress report data. We found some key data elements in the SOR2 year 2 progress report did not agree to support in Smartsheet. Program stated they reviewed a different spreadsheet supplied by the evaluator, not Smartsheet, which had totals agreeing to the submitted report. However, the department did not retain this additional spreadsheet. Without retaining the underlying support used for review, we are unable to assess the effectiveness of the department?s review of the report prior to submission. Program now requires manager review of reports prior to submission. We found evidence of manager review of the SOR2 year 2 progress report, however it was dated two days after the report was submitted. Ineffective controls could result in a misrepresentation of the grant?s performance. We recommend department management implement internal controls to ensure performance progress reports are complete and accurate prior to report submission.

2022-049 Oregon Health Authority Return overdraw of reclassified FEMA expenditures Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.268 Immunization Cooperative Agreements (COVID-19); 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (COVID-19) Federal Award Numbers and Years: 93.268: 5 NH23IP922626 (COVID-19); 6 NH23IP922626 (COVID-19); 93.323: 6 NU50CK000541 (COVID-19) Compliance Requirement: Activities Allowed or Unallowed Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: 93.268: $36,783 (known) (COVID-19); 93.323: $73,333 (known) (COVID-19) Criteria: 2 CFR 200.403 During the COVID-19 pandemic, the Oregon Health Authority (department) spent money from Federal Emergency Management Agency (FEMA) awards to address needs in addressing the pandemic. Due to delays in receiving federal reimbursement for the expenditures, the department reclassified the expenditures to other programs where reimbursements would occur timelier. In our testing of Activities Allowed or Unallowed, we reviewed two individually significant items in the accounting system reclassifying 398 and 914 individual expenditures from the FEMA grants to the Immunization Cooperative Agreements program and Epidemiology and Laboratory Capacity program, respectively. Based upon the account coding of the original transactions, all of the reclassifications were allowable and consistent with program requirements. However, we found several transactions were reclassified twice, resulting in an excess of $36,783 charged to the Immunization program and $73,333 charged to the Epidemiology program. The reclassifications were completed in two batches and the managerial review of the reclassifying transactions failed to detect some transactions were included in both batches. We recommend department management correct the entries and reimburse excess cash drawn to the federal agency for unallowable costs. We also recommend department management revise the review procedures to verify that the same expenditure transactions are not duplicated in multiple batches.

2022-050 Oregon Health Authority Improve review of expenditure transactions Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.268 Immunization Cooperative Agreements (COVID-19) Federal Award Numbers and Years: 5 NH23IP922626, 2022 (COVID-19); 6 NH23IP922626, 2022 (COVID-19) Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303 During fiscal year 2022, payroll for the Oregon Health Authority was processed through the Oregon State Payroll Application (OSPA). As part of each monthly payroll cycle, managers are expected to review and approve employee?s reported hours to ensure expenditures are accurate and are billed to the correct program(s). Although state policy requires managers to review the timesheets, the automated controls in the system will process the payroll without a review, effectively making the managerial review optional. The OSPA was retired as of November 30, 2022. However, the new Workday application that went into effect to replace the OSPA has the same weakness where payroll will process without regard for the managerial review. As part of our testing of program expenditures, we found that 3 of 134 timesheets were not reviewed by a manager prior to release into the payroll system. For each of these items, we were able to perform alternative procedures to verify that the amounts charged to the program were appropriate and there are no questioned costs. However, the lack of review increases the risk that inappropriate payroll costs may be charged to the program. We recommend management implement procedures to ensure that all employee payroll submissions are properly reviewed, and payroll is appropriately charged to the correct cost center or program.

2022-051 Oregon Health Authority Correct expenditures charged to the incorrect program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (COVID-19) Federal Award Numbers and Years: 6 NU50CK000541 (COVID-19) Compliance Requirements: Activities Allowed or Unallowed Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $356,050 (COVID-19) Criteria: 2 CFR 200.302 To address the COVID-19 pandemic, the Center for Disease Control (CDC) awarded the Oregon Health Authority (department) over $495 million in additional funding beyond the normal funding levels for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. The funding was awarded for specific purposes such as enhancing detection, reopening schools, and enhancing detection expansion. The purposes of these awards generally do not allow for expenditures directly related to operating the COVID-19 vaccine clinics. In our testing, we identified two payments totaling $356,050 relating to emergency medical technicians attending vaccine clinics to assist if those receiving the vaccine had adverse reactions and required medical attention. Per department management, the transactions should have been charged to a different grant provided by the Federal Emergency Management Agency (FEMA). The error was caused by incorrect account coding when the invoice was processed. Other transactions under this contract were properly charged to the FEMA grant. We recommend management correct the accounting error and ensure the expenditures are charged to the correct programs. We also recommend the department determine if there are additional questioned costs relating to the advanced cash draw as the federal programs have different timing for federal reimbursements.

2022-052 Oregon Health Authority Improve review of expenditure transactions Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (COVID-19) Federal Award Numbers and Years: 6 NU50CK000541, 2021 (COVID-19) Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $35,416 (known) (COVID-19) Criteria: 2 CFR 200.303 As part of our testing, we reviewed expenditures charged to the program to ensure they were properly approved and an appropriate use of program resources. We randomly selected 25 of 2,355 non-payroll transactions as the basis for our testing. For one of the transactions, there was no evidence the expenditures had been reviewed and approved as appropriate expenditures for the program. The specific transaction was for cell phones and data plans on wireless devices and consisted of 584 separate devices. Only 24 (2.5%) of those devices had been approved by a manager. The department will pay the vendor for the full amount of the invoice. Managers are expected to review the charges for their unit and verify they are directed to the proper cost center. The $35,416 in questioned costs represents the charges for the devices without approval. Also, during fiscal year 2022, payroll for the department was processed through the Oregon State Payroll Application (OSPA). As part of each monthly payroll cycle, managers are expected to review and approve employee?s reported hours to ensure expenditures are accurate and are billed to the correct program(s). Although state policy requires managers to review the timesheets, the automated controls in the system will process the payroll without a review, effectively making the managerial review optional. The OSPA was retired as of November 30, 2022; however, the replacement payroll system operates in a similar manner for managerial review. As part of our testing of payroll expenditures, we found one of 25 randomly selected timesheets were not reviewed by a manager prior to release into the payroll system. We were able to perform alternative procedures to verify the amounts charged to the program were appropriate and there are no questioned costs. The lack of review increases the risk that inappropriate costs may be charged to federal programs. We recommend management ensure wireless device charges are properly reviewed, and expenditures are charged to the correct cost center or program. We also recommend management implement procedures to ensure all employee payroll submissions are reviewed and approved by program management.

2022-053 Oregon Health Authority Improve financial reporting accuracy Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.323 Epidemiology and Laboratory Capacity for Infectious Diseases (COVID-19) Federal Award Numbers and Years: 6 NU50CK000541, 2020 (COVID-19); 6 NU50CK000541, 2021 (COVID-19) Compliance Requirements: Reporting Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2021-022 Questioned Costs: N/A Criteria: 2 CFR 200.328 In response to the COVID-19 pandemic, the Centers for Disease Control (CDC) awarded states substantial funds for the purpose of addressing the pandemic at the state level. Among other requirements, states are required to submit monthly financial reports to the CDC providing totals spent on travel, payroll, equipment, and other categories. During the fiscal year 2021 audit, we reported a material weakness relating to the accuracy of the amounts reported to the CDC. The same issue persisted throughout fiscal year 2022. As of June 30, 2022, the department had not taken the necessary actions to implement the prior recommendations and had not fully corrected the reports submitted in fiscal years 2021 and 2022. However, as of March 2023, the department had implemented the appropriate corrective actions and the previously inaccurate reports have been updated, including the reports for fiscal year 2022. Audit standards require that we report on the status as of June 30, 2022. We recommend department management maintain the necessary internal controls to ensure the monthly financial reports are accurate and agree to the accounting records.

2022-054 Department of Human Services/Oregon Health Authority Improve controls over payments for Medicaid clients Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2105OR5MAP, 2021; 2105OR5ADM, 2021; 2205OR5MAP, 2022; 2205OR5ADM, 2022 Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.1(1); 2 CFR 200.400(a); 2 CFR 200.404; 42 CFR ? 433.32(a) Federal regulations only allow the Medicaid program to charge allowable program expenditures at the federal financial participation rate for various program costs at the time of payment for services provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to service providers through the Jsystems system. We randomly sampled 61 clients and one Medicaid service payment associated with each client using a statistically valid sample. We reviewed agency documentation to test compliance with the Activities Allowed or Unallowed & Allowable Cost requirements. For 1 client, we found the issues described below. ? The claim selected as our sample item did not have mileage accurately calculated, which resulted in an overpayment. Further review of payments for this client identified additional inaccurate payments during the fiscal year for mileage to this provider. Questioned costs identified for our sample item resulted in an overpayment of $6.00 and other identified questioned costs resulted in an underpayment of ($5.27). The above issues occurred due to human error when entering mileage into the state payment system from the home care worker mileage tracking software (OR-PTC), which lead to improper payments. Phase 1 of the OR-PTC system was implemented in September of 2021. During this phase of the implementation branches must run a report of mileage claims and enter these claims manually into the payment system. Due to the exceptions noted above, we reviewed all clients within our sample for the fiscal year which had mileage entered into the OR-PTC system and identified multiple additional underpayments and overpayments that resulted in an overall underpayment of ($49.07). Due to the systemic nature of this issue, we are unable to reasonably estimate or quantify remaining potential questioned costs outside of our sample population. We recommend department and authority management strengthen controls over the OR-PTC system to ensure transactions are adequately supported and reviewed.

2022-055 Department of Human Services/Oregon Health Authority Strengthen review over direct costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2105OR5MAP, 2021; 2105OR5ADM, 2021; 2205OR5MAP, 2022; 2205OR5ADM, 2022 Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $47,942 (known) Criteria: 2 CFR 200.1(1); 2 CFR 200.400(a); 2 CFR 200.404; 42 CFR ? 433.32(a) Federal regulations only allow the Medicaid program to charge allowable program expenditures at the federal financial participation rate for various program costs at the time of payment for services provided. The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state?s accounting system. We judgmentally selected payments to 28 vendors for our review. We identified the following 2 errors, which were not identified during their review process, that resulted in improper payment of Medicaid expenditures: ? Payments to one vendor charged expenditures related to a specific project unrelated to the Medicaid program, resulting in known federally funded questioned costs of $1,361. ? For one payment management was unable to provide a contract or support for bids collected for the project charged to the Medicaid program, resulting in known federally funded questioned costs of $46,581. The above issues occurred due to human error and inadequate record maintenance which could lead to unallowed activities/costs being charged to the Medicaid program. We recommend department and authority management strengthen controls over review to ensure transactions are adequately supported and reviewed. Additionally, we recommend the authority reimburse the federal agency for unallowable costs.

2022-056 Department of Human Services/Oregon Health Authority Return questioned costs related to 2019-014 audit finding Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 1805OR5MAP, 2018; 1805OR5ADM, 2018; 1905OR5MAP, 2019; 1905OR5ADM, 2019 Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Noncompliance Prior Year Finding: 2019-014 Questioned Costs: $348,080 (known) Criteria: 42 CFR 433.32(a); 42 CFR 433.312(a); 42 CFR 447.45(f)(1)(iv) During our testing for the fiscal year 2019 we noted that the MMIS data tables did not agree to the rates established by CMS for 2 procedures codes. Using incorrect rates resulted in an overpayment of $348,080 to providers. This overpayment was first reported in the fiscal year-end June 30, 2019, Secretary of State audit report number 2020-14, finding number 2019-014. As of January 1, 2020, management updated the MMIS data tables to ensure all future provider payments were made at the correct rate. Additionally, management updated control procedures to ensure MMIS data tables are updated timely and accurately. However, as of May 1, 2023, the overpayment to providers has not been collected, federal funds have not been returned, and the planned repayment method has not been approved by CMS. Per authority management they plan to let these overpayments run through their cost settlement process which would be an unusual method to return federal funds. We recommend authority management reimburse the federal agency for unallowable costs.

2022-057 Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.777 and 93.778 Medicaid Cluster Federal Award Numbers and Years: 2105OR5MAP, 2021; 2105OR5ADM, 2021; 2205OR5MAP, 2022; 2205OR5ADM, 2022 Compliance Requirement: Special Tests and Provisions Type of Finding: Significant Deficiency Prior Year Finding: 2021-020 Questioned Costs: N/A Criteria: 42 CFR 455.436; 42 CFR 455.102 to 455.107; 42 CFR 455.414 Provider eligibility requirements for the Medicaid program differ depending upon the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulations agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, the federal regulations require that the Oregon Health Authority (authority) and Department of Human Services (department) determine eligibility for Medicaid providers and revalidate providers at least every five years by performing database checks to ensure providers are still eligible to participate in the Medicaid program. We selected a random sample of 62 providers in the Medicaid program with 32 providers enrolled by the authority and 30 enrolled by the department. For 4 providers we found the issues described below. ? I-9 form for 1 department provider could not be located. This provider is not currently a provider with the State and an updated I-9 will not be obtained. Based on our review of other available support we were able to determine this to be an eligible provider during the fiscal year. ? I-9 form for 1 department provider could not be located. The department has since obtained a completed I-9 form. ? I-9 forms for 2 department providers did not include a review of minimum acceptable documents to verify identity and employment authorization. The department is actively working to obtain missing documentation and based on our review of other available support we were able to determine these to be eligible providers during the fiscal year. The above issues occurred due to human error and inadequate record maintenance which could lead to ineligible providers receiving Medicaid funding. We recommend department management strengthen controls to ensure documentation supporting a provider?s eligibility determination and revalidation is complete.

2022-058 Department of Human Services Perform timely reconciliations of refinanced OR-Kids transactions Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Number and Name: 93.667 Social Services Block Grant Federal Award Numbers and Years: 2101ORSOSR, 2021; 2201ORSOSR, 2022 Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $1,308,457 (likely) Criteria: 42 USC 1397a(c); 45 CFR 75.386a(2); 45 CFR 96.30b(2) According to federal requirements, to be eligible for federal funding, expenditures must be expended in the fiscal year allotted or in the succeeding fiscal year (period of performance). Additionally, federal post-closeout requirements stipulate the return of any funds due because of later refunds, corrections, or other transactions. As part of the grant closeout process, block grants also require the grantees to report the total funds expended and the date of the last expenditure. Grant closeout is the process by which the federal awarding agency determines that all applicable administrative actions and all required work have been completed. Social Services Block Grant (SSBG) has expenditures originating from the child welfare system, OR-Kids. OR-Kids is used to manage placements, eligibility, payments, and other case information. When various corrections are initiated, OR-Kids can re-process transactions as far back as January 1, 2008. For some placement corrections, OR-Kids processed the recovery of the funds in a state grant (Miscellaneous Other Fund grant), instead of the federal grant. To date, the department has not completed permanent fixes to the OR-Kids system to prevent these re-processing errors from occurring. During fiscal year 2022, the department was reconciling the Miscellaneous Other Fund grant and identified refunds related to SSBG. The refinanced expenditures reduced the amount of SSBG expenditures originally reported in closed grant awards. Instead of submitting a refund, the department identified expenditures recorded in subsequent grants that could have been used to backfill the reduction of expenditures. Allowable expenditures, that met the period of performance, were subsequently moved. To illustrate, a total of $1.3 million of expenditures were moved in the accounting system from grant award 21 (federal fiscal year 2021) to grant award 20. The department then moved expenditures totaling $1.2 million from grant award 20 to grant award 19. This process continued for all grant awards going back to grant award 11 (federal fiscal year 2011). The table below illustrates the movement of expenditures between grant awards. [See schedule of findings/questioned costs for table] Although the department only moved expenditures that qualified for each respective period of performance, we question whether the federal awarding agency would allow the department to backfill the $1.3 million of expenditures in question after grant closeout had been completed. We recommend department management conduct more timely reconciliations of OR-Kids refinancing adjustments to ensure adjustments are made during the related periods of performance. We further recommend management work with its federal awarding agency to determine if it is appropriate to backfill program expenditures between grants to account for the reduction in expenditures created by the reconciliation process. If not appropriate, the questioned costs should be repaid to the federal awarding agency.

2022-059 Department of Human Services Ensure issued benefits are accurate Federal Awarding Agency: U.S. Department of Agriculture Assistance Listing Number and Name: 10.542 Pandemic EBT Food Benefits (COVID-19) Federal Award Numbers and Years: Not available (COVID-19) Compliance Requirement: Activities Allowed or Unallowed Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $3,692,215 (known); $13,554,666 (likely) (COVID-19) Criteria: Public Law 116-127; 2 CFR 200.303 The federal requirements for the Pandemic EBT (P-EBT) program require state agencies follow their approved state plan. Part of Oregon?s simplifying assumptions in their state plan was that the benefit amount was determined at the school level, not the individual level, based on the school?s operating status, for October 2020 ? May 2021. As part of Oregon?s Ready Schools, Safe Learners program, schools were required to weekly report their operating status/instructional model to the Oregon Department of Education (ODE). In fiscal year 2022, the Department of Human Services (department) paid retroactive P-EBT benefits for children related to the 2020-2021 school year. This sample population consisted of institutions (schools and other educational facilities) and months in which children at the institutions received benefits, totaling $391 million. We selected a random sample of 40 institutions and a random month to determine if the benefits provided to the children, based on the status reported by the institution, were accurate. We identified 4 institutions, for April/May, where the benefit paid status of the institution was not the same as reported by the institution to ODE. In all 4 cases, the benefits paid were at a higher level resulting in questioned costs of $38,931 and likely questioned costs of $9.2 million. One of the simplifying assumptions for the P-EBT program, approved in Oregon?s state plan, was ?Oregon will have a limited reconsideration process to revisit benefit allotments at a school level.? However, the department allowed institutions to update their status without additional review, explanation, or documentation. The department could not provide the auditors any support for the changes made by the institutions. Furthermore, the Oregon Governor issued a directive to schools, on March 5, 2021, to begin a phased approach to require all public schools to provide in-person instruction through either a fully on-site or hybrid model on or before the week of April 19, 2021, for all schools. Although benefits issued continued to decrease as the school year end approached, in May 2021, 26% of the institution?s benefits paid were for fully virtual totaling $17 million. We judgmentally selected 36 institutions classified as fully virtual in May with benefits totaling $7.9 million. For 25 institutions, the benefit paid status did not agree to the status reported by the institution to ODE resulting in questioned costs of $3,653,284 and likely questioned costs of $4.4 million. We recommend DHS perform review to identify any additional discrepancies between benefits paid and the institutions reported status, to determine if payments were appropriate, and communicate with the federal awarding agency to determine if repayment is necessary.

2022-060 Higher Education Coordinating Commission Strengthen controls to ensure expenditures are not obligated beyond the period of performance Federal Awarding Agency: U.S. Department of Labor Assistance Listing Number and Name: 17.258 WIOA Adult Program 17.259 WIOA Youth Activities 17.278 WIOA Dislocated Workers Formula Grant Federal Award Numbers and Years: AA32218F30, 2018; AA32218G10, 2018; AA32218G30, 2018; AA32218G70, 2018; AA32218H90, 2018; AA32218F31, 2018 Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: $47,523 (known) Criteria: 20 CFR 683.110; 2 CFR 200.343 (2018) WIOA grants are available for expenditure by the State during the grant program year and the two succeeding program years. In addition, the State must liquidate all financial obligations incurred no later than 90 calendar days after the end date of the period of performance. We judgmentally selected for review expenditures recorded in fiscal year 2022 related to 2018 grant award whose period of performance ended June 30, 2021. Our review of the supporting documentation found there were 3 out of 13 items with expenditures that were outside the period of performance. Total question cost for these expenditures were $47,523. Per management, these errors were due to a change in personnel and trying to balance out the 2018 grant after the fact. We recommend department management review and revise controls to ensure expenditures are only obligated during the period of performance federally mandated dates.

2022-061 Higher Education Coordinating Commission FFATA reports were not prepared or submitted Federal Awarding Agency: U.S. Department of Labor Assistance Listing Number and Name: 17.258 WIOA Adult Program; 17.259 WIOA Youth Activities; 17.278 WIOA Dislocated Worker Formula Grant Federal Award Numbers and Years: AA33251LN0, 2019; AA33251L70, 2019; AA33251L90, 2019; AA33251R70, 2019; AA33251R90, 2019; AA34789VS0, 2020; AA34789V90, 2020; AA34789VQ0, 2020; AA347893L0; 2020; AA347895P0, 2020; AA36341E10, 2021; AA36341D90, 2021; AA36341DQ0, 2021; AA36341KY0, 2021; AA36341LA0, 2021 Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 170; 2 CFR 200.303 The WIOA Cluster is subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). FFATA requires the department to submit information for any subaward action that equals or exceeds $30,000 in the FFATA Subaward Reporting System (FSRS). Reports should be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Upon inquiry of the department, we determined it had not submitted any subaward information to the FSRS during fiscal year 2022. Department management stated FFATA reporting was not completed due to staff turnover. We also reviewed information the department had submitted at USAspending.gov and determined the department had not submitted any subaward information to FSRS since 2017. The agency is not in compliance with FFATA reporting requirements. Additionally, the department is not transparent in the spending decisions of these federal awards. We recommend department management implement controls to timely prepare and submit the monthly FFATA reports as required by federal regulations. The department should also work with the federal awarding agency to determine what actions it should take for older reports not submitted.

2022-062 Higher Education Coordinating Commission Improve controls over payroll Federal Awarding Agency: U.S. Department of Labor Assistance Listing Number and Name: 17.258 WIOA Adult Program; 17.259 WIOA Youth Activities; 17.278 WIOA Dislocated Workers Formula Grant Federal Award Numbers and Years: AA33251LN0, 2019; AA33251L70, 2019; AA33251L90, 2019; AA33251R70, 2019; AA33251R90, 2019; AA34789VS0, 2020; AA34789V90, 2020; AA34789VQ0, 2020; AA347893L0, 2020; AA347895P0, 2020; AA36341E10, 2021; AA36341D90, 2021; AA36341DQ0, 2021; AA36341KY0, 2021; AA36341LA0, 2021 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303 Federal regulations require recipients of federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The department has implemented the following procedures to ensure payroll costs are correctly charged to the program. Managers approve monthly timesheets submitted by the employees in the state?s payroll system. When managers do not approve by a specified date, the payroll system will automatically approve the timesheet, shown with the words ?system approved.? Additionally, each employee should have a signed position description, which details the duties of the position and the amount of time to be charged for the duties. We selected a nonstatistical random sample of 20 employee timesheets related to 12 employees to ensure payroll was appropriately charged to the program. Additionally, we selected one employee who was on job rotation with the agency from January 2022 through June 2022. We verified payroll timesheets were reviewed by a manager and signed position descriptions were retained per state guidelines, and identified the following exceptions: ? Two timesheets for one employee did not have evidence of manager approval and 2 timesheets for two employees were reviewed over three months later. ? For all 12 employees, the position descriptions provided were unsigned or signed upon our request. We did not question these costs as department management verified job duties were appropriate to the program. ? For the employee on job rotation, 4 of the 6 timesheets were not reviewed and a signed position description was not signed by the employee. According to department management, timesheets were not always approved by the manager as the system will automatically lock and approve the timesheet. For position descriptions, supervisor did not always follow through on obtaining signed position descriptions and for longer term employees a number of boxes could not be located when the agency moved. There is a risk that employees could be improperly charging to the federal program. We recommend department management ensure timesheets are timely reviewed and positions descriptions are completed and retained.

2022-063 Oregon Department of Transportation Consistency needed when providing required federal award information to subrecipients Federal Awarding Agency: U.S. Department of Transportation Assistance Listing Number and Name: 20.205 Highway Planning and Construction Federal Award Numbers and Years: Various Compliance Requirements: Subrecipient Monitoring Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332(a)(1) Federal regulations require pass-through entities to ensure every subaward is clearly identified to the subrecipient as a subaward and includes certain required information. We examined 17 subrecipient awards to ensure the information required under 2 CFR 200.332(a)(1) was communicated at the time of the subaward. Each award examined was missing one or more of the required elements: ? 15 samples did not include the subrecipient?s Unique Entity Identifier or DUNS number; ? 7 samples did not provide the Federal Award Identification Number (FAIN); ? 5 samples did not provide the Federal Award date; and ? 1 sample did not provide the correct assistance listing number. The required award information is necessary for the subrecipient to accurately report the subaward information in its accounting records and on the schedule of expenditure of federal awards. Procedures to communicate award information are not consistently followed across the department and as a result do not ensure that all the required award information is communicated. Specifically, some required information is included in the Federal Project Agreement from the Federal Management Information System (FMIS), but not all managers were aware it needed to be provided. In many cases an exhibit was included with the agreement that could have provided all the required information, but the exhibit was not completed. We recommend the department adopt procedures for preparing subaward agreements that ensure all required information is provided to subrecipients at the time of the subaward.

2022-064 Oregon Department of Transportation Management should ensure timely review of transfers is documented Federal Awarding Agency: U.S. Department of Transportation Assistance Listing Number and Name: 20.205 Highway Planning and Construction Federal Award Numbers and Years: Various Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303; GAO-17-704G ?10.03, 12.05; ODOT FASM 3.7 The department is responsible for establishing and maintaining internal controls to ensure entries posted in the accounting records are for costs and activities allowable under the federal program. Journal entry review and approval should be clearly documented and readily available for examination. The department has established Financial Administration Standard 3.7, Expenditure Journal Entries, which requires management to transmit signed hard copy supporting documentation of journal entries to financial services after they?ve been reviewed and approved. We tested 40 transfer journal entries moving costs between federal project sub jobs and found that 19 did not have documentation of timely approval. In two cases, approval was documented more than a year after costs were transferred. The 19 entries were all lump sum transfers processed by Program and Funding Services (P&FS). P&FS is authorized to process transfers, moving costs between sub jobs of the same project. These transfers are necessary to align project costs with the appropriate funding source. Per P&FS management, transfers are generally reviewed within a few days. However, documentation of the review has not been occurring until much later due to challenges associated with remote work and policies requiring hard copy documentation. Over $90 million in program costs were transferred between sub jobs in this manner during fiscal year 2022. Without timely review and documentation available to support transfers, unallowable costs or activities could be transferred and billed erroneously to the Federal government. We recommend management ensure procedures for review of transfer journal entries result in timely documented approvals.

2022-065 Oregon Department of Education State did not meet maintenance of effort requirement Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425R, 84.425U & 84.425W, Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C210048; 2021 (COVID-19), S425D210049; 2021 (COVID-19), S425R210047; 2021 (COVID-19), S425U210049; 2021 (COVID-19), S425W210038; 2021 (COVID-19) Compliance Requirement: Matching, Level of Effort, Earmarking Type of Finding: Material Weakness; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: Section 18008 of Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act; Section 2004(a) of the American Rescue Plan (ARP) Act; 2 CFR 200.303 The CRRSA and the ARP acts require the State to maintain support for both elementary and secondary education and for higher education in fiscal year 2022 at least at the proportional level of the state?s support for elementary and secondary education and for higher education relative to the state?s overall spending, averaged over fiscal years 2017, 2018 and 2019. The Department of Education did not meet the maintenance of effort provisions for fiscal year 2022 for elementary and secondary education. Although the state?s overall funding increased for education its proportional level relative to Oregon?s overall spending declined. The department is reliant on the legislative budget process. The department was in contact with the federal awarding agency about the maintenance of effort issue. The department submitted a waiver request to the U.S. Department of Education dated March 29, 2023. According to department management, budget changes and obtaining a clearer understanding of the other fund amount delayed the calculation for maintenance of effort. If the waiver is not approved, the department may be asked to return some of the funds. The total federal expenditures for the Education Stabilization Fund program for the fiscal year ended June 30, 2022 were $426 million. We recommend department management continue to actively track whether it will meet the maintenance of effort requirement and work with the federal awarding agency.

2022-066 Oregon Department of Education Improve subrecipient monitoring procedures Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C, 84.425D, 84.425U & 84.425W Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048; 2020 (COVID-19), S425D200049; 2020 (COVID-19), S425C210048; 2021 (COVID-19), S425D210049; 2021 (COVID-19), S425U210049; 2021 (COVID-19), S425W210038; 2021 (COVID-19) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.332 Federal regulations require the department to evaluate each subrecipients risk of noncompliance with Federal statues, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate monitoring to perform. In addition, the department should monitor the activities of the subrecipients receiving funds to ensure the subaward is used for authorized purposes, is in compliance with Federal statutes, regulations, and the terms and condition of the subaward; and the subaward performance goals are achieved. Depending on the department risk assessment, which was not performed, the department could perform various monitoring tools to ensure accountability and compliance. As of June 30, 2022, the department was still in the process of drafting and implementing a plan to monitor the funds. The department had not completed a risk assessment process of the local educational agencies (LEA) for these funds and stated it planned to begin some desk or on-site monitoring in Spring 2023. $522 million in funds have been passed through to subrecipients as of June 30, 2022. The department required LEA?s to submit applications to receive funds and sign agreements that outlined all federal requirements. In addition, the department also required the LEA?s to complete a reimbursement request form that contains general ledger detail but no additional support is provided. According to the department, it follows-up with a LEA if funds appear to be ineligible or other questions are raised. Finally, although LEAs programs may have had a single audit the department could not provide a list of which LEAs had audits and whether there were findings or not. In fiscal year 2021, the department was also working to finalize its risk assessment and monitoring plans. However, the department experienced staff turnover which delayed its plans. Insufficient subrecipient monitoring increases the risk of not timely identifying subrecipients that are not administering federal awards in compliance with federal requirements. We recommend department management complete its risk assessment, consider the results of LEAs single audits and perform desk or on-site monitoring as necessary.

2022-067 Oregon Department of Education Ensure accuracy of federal reporting Federal Awarding Agency: U.S. Department of Education Assistance Listing Number and Name: 84.425C Education Stabilization Fund (COVID-19) Federal Award Numbers and Years: S425C200048; 2020 (COVID-19) Compliance Requirement: Reporting Type of Finding: Significant Deficiency; Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.302(b); 2 CFR 200.303(a) Federal regulations require that federal reports include all activity of the reporting period and be supported by applicable accounting records. Federal regulations also require that the department file a separate report for the Governor?s Emergency Education Relief (GEER) expenditures for the period ending June 30, 2021. The department reported GEER information for the local education areas (LEAs) related to the comprehensive distance learning grant program. LEAs submit reimbursement to the department and this information is tracked in an excel database. The database includes various information, including funding types, dates, and amounts. During FY 2022, the department completed the reports using the database, but incorrectly filtered the data so some expenditures were not captured. This resulted in an underreporting of GEER expenditures by $13.9 million. We recommend department management ensure that accurate expenditure data is submitted to the federal government for federal reporting.

2021-009 Department of Human ServicesEnsure performance data reports are complete and accurateFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF)Federal Award Numbers and Years: 2021G996115, 2021; 2020G996115, 2020Compliance Requirement: ReportingType of Finding: Material Weakness; Material NoncompliancePrior Year Finding: 2020-013Questioned Costs: N/ACriteria: 45 CRF 265.3(a)Federal regulations require the department to collect monthly and report quarterly certain non financial data elements for services paid with Temporary Assistance for Needy Families (TANF) federal funding in the ACF-199 TANF data report. Federal regulations also require the department to report data quarterly for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the ACF-209 SSP-MOE data report. Both data reports should be supported by applicable performance records.During fiscal year 2021, the department transitioned key aspects of the TANF program to a new application, Oregon Eligibility (ONE), for case management. Given the implementation of ONE during the fiscal year, we limited our review of the quarterly data reports to the quarter ended June 30, 2021. We found between 200 and 260 cases per month may have been improperly excluded from the ACF-199 reports. We also found, on average, between 3,600 and 4,000 cases per month with no corresponding federal TANF expenditures were improperly included in the ACF-199 report.Additionally, we were unable to determine whether the child welfare cases reported were accurate or complete. Child welfare client case numbers used in the report did not correlate with case numbers used in the child welfare system, and we were unable to determine which cases should have been included or excluded. When comparing child welfare case counts, we noted 1,420 cases were reported in the ACF-199 for April, however, the child welfare system indicated 3,180 cases received TANF federal benefits.Findings related to performance data reporting have been ongoing since fiscal year 2010. Per the department's response to the prior year findings, they have been working with the service organization that administers ONE to implement system requirements, based on federal instructions, to ensure the data reporting is complete and accurate. Since the implementation of ONE, data reports are prepared and submitted to the federal oversight agency by the service organization on the department's behalf. Department management stated they do not perform any review of the reports submitted.Service Organization Control (SOC) reports are a best practice as they provide assurance that controls of the service organization are functioning as intended. Department management did not require a SOC report to provide assurance over the service organization's internal controls over the ONE application for the TANF program. Without an annual SOC report, the department does not have assurance controls are functioning as intended at the service organization for the TANF program.We recommend department management ensure system requirements used to prepare the ACF-199 and ACF-209 are appropriate to ensure compliance and implement review procedures to ensure performance data reports submitted are complete and accurate. We also recommend department management obtain an annual SOC report over the service organization's internal controls for the ONE application.

2021-010 Department of Human ServicesEnsure work participation rate calculation uses verified and accurate dataFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF)Federal Award Numbers and Years: 2021G996115, 2021; 2020G996115, 2020Compliance Requirement: Special Tests and ProvisionsType of Finding: Material Weakness; Material NoncompliancePrior Year Finding: 2020-014Questioned Costs: N/ACriteria: 45 CRF 261.61; 45 CFR 261.62Federal regulations require each state maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Each state must have procedures to count and verify reported hours of work and must comply with its Work Verification Plan as approved by the U.S. Department of Health and Human Services (DHHS).Oregon?s Work Verification Plan outlines a system of controls for how reported hours will be verified and documented, and for independent reviews and monitoring procedures to catch errors.Work participation hours are reported via the quarterly Temporary Assistance for Needy Families (TANF) Data Reports. As stated in a separate finding, titled `Ensure performance data reports are complete and accurate,? we determined the TANF Data Report is not complete or accurate. However, additional issues were identified when we attempted to perform testing specific to the Work Verification Plan.We limited our review for Work Verification Plan compliance to the fourth quarter of fiscal year 2021. When reviewing the fields where work participation hours are reported we found essentially all (99.9%) participation hours reported on the ACF-199 were zero.We also reviewed 12 randomly selected, two-parent case files of participating clients for verification of work activity participation reported in the ACF-209. Of the 12 cases reviewed, we found seven cases where the department did not adhere to the approved Work Verification Plan policies and procedures for maintaining documentation or accurately reporting hours of participation.These inaccurate or unverified hours were used in calculating the work participation rate reported to DHHS. If the state fails to follow the approved Work Verification Plan, DHHS may penalize the state.We recommend TANF program management ensure the work participation rate is calculated appropriately using verified and accurate participation data in adherence to the department?s Work Verification Plan. We also recommend program management review the system of controls and identify where improvements are needed to ensure compliance with the work verification plan.

2021-011 Department of Human ServicesImprove documentation of required income and benefit verificationsFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.558 Temporary Assistance for Needy Families (TANF)Federal Award Numbers and Years: 2021G996115, 2021; 2020G996115, 2020Compliance Requirement: Special Tests and ProvisionsType of Finding: Material Weakness; Material NoncompliancePrior Year Finding: N/AQuestioned Costs: N/ACriteria: 45 CRF 205.55Federal regulations require each state to participate in the Income Eligibility and Verification System (IEVS), which includes using income and benefit screens accessible through the department?s client maintenance system, when making Temporary Assistance for Needy Families (TANF) eligibility determinations. The caseworker should document the verification of IEVS screens in the case file for each client.Of 40 randomly selected case files for fiscal year 2021, there was no evidence that relevant income information was verified using IEVS screens when determining eligibility for 8 cases. Per discussions with the department, the implementation of the new case management system, ONE, was a contributing factor as caseworkers may not be clear whether to document their eligibility notes in ONE or the older narrative system known as TRACS. We verified these clients did meet TANF financial eligibility criteria. However, by not providing assurance of verification of the use of IEVS screens, the department increases the risk of providing benefits to TANF ineligible individuals.We recommend department management ensure verification of income with IEVS screens is clearly documented in client case files when determining client eligibility. We also recommend management develop policies and procedures directing case workers to document their review of the IEVS screens in ONE, the new case management system.

2021-012 Oregon Housing and Community Services DepartmentEnsure financial and Federal Funding Accountability and Transparency Act reports are submittedFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program (LIHEAP)Federal Award Numbers and Years: 18B2ORLIEA, 2018; 1901ORLIEA, 2019; 2001ORLIEA, 2020; 2001ORE5C3, 2020; 2102ORLIEA, 2021; 2102ORE5C6, 2021Compliance Requirement: ReportingType of Finding: Material Weakness; Material NoncompliancePrior Year Finding: N/AQuestioned Costs: N/ACriteria: 2 CFR 200.303(a), (c)-(d); Administration for Children and Families, Terms and Conditions Addendum: Additional Financial Requirements, Office of Community Services, Low-Income Home Energy Assistance Program, Financial Reporting, items 7-8; 2 CFR 170, Appendix A I(a))Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing, evaluating, and monitoring the federal award in compliance with the terms and conditions of the award and taking prompt action when instances of noncompliance are identified.Federal Financial Reports (SF-425?s) are required to be submitted annually for each open grant award 90 days after the end of the federal fiscal year. The department did not submit SF-425?s for open grants for the federal fiscal period ended September 30, 2020.The Federal Funding Accountability and Transparency Act (FFATA) requires the department to submit information for any subaward action that equals or exceeds $30,000. We selected a sample of subaward actions and noted that for two of the four grant awards, no FFATA submissions were completed. For the remaining two grant awards, only partial submissions were completed.Department management stated financial and FFATA reports were not completed during the fiscal year in compliance with reporting requirements because of staffing constraints and prioritizing staff resources to address programmatic compliance requirements, such as processing the significant increase in reimbursements to subrecipients providing benefits over administrative compliance requirements. There is a risk the federal awarding agency could withhold grant funding if the department is not compliant with reporting requirements.We recommend department management ensure outstanding financial and FFATA reports are completed and submitted, and allocate sufficient staff resources to ensure compliance with reporting requirements in future fiscal periods.

2021-013 Oregon Housing and Community Services DepartmentEnsure documentation is maintained to support amounts reported and review of reportsFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program (LIHEAP)Federal Award Numbers and Years: 2001ORLIEA, 2020; 2001ORE5C3, 2020Compliance Requirement: ReportingType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: N/AQuestioned Costs: N/ACriteria: 2 CFR 200.303(a)Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing the federal award in compliance with the terms and conditions of the award.The department is required to submit two annual special reports, the Households Assisted by LIHEAP (Households) report and the Carryover and Reallotment (Carryover) report. To ensure the accuracy and completeness of these two reports, the department?s control process requires a review of reports prior to submission and maintenance of documentation that supports the amounts reported.During our testing we noted that the Carryover report was not reviewed by a manager. Additionally, the department was not able to locate documentation to support the number of homes receiving nominal LIHEAP in the Households report.These reports provide the federal awarding agency with key information related to needs and performance, and errors in reports could alter the amount of funding received by the department for the LIHEAP program in future years.We recommend department management ensure adequate controls are in place to ensure documentation is maintained to support amounts reported and reports are reviewed prior to submission.

2021-014 Oregon Housing and Community Services DepartmentEstablish controls to ensure information is readily available to assist in monitoring compliance requirementsFederal Awarding Agency: U.S. Department of Health and Human Services,Assistance Listing Number and Name: 93.568 Low-Income Home Energy Assistance Program (LIHEAP)Federal Award Numbers and Years: 2001ORLIEA, 2020Compliance Requirement: EarmarkingType of Finding: Significant DeficiencyPrior Year Finding: N/AQuestioned Costs: N/ACriteria: 2 CFR 200.303(a), (c)Department management is responsible for establishing and maintaining effective internal control that provides reasonable assurance the department is managing, evaluating, and monitoring the federal award in compliance with the terms and conditions of the award.The department prepares monthly Grant Management Reports (GMR?s), by grant award, that allow for the management, evaluation, and monitoring of obligations and spending of LIHEAP funds. The GMR?s break down the grant award by federal earmarking categories and track obligations and spending by category to ensure compliance with the various earmarking requirements.We selected a sample of GMR?s to determine if they were being prepared. We identified one month for one award that was not prepared. According to the department, time sensitive system reports used to prepare the GMR were not processed timely, resulting in the department being unable to accurately prepare the report. Without controls in place to ensure timely processing of system reports, the department is unable to ensure compliance with earmarking requirements on an ongoing basis.We recommend department management establish controls to ensure system reports are processed timely to allow for preparation of the GMR reports.

2021-015 Department of Human ServicesImplement review to ensure accurate behavior rehabilitation service rates are usedFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.658 Foster Care ? Title IV-EFederal Award Numbers and Years: 2101ORFOST, 2021; 2001ORFOST, 2020Compliance Requirement: Allowable Costs/Cost PrinciplesType of Finding: Significant Deficiency, NoncompliancePrior Year Finding: N/AQuestioned Costs: $20,793 (known)Criteria: 42 USC 672(b)Federal regulations allow expenditures to be reimbursed to foster care providers at the federal financial participation rate for various program costs, including maintenance payments.We selected a random sample of 40 transactions to determine the allowability of costs charged to the foster care program and identified one error where the behavior rehabilitation services rate was not properly entered in the system. The total rate was correct, but the split between Title IV-E administration, Title IV-E maintenance, Medicaid services and other costs was incorrect, with a larger percentage of the split allocated to Title IV-E administration and Title IV-E maintenance than was indicated in other documentation. We further reviewed all transactions related to this behavioral rehabilitation service and identified total questioned costs of $20,793.The department does not have a review for the accuracy of the split rates that are entered into the system.We recommend department management implement procedures to ensure the accuracy of behavior rehabilitation service split rates entered into the system and reimburse the federal agency for unallowable costs.

2021-016 Department of Human ServicesTimely review foster care maintenance payment rates for continuing appropriatenessFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.658 Foster Care ? Title IV-EFederal Award Numbers and Years: 2101ORFOST, 2021; 2001ORFOST, 2020Compliance Requirement: Special Tests and ProvisionsType of Finding: Significant DeficiencyPrior Year Finding: N/AQuestioned Costs: N/ACriteria: 42 USC 671(a)(11); 45 CFR 1356.21(m)(1)In accordance with federal requirements, the department is required to review the amount of the payments made for foster care maintenance assistance at reasonable, specific, time-limited periods established by the department, to assure the rates continue to be appropriate for the administration of the foster care program. The department established in Oregon Administrative Rule that a review of the foster care payment rates shall take place every two years in conjunction with the department budget preparation process.Department management last updated foster care maintenance payment rates in January 2018. Due to program manager turnover a review did not take place for the 2019-2021 biennium budget process to ensure payment rates were appropriate.We recommend department management ensure reviews of maintenance payment rates for continuing appropriateness are conducted timely and in compliance with department rules.

2021-017 Department of Human ServicesImprove controls and compliance over hospitals and long-term care facility auditsFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.777, 93.778 Medicaid ClusterFederal Award Numbers and Years: 2005OR5MAP, 2020; 2005OR5ADM, 2020;2105OR5MAP, 2021; 2105OR5ADM, 2021Compliance Requirement: Special Tests and ProvisionsType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: N/AQuestioned Costs: N/ACriteria: 42 CFR 435.10; OAR 411-070-0315(3); 2 CFR 200.303(a)The Oregon state plan requires each long-term care facility to submit annual financial statements reporting actual costs to the Department of Human Services (department). Each statement is subject to a desk audit by the department. One of the procedures performed by the department is to verify administrator payroll costs do not exceed the maximum amount. Oregon Administrative Rule requires this maximum compensation amount be prorated for individuals that work less than an average of 40 hours in a week.We selected a random sample of 12 out of 120 long-term care facilities. We identified 6 facilities where the administrator compensation for the year was greater than the prorated maximum compensation based on the number of hours worked. These costs were allowed by the department as the department did not consider the number of hours being worked when comparing to the maximum compensation limit. Excess costs that exceed the maximum compensation limit may result in the facility?s bed rate being incorrectly calculated.Similar to long-term care facilities, inpatient hospitals report actual costs to the Oregon Health Authority (authority) who conducts desk audits of the costs. We selected a random sample of 7 out of 65 hospitals. For 2 hospitals the authority could not locate documentation indicating the cost reports submitted were reviewed by the authority. According to the authority, the employee who performed the review separated and the authority could not access the former employee?s email to verify the reviews were performed. Without evidence of a review, the authority does not have assurance as to the accuracy of cost reports submitted by hospitals, potentially resulting in inappropriate payments to the hospitals.We recommend department management strengthen controls to ensure the long-term care facility?s administrator compensation does not exceed the prorated maximum compensation limit for administrators who average less than 40 hours a week. We also recommend authority management strengthen controls to ensure evidence of review is maintained and readily available.

2021-018 Department of Human ServicesImplement review procedures to ensure accuracy of manual cost allocation calculationsFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.777, 93.778 Medicaid ClusterFederal Award Numbers and Years: 2005OR5MAP, 2020; 2005OR5ADM, 2020; 2105OR5MAP, 2021; 2105OR5ADM, 2021Compliance Requirement: Allowable Costs/Cost PrinciplesType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: N/AQuestioned Costs: $180,643 (known)Criteria: 2 CFR 200.400The Department of Human Services (department) administers separate federally approved cost allocation plans for both the department and the Oregon Health Authority. The plans outline the methods used to allocate the various cost pools to federal programs.The department uses a random moment sampling system (RMSS) to develop statistics for cost pool allocation for three department divisions. Due to implementation of the new integrated eligibility system, the number of cost pools using RMSS increased from three to five during the fiscal year. As the department was unable to incorporate the new cost pools into the existing cost allocation system at implementation, manual statistics calculations were performed. While recalculating the department?s allocations for the month of April 2021, we identified discrepancies between the RMSS files and the counts used in the statistics calculations. The department performed further follow-up for April, May, and June and confirmed incorrect counts were used in the April calculations, which resulted in $180,643 in known questioned costs to one federal program.We recommend department management implement review processes and procedures to ensure manual calculations are complete and accurate.

2021-019 Department of Human Services/Oregon Health AuthorityStrengthen review over costs charged to the programFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.777, 93.778 Medicaid ClusterFederal Award Numbers and Years: 2005OR5MAP, 2020; 2005OR5ADM, 2020; 2105OR5MAP, 2021; 2105OR5ADM, 2021Compliance Requirement: Activities Allowed or UnallowedType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: N/AQuestioned Costs: $72,716 (known)Criteria: 2 CRF 200.1 (Improper payment); 2 CFR 200.403(a); 2 CFR 200.404; 42 CFR 435.10Federal regulations only allow the Medicaid program to charge allowable program expenditures at the federal financial participation rate for various program costs at the time of payment for services provided.The Department of Human Services (department) and the Oregon Health Authority (authority) make payments to vendors other than providers through the state?s accounting system. We judgmentally selected for review payments to 28 vendors. We identified the following errors, which were not identified during their review process, that resulted in improper payment of Medicaid expenditures:? Payment to one vendor charged expenditures related to another program to the Medicaid program, resulting in known federally funded questioned costs of $20,000.? Payments to one vendor charged expenditures related to a specific project unrelated to the Medicaid program, resulting in known federally funded questioned costs of $4,596. Additional payments made to other vendors related to this project, resulted in known federal funded questioned costs of $48,120.We recommend department and authority management strengthen review controls to ensure only allowable expenditures are charged to the Medicaid program. Additionally, we recommend the authority reimburse the federal agency for unallowable costs.

2021-020 Department of Human Services/Oregon Health AuthorityImprove documentation for provider eligibility determinations and revalidationsFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.777, 93.778 Medicaid ClusterFederal Award Numbers and Years: 2005OR5MAP, 2020; 2005OR5ADM, 2020; 2105OR5MAP, 2021; 2105OR5ADM, 2021Compliance Requirement: Special Tests and ProvisionsType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: 2020-019Questioned Costs: N/ACriteria: 42 CFR 455.436; 42 CFR 455.102 to 455.107; 42 CFR 455.414Provider eligibility requirements for the Medicaid program differ depending upon the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulations agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, the federal regulations require that the Oregon Health Authority (authority) and Department of Human Services (department) determine eligibility for Medicaid providers and revalidate providers at least every five years by performing database checks to ensure providers are still eligible to participate in the Medicaid program.We selected a random sample of 61 providers in the Medicaid program with 31 providers enrolled by the authority and 30 enrolled by the department. For 6 providers we found the issues described below.? I-9 forms for one department provider and two authority providers did not include a review of minimum acceptable documents to verify identity and employment authorization and was not signed by the department or authority at the time of our audit. The department and authority have since obtained completed I-9 forms.? I-9 form for one provider did not include a review of minimum acceptable documents to verify identity and employment authorization and was not signed by the department at the time of our audit. This provider is not currently a provider with the State and an updated I-9 will not be obtained. Based on our review of other available support we determined this provider was eligible during the fiscal year under audit.? I-9 form for one provider did not include a review of minimum acceptable documents to verify identity and employment authorization. The authority has since obtained completed I-9 forms.? I-9 form for one provider could not be located. The authority is actively working to obtain missing documentation and based on our review of other support we determined this provider was an eligible provider.The above issues occurred due to human error and inadequate record maintenance, which could lead to ineligible providers receiving Medicaid funding.We recommend department and authority management strengthen controls to ensure documentation supporting a provider?s eligibility determination and revalidation is retained and is complete.

2021-021 Oregon Health AuthorityEnsure medical loss ratio reports are completeFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.777, 93.778 Medicaid ClusterFederal Award Numbers and Years: 2005OR5MAP, 2020; 2005OR5ADM, 2020; 2105OR5MAP, 2021; 2105OR5ADM, 2021Compliance Requirement: Special Tests and ProvisionsType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: N/AQuestioned Costs: N/ACriteria: 42 CFR 438.8(k)Oregon Health authority (authority) must require each managed care organization (MCO) to submit a report to the state that includes specific information for each medical loss ratio (MLR) reporting year. During FY21, the state had 15 MCOs, each of which submitted a MLR report. For 3 MCOs, the MLR report did not contain all information required by federal regulation. The reports submitted for each MCO excluded a methodology of the expenditure allocation and a comparison of the MLR report to the audited financial report. Without all required information, rebates may be inappropriately calculated. The authority was not aware of all information MLR reports must include. They completed additional review steps to ensure data provided was sufficiently comparable to other authority records rather than request MCOs to updated or resubmit reports.We recommend authority management strengthen internal controls to ensure each MLR report contains all required information.

2021-022 Oregon Health AuthorityImprove financial reporting accuracyFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.323 Epidemiology and Laboratory CapacityFederal Award Numbers and Years: 6 NU5OCK000541-02-04, 2021; 6 NU5OCK000541-01-07, 2020; 6 NU5OCK000541-01-06, 2020Compliance Requirement: ReportingType of Finding: Material Weakness; NoncompliancePrior Year Finding: N/AQuestioned Costs: N/ACriteria: 2 CFR 200.328In response to the COVID-19 pandemic, the Centers for Disease Control (CDC) awarded states substantial funds for the purpose of addressing the pandemic at the state level. Among other requirements, states are required to submit monthly financial reports to the CDC providing totals spent on travel, payroll, equipment, and other categories.We reviewed the reports submitted for three separate subawards for the program, representing 99.97% of the amounts reported for fiscal year 2021, and totaling approximately $111.2 million. In our review, we noted the reports frequently did not agree to accounting records and the reporting methodology was inconsistently applied. Per department staff, the amounts are intended to be monthly totals for the report month. However, we noted numerous instances where the totals were reported as year-to-date amounts. In other instances, expenditures were misclassified among the categories requested by the CDC. For example, travel expenditures were misclassified as supplies expenditures.In reviewing the process for preparing and uploading the monthly financial reports, we noted that one employee is responsible for obtaining and uploading the data into the federal reports. The department does not have a separate review function to ensure the accuracy of the information reported.We recommend department management develop and implement procedures to help ensure the accuracy of amounts reported in the monthly financial reports. Additionally, we recommend department management work with the CDC to revise and resubmit the inaccurate reports.

2021-023 Oregon Health AuthorityStrengthen review over costs charged to the programFederal Awarding Agency: U.S. Department of Health and Human ServicesAssistance Listing Number and Name: 93.767 Children?s Health Insurance Program (CHIP),Non-Major ProgramFederal Award Numbers and Years: 2005OR5021, 2020; 2105OR5021, 2021Compliance Requirement: Allowable Costs/Cost Principles; MatchingType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: 2020-021Questioned Costs: $77,214 (known)Criteria: 2 CFR 200.53(a); 45 CRF 95.11; 45 CFR 95.13(d)In the fiscal year 2020 audit of the Children?s Health Insurance Program (CHIP), we identified that the Oregon Health Authority (authority) applied an incorrect matching rate to a transaction in the CHIP program. (See report 2021-13, Finding 2020-021). To follow up on the prior finding, we reviewed transactions in the current fiscal year to determine if corrective action had been taken.During our review, we found that the authority had appropriately taken actions to return the questioned costs identified in the prior year to the Department of Health and Human Services. Although the authority updated the underlying procedures subsequent to our audit, changes were not applied retroactively. As a result, we identified transactions in fiscal year 2021 that used the incorrect matching rate, resulting in questioned costs of $77,214.We recommend the authority return the questioned costs to the Department of Health and Human Services.

2021-024 Department of EducationImplement controls to ensure accuracy of federal reportingFederal Awarding Agency: U.S. Department of EducationAssistance Listing Number and Name: 84.425D Education Stabilization Fund (ESF)Federal Award Numbers and Years: S425D200049; 2020Compliance Requirement: ReportingType of Finding: Material Weakness; NoncompliancePrior Year Finding: N/AQuestioned Costs: N/ACriteria: 2 CFR 200.302(b); 2 CFR 200.303(a)Federal regulations require that federal reports include all activity of the reporting period and be supported by applicable accounting records. Federal regulations also require that the Oregon Department of Education (department) file separate annual reports for Elementary and Secondary School Emergency Relief (ESSER) expenditures and Governor?s Emergency Education Relief (GEER) expenditures for period ending 9/30/20, which includes both financial and performance data. The GEER program had only $586,000 in direct expenditures as of 9/30/20.The department did not establish or follow a consistent methodology for reporting ESSER I award expenditures, nor did the department document the reasoning behind any adjustments made. A lack of documented policies and procedures could result in incomplete or inaccurate reports being submitted to the federal government.The department reported information for 197 Local Education Areas (LEAs) on the LEA section of the report. This includes total Public and Non-Public School expenditures and a breakdown of the expenditures into various subcategories. Business rules on the federal reporting portal required these two sets of data to reconcile. The department used self-reported LEA data for the Public and Non-Public expenditures and department reimbursement data for the subcategories. The LEA self reported data, as adjusted by the department on the submitted report, totaled $25.8 million while the reimbursement database totaled $18.2 million.Management indicated they applied various criteria when determining whether to adjust the self-reported data or the department?s accounting records, including knowledge of the award terms, discussion with LEAs, and timing differences. In some instances, adjustments were made to the self-reported data. For example, one LEA self-reported expenditures of $115 million when the total amount awarded was only $149,000. In other instances, the adjustments were made to the amounts the department reported. For example, one LEA self-reported $1.5 million and only $89,000 of this amount was supported in the reimbursement database. As the department used various criteria and the process was not documented, the reported expenditures were not consistently supported by the department?s records.Management indicated that the lack of sufficient staff resources and the short timeline between the period to collect data and the due date of report submission was insufficient to collect and thoroughly analyze, correct, and compile self-reported subrecipient information and reconcile that information to the department?s reimbursement database.We recommend department develop a process to ensure that accurate expenditure data is submitted to the federal government for federal reporting.In addition, we reported a significant deficiency and noncompliance finding related to the department?s Federal Funding Accountability and Transparency Act report for this federal program. Please refer to Finding 2021-025.

2021-025 Department of EducationImprove subaward reporting under the Federal Funding Accountability and Transparency ActFederal Awarding Agency: U.S. Department of EducationAssistance Listing Number and Name: 84.010 Title I Grants to Local Educational Agencies84.425D Education Stabilization Fund (ESF)Federal Award Numbers and Years: S010A200037, 2020; S425D200049, 2020; S425D210049, 2021Compliance Requirement: ReportingType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: N/AQuestioned Costs: N/ACriteria: 2 CFR 170; 2 CFR 200.303The Title I-A and Education Stabilization Fund programs are subject to subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA). Federal regulations require recipients of federal awards to report certain subaward information in the FFATA Subaward Reporting System (FSRS) for subawards meeting the criteria for reporting. Reports must be submitted no later than the end of the month following the month in which the subawards were made. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements.The department maintains written procedures that document the steps for completing the monthly FFATA reporting. However, responsibility for this reporting lies solely on one employee and the department did not have formal, documented, and consistently performed controls in place during fiscal year 2021 to ensure the reports were accurately and completely prepared. Our audit procedures included the testing of 50 Title I-A and 60 Education Stabilization Fund subawards/subaward modifications totaling $38.2 million and $70.9 million in obligations, respectively. During our testing we noted the following:? 3 Title I-A subawards obligated in August 2020 totaling more than $519,000 were not reported for the Title I-A program. 2 subawards obligated in April 2021 totaling $80,000 were not reported for the Education Stabilization Fund program. According to the department, FSRS edit checks prevented the reporting of these subawards. As a result of our audit procedures, the department reached out to the FSRS HelpDesk to resolve the underlying issues related to the reporting of these subawards.? 3 Title I-A subaward modifications from March 2021 totaling -$1.8 million and 1 Education Stabilization Fund subaward from November 2020 totaling more than $77,000 were overlooked and not reported.We recommend department management implement controls to ensure the monthly FFATA reports are independently reviewed to ensure accurate and complete reporting of required subaward information. We further recommend department management ensure the required subaward information is reported for the nine subawards identified in our testing.

2021-026 Department of EducationImplement documented methodology and review controls over State Level of EffortFederal Awarding Agency: U.S. Department of EducationAssistance Listing Number and Name: 84.027, 84.173 Special Education Cluster (IDEA)?Federal Award Numbers and Years: H173A190100, 2020; H173A200100, 2021Compliance Requirement: Level of EffortType of Finding: Significant DeficiencyPrior Year Finding: N/AQuestioned Costs: N/ACriteria: 34 CFR Section 300.163(a)The IDEA Part B program is subject to level of effort requirements. Federal regulations stipulate a state may not reduce the amount of state financial support for special education and related services for children with disabilities below the amount of state financial support provided for the preceding year. Federal regulations also require recipients of federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements.The department maintains a spreadsheet for the calculation of the annual amounts used to meet the state level of effort requirement. Although this spreadsheet contains some instructions the department does not have formal documented methodology or review controls in place to ensure the state level of effort is accurately and consistently calculated and maintained above prior year availability.During our testing of the fiscal year 2021 level of effort calculations we determined the department identified and supported sufficient amounts made available by the state to meet the required minimum level of effort. However, we noted the following during our testing:? The fiscal year 2019-20 State School Fund total was $14.8 million lower than what was reflected in the department?s current supporting documentation as the department did not have support for the amount reported.? The Office of Student Services operations total of almost $500,000 for the 2019-20 biennium was not supported.? The determination of amounts made available from Other Fund sources was based in part on a consideration of cash balances available at the beginning of the biennium rather than solely on budgeted amounts. However, the reasoning behind this approach was not documented.? The level of effort calculation spreadsheet included areas highlighted for review that were not verified before the level of effort total was submitted in the annual IDEA application.We recommend department management documents its methodology to ensure the annual level of effort calculation is consistently performed and document review of the calculation before the total is entered into the grant applications.

2021-027 Department of Human ServicesImprove controls over EBT card securityFederal Awarding Agency: U.S. Department of AgricultureAssistance Listing Number and Name: 10.551, 10.561 Supplemental Nutrition Assistance Program (SNAP) ClusterFederal Award Numbers and Years: 202020S601847, 2020; 202121S601847, 2021; 202020S251447, 2020; 202121S251447, 2021Compliance Requirement: Special Tests and ProvisionsType of Finding: Significant Deficiency, NoncompliancePrior Year Finding: N/AQuestioned Costs: N/ACriteria: 7 CFR 274.5(c)(1)Clients participating in the SNAP program receive benefits electronically via electronic benefit transfer (EBT cards). Federal regulations require that the department provide certain minimum security and control procedures over EBT cards including secure storage, bulk inventory control records, subsequent control records maintained through the point of issuance, and periodic review and validation of inventory controls and records. The department has established procedures to meet minimum security requirements, which include conducting and comparing monthly inventory of EBT cards to the balance on the stock control log. However, these procedures have not been fully implemented. Ensuring compliance with minimum security requirements helps prevent loss and potential misuse of EBT cards.We reviewed EBT card security processes for 17 of the 105 field offices that issue EBT cards, which included reviewing whether inventory was conducted at least quarterly between July 2020 and June 2021. During our review we found:? One branch was unaware of the requirement to perform EBT card inventory and therefore did not perform EBT card inventory during the fiscal year. Additionally, the branch did not maintain a running inventory balance on their stock control logs that would allow for proper inventory to be completed.? One branch did not document their EBT card inventory for nine months of the fiscal year.? One branch did not maintain destructions logs for the fiscal year.The department previously had a repeated finding related to EBT card inventory from fiscal year 2013 to 2018 that was cleared in fiscal year 2019. Over the years, the department reminded branch offices of its processes, developed training and verified branch offices completed it, and one year monitored branch offices inventory process for a quarter. However, based on the results of our audit, the security processes are not being consistently implemented.We recommend department management implement a consistent process to verify branch offices are conducting required inventory and accurately completing inventory control logs.

2021-028 Oregon Military DepartmentStrengthen controls to ensure expenditures are not obligated beyond the period of performanceFederal Awarding Agency: U.S. Department of DefenseAssistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance ProjectsFederal Award Numbers and Years: W912JV-20-2-1001; 2020Compliance Requirement: Period of PerformanceType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: 2020-031Questioned Costs: $150,544 (known)Criteria: NGR 5-1, Chapter 11-2Federal regulations require that grantees must obligate funds in the federal fiscal year specified in the relevant appendix to be reimbursable by federal funds.We judgmentally selected for review payroll expenditures recorded to federal fiscal year 2020 grant awards after the federal fiscal year ended. Our review of supporting documentation found, in two payroll months, payroll costs for several employees were incorrectly coded to the federal fiscal year 2020 grant award. Total questioned costs for these coding errors totaled $150,544. Per department management, these errors were due to the use of incorrect time codes manually entered on employees? timesheets.If the underlying accounting records do not properly account for transactions, the department could inappropriately request reimbursement for obligations that are outside of the period of performance for the grant. When the entries above were brought to management?s attention, they promptly made correcting journal entries, moving the expenditures to the federal fiscal year 2021 grant award.We recommend department management implement controls to ensure payroll expenditures are recorded in the correct federal grant year.

2021-029 Oregon Military DepartmentStrengthen controls to ensure level of federal support for expenditures is accurately recordedFederal Awarding Agency: U.S. Department of DefenseAssistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance ProjectsFederal Award Numbers and Years: W912JV-20-2-1001; 2020; W912JV-21-2-1001, 2021Compliance Requirement: MatchingType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: 2020-032Questioned Costs: $1,180 (known); $509,544 (likely)Criteria: National Guard Regulation 420-10, Chapter 7-2Program guidance indicates the rate at which authorized Operations and Maintenance costs are federally reimbursed is based on the Facilities Inventory and Support Plan (FISP) agreement support code for the facility(s) generating the costs. For example, if a facility?s FISP agreement support code indicates the facility is authorized for 75% federal support, the generated costs will be federally supported at 75%.We reviewed a random sample of 40 expenditures and for two transactions, we found the level of federal support was not accurate according to the FISP agreement support codes for the included facilities. This resulted in known questioned costs of $1,180 and in likely questioned costs of $509,544 when total known costs were projected to the population. The department inadvertently used outdated facility agreement support code splits. Without adequate procedures in place to ensure department staff are using up-to-date federal agreement support code splits for facility-related expenditures, the department may request reimbursement for expenditures that should be partially funded with state funds. When the transactions above were brought to management?s attention, they promptly made correcting journal entries to the level of federal support.We recommend department management establish controls to ensure the level of federal support for expenditures is accurately recorded.

2021-030 Oregon Military DepartmentStrengthen controls to ensure changes in expenditures requested for reimbursement are sufficiently documented and trackedFederal Awarding Agency: U.S. Department of DefenseAssistance Listing Number and Name: 12.401 National Guard Military Operations and Maintenance ProjectsFederal Award Numbers and Years: W912JV-16-2-1001, 2016; W912JV-18-2-1001, 2018;W912JV-19-2-1002, 2019; W912JV-20-2-1001, 2020;W912JV-20-2-1002, 2020; W912JV-20-2-1021, 2020;W912JV-20-2-1022, 2020; W912JV-21-2-1001, 2021;W912JV-21-2-1003, 2021; W912JV-21-2-1007, 2021;W912JV-21-2-1021, 2021Compliance Requirement: ReportingType of Finding: Significant DeficiencyPrior Year Finding: 2020-030Questioned Costs: N/ACriteria: 2 CFR 200.303(a); 2 CFR 200.302(b)The Oregon Military Department (department) is responsible for establishing controls to ensure federal financial reports include all activity of the reporting period, are supported by applicable accounting records, and are fairly presented in accordance with governing requirements. The department has not implemented sufficient controls to ensure changes in expenditures requested for reimbursement are consistently documented and tracked.The Operations and Maintenance Master Cooperative Agreement with the National Guard Bureau is separated into appendices that support various program objectives. For example, there are several appendices for operations and maintenance, environmental, and security objectives. The department completes the Request for Advance or Reimbursement (SF-270) reports by appendix to obtain reimbursement for federal expenditures.As part of the agency?s SF-270 review process, some expenditures are determined to be more appropriately requested from a different grant or in the future when federal funds are available for a category of expenditures for which funding is not currently available. Those expenditures are held back from the request for future inclusion on an appropriate SF-270 or when the federal funds become available.We reviewed a random sample of 37 SF-270 reports for state fiscal year 2021. We found that for 18 reports, we were unable to agree the amounts reported for cumulative federal and/or non-federal expenditures to the accounting records. Further inquiry and analysis determined the department does not consistently document and track expenditures held back to be included on a future SF-270. If changes in the included expenditures for a particular request are not adequately documented and tracked, expenditures could remain unreimbursed or be reimbursed inappropriately.We recommend department management establish controls and procedures to sufficiently document and track changes in expenditures requested for reimbursement on SF-270 reports.

2021-031 Oregon Department of Fish and WildlifePerform consistent inventory and monitoring of capital assets, including real propertyFederal Awarding Agency: U.S. Department of InteriorAssistance Listing Number and Name: 15.605, 15.611, 15.626 Fish and Wildlife ClusterFederal Award Numbers and Years: Various; Multiple YearsCompliance Requirement: Equipment and Real Property ManagementType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: 2020-040Questioned Costs: N/ACriteria: 50 CFR 80.90 (f)Federal regulations require the department to maintain control of all assets acquired under the Wildlife and Sportfish Restoration (WSFR) grants to ensure they serve the purpose for which acquired throughout their useful life.In December 2019, the Office of the Inspector General (OIG) issued an audit report on the department?s Wildlife and Sport Fish Restoration Program. The audit recommended the department develop and implement procedures to ensure supervisors are aware of lands under their supervision and establish a monitoring process to inspect lands regularly for compliance with program requirements.In response, the department developed a Land Asset Inventory and Monitoring procedure. The new procedure requires an annual land inventory, including a visual inventory of land assets to be performed by the facility or area manager responsible. The department also acquired web-based asset management software (Asset Panda?) to replace the previous system used. Although the agency established the policy and procedure in June 2021 and began converting data into Asset Panda?, we found they have not completed the inventory of capital assets, specifically land and land improvements, and have not begun the visual monitoring of land assets. Additionally, we tested the capital asset inventory process at 11 field locations and found the inventory was not performed in two field locations during FY21.The department has a decentralized organizational structure where various assets are located across the state. The process of recording all capital assets into Asset Panda? is taking longer than anticipated. The delay is primarily because many of the land assets were acquired many years ago, requiring time-consuming research to find the original documentation needed. This delay led to an incomplete inventory of assets at the end of FY21.The lack of a complete inventory listing and irregular monitoring of assets could result in assets purchased with WSFR funds being used for purposes other than those for which they were acquired.We recommend department management ensure the configuration and implementation of the asset management software is completed and an annual physical inventory of all capital assets, including an annual visual inspection (either physically or through the use of satellite imagery) of all land and land improvements is performed.

2021-032 Department of Administrative ServicesEnsure costs submitted for reimbursement are allowableFederal Awarding Agency: U.S. Department of the TreasuryAssistance Listing Number and Name: 21.019 Coronavirus Relief FundFederal Award Numbers and Years: Unknown; 2021Compliance Requirement: Activities Allowed or UnallowedType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: N/AQuestioned Costs: $3,917,490 (known)Criteria: Social Security Act Title VI section 601(d)Federal regulations state that Coronavirus Relief Fund (program) monies are to be used for necessary expenditures incurred due to the public health emergency caused by COVID-19. Federal regulations also allow program monies to be used to cover costs not accounted for in the government's most recently approved budget as of March 27, 2020.During fiscal year 2021, we reviewed a random sample of 40 program expenditures. We also reviewed six expenditures considered individually significant to the population. The department purchased Microsoft 365 (M365) licenses for state employees totaling $11.1 million. The department's 2019-2021 budget designated for M365 license purchases was $5.5 million. License costs totaling $9.5 million, comprised of two individually significant items, were subsequently reimbursed by the program. Although the expenditures were generally allowable, federal regulations specify the department could only be reimbursed for up to $5.6 million, which is the difference between total license costs and the amount budgeted. This resulted in known questioned costs for fiscal year 2021 of $3.9 million.Department staff stated the accelerated and sudden execution of the license purchases was unplanned and seemingly eligible for reimbursement. However, management did not consider that already budgeted expenditures were not allowable.We recommend program management strengthen its review process to include consideration of all requirements related to the allowability of expenditures and reimburse the federal agency for unallowable costs.

2021-033 Oregon Business Development DepartmentStrengthen controls to ensure subawards are used for authorized purposesFederal Awarding Agency: U.S. Department of the TreasuryAssistance Listing Number and Name: 21.019 Coronavirus Relief FundFederal Award Numbers and Years: Unknown; 2021Compliance Requirement: Allowable Costs/Cost Principles; Subrecipient MonitoringType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: N/AQuestioned Costs: $24,573 (known); $61,782 (likely)Criteria: 2 CFR 200.332(d); Federal Register Doc #2021-00827Federal regulations require pass-through entities ensure subawards are used for authorized purposes. The department provided funding to regional cultural coalitions who made subgrants to affected partners in their respective communities. The department required each entity to submit a final report at the subgrantee level, detailing how funds were spent. Of 34 coalitions, we selected eight for testing, seven by random sample selection and one judgmentally determined to be a significant item.Of the seven sampled entities, we found all returned complete final reports showing costs were allowable and any unspent funds were returned. The judgmentally selected entity made 179 subgrants, of which 178 subgrantees submitted final reports showing costs were allowable and any unspent funds were returned. The remaining subgrantee did not return a final report and failed to respond to department requests. All funds provided to this subgrantee are questioned costs totaling $19,291.The department also made emergency business assistance forgivable loans to 44 cities, counties, and other entities (subrecipients) that in turn made subgrants to eligible businesses. The funds were provided under interim guidance from U.S. Treasury which was not finalized in the Federal Register until January 15, 2021. Per the department's forgivable loan contracts, subrecipients were required to independently verify applications for eligibility requirements, retain documentation, and submit final reports to the department. We randomly selected seven subrecipients to verify businesses met the eligibility requirement of having 25 or fewer employees and that subgrant awards did not exceed the established limits per number of employees. After review of final reports, we requested additional documentation from three subrecipients who could not provide support for the amount of payments to four subgrantees, resulting in known questioned costs of $5,282. Per department management, due to the volume of the activity and required speed of funding, the department did not have the resources to review final reports for compliance with loan contracts.We recommend department management strengthen controls to ensure subawards are used for authorized purposes. We also recommend department management reimburse the federal agency for unallowable costs.

2021-034 Oregon Health AuthorityStrengthen controls to ensure appropriate subrecipient monitoring is performed timelyFederal Awarding Agency: U.S. Department of the TreasuryAssistance Listing Number and Name: 21.019 Coronavirus Relief FundFederal Award Numbers and Years: Unknown; 2021Compliance Requirement: Allowable Costs/Cost Principles; Subrecipient MonitoringType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: N/AQuestioned Costs: $372,002 (known); $4,222,558 (likely)Criteria: 2 CFR 200.332(d); Social Security Act Title VI section 601(d); Federal Register, Volume 86, No. 10Federal regulations state that Coronavirus Relief Fund (program) monies are to be used for necessary expenditures incurred due to the public health emergency caused by COVID-19. Federal regulations require pass-through entities to ensure subawards are used for authorized purposes in compliance with those regulations.During fiscal year 2021, the department provided program monies to over 400 subrecipients consisting of both government and non-government organizations. We selected a random sample of 25 subrecipients for testing. We also tested one additional subrecipient that we determined was individually significant to the population.We found the department's monitoring of seven subrecipients did not provide reasonable assurance over program compliance. Program monies were distributed to subrecipients in advance and subrecipients were required to provide the department with periodic expenditure reports. Evidence of monitoring was not retained for two of the seven subrecipients in our sample; but after our request the department obtained expenditure documentation from both subrecipients. For six of the seven subrecipients, the expenditure reports included either unallowable indirect costs, unspent subaward monies, or both. At the time of our audit, the department had not requested reimbursement of these costs, resulting in known questioned costs of $372,002 and likely questioned costs of $4,222,558 in fiscal year 2021. Although staff monitored subrecipients, testing demonstrated the monitoring did not provide reasonable assurance of program compliance and was not performed timely.We recommend management strengthen internal controls to ensure appropriate subrecipient monitoring is performed. Specifically, monitoring procedures should be performed timely and should be designed to ensure subrecipients use program monies for allowable purposes. We also recommend management seek reimbursement of program monies that were not spent by subrecipients or were used for indirect costs and reimburse the federal agency for unallowable costs.

2021-035 Oregon Health AuthorityStrengthen controls to ensure subaward information is accurately communicated and subrecipient risk is assessedFederal Awarding Agency: U.S. Department of the TreasuryAssistance Listing Number and Name: 21.019 Coronavirus Relief FundFederal Award Numbers and Years: Unknown; 2021Compliance Requirement: Subrecipient MonitoringType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: N/AQuestioned Costs: N/ACriteria: 2 CFR 200.332(a)(b)Federal regulations require pass-through entities to communicate subaward information and evaluate each subrecipient's risk of noncompliance with federal statutes and regulations.During fiscal year 2021, the department provided program monies to over 400 subrecipients consisting of both government and non-government organizations. We selected a random sample of 25 subrecipients for testing. We also tested one additional subrecipient that we determined was individually significant to the population.We found the department had not communicated all required subaward information to seven of the selected subrecipients. Subaward information is communicated in one of two ways; directly within the subaward, or through inclusion of a link within the subaward directing the subrecipient to the department's website where the required information is documented. However, required information included within the subaward was not always accurate, and provided links did not always direct the subrecipient to the correct website. For example, three subawards reported the Awarding Agency and Assistance Listing Name incorrectly. Department staff stated they were not provided the required information to communicate to the subrecipients. In three additional subawards, a link directed the subrecipient to one of the department's websites, which was not for communicating subaward information. Additionally, one subaward included a link to the correct website but the subaward information was missing from the website. Department staff did not verify that the link included in the subawards was working properly or that all contracts were included on its website.Finally, the department did not complete a risk assessment for one of the subrecipients included in our test sample. Management stated this was an oversight.We recommend management strengthen internal controls to ensure subaward information is accurately communicated to all subrecipients. We also recommend management ensure a risk assessment is completed for each subrecipient.

2021-036 Oregon Housing and Community ServicesStrengthen controls to ensure subaward information is communicatedFederal Awarding Agency: U.S. Department of the TreasuryAssistance Listing Number and Name: 21.019 Coronavirus Relief FundFederal Award Numbers and Years: Unknown; 2021Compliance Requirement: Subrecipient MonitoringType of Finding: Significant Deficiency; NoncompliancePrior Year Finding: N/AQuestioned Costs: N/ACriteria: 2 CFR 200.332(a)Federal regulations require pass-through entities ensure every subaward is clearly identified and communicated as a subaward at the time of the subaward and that the communication includes certain required information.The department uses a master grant agreement federal award exhibit for the purpose of identifying and communicating required subaward information to its subrecipients for most federal programs. The department attaches the federal award exhibits to new master grant agreements, but not to later amendments. We judgmentally selected eight of 18 subrecipients for review and found the department did not utilize this exhibit for any of its 18 Coronavirus Relief Fund subrecipients, as Coronavirus Relief Funds were added to existing agreements through amendments. As a result, the department did not communicate the following to subrecipients: name of federal awarding agency, assistance listing name, federal requirements to be followed identified by code of federal regulation number, subrecipient?s unique entity identifier, name of pass-through entity contact, and indicator if award is for research and development.Subrecipients need complete award information at the time of award to help ensure the federal award is used in accordance with federal statutes and regulations, to assess their need for a single audit, and to prepare and submit an accurate schedule of expenditures of federal awards.We recommend department management strengthen its existing controls over communications to subrecipients to ensure all required information is communicated.

2021-037 Oregon Housing and Community ServicesDiscontinue federal subawards to noncompliant subrecipientsFederal Awarding Agency: U.S. Department of the TreasuryAssistance Listing Number and Name: 21.019 Coronavirus Relief FundFederal Award Numbers and Years: Unknown; 2021Compliance Requirement: Subrecipient MonitoringType of Finding: NoncompliancePrior Year Finding: N/AQuestioned Costs: $4,426 (known); $415,997 (likely)Criteria: 2 CFR 200.332(b)(d)Federal regulations require pass-through entities to evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining appropriate subrecipient monitoring, which includes ensuring subawards are used for authorized purposes in compliance with those regulations.The department passed-through Coronavirus Relief Funds (CRF) for rental assistance, energy assistance, and safe shelter alternatives to 18 subrecipients. We found that for one of the eight subrecipients judgmentally selected for testing, the department?s monitoring efforts would not provide reasonable assurance over program compliance. The subrecipient did not meet the department?s expectations in its annual risk assessment, receiving the lowest score, indicating questionable or inadequate program administration. Results of prior fiscal monitoring visits conducted in March 2019 and March 2020 through July 2020 also indicated the subrecipient could not provide adequate documentation to demonstrate program compliance. Regardless, the department continued to follow its monitoring procedures by extending the fiscal period under review and increasing the sample size in the subsequent fiscal review. A summary of the June 2021 fiscal monitoring visit showed the subrecipient had sustained repeat compliance issues since fiscal year 2017 monitoring, including:? Failure to provide documentation or inadequate documentation? Failure to cooperate with monitoring activities? Failure to respond to required actions? Disallowed costs, including prior year questioned costs that remain past dueThe June 2021 monitoring procedures identified known questioned costs of $4,436 and likely questioned costs of $415,997 in fiscal year 2021 CRF expenditures. According to department management, Oregon Revised Statute 458.505 states the department shall fully integrate this entity into the antipoverty delivery system and provide a minimum level of services and funding for low-income migrant and seasonal workers from the antipoverty programs administered by the department. However, the statute does not dictate the funding source for the services. As the only approved provider for these types of services, the department continued to provide funding to this entity. Department management indicated they have initiated the process to open the network to other subrecipients to serve migrant workers with Oregon House Bill 2100.We recommend department management continue working with the Oregon legislature to find alternate entities to serve migrant workers, consider non-federal funds for service delivery until the identified subrecipient is compliant with program and monitoring requirements, and reimburse the federal agency for unallowable costs.

2020-013 Department of Human Services Ensure performance data reports are complete and accurate Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Temporary Assistance for Needy Families (TANF)(93.558) Federal Award Numbers and Years: 2019G996115, 2019; 2020G996115, 2020 Compliance Requirement: Reporting Type of Finding: Material Weakness, Material Noncompliance Prior Year Finding: 2019-008, 2018-008 Questioned Costs: N/A Criteria: 45 CFR 265.3(a) Federal regulations require the department to collect monthly and report quarterly certain non-financial data elements for services paid with TANF federal funding in the ACF-199 TANF data report. Federal regulations also require the department to report data quarterly for TANF eligible clients whose benefits are paid with designated state funds called maintenance of effort (MOE) in the ACF-209 SSP-MOE data report. Both data reports should be supported by applicable performance records. We reviewed fiscal year 2020 client expenditure data as it related to the quarterly data reports. The dataset of client expenditures used to compile the information for the performance reports included some coding elements from the department?s case management system, but not all information necessary to determine the funding source for individual client payments. The separate performance reports are intended to provide information on client services based on their funding source. Without the necessary funding source elements in the dataset we were unable to confirm if all cases paid with TANF federal funds were included appropriately in the ACF-199 reports. Based on our analysis, we found, on average, 2,230 cases per month may have been improperly excluded from the ACF-199 reports. We also found, on average, that 150 cases per month may have been improperly included in the ACF-199 reports because they did not have corresponding federal TANF expenditures. Findings related to performance data reporting have been ongoing since fiscal year 2010. Due to the complexity of the issue, the department has been waiting for the implementation of a new eligibility system to address the reporting issues. We recommend the department?s office of information services ensure systems used for preparing the ACF-199 and ACF-209 reports provide the coding elements necessary for accurate and complete reporting in compliance with requirements. We recommend program management ensure performance data reports submitted are complete and accurate.

2020-014 Department of Human Services Ensure work participation rate calculation uses verified and accurate data Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Temporary Assistance for Needy Families (TANF)(93.558) Federal Award Numbers and Years: 2019G996115, 2019; 2020G996115, 2020 Compliance Requirement: Special Tests and Provisions Type of Finding: Material Weakness, Material Noncompliance Prior Year Finding: 2019-009 Questioned Costs: N/A Criteria: 45 CFR 261.61; 45 CFR 261.62 Federal regulations require each state to maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Each state must have procedures to count and verify reported hours of work and must comply with its Work Verification Plan as approved by the U.S. Department of Health and Human Services (DHHS). Oregon?s Work Verification Plan outlines a system of controls for how reported hours will be verified and documented, and for independent reviews and monitoring procedures to catch errors. Using a statistically valid sample, we reviewed 20 randomly selected case files of participating clients for verification of work activity participation. Of the 20 cases reviewed, we found 12 cases where the department did not adhere to the approved Work Verification Plan policies and procedures for maintaining documentation or accurately reporting hours of participation in their automated data processing system. These inaccurate or unverified hours were used in calculating the work participation rate reported to DHHS. If the state fails to follow the approved Work Verification Plan, DHHS may penalize the state. We recommend TANF program management ensure the work participation rate is calculated appropriately using verified and accurate participation data in adherence with the department?s Work Verification Plan. We recommend program management review their system of controls and identify where improvements are needed to ensure compliance with the work verification plan.

2020-015 Department of Human Services Ensure appropriate information is used for determining benefit amounts and eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Temporary Assistance for Needy Families (TANF)(93.558) Federal Award Numbers and Years: 2019G996115, 2019; 2020G996115, 2020 Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility Type of Finding: Material Weakness, Material Noncompliance Prior Year Finding: 2019-010, 2019-011 Questioned Costs: $4,295 (known) Criteria: 45 CFR 263.11(a) Federal regulations allow the use of federal TANF funds for expenditures that are reasonably calculated to accomplish the purposes of the program. In Oregon, the eligibility criteria and determination of benefit amounts are based on multiple factors involving lack of financial resources, employment status, the composition of the household, and residency status. Using a statistically valid sample, we reviewed 94 randomly selected client payments to verify the benefit amount was determined appropriately and identified the following errors: ? Ten cases where benefits were issued to ineligible clients. The majority of these errors were due to the absence of required client agreements or employability screening. Payments exceeded the 60-month federal time limit in one case, and the composition of the household made the recipient ineligible in two cases. ? Four cases where benefits were issued to eligible clients, but were for the wrong amount. In these cases benefits were calculated using the wrong number of people in the household or the pro-rated amount was miscalculated. According to the TANF Policy Unit, missing documentation and oversights or misunderstanding of the eligibility criteria resulted in the errors listed above with known overpayment of federal funds amounting to $4,295 and likely overpayments exceeding $25,000. We recommend program management ensure client benefit payments are correctly calculated, paid on behalf of eligible individuals, and documentation is maintained to support eligibility decisions and benefit calculations. We also recommend program management correct the identified cases and reimburse the federal agency for any amounts claimed for ineligible cases.

2020-016 Department of Human Services Ensure eligibility re-determinations are conducted timely Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Temporary Assistance for Needy Families (TANF)(93.558) Federal Award Numbers and Years: 2019G996115, 2019; 2020G996115, 2020 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $4,158 (known) Criteria: 42 USC 602(a)(1)(B)(iii) Federal regulations require states to outline the criteria used in determining eligibility for TANF benefits in their approved plan. Oregon?s approved plan permits the department to use TANF funds to provide emergency child welfare intervention services as long as client eligibility is re-determined annually to determine if an emergent need still exists. If the re determination is not completed within 30 days of the review due date, emergency assistance is not authorized and the client is deemed ineligible. For fiscal year 2020, we randomly selected 25 emergency child welfare cases using a statistically valid sample and tested for eligibility determinations. We found that 15 of the 25 samples required re-determinations, and one of the 15 was not performed by the required date. According to the department, the re-determination for this case was accidentally missed, and when completed, the client was deemed ineligible. This resulted in $4,158 known questioned costs for fiscal year 2020 which the department refinanced with state funds. We recommend program management ensure eligibility re-determinations are completed timely.

2020-017 Department of Human Services Subrecipient monitoring controls should be strengthened to include review of financial records Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Special Programs for the Aging ? Title IIII, Part B (93.044), Special Programs for the Aging ? Title III, Part C (93.045), Nutrition Services Incentive Program (93.053) Federal Award Numbers and Years: 2001ORCMC2, 2020; 2001ORHDC2, 2020; 2001ORHDC3, 2020; 2001OROACM, 2020; 2001OROAHD, 2020; 2001OROANS, 2020; 2001OROASS, 2020; 2001ORSSC3, 2020 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 331(d); 45 CFR 1321.11 and 1321.17(f)(9) Federal regulations require the department to develop policies and monitor the activities of subrecipients as necessary to ensure the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. The department?s process to ensure subrecipient compliance with federal program requirements includes monitoring program requirements, reviewing financial records, and reviewing subrecipients? annual single audit. The department?s current subaward agreement requires subrecipients to provide supporting financial records for one quarter each biennium; management stated this requirement was not enforced due to staffing issues and the COVID pandemic. Additionally, the department did not require submission of supporting financial records during the prior biennium, resulting in no fiscal monitoring during that biennium as well. Without fiscal monitoring procedures, the department cannot ensure subrecipients comply with federal fiscal requirements. We recommend department management strengthen existing controls by implementing procedures that include review of financial records supporting expenditures submitted for reimbursement.

2020-018 Department of Human Services/Oregon Health Authority Improve documentation and controls over client eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Medicaid Cluster (93.777, 93.778) Federal Award Numbers and Year: 1905OR5MAP and 1905OR5ADM, 2019; 2005OR5MAP and 2005OR5ADM, 2020 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2019-016, 2018-014, 2018-015, 2017-014 Questioned Costs: $16,500 (known) Criteria: 42 CFR 435.916(a); 42 CFR 435.916(b); 42 CFR 435.907(f); 42 CFR 435.914; 42 CFR 435.952(c)(2) Federal regulations require certain conditions be met for the Department of Human Services (department) and Oregon Health Authority (authority) to receive Medicaid funding for medical claims. The requirements include redetermining client eligibility for the program every 12 months or when the agency receives information regarding a change in the client?s circumstances that may affect their eligibility, obtaining signed applications, maintaining sufficient documentation supporting the client?s eligibility and individual claims, and seeking additional information if information provided for an individual is not reasonably compatible with information obtained through an electronic data match. We randomly sampled 100 clients and one Medicaid service payment associated with each client using a statistically valid sample. We reviewed agency documentation to test compliance with the eligibility requirement. For five clients, we found the issues described below. ? Two clients did not have their eligibility verified within 12 months in accordance with federal requirements. ? One client did not have a signed application on file prior to the date of the sample payment, although the department obtained a new application after our payment date. ? One client had income eligibility determined incorrectly by a caseworker causing the client to be inappropriately deemed eligible, resulting in questioned costs of $1,263. ? One client had income eligibility determined incorrectly by the Oregon Eligibility (ONE) System. The system evaluated sources of income separately, rather than combined. As a result, the client was incorrectly determined eligible resulting in questioned costs of $15,237. This system error may have resulted in multiple clients being incorrectly determined eligible. The above issues occurred due to administrative errors by various caseworkers and a flaw in the functionality of the ONE System. We recommend department and authority management strengthen controls to perform timely eligibility redeterminations and provide periodic training to caseworkers to reduce the risk of administrative errors. We also recommend management implement corrections in the ONE system to address the weaknesses identified in verifying income. Management should also review the entire duration of the claim identified to determine if there are additional questioned costs from previous years. Additionally, management should reimburse the federal agency for unallowable costs.

2020-019 Department of Human Services/Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Medicaid Cluster (93.777, 93.778) Federal Award Numbers and Year: 1905OR5MAP and 1905OR5ADM, 2019; 2005OR5MAP and 2005OR5ADM, 2020 Compliance Requirement: Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2019-015, 2018-016, 2017-015 Questioned Costs: N/A Criteria: 42 CFR 455.436; 42 CFR 455.102 to 455.107; 42 CFR 455.414 Provider eligibility requirements for the Medicaid program differ depending upon the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulations agreement (agreement). Typically, the agreement includes disclosures specifically required by federal regulations. Additionally, the federal regulations require that the Oregon Health Authority (authority) and Department of Human Services (department) determine eligibility for Medicaid providers and revalidate providers at least every five years by performing database checks to ensure providers are still eligible to participate in the Medicaid program. Oregon?s Medicaid program pays a specified amount to a Coordinated Care Organization (CCO) to provide all treatments for a client in a month. We performed testing for all of Oregon?s 15 CCOs. We also selected a statistically valid random sample of 60 other providers in the Medicaid program with 38 providers enrolled by the authority and 22 enrolled by the department. ? For one CCO, the authority could not provide evidence that the required disclosure relating to affiliated organizations was obtained. The authority obtained the necessary disclosures after our inquiries in February 2021. ? For one CCO, the authority could not provide documentation that they had completed the required database checks before the contract became effective on January 1, 2020. The authority completed the necessary database checks after our inquiries in February 2021. ? One nursing home enrolled by the authority did not contain the required disclosures. When this provider was enrolled in the program, they were enrolled through a formal contract rather than with a Provider Enrollment Agreement (PEA). The contract did not include the sections relating to the required disclosures that would ordinarily have been included in a PEA. The authority obtained the necessary disclosures in February 2021. ? One hospital?s PEA was originally obtained in 1992 and did not contain the required disclosures. In 2016, the authority implemented a policy to require updated PEAs at each 5- year revalidation. As of March 2021, a new PEA has not been obtained. ? For four providers, the department did not document database checks more recently than 2016. Federal regulations require the provider to be revalidated every five years and department policy is to revalidate at least every two years. ? For an additional four providers, the department could not provide documentation that it had completed database checks at enrollment or any subsequent revalidations. The department subsequently completed the database checks in March 2021. For one of the providers, the five-year term expired in May 2020 based upon the dates of the PEA. As there was no evidence of database checks, we cannot determine if the provider was revalidated at that time. The department subsequently completed the database checks in March 2021. Per department management, for the issues discussed in the final two bullets, the databases were intended to be verified through an automated process. The automated process failed, and management is investigating the necessary corrections. Other issues occurred due to incomplete record maintenance and staff error. Failure to perform the necessary background checks and retain provider enrollment agreements increases the risk of payments to inappropriate vendors. We recommend authority management strengthen controls to ensure documentation supporting a provider?s eligibility determination and revalidation is retained. Additionally, we recommend management review the automated processes to ensure databases are checked timely.

2020-020 Oregon Health Authority Improve controls for monitoring MMIS claims edits and audits Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Medicaid Cluster (93.777, 93.778) Federal Award Numbers and Years: 1905OR5MAP and 1905OR5ADM, 2019; 2005OR5MAP and 2005OR5ADM, 2020 Compliance Requirement: Activities Allowed or Unallowed; Special Tests and Provisions Type of Finding: Significant Deficiency Prior Year Finding: 2019-013, 2018-013 Questioned Costs: N/A Criteria: 42 CFR 447.45 In previous years, we reported that the Oregon Health Authority (authority) did not adequately monitor aspects of the Medicaid Management Information System (MMIS) claims edits and audits; see Audit Report 2020-14, findings 2019-014 and 2018-013. The authority used MMIS to process almost $8.2 billion in paid claims during fiscal year 2020 and relies on the system?s numerous claims edits and audits function to provide assurance that payments are appropriate and to prevent and detect potential inappropriate payments. In the response to the finding reported for 2019, the authority stated that the contractor responsible for administering the system would test 116 of the edits and audits, and the authority would test the remaining 80% or approximately 460 edits and audits. Although the authority has taken some corrective actions toward addressing the finding, such as reducing the number of staff able to configure the edits and audits, as of June 30, 2020, we noted the following: ? Management did not have a process to monitor for unauthorized changes. ? The contractor tested only 94 of the 116 edits identified for testing: and ? The authority tested approximately 15% rather than 80% of the remaining edits and audits. Having a strategic framework and thorough understanding of these controls, including what they do and when they trigger, is critical for ensuring accurate and properly recorded payments. If the claims edits and audits are not configured and functioning correctly, there is the potential for millions of dollars of inappropriate payments. We recommend authority management continue to implement procedures to monitor potential unauthorized changes to the application, as well as continue to verify the effectiveness and completeness of the claim?s edits and audits function.

2020-021 Oregon Health Authority Strengthen review over costs charged to the program Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Children?s Health Insurance Program (CHIP) (93.767) Federal Award Numbers and Year: 1905ORCECF, 2019; 2005OR5021, 2020 Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Matching Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: None Questioned Costs: $342,566 (known) Criteria: 2 CFR 200.53(a); 45 CFR 95.11; 45 CFR 95.13(d) Federal regulations allow the Children?s Health Insurance Program (CHIP) expenditures to be reimbursed at the federal financial participation rate for various program costs at the time of payment for services provided. The Oregon Health Authority (authority) makes payments to vendors other than providers through the state?s accounting system. We judgmentally selected for review all transaction related payments for vaccines, which accounted for more than 95% of this population?s expenditures. We identified the following errors, which were not identified during the authority?s review, that resulted in improper payment of CHIP expenditures: ? One transaction charged expenditures related to another program to the CHIP program, resulting in known questioned costs of $128,991, of which $124,851 was federally funded. ? One transaction was charged at the incorrect federal participation rate, resulting in known questioned costs of $213,575. We recommend authority management strengthen controls over review to ensure transactions are adequately supported and the federal financial participation rate is correctly applied. Additionally, we recommend the authority reimburse the federal agency for unallowable costs.

2020-022 Oregon Health Authority Improve documentation and controls over client eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Children?s Health Insurance Program (CHIP) (93.767) Federal Award Numbers and Year: 1905ORCECF, 2019; 2005OR5021, 2020 Compliance Requirement: Activities Allowed or Unallowed; Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: None Questioned Costs: $25,429 (known) Criteria: 42 CFR 435.914(a); 42 CFR 433.32; 42 CFR 435.952(b) Federal regulations require certain conditions be met for the Oregon Health Authority (authority) to receive Children?s Health Insurance Program (CHIP) funding for medical claims. The requirements include maintaining sufficient documentation supporting the client?s eligibility and individual claims, and seeking additional information if information provided for an individual is not reasonably compatible with information obtained through an electronic data match. We randomly selected a statistically valid sample of 60 clients for eligibility testing and one CHIP service payment associated with each client. We reviewed authority documentation and for four clients we found the issues described below. ? Two clients provided income information after a referral for information was requested by the system during an electronic data match. The authority did not appropriately document that the requested information was reasonably compatible with other available information. However, we determined these clients to be eligible for services, resulting in no questioned costs. ? One client provided income information after a referral for information was requested by the system during an electronic data match. The authority did not appropriately document that the requested information was reasonably compatible with other available information. Our testing determined this client was over the income thresholds and ineligible for CHIP, resulting in questioned costs of $2,292 for the fiscal year ending June 30, 2020. ? One client attested to being pregnant and was appropriately placed in the CHIP program. However, this client later called reporting they had never been pregnant; at which time the authority should have adjusted the client?s benefits and reimbursed the CHIP program expenditures. The authority failed to adjust this client?s claims and benefit program resulting in questioned costs of $23,137 and $9,014 for fiscal years ending June 30, 2020 and 2021, respectively. Additionally, we recognize this client may also have received improper Medicaid benefits over the course of their enrollment. However, at the time of our audit, we were unable to determine improper claims associated with Medicaid. The above issues occurred due to administrative errors by various authority staff. Failure to ensure financial and program eligibility increases the risk of improper payments. We recommend authority management strengthen controls by providing periodic training to eligibility staff to reduce the risk of administrative errors. This training should ensure eligibility staff know how to verify and document income support. In addition, management should review benefits and program eligibility related to cases identified with questioned costs to ensure proper funding within CHIP and other applicable federal programs and should reimburse the federal agency for unallowable costs.

2020-023 Oregon Health Authority Improve documentation for provider eligibility determinations and revalidations Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Children?s Health Insurance Program (CHIP) (93.767) Federal Award Numbers and Year: 1905ORCECF, 2019; 2005OR5021, 2020 Compliance Requirement: Special Tests and Provisions Type of Finding: Significant Deficiency Prior Year Finding: None Questioned Costs: N/A Criteria: 42 CFR 431.107; 42 CFR 455.436; 42 CFR 455.102 to 455.106; 42 CFR 455.414 Provider eligibility requirements for the Children?s Health Insurance Program (CHIP) differ depending upon the type of services provided. In addition, all CHIP providers are subject to specified database checks and are required to sign an adherence to federal regulations agreement (agreement). The agreement must include disclosure information and terminology required by federal regulations for which the provider must agree to provide at the agreement date and/or upon request. Additionally, federal regulations require that the Oregon Health Authority (authority) determine eligibility for CHIP providers and revalidate providers at least every five years by performing various database checks to ensure providers are still eligible to participate in the CHIP program. We conducted testing of Oregon?s Coordinated Care Organizations (CCOs) during our audit of the Medicaid program. CCOs are dual-enrolled as both CHIP and Medicaid providers. Medicaid testing identified two exceptions as noted in the Medicaid finding titled ?Improve documentation for provider eligibility determinations and revalidations.? We judgmentally selected an additional 18 providers for testing, all of which were hospitals or Federally Qualified Health Centers, and identified 12 control deviations as described below: ? For one provider the death master check was not completed for the managing employee during revalidation. As of February 2021, the authority obtained an updated disclosure statement and verified the death master file for the managing employee. ? For two providers the disclosure statements did not include the required managing employee information. As of March 1, 2021, the authority had obtained a completed disclosure statement with the required managing employee details from only one of these providers. ? For two providers the authority could not provide signed provider enrollment agreements or disclosure statements. As of March 1, 2021, the authority obtained a signed provider enrollment agreement and completed disclosure statement from one of these providers. ? For one provider the authority could not provide a disclosure statement from the most recent revalidation period. As of March 1, 2021, the authority had obtained a completed disclosure statement for this provider. ? For six providers the authority could not provide provider enrollment agreements or disclosure statements that met the minimum federal requirements. As of March 1, 2021, the authority obtained signed provider enrollment agreements and completed disclosure statements from five of the six providers. Issues identified above occurred due to incomplete record maintenance. The authority began sending new agreements and disclosure statement requests in spring of 2020 and were in the process of reviewing the providers in this revalidation batch during the course of this audit. Failure to retain provider enrollment agreement and updated disclosure statements increases the risk of payments to ineligible vendors. We recommend authority management strengthen controls over provider eligibility determinations and revalidations to ensure maintenance of updated agreements and disclosure statements in accordance with federal regulations and ensure all databases are checked timely.

2020-024 Department of Human Services Complete system modifications to ensure proper reporting of program expenditures Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Foster Care ? Title IV-E (93.658), Non-Major Program; Temporary Assistance for Needy Families (TANF)(93.558) Federal Award Numbers and Year:1901ORFOST, 2019; 2001ORFOST, 2020; 1901ORTANF, 2019; 2001ORTANF, 2020 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Noncompliance Prior Year Finding: 2019-017; 2018-018; 2017-013 Questioned Costs: $127,654 (Foster Care known); $4,404 (TANF known) Criteria: 45 CFR 1356.21 The department uses its child welfare information system, OR-Kids, to manage placements, eligibility, payments, and other case information. Information systems should be designed to ensure information processed by the system is complete, accurate, and valid. As with any significant program or system, management should have an adequate understanding of the processes and controls it is relying on, and should obtain assurance those processes and controls are functioning as intended. While performing current year follow-up procedures related to prior year findings that identified processing issues within OR-Kids, we found errors continue to occur when certain corrections are made to placement information in the system. When placement corrections are initiated, OR-Kids issues a ?new? payment, and simultaneously recovers the funds from the payment issued at the time of original services, which generally results in no payment to the provider. However, this process does not always occur as it should, and results in the department incorrectly reporting and drawing federal funds. For some placement corrections, OR-Kids processed the recovery of the funds in a state grant instead of the federal program, resulting in estimated inappropriate federal expenditures in fiscal year 2020 of $127,654 for Title IV-E Foster Care and $4,404 for TANF. This issue was originally identified in fiscal year 2015. During fiscal year 2019 the department developed a partial fix to the OR-Kids system to prevent a subset of these processing errors from occurring. During fiscal year 2020 the department stated they are developing a report that will identify errors needing to be corrected to accurately report federal expenditures. The agency has also repaid estimated questioned costs identified in the prior year; however, the actual questioned costs to be repaid have not been identified. We recommend department management review OR-Kids transaction processing and complete system modifications as appropriate to ensure proper financial reporting of program expenditures. We also recommend department management review prior year and current year transactions and reimburse the federal agency for grant expenditures claimed inappropriately.

2020-025 Department of Human Services Improve controls over copay and child care hour calculations and multiple provider copays Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Child Care Development Fund Cluster (93.575, 93.596) Federal Award Numbers and Years: G999005, 2018-2020; G999004, 2018-2020; G996005, 2018-2019 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2017-016 Questioned Costs: $10,241 (known); $1,354,980 (likely) Criteria: 45 CFR 98.45(b)(5); 42 USC 9858 The Child Care Development Fund program offers federal funding to states to increase the availability, affordability, and quality of child care services. As required by federal regulations, the department has developed a sliding fee scale, based on family size and income that provides for cost sharing by families that receive child care services (monthly copay). The copay is attached to one provider?s monthly bill regardless of the number of providers a client uses. The department also calculates authorized monthly child care hours based on parent work schedules. We tested a statistically valid random sample of 60 provider payments for client eligibility and verified the monthly copay calculated for each family was accurate based on family size and income. We also verified the child care hours calculated were accurate based on parent work schedules. We identified the following errors: ? Nine cases where the copay was calculated incorrectly due to not capturing tips or child support income, using an incorrect family size, or mathematical errors. ? Eight cases where authorized child care hours were calculated incorrectly due to missing support of parent work hours or mathematical errors. ? One case in which the client did not pay the copay because the copay was attached to a provider no longer providing care. Federal funds subsidized the copay amount of the payment made to the provider. ? One case in which the provider?s zip code was not updated in the system for 14 months. As provider rates are determined by zip code groupings, the provider received a higher subsidy each month in error. These errors resulted in total known questioned costs of $7,621 and projected questioned costs of $1,284,027. We also tested a random sample of 25 instances in which a client with multiple providers in one month used fewer providers in a subsequent month to verify the copay was attached to the provider still providing care. For two cases, the client?s copay was attached to a provider that did not provide care or bill for the sampled month, therefore the client did not pay their required copay. According to the department, it generates a monthly report that identifies situations where the primary provider, with copay attached, stopped providing care. However, the department does not require the client to reimburse the agency for the copay not met. Federal funds subsidized the copay portion of these two payments to the providers, resulting in questioned costs of $2,620. Projected questioned costs for this population total $70,953. We recommend department management ensure a client?s monthly copay and childcare hours are correctly calculated, and provider addresses are updated timely. In addition, in situations with multiple providers, the department should seek reimbursement from a client when the client copay is not met as the primary provider did not provide care. We also recommend department management reimburse the federal agency for unallowable costs.

2020-026 Department of Human Services Improve controls over incentive payments Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Child Care Development Fund Cluster (93.575, 93.596) Federal Award Numbers and Years: G999005, 2018-2020; G999004, 2018-2020; G996005, 2018-2019 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $12,250 (known); $619,121 (likely) Criteria: 45 CFR 75.303; 45 CFR 75.403 The Child Care Development Fund program?s lead agency implemented a limited duration incentive payment for eligible providers who provided care during the alternate hours of evenings and weekends. Each month, providers were eligible to receive $250 per child when providing alternative hour care at least 20 hours per month, or $500 per child when providing alternative hour care at least 40 hours per month. The incentive program ran from January through September 2019 with federal funds providing over $5 million in fiscal year 2020. The department implemented a policy stating providers must: 1) have received a child care billing form from the department, 2) provide care during certain hours, 3) maintain attendance logs of all hours a child is in care, and 4) request the incentive by submitting an alternative hour incentive form. We tested a nonstatistical random sample of 25 monthly provider incentive payments for alternate and weekend child care to verify these payments were necessary and reasonable for the performance of the federal award. The department did not retain sufficient support to verify these payments. The department relied solely on provider self-attestation on the alternative hour incentive form that they provided care during alternate hours. We found no evidence of other corroboration by the department for alternative hour care, including client attestation. In addition, attendance records were not available to us as providers were instructed to retain attendance logs for a minimum of one year. This retention schedule ended September 2020. We used a combination of client applications, paystubs, and case narratives to establish a client?s need for evening or weekend child care. When this was not available, we used provider websites or other department documentation that supported at least the provider offered care during alternate hours. We found the following issues: ? For two sample items, the clients? work schedules did not support the clients? need for child care during alternate hours, resulting in total known questioned costs of $10,250. ? For one sample item, the client?s work schedule would have supported a need for alternate care for less than 40 hours for the month. The provider was paid at the higher rate of $500 per child instead of $250 per child, resulting in total known questioned costs of $1,500. ? For payments made to the 25 sampled providers, six providers received duplicate payments during the program?s existence, totaling $31,750. The department identified $31,250 of these payments and initiated repayment procedures, leaving $500 in questioned costs. We analyzed data for the incentive payment population and found an additional $77,125 in potential duplicate payments. Without attendance logs, we were unable to verify that correct incentive payment rates were paid to providers; incorrect rates may have been paid, resulting in excess payments to providers. We recommend department management extend its retention policies for a sufficient length of time to ensure the department and auditors can verify federal awards are necessary and reasonable. In addition, the department should review all incentive payments made to providers to ensure duplicate payments have been identified and reimburse the federal agency for all improper costs.

2020-027 Department of Human Services Investigate fraud referral cases and conduct other fraud detection activities Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Child Care Development Fund Cluster (93.575, 93.596) Federal Award Numbers and Years: G996005, 2019-2020; G999004, 2019-2020; G999005, 2019- 2020 Compliance Requirement: Special Tests and Provisions Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 45 CFR 98.16(cc) The Child Care and Development Fund (CCDF) Plan (plan) serves as a state?s application for CCDF funds by providing a description of, and assurance about, the grantee?s child care program and all services available to eligible families. Plans include federally required processes to recover child care payments that are the result of fraud. The Oregon Department of Education, designated as Oregon?s lead agency in Oregon?s 2019-2021 plan, has assigned the establishment of a fraud unit to the Department of Human Services (department). We tested a random sample of 13 fraud referral cases and found five were closed before the department verified whether the result of fraud, averaging 812 days between referral and closure dates. At least four of the five could have resulted in repayment procedures being necessary. Department management made a decision to close older cases without investigation to alleviate its significant backlog of cases, stating it is no longer cost effective to investigate old cases. We reviewed several fraud activities listed in the plan that were assigned to the department and found two were not occurring. This heightens the risk that remaining fraud detection activities will be insufficient to detect fraud. ? The monthly audit of child care for school age children, conducted for selected months when school is in session, did not occur during the fiscal year. The department did not detect it had stopped performing these reviews in fiscal year 2019, citing the intermittent nature of the audit reports as the cause. In addition, the department did not provide the annual summary of fiscal year 2019 audits, due September 2019, to the lead agency. The department stated in June 2020 it would resume audits, process missing reports, and submit the fiscal year 2019 annual summary to the lead agency. ? Site visits to review attendance and billing records of randomly selected providers did not occur. The department stated this activity was met with resistance from providers and unions and was discontinued at least two years prior; it was an oversight to not remove it from the plan. We recommend department management implement controls to ensure actions listed in Oregon?s CCDF State Plan are accurate and occurring. We also recommend department management timely investigate its fraud referral cases in order to recover improper payments.

2020-028 Department of Education Improve controls to ensure expenditures are liquidated by federally mandated date Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Child Care Development Fund Cluster (93.575, 93.596) Federal Award Numbers and Years: G999005, 2018 Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $1,452,166 (known) Criteria: 45 CFR 98.60 The Oregon Department of Education (department) receives federal awards for the Child Care Development Fund program (CCDF) in three categories, each with a specified time period by which funds must be spent. The department uses coding within the state?s accounting system to prevent payments beyond each fund category?s liquidation period. We tested fiscal year 2020 payments and found four transactions, totaling $1,452,166, that were not liquidated by the required date and, therefore, not allowed to be expended from the federal award number G999005, 2018. The system coding the department relied on is not designed to prevent payments beyond the liquidation period. We recommend department management review and revise how it relies on the accounting system coding to ensure payments are liquidated by federally mandated dates. We also recommend department management reimburse the 2018 grant award.

2020-029 Department of Education Improve controls over expenditures Federal Awarding Agency: U.S. Department of Health and Human Services Assistance Listing Name and Number: Child Care Development Fund Cluster (93.575, 93.596) Federal Award Numbers and Years: 90YE0200-03-00, 2020; G999004, 2020; G999005, 2019; G996005, 2018-2020 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $40,282 (known); $688,610 (likely) Criteria: 45 CFR 75.403(a); 45 CFR 75.430(a) Federal regulations state that allowable costs are costs necessary and reasonable for the performance of federal awards. Payroll costs directly related to a federal award are allowable costs, provided they are reasonable for the services rendered and are supported. The department has implemented the following procedures to ensure allowable costs are charged to the program. Managers approve monthly timesheets submitted by employees in the state?s payroll system. When managers do not approve by a specified date, the payroll system will automatically approve the timesheet, shown with the words ?system approval.? In such cases, managers are to document their approval with signatures on paper timesheets. Additionally, each employee should have a signed position description, which details the duties of the position and the amount of time to be charged for each duty. We tested a nonstatistical random sample of 25 employees to ensure payroll was appropriately charged to the program. We also tested 7 additional employees with certain payroll months identified as outliers. We verified payroll timesheets were reviewed by a manager and signed position descriptions were retained per state guidelines, and identified the following exceptions: ? Six timesheets did not have evidence of manager approval, and the department could not locate the signed physical timesheets. ? Position descriptions could not be located for two employees. Management verified one of these employees did not work on the Child Care Development Fund program (CCDF), however, a CCDF default labor cost code was entered in the payroll system for this employee. A total of three months? salary was incorrectly charged to the federal program, resulting in $25,679 in known questioned costs and $575,222 in likely questioned costs when projected to the population. The second employee was verified to have 100% of duties assigned to CCDF. ? For eight employees, the position descriptions provided were unsigned and did not include the name of the employee. The department stated that it is best practice for position descriptions to be signed and retained but that it does not always happen. We did not question these costs as department management verified job duties were appropriate to the program. We also tested a nonstatistical random sample of 13 service and supply expenditures. We found one was not entered into the accounting system correctly due to a data keying error. The department subsequently corrected the $14,603 charged to the federal program after we informed them of the error. We recommend department management improve its review of timesheets, ensure position descriptions are completed and retained, and strengthen its review of data entry. We also recommend department management reimburse the federal agency for unallowable costs.

2020-030 Oregon Military Department Strengthen controls to ensure financial reports are accurate and adequately supported by accounting records Federal Awarding Agency: U.S. Department of Defense Assistance Listing Name and Number: National Guard Military Operations and Maintenance Projects (12.401) Federal Award Numbers and Years: W912JV-18-2-1002, 2018; W912JV-19-2-1001, W912JV-19-2-1011, W912JV-19-2-1022, W912JV-19-2-1040, 2019; W912JV-20-2-1001, W912JV-20-2-1007, W912JV-20-2-1010, W912JV-20-2-1021, 2020 Compliance Requirement: Reporting Type of Finding: Material Weakness, Noncompliance Prior Year Finding: 2019-021 Questioned Costs: N/A Criteria: 2 CFR 200.303(a); 2 CFR 200.302(b) The Oregon Military Department (department) is responsible for establishing controls to ensure federal financial reports include all activity of the reporting period, are supported by applicable accounting records, and are fairly presented in accordance with governing requirements. The department has not implemented sufficient controls to ensure amounts reported are supported by accounting records. The Master Cooperative Agreement is separated into appendices that support various program objectives. For example, there are several appendices for operations and maintenance, environmental, and security objectives. The department completes the Request for Advance or Reimbursement (SF-270) reports to obtain reimbursement for federal expenditures. We reviewed a random sample of 32 SF-270 reports for fiscal year 2020 and found the following: ? For 9 reports, the amounts reported for cumulative federal and non-federal expenditures did not agree to the accounting records because the department used a combination of the accounting records and a subsidiary system as the basis for requesting reimbursement and because the department does not separately account for non-federal expenditures by federal fiscal year. Additionally, some expenditures are driven by construction contracts that span several years, resulting in the reconciliation process occurring several years after the grant award begins. Overall, the process results in cumulative federal expenditures being understated on the federal reports and contributes to the department?s cash flow challenges. ? In response to the prior year finding, the department changed its process during December 2019 to rely on the accounting records for reporting amounts rather than the subsidiary system. However, differences were still identified on reports submitted after December 2019. We recommend department management ensure corrections are made in the accounting records as errors are identified and consider implementing the use of additional data fields within the accounting system to promote accurate federal reporting. Finally, we recommend the department separately account for non-federal expenditures by federal award.

2020-031 Oregon Military Department Strengthen controls to ensure expenditures are not obligated beyond the period of performance Federal Awarding Agency: U.S. Department of Defense Assistance Listing Name and Number: National Guard Military Operations and Maintenance Projects (12.401) Federal Award Numbers and Years: W912JV-19-2-1001, 2019 Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $25,682 (known) Criteria: National Guard Regulations 5-1, Chapter 11-2 Federal regulations require that grantees must obligate funds in the federal fiscal year specified in the relevant appendix in order to be reimbursable by federal funds. We judgmentally reviewed payroll expenditures recorded to federal fiscal year 2019 funds in the accounting records that appeared to be obligated after September 30, 2019. Our review of supporting documentation found: ? In three payroll months, payroll for 5 employees was incorrectly coded to the federal fiscal year 2019 grant award and the department could not locate payroll corrections. Total questioned costs in these cases were $25,682. If the underlying accounting records do not properly account for transactions, the department could inappropriately request reimbursement for obligations that are outside the period of performance for the grant. We recommend department management implement control procedures to ensure payroll is coded to the correct federal grant awards and identify and correct all errors noted.

2020-032 Oregon Military Department Strengthen controls to ensure level of federal support for expenditures is adequately documented Federal Awarding Agency: U.S. Department of Defense Assistance Listing Name and Number: National Guard Military Operations and Maintenance Projects (12.401) Federal Award Numbers and Years: W912JV-20-2-1001, 2020 Compliance Requirement: Allowable Costs/Cost Principles; Matching Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $372 (known), $122,465 (likely) Criteria: National Guard Pamphlet 420-10, Chapter 7-2; National Guard Regulations 5-1, Chapter 3 and 11; 2 CFR 200.333 Program guidance indicates that the rate at which authorized Operations and Maintenance costs are federally reimbursed is based on the Facilities Inventory and Support Plan (FISP) agreement support code for the facility(s) generating the costs. For example, if a facility?s FISP agreement support code indicates the facility is authorized for 75% federal support, the generated costs will be federally supported at 75%. Federal regulations also require grantees to retain supporting documentation for audit for up to 6 years and 3 months. Without adequate supporting documentation, expenditures are not able to be determined accurate or allowable for the program. We reviewed a random sample of 40 expenditures and for two transactions related to one vendor the department was unable to provide documentation that detailed additional costs billed above the monthly billing rates per the purchase order with the vendor. This resulted in known questioned costs of $94. We also determined some of the federal match rates used in the two transactions were not correctly calculated for the facilities included. Using the department?s methodology for calculating federal match rates for facilities with multiple match rates depending on federal support of activities in each facility area, we identified known questioned costs of $278 and $122,465 in likely questioned costs when total known costs were projected to the population. Without adequate documentation, the department is unable to support expenditures charged to the federal award. We recommend department management ensure that adequate documentation is retained to support the expenditures and the matching rates charged to the federal award.

2020-033 Oregon Military Department Fully implement subrecipient risk assessments Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Name and Number: Disaster Grants ? Public Assistance (Presidentially Declared) (97.036) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR_OR, 2019; FEMA-4499-DR-OR, 2020; FEMA-4519-DR-OR, 2020 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.331(b) Federal regulations stipulate that pass-through entities evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring. Monitoring activities should be completed based on the results of the subrecipient?s determined risk. During fiscal year 2020, the department developed procedures to assess subrecipient risk of noncompliance with program requirements. These procedures include a risk assessment matrix tool, and a self-assessment risk questionnaire sent to subrecipients at the beginning of each new disaster. Department staff enter questionnaire responses into the risk assessment matrix and calculate the subrecipient?s overall risk score to determine the level of monitoring required. We selected a sample of 12 subrecipients for review. The department had not completed the risk assessment matrix for 10 of the selected subrecipients. Management also noted that the self-assessment risk questionnaires had not been received for a number of the subrecipients in our test sample. The department?s risk assessment procedures are a new process. Management stated that the procedures are still being developed and have not been fully implemented due to staffing issues. Risk assessments help prioritize subrecipients for monitoring and guide the breadth and depth of procedures to be applied. Without this guidance, the department may not provide an adequate level of monitoring, which could lead to an increased risk of noncompliance with program requirements. We recommend department management continue to implement and document its risk assessments process for each subrecipient.

2020-034 Oregon Military Department Improve accuracy of quarterly performance reporting Federal Awarding Agency: U.S. Department of Homeland Security Assistance Listing Name and Number: Disaster Grants ? Public Assistance (Presidentially Declared) (97.036) Federal Award Numbers and Years: FEMA-4258-DR-OR, 2016; FEMA-4296-DR-OR, 2017; FEMA-4328-DR-OR, 2017; FEMA-4432-DR-OR, 2019; FEMA-4452-DR_OR, 2019; FEMA-4499-DR-OR, 2020; FEMA-4519-DR-OR, 2020 Compliance Requirement: Reporting Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.328(b)(1) Federal regulations require pass-through entities to establish and maintain effective internal control that provides reasonable assurance the award is managed in compliance with regulations and terms and conditions of the award. Effective controls ensure submitted reports are both accurate and complete. The Disaster Grants ? Public Assistance award requires the department to submit quarterly performance reports. The department is responsible for completing a number of fields within the report with applicable financial information, including applicant expenditures to date, total grantee drawdown, and federal funds disbursed by disaster and subgrantee. The department?s existing controls are not effective to ensure the reports are complete and accurate prior to submission to the federal awarding agency. We reviewed two of the four performance reports submitted during fiscal year 2020, and found inaccurate information was reported in two reports. For example, we reviewed eight projects included on the report submitted for the quarter ending June 30, 2020. Selected projects comprised 46% of the reported total applicant expenditures to date field. Errors were identified in five of the eight reviewed projects. Specifically, we found: ? A $270,000 overstatement caused by a transposition error. ? Two instances where the department could not fully support the expenditures reported in the applicant expenditures to date field, resulting in a potential overstatement of $1.7 million. ? Expenditures totaling $1.6 million that were not included in the applicant expenditures to date field. Similar errors in the same projects were noted on the performance report for the quarter ending September 30, 2019. Management stated that previous staff, with reporting responsibilities, did not always prepare accurate reports. However, management?s review of the reports did not identify the errors. We recommend department management improve existing controls to ensure quarterly performance reports are complete and accurate prior to report submission.

2020-035 Oregon Employment Department The department should ensure identity verifications occur to reduce improper payments Federal Awarding Agency: U.S. Department of Labor Assistance Listing Name and Number: Unemployment Insurance (17.225) Federal Award Numbers and Years: UI-34080-20-55-A-41, 2020; UI-34737-20-55-A-41, 2020 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $198,913 (known), $65,756 (likely) Criteria: 2 CFR 200.53; 20 CFR 604.1 The Oregon Employment Department (department) is responsible for establishing internal controls to ensure that benefits are only paid to eligible individuals. To ensure that claimants filing for regular unemployment insurance (UI) are not deceased at claim inception, the department verifies their identity through the federal Unemployment Insurance Interstate Connection Network (ICON) system in real-time. This verification compares the claimant?s social security number (SSN), name, and date of birth with Social Security Administration records. At the beginning of the pandemic this site experienced processing delays due to increased claim activity that were not resolved until April 2020. At this time the department continued real-time verification of identity for regular UI claims, and staff worked on the backlog of identity verifications from the period where the ICON system was delayed. Their review of the backlog was completed in October 2020. The Coronavirus Aid, Relief, and Economic Security (CARES) Act established the Pandemic Unemployment Assistance program (PUA), a program focusing on individuals who typically do not qualify for UI benefits. Due to programming constraints, the department did not begin to verify identities of PUA claimants through ICON until December 2020. When the programming was updated, all PUA claimants were batch processed for identity verification through ICON. To assist in mitigating PUA claim risks, the department implemented the ID Verification module of the National Association of State Workforce Agency?s Integrity Data Hub and began processing PUA and regular claims in July 2020. For those claimants where an issue occurred, benefit weeks had been paid until the department put a stop flag on the claim. The programming provided for daily batch verifications for new claimants, and any issue identified resulted in no claim payments until the issue was resolved. Due to the significant increase in benefit claims as a result of the onset of the COVID-19 pandemic and implementation of the CARES Act, we partnered with the United States Treasury (UST) to cross-match individuals who had attempted to claim unemployment benefits during the fiscal year with individuals who were reported as deceased in at least one of the five death databases available to the UST. The UST identified 502 unique matches. The UST also analyzed the Oregon data for quality in key information fields (e.g. SSN, name, date of birth etc.), and identified 626 individuals where key information appeared erroneous or incomplete. We provided the deceased matches and data quality errors to the department for review and determination of improper payments. Based on responses provided by the department, we judgmentally selected claimants to review to determine whether the department?s determination and improper payment amounts, if any, appeared reasonable. We reviewed all of the deceased matches where the department identified improper payments and confirmed the following: ? 10 claimants with known improper payments totaling $93,869, with $55,655 being funded as part of the PUA and Federal Pandemic Unemployment Compensation (FPUC) programs; and ? 11 claimants with potential improper payments totaling $44,322, with $26,400 being funded by the FPUC program. We also reviewed all of the data quality errors where the department identified improper payments and confirmed the following: ? 30 claimants with known improper payments totaling $105,044, with $96,157 being funded by the PUA and FPUC programs; and ? 1 claimant with potential improper payments totaling $21,434 all funded by the PUA and FPUC programs. We recommend department management complete the review of claims where identity verification has not been resolved, and establish overpayment recoveries for all known improper payments.

2020-036 Oregon Commission for the Blind Implement controls to ensure the accuracy of federal financial reporting Federal Awarding Agency: U.S. Department of Education Assistance Listing Name and Number: Rehabilitation Services ? Vocational Rehabilitation Grants to States (84.126) Federal Award Numbers and Years: H126A180055, 2018; H126A190055, 2019; H126A200055, 2020 Compliance Requirement: Reporting Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2017-031 Questioned Costs: N/A Criteria: 2 CFR 200.303(a) Federal regulations require financial reports include all activity of the reporting period and be supported by applicable accounting records. The commission did not have an effective review in place during the year to ensure these reports are accurate and supported by accounting records. As a result, we identified errors on the Federal Financial Report (SF-425) and the Annual Vocational Rehabilitation Program/Cost Report (RSA-2). Four SF-425 reports were submitted covering federal awards that were active during fiscal year 2020. We tested three reports and identified the following errors: ? The base indirect payroll reported on Line 11d for each of the three reports tested did not include all Pre-Employment Transition Services payroll expenditures. This error also resulted in errors on Lines 11e and 11f as these are based in part on Line 11d. ? The incorrect indirect cost rate was reported on Line 11b.1 for the grant phase 19, quarter ending March 31, 2019 report. This error also resulted in errors on Lines 11e and 11f as these are based in part on Line 11b. We tested the annual RSA-2 report submitted for 2019 and identified the following errors: ? Amounts reported on Schedule II, Line 1.c and 1.d were incorrectly reported resulting in an overstatement of Line 1.c and understatement of Line 1.d by $36,398. ? The amount reported on Schedule III, Line 15 was $50,000 less than the supporting accounting record. ? An amount of $1,040 was incorrectly reported in Schedule III resulting in an overstatement of Line 21 and understatement of Line 18 by that amount. Data collected through the SF-425 and RSA-2 reports is used by the federal government to evaluate and monitor the financial and programmatic performance of the Vocational Rehabilitation program. As such, it is important that the data be accurately collected and reported. We recommend commission management implement an effective review of its federal financial reports prior to filing. This will ensure reports contain accurate information, are supported by accounting records, and follow federal reporting guidelines. We also recommend that the final versions of the erroneous reports be corrected and resubmitted.

2020-037 Oregon Commission for the Blind Improve documentation of management review of program costs Federal Awarding Agency: U.S. Department of Education Assistance Listing Name and Number: Rehabilitation Services ? Vocational Rehabilitation Grants to States (84.126) Federal Award Numbers and Years: H126A180055, 2018; H126A190055, 2019; H126A200055, 2020 Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.430, 200.303 Commission management is responsible for maintaining adequate internal controls over the approval of expenditures of federal awards. Proper segregation of responsibilities is a necessary element of effective controls. During testing of internal controls over allowable costs and allowable activities we found the following: ? We randomly selected a statistical sample of 11 timesheets. One employee timesheet was not signed as approved by management. ? We randomly selected a statistical sample of 10 program expenditure transactions. One transaction, a request for reimbursement of program expenditures, was approved by the same person requesting the reimbursement with no indication of approval by separate staff. The issues appeared to be caused when established controls for review, approval, and documentation were not followed. Lack of documented approval or segregation of responsibilities could lead to unallowable costs or activities charged to the program or misappropriation of federal funds. We recommend commission management provide staff with additional training and develop procedures for timesheet and expenditure review and retain electronic copies of any paper documentation to support the review or revision of the timesheets.

2020-038 Department of Human Services Strengthen controls over program expenditures Federal Awarding Agency: U.S. Department of Education Assistance Listing Name and Number: Rehabilitation Services ? Vocational Rehabilitation Grants to States (84.126) Federal Award Numbers and Years: H126A180054, 2018; H126A190054, 2019; H126A200054, 2020 Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs: N/A Criteria: 34 CFR 361.50(e) The state is required to establish policies related to the timely authorization of services. All recorded transactions should be supported by copies of source documents and other supporting information and provide clear evidence that the transaction was properly authorized. We reviewed a statistical sample of 56 client and nonclient program expenditures to ensure they were properly documented and approved and noted the following: ? A contract payment for $115,587.67 for Youth Transition Program services was approved by contract payment staff. The approval exceeded the individual?s $50,000 signature authority. ? A $1,500 payment was made for client job placement services. The department provided copies of the vendor invoice, a completed authorization for purchase, and the client individualized plan for employment, which included the service billed. However, none of the documents were signed as approved, and signed copies could not be provided. Controls at the department were not followed to prevent or detect the errors noted. Unallowable costs or activities could be charged to the program if transactions are not reviewed by staff with appropriate authority, or the review is not documented. We recommend department management review policies and procedures surrounding documentation and approval of transactions, and provide additional staff training on processes involved, including verification of signature authority during the invoice review process.

2020-039 Oregon Business Development Department Document review of the annual performance and evaluation reports Federal Awarding Agency: U.S. Department of Housing and Urban Development Assistance Listing Name and Number: Community Development Block Grant (CDBG) (14.228) Federal Award Numbers and Years: B-10-DC-41-0001, 2010; B-11-DC-41-0001, 2011; B-12-DC-41-0001, 2012; B-13-DC-41-0001, 2013; B-14-DC-41-0001, 2014; B-15-DC-41-0001, 2015; B-16-DC-41-0001, 2016; B-17-DC-41-0001, 2017; B-18-DC-41-0001, 2018; B-19-DC-41-0001, 2019 Compliance Requirement: Reporting Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs N/A Criteria: 2 CFR 200.303(a) Federal regulations require management to establish and maintain effective internal controls over federal awards and financial reporting to ensure compliance with statutes, regulations, and the terms and conditions of the federal award. The department does not have documented policies or procedures to ensure the annual Performance and Evaluation Report is reviewed prior to submission and to ensure that evidence of the review is maintained. Department management has not required this review to be formalized or documented. As a result, we were not able to verify whether reports were reviewed prior to being submitted to the federal government. A lack of documented policies and procedures and inadequate review could result in incomplete and inaccurate reports being submitted to the federal government. As part of our review of compliance with the Reporting requirement, we selected a statistically valid sample of the submitted reports. Of the eleven reports submitted for grant year 2019, we reviewed four and identified immaterial errors and inaccuracies throughout the reports. We recommend department management document review procedures that are sufficient to ensure accurate reports are submitted. We also recommend department management maintain evidence of reviews performed.

2020-040 Oregon Department of Fish and Wildlife Implement Monitoring and Maintenance of Real Property Federal Awarding Agency: U.S. Department of the Interior Assistance Listing Name and Number: Fish and Wildlife Cluster (15.605, 15.611), Non-Major Program Federal Award Numbers and Year: Various, Multiple Years Compliance Requirement: Equipment and Real Property Management Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2017-033 Questioned Costs: N/A Criteria: 50 CFR 80.90(f) The Oregon Department of Fish and Wildlife (department) has not fully implemented procedures to ensure compliance with federal requirements over real property management. Federal regulations require the state to maintain control of all assets acquired with the Fish and Wildlife Cluster program grants to ensure that throughout their useful life they serve the purpose for which they were acquired. In fiscal year 2017, the department partially resolved a 2008 finding from the Office of Inspector General (OIG) to reconcile real property records with those of the U.S. Fish and Wildlife Service. In addition to reconciling records, the OIG finding recommended the department implement procedures ?to ensure supervisors are aware of lands under their supervision and are monitoring lands for compliance with Program requirements.? In fiscal year 2019, the department issued a real property management policy covering grant funded properties, and hired a real property manager. However, as of June 30, 2020, the department has not taken sufficient action to resolve the 2008 finding by developing or implementing procedures to ensure: ? supervisors are informed of the lands acquired with Fish and Wildlife Cluster program grants that are under their supervision; and, ? lands are monitored and maintained for compliance with federal requirements. Additionally, the department began the process of acquiring real estate management software to more effectively track the acquisition, maintenance, and disposition of real estate for which the department is responsible. Without monitoring procedures and tracking mechanisms, the department risks losing assets under their supervision. This finding was previously reported as 2017-033 in the Statewide Single Audit Report (no. 2018-11). We recommend department management finalize and implement procedures to ensure compliance with real property federal requirements. We also recommend the department complete the acquisition and implementation of real estate management software.

2019-008 Department of Human Services Improve Accuracy of Performance Data Reports Federal Awarding Agency: U.S. Department of Health and Human Services Program Title and CFDA Number: Temporary Assistance for Needy Families (TANF) (93.558) Federal Award Numbers and Years: 2018G996115; 2018, 2019G996115; 2019 Compliance Requirement: Reporting Type of Finding: Material Weakness, Material Noncompliance Prior Year Finding: 2018-008, 2015-025, 2014-026, 2013-032, 2010-015 Questioned Costs: N/A Criteria: 45 CFR 265.3(a); 45 CFR 265.7(f) Federal regulations require the department to collect monthly, and report quarterly in the ACF 199 TANF data report certain non-financial data elements for services paid with TANF federal funding. Federal regulations also require the department to report data quarterly in the ACF 209 SSP-MOE data report, for TANF eligible clients whose benefits are paid with designated state funds called separate state program maintenance of effort. Both data reports should be supported by applicable performance records. Prior to selecting sample items for testing the ACF-199 data reports, we reviewed fiscal year 2019 client expenditure data as it related to the data reports. The dataset provided for client expenditures included some coding elements from the department?s case management system, but not all elements necessary to determine the funding source for individual client payments. As the reports are intended to provide information on client services based on their funding, we were unable to confirm if all cases paid with TANF federal funds were included appropriately in the ACF-199 reports. We found, on average, that up to 2,200 cases each month may have been improperly excluded from the ACF-199 reports. We also found, on average, that 180 cases each month reported in the ACF-199 reports may have been improperly included because they did not have corresponding federal TANF expenditures. For data submitted in the fiscal year 2019 ACF 199 reports, we reviewed report line items identified as ?key? by the U.S. Department of Health and Human Services. We reviewed a random sample of 50 cases and identified the following known errors: ? Six cases where clients were incorrectly counted as exempt from the federal time limit; ? One case where the client?s classification as parent with minor child in the family was incorrect; ? One case where the work eligible indicator was incorrect; ? Three cases where work participation status was inaccurate; and ? Two cases where activities other than work participation were inaccurately reported. We also reviewed a random sample of 25 cases for data submitted in the ACF 209 quarterly reports and identified the following: ? One case where the type of family for work participation was inaccurate; ? Five cases where receipt of subsidized child care was incorrect; ? Two cases where relationship to head of household was incorrect; ? Two cases where the work eligible indicator was incorrect; and ? One case where work participation status was inaccurate. In performing other testing procedures where a sample of 38 cases was selected from the ACF-199 reports, we found one case that should not have been included in the report as it did not receive TANF payments during the report period. According to the department, these errors were due to worker errors when entering information in the case management system. The department reviews the report data for formatting, but not accuracy. As the department is planning to implement a new eligibility system, they have suspended effort to address the data reporting errors in the current system. This finding has been ongoing since fiscal year 2010. We recommend department management provide additional coding elements related to expenditure data to allow for identification of federal expenditures within the dataset, and implement processes and procedures to ensure data reports accurately reflect case status and activity of the reporting period.

2019-009 Department of Human Services Improve Compliance with Work Verification Plan Requirements Federal Awarding Agency: U.S. Department of Health and Human Services Program Title and CFDA Number: Temporary Assistance for Needy Families (TANF) (93.558) Federal Award Numbers and Years: 2018G996115; 2018, 2019G996115; 2019 Compliance Requirement: Special Tests and Provisions Type of Finding: Material Weakness, Material Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 45 CFR 261.61; 45 CFR 261.62 Federal regulations require each state to maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Each state must have procedures to count and verify reported hours of work and must comply with its Work Verification Plan as approved by the Department of Health and Human Services (DHHS). Oregon?s Work Verification Plan states employment attendance will be documented and verified in one of four ways: pay stubs, time cards, sign-in sheets or other specific attendance records, or by documenting a phone conversation with the employer. If a client has stable employment, the department may use a six-month projection of actual hours. However, if the department receives information that actual hours have changed, the department is required to re-verify the current average and update the projection as needed. We randomly selected 40 participating clients and reviewed case file documentation for verification of work activity participation for one month during the fiscal year. We found 16 cases where the department did not adhere to the approved Work Verification Plan policies and procedures for maintaining documentation of hours of participation, appropriately projecting hours of participation, and accurately reporting hours of participation in their automated data processing system. These inaccurate or unverified hours were used in calculating the work participation rate reported to DHHS. If the state fails to follow the approved Work Verification Plan, DHHS may penalize the state. We recommend department management strengthen controls to ensure adherence to the department?s work verification plan documentation of participation and projection of hours of participation, and to ensure data entered into the automated data processing system is accurate and complete.

2019-010 Department of Human Services Ensure Appropriate Information is Used for Determining Benefit Amounts Federal Awarding Agency: U.S. Department of Health and Human Services Program Title and CFDA Number: Temporary Assistance for Needy Families (TANF) (93.558) Federal Award Numbers and Years: 2018G996115; 2018, 2019G996115; 2019 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $412 (known); $577,056 (likely) Criteria: 45 CFR 263.11(a)(1); 45 CFR 261.14 Federal regulations allow the use of federal TANF funds for expenditures that are reasonably calculated to accomplish the purposes of the program. In Oregon, the calculation of TANF benefits is based on multiple factors, one of which is the number of qualifying household members. Benefit amounts may also be pro-rated based upon when activities impacting the amount occur within the benefit month. We reviewed a sample of 50 client payments to verify the benefit amount was determined appropriately and identified the following errors: ? One case where duplicate benefits were issued due to caseworker error when entering the date the case was re-opened; and ? One case where the amount of benefits issued included an ineligible family member, as the caseworker did not update the household size when one member turned 18 years old. These two errors resulted in an overpayment of federal funds of $128, with likely questioned costs of $577,056 when projected to the population. Additionally, while performing other testing procedures related to benefit reductions due to noncooperation, we identified two cases where benefits were restored or supplemented with incorrect amounts after the benefit reduction. Restoring or supplementing benefits is allowable if a client begins cooperating, however, the benefits were reissued at incorrect amounts as the caseworker issued the benefits for the entire month rather than the time remaining after clients began cooperating. For these two clients, we identified known federal overpayments of $284. We recommend department management strengthen controls to ensure clients benefit payments are appropriately determined.

2019-011 Department of Human Services Maintain Documentation to Support Client Eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Program Title and CFDA Number: Temporary Assistance for Needy Families (TANF) (93.558) Federal Award Numbers and Years: 2018G996115; 2018, 2019G996115; 2019 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs: N/A Criteria: 42 USC 608(a)(3); 42 USC 602(a)(1)(A); 42 USC 602(a)(1)(B)(iii); To comply with federal regulations for eligibility determination, the department?s Family Services Manual requires each TANF client to complete and sign an application at the initial application and at eligibility re-determination. Completing the application form is key in determining a client?s TANF eligibility. By signing the application, the client assigns rights to support received to the department, as required for eligibility by federal regulations, and agrees to actively pursue any asset for which they have a legal right or claim. The client also accepts responsibility for participating in employment activities for program eligibility. Of 50 clients randomly selected for testing, the department was unable to readily provide documentation as follows: ? Two client files were missing signed applications; ? Three client files were missing evidence of pursuit of child support assets; and ? Four client files were missing evidence of employability screenings. Although we were able to verify other eligibility criteria were met through review of clients? case files, we were not able to verify all eligibility documentation. By not maintaining adequate documentation, the department may not be able to demonstrate compliance with all eligibility requirements. We recommend department management coordinate resources to better maintain and more readily provide sufficient eligibility documentation.

2019-012 Department of Human Services/Oregon Health Authority Strengthen Controls over Cost Allocation Process Federal Awarding Agency: U.S. Department of Health and Human Services Program Title and CFDA Number: Temporary Assistance for Needy Families (TANF) (93.558) Medicaid Cluster (93.777, 93.778) Adoption Assistance ? Title IV-E (93.659) Immunization Cooperative Agreements (93.268) Opioid STR (93.788) Federal Award Numbers and Year: Various Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2018-021 Questioned Costs: TANF $1,824,260 (known), Medicaid $36,234 (known) Criteria: 2 CFR 200.62; 2 CFR 200.400; 45 CFR 95.509(a)(b) Federal regulations require state agencies to submit Public Assistance Cost Allocation Plans (plans) to the federal oversight agency for approval. Changes to federally approved plans are allowed but require state agencies to notify the federal oversight agency when changes affect the allocation of costs. At a minimum, state agencies are required to submit an annual statement certifying that the plan is not outdated. The Department of Human Services (department) administers separate plans for the department and Oregon Health Authority (authority). The plans outline the methods used to allocate various cost pools to federal programs. The department submits biennial plans to the federal oversight agency for approval with interim updates submitted prior to the start of the second year of each biennium. During our testing we noted the following instances where the department did not allocate costs according to the approved plans: ? One allocation method used during the AY19 biennium was not approved by the federal oversight agency. The method was initially included in the AY19 plan submission; however, during the approval process the federal oversight agency determined the method was inappropriate. This method was subsequently excluded from the final approved AY19 plan but continued to be used in the department?s cost allocation process. The continued use of this method resulted in the under claiming of federal funds across the department?s various programs. ? Statistics for a metrics based allocation method were incorrectly calculated for the AY19 biennium until identified in April 2019 as part of our audit procedures. This resulted in a small over or under claiming of various federal and state programs. ? The wrong penetration rates were used in the formulas for three activity codes when calculating the random moment sampling statistics. This resulted in the over-claiming of Medicaid by $36,234 over a 23-month period and TANF by $1,824,260 over a 15-month period. SNAP and other federal and state programs were under-claimed by $1,425,334 over a 15-month period. ? Formulas for ten activity codes used in the calculation of the random moment sampling statistics did not agree to the approved plan. However, no impact to federal funds is noted as the formulas used in the cost allocation process appeared appropriate. We recommend department and authority management ensure the cost allocations are processed according to the federally approved cost allocation plans.

2019-013 Oregon Health Authority Improve Controls for Monitoring MMIS Claims Edits and Audits Federal Awarding Agency: U.S. Department of Health and Human Services Program Title and CFDA Number: Medicaid Cluster (93.777, 93.778) Federal Award Numbers and Years: 1805OR5MAP and 1805OR5ADM; 2018, 1905OR5MAP and 1905OR5ADM; 2019 Compliance Requirement: Activities Allowed or Unallowed; Special Tests and Provisions Type of Finding: Material Weakness Prior Year Finding: 2018-013 Questioned Costs: N/A Criteria: 42 CFR 447.45 In the prior year, we reported that the Oregon Health Authority (authority) did not adequately monitor aspects of the Medicaid Management Information System (MMIS) claims edits and audits; see Audit Report 2019-14, finding 2018-013. The authority used MMIS to process almost $7.9 billion in paid claims during fiscal year 2019, and relies on the system?s numerous claims edits and audits function to provide assurance that payments are appropriate and to prevent and detect potential inappropriate payments. For fiscal year 2019, we determined the authority had taken some corrective action such as compiling a comprehensive inventory of MMIS claims edits and establishing agreement with the system contractor to begin testing the top 20 percent of the edits to verify they are active and functioning correctly. However, as of June 30, 2019, we noted the following: ? Management had not appropriately limited the number of employees that had the ability to modify the claims edits and audits and did not have a process to monitor for unauthorized changes; ? The contractor had tested only 11 of the 116 edits identified for testing; and ? Management had not completed a testing plan or actual testing of the remaining 80 percent of the claims edits and audits. Having a strategic framework and thorough understanding of these controls, including what they do and when they trigger, is critical for ensuring accurate and properly recorded payments. If the claims edits and audits are not configured and functioning correctly, there is the potential for millions of dollars of inappropriate payments. We recommend authority management implement procedures to monitor user access and potential unauthorized changes to the application, as well as continue to implement processes to verify the effectiveness and completeness of the claims edits and audits function.

2019-014 Oregon Health Authority Ensure MMIS Data Tables are Accurate and Updated Timely Federal Awarding Agency: U.S. Department of Health and Human Services Program Title and CFDA Number: Medicaid Cluster (93.777, 93.778) Federal Award Numbers and Year: 1805OR5MAP and 1805OR5ADM; 2018, 1905OR5MAP and 1905OR5ADM; 2019 Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Type of Finding: Material Weakness Prior Year Finding: N/A Questioned Costs: Unknown Criteria: 42 CFR 433.32; 42 CFR 447.45(f)(1)(iv) The Oregon Health Authority (authority) administers client based payments for the Medicaid program. For some clients, Medicaid allows the authority to make payments to providers for a specific fee-for-service (FFS). During fiscal year 2019, FFS payments totaled approximately $1.67 billion. The FFS payments are calculated based upon factors such as the type of procedure, location of the facility, and other factors determined by the federal Centers for Medicaid Services (CMS). The authority uses the Medicaid Management Information System (MMIS) to make the calculation and process the payments. CMS generally updates their factors each year, and the authority similarly updates the tables in MMIS used to make the calculations. During our testing, we identified that data in one of the tables did not agree to the rates established by CMS. As a result, the authority paid incorrect amounts to providers for three sample items that were FFS transactions. In addition, staff informed us of other data elements in MMIS related to FFS that were incorrect. According to management, CMS provided updated data elements on November 21, 2018, that were uploaded into MMIS. CMS subsequently issued corrected and updated tables on December 28, 2018, that were not identified by authority staff or uploaded into MMIS. As of March 2, 2020, management is not able to provide an estimate of the magnitude of the issue. Due to the systemic nature of the issue, we are unable to reasonably estimate or quantify potential questioned costs. According to management, they are in the process of performing procedures to identify the total effect and implementing a batch-entry solution to correct the data in MMIS. We recommend authority management continue their analysis and correct all incorrect provider payments. We also recommend authority management ensure tables are updated timely and accurately when CMS provides updates.

2019-015 Oregon Health Authority Improve Documentation for Provider Eligibility Federal Awarding Agency: U.S. Department of Health and Human Services Program Title and CFDA Number: Medicaid Cluster (93.777, 93.778) Federal Award Numbers and Year: 1805OR5MAP and 1805OR5ADM; 2018 1905OR5MAP and 1905OR5ADM; 2019 Compliance Requirement: Special Tests and Provisions Type of Finding: Significant Deficiency Prior Year Finding: 2018-016; 2017-015; 2016-025, 2015-020, 2014-023, 2014-019, 2013-041, 2012-030 Questioned Costs: N/A Criteria: 42 CFR 455.436; Oregon Administrative Rules (OAR 411-031-0040) Provider eligibility requirements for the Medicaid program differ depending upon the type of services provided; however, all providers are subject to specified database checks and are required to sign an adherence to federal regulations agreement (agreement). Additionally federal regulations require that the Oregon Health Authority (authority) determine eligibility for Medicaid providers and periodically revalidate providers by performing database checks to ensure providers are still eligible to participate in the Medicaid program. We tested 30 authority providers receiving Medicaid funds during fiscal year 2019 and found the authority could improve the documentation supporting provider eligibility. Specifically, we found: ? For one provider, the authority was unable to locate the Provider Enrollment Agreement (PEA). We notified the authority of this issue and the authority was able to obtain a new completed PEA. ? For a different provider, the authority did not complete the required revalidation database checks within the required timeframe. After we identified the specific item, the authority completed the necessary database checks. The above issues occurred due to incomplete record maintenance and staff error. Failure to perform the necessary background checks and retain provider enrollment agreements increases the risk of payments to inappropriate vendors. We recommend authority management strengthen controls to ensure documentation supporting a provider?s eligibility determination is retained.

2019-016 Department of Human Services/Oregon Health Authority Improve Documentation and Controls for Client Eligibility Determinations Federal Awarding Agency: U.S. Department of Health and Human Services Program Title and CFDA Number: Medicaid Cluster (93.777, 93.778) Federal Award Numbers and Year: 1805OR5MAP and 1805OR5ADM; 2018, 1905OR5MAP and 1905OR5ADM; 2019 Compliance Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: 2018-015, 2018-014, 2017-014, 2016-024, 2015-016, 2014-018, 2013-038, 2012-033, 2011-015, 2010-012 Questioned Costs: $48,472 (known) Criteria: 42 CFR 435.916(a); 42 CFR 435.916(b); 42 CFR 435.916(d); 42 CFR 447.56(e)(1); 42 CFR 433.138; 42 CFR 433.32 Federal regulations require certain conditions be met for the Department of Human Services (department) and Oregon Health Authority (authority) to receive Medicaid funding for medical claims. The requirements include obtaining signed applications, redetermining client eligibility for the program every 12 months or when the agency receives information regarding a change in the client?s circumstances that may affect their eligibility, properly enrolling eligible clients in the Medicare program, and providing assurance that payments are calculated correctly. In addition, the department and the authority are required to maintain sufficient documentation supporting the client?s eligibility and individual claims. We randomly selected 100 clients and one Medicaid service payment associated with each client. We reviewed agency documentation to verify matching, eligibility, and allowability of Medicaid service. For 12 clients, we found the issues described below. ? Three clients where income was not appropriately verified against the Federal hub. The errors related to a prior year finding and occurred prior to the authority taking corrective action. ? Five clients did not have their eligibility verified within 12 months in accordance with federal requirements. ? Two clients were not appropriately enrolled in the Medicare program, resulting in questioned costs of $47,503. ? One client did not have a signed application on file. ? For one client, the required client co-payment was not applied prior to making payment to a nursing facility for one month, resulting in questioned costs of $627. ? One client received homecare services from December 2018 to July 2019. In July 2019, a Final Order, a legal ruling, was issued to retroactively disallow a portion of the hours paid during that time totaling $342. The department has yet to recover the funds from the provider. The above issues occurred due to input errors, oversight errors, and other administrative errors by various caseworkers. We recommend department and authority management strengthen controls to perform timely eligibility redeterminations and verification of client income and ensure eligible clients are appropriately enrolled in both Medicare and Medicaid. Additionally, we recommend management provide periodic training to caseworkers to reduce the risk of administrative errors. We also recommend management correct all identified issues and reimburse the federal agency for unallowable costs.

2019-017 Department of Human Services Complete System Modifications to Ensure Proper Reporting of Program Expenditures Federal Awarding Agency: U.S. Department of Health and Human Services Program Title and CFDA Number: Foster Care ? Title IV-E (93.658), Non-Major Program Medicaid Cluster (93.777, 93.778) Federal Award Numbers and Year: 1801ORFOST, 2018; 1901ORFOST, 2019; 1805OR5MAP, 2018; 1805OR5ADM, 2018; 1905OR5MAP, 2019; 1905OR5ADM, 2019 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Noncompliance Prior Year Finding: 2018-018, 2017-013, 2016-018, 2015-007, 2013-023, 2012-024 Questioned Costs: Foster Care $50,811 (known), Medicaid $10,577 (known) Criteria: 45 CFR 1356.21 The department uses its child welfare information system, OR-Kids, to manage placements, eligibility, payments, and other case information. Information systems should be designed to ensure information processed by the system is complete, accurate, and valid. As with any significant program or system, management should have an adequate understanding of the processes and controls it is relying on, and should obtain assurance those processes and controls are functioning as intended. While performing current year follow-up procedures related to prior year findings that identified processing issues within OR-Kids, we found errors continue to occur when various types of corrections are made to placement information in the system. When placement corrections are initiated, OR-Kids issues a ?new? payment, and simultaneously recovers the funds from the payment issued at the time of original services, which generally results in no payment to the provider. However, this process does not always occur as it should, and results in the department incorrectly reporting and drawing federal funds. For some placement corrections, OR-Kids processed the recovery of the funds in a state grant instead of the federal program, resulting in estimated inappropriate federal expenditures in fiscal year 2019 of $50,811 for Title IV-E Foster Care, and $10,577 for Medicaid. This issue was originally identified in fiscal year 2015. During fiscal year 2019 the department developed a partial fix to the OR-Kids system to prevent these processing errors from occurring. The agency has also repaid estimated questioned costs identified in the prior year audits; however, the actual questioned costs to be repaid have not been identified. Reports that can be used to identify actual amounts to be repaid are in development. We recommend department management review OR-Kids transaction processing and complete system modifications as appropriate to ensure proper financial reporting of program expenditures. We also recommend department management review prior year and current year transactions and reimburse the federal agency for grant expenditures claimed inappropriately.

2019-018 Department of Human Services Strengthen Controls to Ensure the Accuracy and Completeness of ?Applicable Child? Data Federal Awarding Agency: U.S. Department of Health and Human Services Program Title and CFDA Number: Adoption Assistance ? Title IV-E (93.659) Federal Award Numbers and Years: 1901ORADPT, 2019; 1801ORADPT, 2018 Compliance Requirement: Level of Effort Type of Finding: Significant Deficiency Prior Year Finding: 2016-030, 2015-014, 2014-017 Questioned Costs: N/A Criteria: 42 USC 673(a)(8)(A) Since fiscal year 2010, states are required to have two sets of program eligibility criteria for Title IV-E Adoption Assistance. One set of criteria applies to a child who is considered an ?applicable child? due to the child?s age, length of time in care, or because they are a sibling of an applicable child. The second set of criteria is for a child who is considered ?not an applicable child? and must meet the eligibility requirements in place before 2010. In addition, states are required to estimate any savings in state expenditures as a result of applying the additional applicable child eligibility rules and spend an amount equal to the savings to provide other program related services. The Department of Human Services (department) relies on reports from the child welfare system, OR-Kids, to calculate cost savings related to children determined eligible under the applicable child criteria. During fiscal year 2019 we noted the following issues related to the department?s identification and tracking of applicable children: ? In response to a prior year audit finding, in February 2019 the department updated the OR-Kids eligibility screen to provide additional detail for each child?s eligibility determination. However, the department identified in February 2020 this update caused eligibility determinations to change to pending status when children were moved from the pre-adoptive to adoptive case file, and resulted in any new applicable children not being counted on the report used to calculate cost savings. The update also resulted in all Adoption Assistance subsidy payments related to eligibility determinations made after the update to be paid from state funds rather than split between federal and state. ? Our testing of 60 samples for eligibility identified three instances where a caseworker determined the child met the ?not an applicable child? eligibility criteria; however, eligibility in OR-Kids was manually entered incorrectly as ?applicable child.? Payments related to these cases were then included in the savings calculation. The OR-Kids system and manual errors resulted in the inaccurate identification of applicable child case data. Without complete and accurate data, the department is not able to correctly calculate the related savings of state expenditures. We recommend department management continue to correct known applicable child eligibility data issues in OR-Kids to ensure data used to estimate the savings in state expenditures is complete and accurate.

2019-019 Oregon Health Authority Comply with Subrecipient Monitoring Requirements Federal Awarding Agency: U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration Program Title and CFDA Number: Opioid STR (CFDA 93.788) Federal Award Numbers and Years: TI080258; 2018 & 2019, H79TI080258; 2019, H79TI081716; 2019 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 45 CFR 75.352(b); 45 CFR 75.352(d) Federal regulations require that pass-through entities evaluate each subrecipient?s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining appropriate subrecipient monitoring activities. Monitoring activities should be completed based on the results of the subrecipient?s determined risk. The authority does not have a formal process for performing risk assessments to determine appropriate monitoring activities. Moreover, the authority has not developed a formal process to ensure subrecipients comply with federal regulations, terms and conditions of the subaward, and that subaward performance goals are achieved. Although program staff maintain a close working relationship with subrecipients, these interactions are not formalized and documented for the purpose of subrecipient monitoring. Authority management stated they were unaware of the federal requirement to have formal standardized documentation of subrecipient monitoring. If subrecipient monitoring is not performed and documented, subawards could be used for unauthorized purposes and performance goals not met. We recommend authority management comply with subrecipient monitoring requirements, develop and implement internal controls to ensure risk assessments are performed and documented for each subrecipient, and monitoring activities are completed and documented in conformance with risk assessment results.

2019-020 Oregon Health Authority Improve Controls over Federal Performance Reporting Federal Awarding Agency: U.S. Department of Health and Human Services, Substance Abuse and Mental Health Services Administration Program Title and CFDA Number: Opioid STR (CFDA 93.788) Federal Award Numbers and Years: TI080258; 2018 & 2019, H79TI080258; 2019, H79TI081716; 2019 Compliance Requirement: Reporting Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs: N/A Criteria: 45 CFR 75.342(b); Opioid STR Notice of Awards The Opioid STR grant requires performance progress reports to be submitted semi-annually and include an overview of the goals and objectives accomplished during the funding period as stated in the authority?s original grant application. In addition, federal regulations require award grantees to establish and maintain effective internal control that provides reasonable assurance the award is managed in compliance with regulations and terms and conditions of the award. Effective controls may include review and approval of reports for completeness and accuracy. The authority has consistently submitted performance progress reports; however, it has not implemented internal controls to ensure that performance reports are complete and accurate prior to submission to the federal awarding agency. Authority management stated they were unaware of this federal requirement. This absence of controls could result in a misrepresentation of the grant?s performance. We recommend authority management develop and implement controls to ensure performance progress reports are complete and accurate prior to report submission.

2019-021 Oregon Military Department Strengthen Controls to Ensure Financial Reports are Accurate and Adequately Supported by Accounting Records Federal Awarding Agency: U.S. Department of Defense Program Title and CFDA Number: National Guard Military Operations and Maintenance Projects (12.401) Federal Award Numbers and Years: W912JV-15-2-1001; 2015, W912JV-17-2-1001; 2017, W912JV-18-2-1001; 2018, W912JV-18-2-1002; 2018, W912JV-18-2-1021; 2018, W912JV-19-2-1001; 2019, W912JV-19-2-1002; 2019, W912JV-19-2-1021; 2019 Compliance Requirement: Reporting Type of Finding: Material Weakness, Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.303(a), 2 CFR 200.302(b) The Oregon Military Department (department) is responsible for establishing controls to ensure federal financial reports include all activity of the reporting period, are supported by applicable accounting records, and are fairly presented in accordance with governing requirements. The department has not implemented sufficient controls to ensure amounts reported are supported by accounting records. The Master Cooperative Agreement (MCA) is separated into appendices that support various program objectives. For example, there are separate appendices for operations and maintenance, environmental, and security objectives. The department completes the Request for Advance or Reimbursement (SF-270) reports by appendix to obtain reimbursement for federal expenditures. We reviewed 65 SF-270 reports for fiscal year 2019 and found the following: ? For two reports, the amount reported for cumulative federal expenditures and cumulative non-federal expenditures did not agree to the accounting records. The department had not made corrections for known errors related to payroll allocations, which resulted in overstating federal expenditures in the accounting records. If the errors are not corrected, the department may inappropriately seek federal reimbursement for unallowable expenditures. ? For 15 reports, the amount reported for cumulative federal expenditures did not agree to the accounting records because the department uses a combination of the accounting records and a subsidiary system as the basis for requesting reimbursement. The subsidiary system did not include all transactions related to the federal award, and is not reconciled to the accounting records until appendix close-out. In addition, some expenditures are driven by construction contracts that span several years, resulting in the reconciliation process occurring several years after the grant award begins. For example, the department finalized the operations and maintenance appendix reconciliation for federal fiscal year 2014 during the 2019 audit period. The process results in cumulative federal expenditures being understated on the federal reports and contributes to the department?s cash flow challenges. For example, as of May 2019, for one open appendix the department had approximately $1.7 million of expenditures recorded in the accounting records for which the department had not sought reimbursement. ? For 10 reports, we were unable to determine whether the amount reported for cumulative non-federal expenditures agreed to the accounting records because the department does not separately account for non-federal expenditures by federal award. We recommend department management ensure corrections are made in the accounting records as errors are identified. Additionally, we recommend department management ensure monthly reconciliations occur between its subsidiary system and accounting records and consider implementing the use of additional data fields within the accounting system to promote accurate federal reporting. Finally, we recommend the department separately account for non-federal expenditures by federal award.

2019-022 Oregon Military Department Strengthen Controls to Ensure Expenditures Do Not Exceed Obligated Amounts Federal Awarding Agency: U.S. Department of Defense Program Title and CFDA Number: National Guard Military Operations and Maintenance Projects (12.401) Federal Award Numbers and Years: W912JV-13-2-1001; 2013 Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: $230,656 (known) Criteria: National Guard Regulations 5-1, Chapter 11 Federal regulations require a written request to keep an appendix open when unliquidated obligations will remain 90 days or more after the close of the federal fiscal year. The request should include a consolidated, detailed listing of all unliquidated obligations and a projected timetable for their disbursement. Subsequent requests are to be submitted by the department every 90 days or so thereafter as long as there are unliquidated claims. Federal regulations also state that costs incurred in a fiscal year that are not disclosed by the department shall not be eligible for reimbursement. The Master Cooperative Agreement (MCA) is separated into appendices that support various program objectives. For example, there are separate appendices for operations and maintenance, environmental, and security objectives. The department separates the unliquidated obligations listings by federal fiscal year and appendix. For construction contracts that exceed one federal fiscal year and or include multiple federal fiscal years of funding, the department maintains spreadsheets that track budgeted and actual amounts by federal fiscal year. We judgmentally reviewed eight construction contracts with payments during the fiscal year and found one contract where expenditures exceeded budgeted amounts by $230,656 and actual payments per the department?s tracking spreadsheet by $789,577. The department was unable to determine why the accounting records showed contract payments exceeding budgeted amounts, but thought it was possible that payments were incorrectly recorded to federal fiscal years. We recommend department management ensure construction tracking sheets are appropriately reconciled to the accounting records to ensure payments do not exceed budgeted amounts.

2019-023 Department of Human Services Improve Documentation of Monitoring of Administrative Costs Federal Awarding Agency: U.S. Department of Agriculture ? Food and Nutrition Services Program Title and CFDA Number: Food Distribution Cluster (10.565, 10.568) Federal Award Numbers and Year: 197OROR2Y8005; 2019, 197OROR2Y8105; 2019 Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Type of Finding: Significant Deficiency, Noncompliance Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 200.403; 7 CFR 247.25; 7 CFR 251.10 Federal regulations state that costs under federal awards be necessary to ensure the efficient and effective administration of the program. Additionally, they state that eligible recipient agencies maintain adequate records for allowable administrative costs and that the state agency monitor the operation of the program to ensure it is administered in accordance with federal and state requirements. For fiscal year 2019, the department passed through all administrative funding to the recipient agency, totaling $1.3 million or 7.36% of total expenditures. Throughout the year the department received invoices from the recipient listing administrative charges by category such as staffing, supplies, and rent. No detail or additional support was provided by the recipient to support the charges. According to the department, they approve invoices for payment if funding is available and costs appear allowable. In addition, their on-site monitoring process includes a review of recipient invoices submitted for reimbursement, but there was no evidence invoices were reviewed. Without detail to support the charges and no documented on-site review of recipient invoices, there is a risk that the department is reimbursing the recipient for administrative costs that are not supported or allowable. We recommend department management review adequate support for administrative charges and revise the monitoring checklist to demonstrate that on-site monitoring of invoices is done.

2019-024 Oregon State Police Strengthen Controls for Verifying Suspension and Debarment Federal Awarding Agency: U.S. Department of Homeland Security Program Title and CFDA Number: Fire Management Assistance Grant (97.046) Federal Award Numbers and Years: FEMA 5255FM-OR; 2018, FEMA 5256FM-OR; 2018, FEMA 5265FM-OR; 2018, FEMA 5274FM-OR; 2018, FEMA 5275FM-OR; 2018 Compliance Requirement: Suspension and Debarment Type of Finding: Significant Deficiency Prior Year Finding: N/A Questioned Costs: N/A Criteria: 2 CFR 180.220; 2 CFR 180.300 Federal regulations prohibit recipients of federal awards from using federal funds to pay for goods and services if the vendor is suspended or debarred. This requirement includes procurement contracts and non-procurement transactions that are expected to exceed $25,000. These regulations require the state to verify that the vendor is not suspended, debarred, or otherwise excluded from participating before submitting the cost for federal reimbursement. The majority of the department?s Fire Management Assistance Grant program expenditures were non-procurement agreements. These agreements do not go through the department?s formal procurement process. Of the 21 vendors selected for testing, 13 had total expenditures in fiscal year 2019 that met the threshold of $25,000, and required the department to verify suspension and debarment. We found the department did not verify or document verification of suspension and debarment for any of the 13 vendors. In the vendor population as a whole, 79 of the 201 vendors met the threshold for suspension and debarment verification. As part of our planned test procedures, we searched the federal System for Award Management for each selected vendor. We found no vendors in our sample that were suspended or debarred. Management stated that it had performed the verification for one of the vendors, but the verification was not documented. Additionally, the department?s procedures for non-procurement agreements do not require a vendor?s status to be verified. Making payments to a vendor shown on the federal suspended or debarred vendor list could lead the department to contract with a vendor that is prohibited from participating in federal programs. The state could also be required to repay any federal monies it used to cover the costs associated with suspended or debarred vendors. We recommend department management strengthen existing controls to include verification of suspension and debarment for vendors with non-procurement agreements that equal or exceed $25,000. We further recommend the department maintain evidence demonstrating the verification was performed.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION