State of Texas C/O Comptroller of Public Accounts

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Period of Performance, Reporting, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Temporary Assistance for Needy Families 2401TXTANF, 2501TXTANF October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2025 - September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Department of Family and Protective Services (DFPS) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user access termination controls, we identified two instances, out of a sample of 25 terminated users, in which individuals were not removed from the Network and IMPACT in a timely manner. In both cases, the users’ accounts remained active well beyond their documented termination dates, resulting in unauthorized active credentials during the post‑termination period. The two exceptions were as follows: User A: Termination date 11/05/2024; access not removed until 11/22/2024. User B: Termination date 11/17/2024; access not removed until 02/20/2025. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend DFPS: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: Management agrees with the findings.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Eligibility, Reporting – Information Technology – User Access Federal Agency: U.S. Department of Veterans Affairs Federal Program Title: Veteran's State Nursing Home Care ALN: 64.015 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: N/A Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), The General Land Office (GLO) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our assessment of access controls, we noted that while GLO performs user access reviews for accounts with privileged (elevated) access to the network. No periodic user access review is performed for all network users (non‑privileged/general users) within the audit period. As a result, there is no documented verification that standard user accounts retain only appropriate, job‑related access. Questioned costs: None. Context: See “Condition.” Cause: The condition appears to result from policy and process gaps that focus review efforts primarily on privileged accounts, coupled with the absence of a formalized, agency‑wide schedule and procedure for reviewing all network users’ access and retaining evidence of those reviews. Effect: Failure to conduct and document periodic access reviews for all network users increases the risk that: • Excessive or outdated access persists undetected; • Unauthorized access to systems or data may occur; • Potential security, operational, and compliance exposures are elevated. No instances of misuse were identified during our procedures; however, the lack of comprehensive reviews represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that GLO: • Establish a formal, documented access review program that covers all network users (privileged and non‑privileged) on at least an annual cadence. • Implement standardized templates and a central repository to capture review date, reviewer, population, exceptions identified, and remediation actions taken. • Periodically monitor adherence to the review schedule and report completion status and exceptions to management governance (e.g., IT leadership or an information security committee). Views of responsible officials: Management of the Texas General Land Office (GLO), Information Technology Services (ITS) Department, concurs with the audit finding and agrees that formalizing and documenting a periodic user access review process for all non-privileged network users will further strengthen the agency’s internal control framework and cybersecurity posture in alignment with 2 CFR §200.303 and applicable federal internal control standards.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Equipment and Real Property Management, Matching, Level of Effort and Earmarking, Period of Performance, Procurement and Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) U.S. Department of Education (USDE) U.S. Department of Health and Human Services Social Security Administration Federal Program Title: SNAP Cluster Special Education Grants for Infants and Families Temporary Assistance for Needy Families Social Services Block Grant Block Grants Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse Aging Cluster Medicaid Cluster Disability Insurance/ SSI Cluster ALN: 10.551, 10.561 84.181 93.558 93.667 93.958 93.959 93.044, 93.045, 93.053 93.775, 93.777, 93.778 96.001, 96.006 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SNAP Cluster 6TX400105, 6TX400106, USDA-FNS-SNAP-24-EVS-TX October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, September 25, 2024 - September 30, 2025 Special Education Grants for Infants and Families H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2022 - September 30, 2023, July 1, 2023 - September 30, 2024, July 1, 2024 - September 30, 2025, July 1, 2025 - September 30, 2025 Temporary Assistance for Needy Families 1601TXTANF, 1801TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF, 2501TXTANF October 1, 2015 - September 30, 2016, October 1, 2017 - September 30, 2018, October 1, 2020 - September 30, 2022, October 1, 2021 – September 30, 2022, October 1, 2022 - September 30, 2023, October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2025 - September 30, 2026 Block Grants Community Mental Health Services B09SM089610, B09SM087322, B09SM087345, B09SM085385, B09SM089380, B09SM089984, B09SM085913 October 1, 2023 - September 30, 2025, October 17, 2022 - October 16, 2024, October 1, 2022 - September 30, 2024, September 1, 2021 - March 24, 2025, September 30, 2023 - September 29, 2025, September 30, 2024 - September 29, 2026, September 1, 2021 - March 24, 2025 Block Grants For Prevention and Treatment of Substance Abuse B08TI087067, B08TI085835, B08TI084609, B08TI088134, B08TI083969 October 1, 2023 - September 30, 2025, October 1, 2022 - September 30, 2024, September 1, 2021 - March 24, 2025, October 1, 2024 - September 30, 2026, September 1, 2021 - March 24, 2025 Aging Cluster 2101TXSSC6, 2101TXCMC6, 2101TXHDC6, 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD, 2201TXSTPH, 2301TXOAHD, 2301TXOACM, 2301TXOASS, 2301TXOANS, 2401TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2501TXOASS, 2501TXOAHD, 2501TXOAHD, 2501TXOANS April 1, 2021 - September 30, 2025, October 1, 2021 - September 30, 2024, January 1, 2022 - September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 - September 30, 2025, October 1, 2024 - September 30, 2026 Medicaid Cluster 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2024, October 1, 2024 - September 30, 2024, October 1, 2024 – September 30, 2025, October 1, 2023 - September 30, 2025, October 1, 2024 - December 31, 2024 Disability Insurance/ SSI Cluster 2304TXDI00, 2404TXDI00, 2504TXDI00 October 1, 2023 - February 2, 2024, October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user access within the CAPPS FIN (PeopleSoft Financials) system, we identified two user accounts, out of 17 tested, that had been granted inappropriate access to the PeopleSoft Administrator role. This role provides elevated privileges beyond those required for their job duties and should be limited to authorized system administrators. Management remediated the inappropriate access on November 10, 2025. Questioned costs: None. Context: See “Condition.” Cause: The inappropriate access assignments appear to result from gaps in privileged access provisioning and periodic re‑certification controls within the CAPPS FIN environment. Effect: Improper assignment of elevated PeopleSoft Administrator access in CAPPS FIN increases the risk of: • Unauthorized changes to system configuration, accounting rules, or financial data; • Data modification or exposure, including information related to federal program expenditures; • Bypassing of compensating controls intended to maintain data integrity and separation of duties; Although management removed access on 11/10/2025, the presence of improper administrator‑level access before remediation represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend HHSC: • Strengthen privileged access provisioning by requiring documented approval, business justification, and periodic revalidation for all elevated roles in CAPPS FIN. • Implement a formal, recurring privileged access review across all CAPPS FIN modules, with documented results and timely remediation of exceptions. • Utilize identity governance tools or CAPPS FIN security reporting to automatically flag unauthorized assignments of administrator roles. Views of responsible officials: HHSC concurs with the recommendation.

Earmarking – Administrative Expenses Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM087322 October 17, 2022 – October 16, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 300x-5(b), a funding agreement for a grant under section 300x of this title is that the State involved will not expend more than 5 percent of the grant for administrative expenses with respect to the grant. Condition: HHSC expended $1,069,086 of the total grant award amount of $3,690,918 as of the end of the project period. Administrative expenditures for the grant totaled $54,672, which represents 5.11 percent of the federal funds expended, exceeding the allowable 5 percent threshold. Questioned costs: $1,217. Context: See “Condition.” Cause: The overage resulted from a delay in the grant’s start date, which subsequently postponed the initiation of related projects and led to lower overall expenditures. Effect: By exceeding the 5 percent administrative cap, HHSC did not comply with the statutory limitation on administrative costs, resulting in unallowable administrative expenditures charged to the grant. This noncompliance may require reimbursement to the federal agency and increases the risk of future questioned costs. Repeat Finding: No Recommendation: We recommend HHSC make necessary adjustments to federal expenditures in the event of program delays to ensure the agency stays within required percentage maximums. Views of responsible officials: HHSC concurs with the recommendation.

Earmarking – Evidence Based Programs Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM085385 September 1, 2021 – March 24, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Noncompliance Criteria or specific requirement: Per 42 USC 300x-9(c), (1) except as provided in paragraph (2), a State shall expend not less than 10 percent of the amount the State receives for carrying out this section for each fiscal year to support evidence-based programs (EBP) that address the needs of individuals with early serious mental illness (ESMI), including psychotic disorders, regardless of the age of the individual at onset. (2) In lieu of expending 10 percent of the amount the State receives under this section for a fiscal year as required under paragraph (1), a State may elect to expend not less than 20 percent of such amount by the end of such succeeding fiscal year. Condition: HHSC expended $4,114,245 on evidence‑based programs related to ESMI out of $86,184,653 in total grant expenditures as of the end of the project period, representing 4.77% of total expenditures. This percentage is below the required 10% annual EBP set‑aside and also does not meet the 20% by the end of the succeeding fiscal year alternative as the grant ended March 24, 2025. Consequently, expenditures under this award did not meet statutory EBP set‑aside requirements. Questioned costs: Unknown. Context: See “Condition.” Cause: The noncompliance occurred because the grant was abruptly terminated by the federal government on March 24, 2025, approximately six months earlier than the original end date of September 30, 2025. The early termination limited HHSC’s ability to fully implement planned activities and make the remaining expenditures necessary to meet the statutory minimum EBP set‑aside requirement. Had the grant period continued as originally awarded, HHSC may have had sufficient time to achieve the required expenditure level. Effect: Because the grant was terminated earlier than anticipated, HHSC was unable to expend the statutorily required minimum amount on evidence‑based programs for early serious mental illness. As a result, HHSC did not meet the expenditure requirements under 42 U.S.C. § 300x‑9(c), creating a condition of federal noncompliance. This may expose HHSC to potential corrective actions by the federal awarding agency and limits assurance that the intended level of evidence‑based services for individuals with early serious mental illness was fully delivered during the grant period. Repeat Finding: No Recommendation: HHSC should consider formally requesting a waiver or exception from the federal awarding agency for the unmet evidence‑based program expenditure requirement, given that the early termination of the grant was outside the agency’s control and materially limited its ability to meet the statutory set‑aside. In addition, HHSC should document the impact of the shortened project period, including planned but unspent EBP activities, to support the waiver request. Seeking this relief will help ensure that HHSC is not penalized for circumstances beyond its control and will provide federal officials with the necessary context to evaluate compliance in light of the unexpected grant termination. Views of responsible officials: HHSC concurs with the recommendation.

Level of Effort - Supplement not Supplant Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster ALN: 93.044, 93.045, 93.053 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD October 1, 2021 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §1321.9(c)(2)(xvi), funds awarded under Title III of the Older Americans Act for services provided under section 321(d) (42 U.S.C 3030d(d)) must be used to supplement, not supplant existing Federal, State, and local funds expended to support those activities. Condition: A comparison of supportive services and senior center funding between fiscal years 2023 and 2024 showed that total service levels increased by approximately 5 percent, rising from $40,354,713 in FY2023 to $42,267,130 in FY2024. During the same period, federal expenditures increased by 8 percent, from $31,170,863 to $33,755,005, while non‑federal expenditures decreased by 7 percent, from $9,183,850 to $8,512,125. Because the increase in federal funding outpaced the increase in total services, and was accompanied by a reduction in non‑federal contributions, federal funds effectively replaced rather than supplemented state or other non‑federal resources. Accordingly, HHSC supplanted non‑federal funds with federal funds for the 2024 grant. To quantify the financial impact, total services increased by 5 percent; therefore, the federal contribution would be expected to increase proportionally by 5 percent. Applying a 5 percent growth rate to the FY2023 federal amount of $31,170,863 yields an expected level of $32,729,406 for FY2024. However, actual federal expenditures totaled $33,755,005, resulting in excess federal funding of $1,025,599 beyond what would be needed to support the observed service increase. Questioned costs: $1,025,599. Context: See “Condition.” Cause: HHSC has followed supplement not supplant policies and procedures that were implemented based on compliance with total level of services (i.e., all services) and not specifically for supportive services and senior centers, as required. Effect: HHSC has supplanted non-federal funds used for supportive services and senior centers, resulting in questioned costs and noncompliance. Repeat Finding: No Recommendation: HHSC should revise existing policies and procedures to ensure they are not supplanting nonfederal funds specifically related to supportive services and senior centers. Views of responsible officials: HHSC concurs with the recommendation.

Reporting – Post-Expenditure Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: • TANF Funds Transferred into SSBG –Amount reported on this line item should be consistent with the TANF federal financial report (ACF-196R). The Federal Funds Office (FFO) is responsible for the completeness, accuracy, and timely submission of the Post Expenditure Report. Federal Reporting Fiscal Management personnel are responsible for proper reporting and submission of the ACF-196R Report. Condition: During testing of key line items for the FY2024 Post Expenditure Report submitted in March 2025, we noted that TANF Funds Transferred into SSBG was reported as $41,623,634. However, the amount reported on the ACF-196R report was $38,778,521, resulting in a variance of $2,845,113. Questioned costs: None Context: See “Condition.” Cause: FFO did not properly coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196R report were consistent with the amount on the Post Expenditure Report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: 2023-013, 2024-008 Recommendation: We recommend the FFO coordinate with the appropriate Federal Reporting Team personnel regarding amounts noted for the TANF Funds Transferred into SSBG to ensure the amount in the Post Expenditure Report matches with the amount in the ACF-196R. Views of responsible officials: HHSC concurs with the recommendation.

Reporting – ACF-196R Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF October 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Pursuant to 45 CFR §265.3(a)(1) each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report). More specifically, Form ACF-196R is used by States administering the Temporary Assistance for Needy Families (TANF) program to report quarterly expenditure data and to request quarterly grant funds. The ACF-204 report (Annual Report on State Maintenance-of-Effort Programs) must be completed and submitted in accordance with the requirements at 45 CFR §265.9(c). The report includes several line items that contain critical information, including “Total State MOE Expenditures.” Input for the Total State MOE expenditures line item is provided by the Texas Education Agency (TEA), the Texas Workforce Commission (TWC), and HHSC. The MOE amounts in the ACF-204 report are to agree to the amounts in the final ACF-196R report. For the FY2024 ACF-196R report, the contributing agencies reported State MOE expenditures on various line items including but not limited to: HHSC – Line 6a (Basic Assistance (excluding Relative Foster Care Maintenance Payments and Adoption and Guardianship Subsidies) TEA – Line 11b (Pre-Kindergarten/Head Start) Condition: All key line items in the FY 2024 ACF‑204 report were tested and agreed to supporting documentation without exception. However, the Total State Maintenance of Effort (MOE) Expenditures reported in the ACF‑204 by HHSC and the Texas Education Agency (TEA) did not reconcile to the amounts reported in the ACF‑196R as shown below: Amounts reported in the ACF‑204 were accurate and supported; the variances occurred because the ACF‑196R reflected higher MOE expenditures than those reported on the ACF‑204. Questioned costs: None. Context: See “Condition.” Cause: The variance in line 11b was due to miscommunication between the relevant HHSC personnel regarding revisions to an initial submission. The variance in line 6a was due to the HHSC Federal Reporting Team incorrectly including period 1 of 2025 in the MOE calculation. The agency did not perform a complete reconciliation between the ACF‑204 and ACF‑196R prior to submission, resulting in inconsistent MOE reporting across the required reports. Effect: Inaccurate or inconsistent reporting of MOE expenditures increases the risk of noncompliance with federal reporting requirements under 2 CFR §200.302 (financial management) and 2 CFR §200.329 (performance and financial reporting). These discrepancies may impair the federal awarding agency’s ability to evaluate program performance, assess State MOE compliance, and rely on the accuracy of reported financial information. Repeat Finding: No. Recommendation: HHSC should strengthen their financial reporting controls to ensure consistency between the ACF‑204 and ACF‑196R reports. Specifically, the agency should implement a formal reconciliation process that: • Compares all MOE expenditure amounts reported on the ACF‑204 to those reported on the ACF‑196R prior to submission; • Requires documented review and approval of the reconciliation by management; and • Ensures any discrepancies are researched, resolved, and corrected before the reports are finalized. Views of responsible officials: HHSC concurs with the recommendation.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.044, 93.045, 93.053 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXSSC6, 2101TXCMC6, 2101TXHDC6, 2201TXOASS, 2201TXOANS, 2201TXOACM, 2201TXOAHD, 2201TXSTPH, 2301TXOAHD, 2301TXOACM, 2301TXOASS, 2301TXOANS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS, 2501TXOASS, 2501TXOAHD, 2501TXOACM, 2501TXOANS April 1, 2021 – September 30, 2025, October 1, 2021 – September 30, 2024, January 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 TANF 2401TXTANF and 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Social Services Block Grant 2301TXSOSR, 2401TXSOSR, 2501TXSOSR October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Block Grants for Community Mental Health Services 1B09SM085913, 1B09SM085385, 1B09SM087345, 1B09SM087322, 1B09SM089380, 1B09SM089610, 1B09SM089984 September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, September 30, 2023 – September 29, 2025, October 1, 2023 – September 30, 2025, September 30, 2024 – September 29, 2026 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Nonmajor programs Opioid STR 6H79TI083288, 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. As of March 8, 2025, fsrs.gov was retired, and all subaward reporting data and functionality are now on SAM.gov. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards on FSRS.gov or SAM.gov. A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligation at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS.gov or SAM.gov. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2024-005, 2023-010, 2022-013, 2021-007 Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Child Support Non-Cooperation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 U.S.C 608 (a)(2), if the agency responsible for administering the State plan approved under part D determines that an individual is not cooperating with the State in establishing paternity or in establishing, modifying, or enforcing a support order with respect to a child of the individual, and the individual does not qualify for any good cause or other exception established by the State pursuant to section 654(29) of this title, then the State: (1) shall deduct from the assistance that would otherwise be provided to the family of the individual under the State program funded under this part an amount equal to not less than 25 percent of the amount of such assistance; and (2) may deny the family any assistance under the State program. The State’s policy is to reduce benefits 100% for non-cooperation. HHSC policy requires that when the Office of the Attorney General (OAG) identifies a TANF recipient who has failed to cooperate with child support requirements, OAG must notify HHSC within seven days of the non‑cooperation date. Upon receipt, HHSC must apply the sanction within five working days. Condition: A sample of 40 TANF beneficiaries who were reported as non‑cooperating with program requirements during fiscal year 2025 was selected for testing. Two instances of untimely sanction application were identified: • One case in which HHSC reduced benefits one month late, resulting in an overpayment of $320. • One case in which HHSC reduced benefits two months late, resulting in an overpayment of $890. Questioned costs: $1,210 Context: See “Condition.” Cause: HHSC’s internal controls did not consistently ensure timely processing of sanctions upon receipt of non‑cooperation referrals from OAG. Existing monitoring and workflow procedures were insufficient to detect or prevent delays in applying benefit reductions. Effect: Failure to apply sanctions within required timeframes can lead to inaccurate benefit issuance, questioned costs, and weakened program integrity. Repeat Finding: No. Recommendation: HHSC should strengthen internal controls over the processing of TANF non‑cooperation sanctions to ensure timely application in accordance with program requirements. Specifically, HHSC should: • Implement an automated or workflow‑based tracking mechanism to monitor the timeliness of sanctions received from OAG. • Provide refresher training to eligibility staff on timely sanction procedures and the importance of preventing improper payments. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – ADP Risk Analysis and System Security Review Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5001, 2505TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 – September 30, 2024, October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2024, October 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – December 31, 2024, October 1, 2024 – December 31, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §95.621, State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. Condition: HHSC maintains a total of 35 in-house and third-party systems that are used in the administration of Medicaid, which are required to be reviewed each biennial period. During the fiscal year 2024-2025 biennial, only 15 risk assessments were executed based on internal methodology or third-party assessments. HHSC did not perform risk assessments over the remaining 20 systems during the two-year period. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to it’s current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2024-012, 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the recommendation.

Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2405TXIMPL, 2405TX5000, 2505TXPACT, 2505TX5000, 2405TX5001, 2505TX5021, 2505TX5MAP, 2505TX5ADM October 1, 2023 – September 30, 2024, October 1, 2023 – September 30, 2024, October 1, 2024 – September 30, 2024, October 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – December 31, 2024, October 1, 2024 – December 31, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission (HHSC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC policies require the completion of Form 2567 Statement of Deficiencies and Plan of Correction to include the prefix tag, the deficiency that contains the code of federal regulations (CFR) or life safety code (LSC) reference for each health and safety survey conducted. HHSC is required to mail a copy of the completed form to the provider within ten business days after the exit date of the survey to ensure any deficiencies noted are addressed timely. For one of 40 health surveys conducted during the fiscal year, Form 2567 was mailed out to the provider 162 business days after the exit date of the survey. While the form was mailed after the required timeline per HHSC policy, it did not include any cited deficiencies. Questioned costs: None. Context: See “Condition.” Cause: After the provider's exit date, HHSC regional staff subsequently determined, several months later, that the required notice had not been issued to the facility. This oversight occurred during a period of transition within the ICF team. Effect: Failure to notify a provider of identified deficiencies in a timely manner may prevent the provider from implementing corrective actions within the required timeframe to meet compliance deadlines. Such delays increase the risk of continued noncompliance and may result in inappropriate payments for new admissions before the provider agreement is terminated. Repeat Finding: No. Recommendation: HHSC should enhance and/or reinforce existing internal controls to ensure timely completion and mailing of Form 2567 to meet standards in 42 CFR Part 442 and related policy requirements. This could include developing automated tracking systems or checklists to monitor survey deadlines and/or providing refresher training for all regional staff involved in the survey and notification process. Views of responsible officials: HHSC concurs with the recommendation.

Subrecipient Monitoring – Missing Contract Elements Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Special Education – Grants for Infants and Families Temporary Assistance for Needy Families (TANF) Block Grants for Prevention and Treatment of Substance Abuse ALN: 84.181 93.558 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Special Education – Grants for Infants and Families H181A200171, H181A210171, H181A220171, H181A230171, H181A240171, H181A250171 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024, July 1, 2024 – September 30, 2025, July 1, 2025 – September 30, 2026 TANF 2001TXTANF, 2101TXTANF, 2201TXTANF, 2301TXTANF, 2401TXTANF and 2501TXTANF October 1, 2019 – September 30, 2020, October 1, 2020 – September 30, 2021, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Block Grants for Prevention and Treatment of Substance Abuse 1B08TI083969, 1B08TI084609, 1B08TI083054, 1B08TI083478, 1B08I084673, 1B08TI085835, 1B08TI087067, 1B08TI088134 September 1, 2021 – March 24, 2025, September 1, 2021 – March 24, 2025, October 1, 2019 – September 30, 2021, October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Health and Human Services Commission must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the certain required information provided. A pass-through entity must provide the best available information when some of the required information is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes the subrecipient’s unique entity identifier (UEI), assistance listings numbers (ALN), and title of the program. Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Special Education – Grants for Infants and Families (SEGIF) –The UEI was not included in the base subaward agreement for seven of the eight agreements selected for testing. The last amendment to the original agreement included the UEI number, however, it did not reference the ALN and title of the program. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Temporary Assistance for Needy Families – The ALN and title of the program was not included in four of the seven subaward agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2025. Block Grants for Prevention and Treatment of Substance Abuse –The UEI was not included in one of the 18 agreements selected for testing. The start and end dates for the agreement was September 1, 2020 – August 31, 2025. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR §200.332 prior to execution is not at the correct precision level. Effect: Because required subaward information was omitted, HHSC increased the risk that subrecipients were not fully informed of the federal award details necessary to properly administer the funds in compliance with the applicable statutes, regulations, and award terms. Missing UEI, ALN, and program titles may impede subrecipients’ ability to accurately identify the federal program, appropriately report activities, and meet federal requirements, including those related to financial management, performance, subrecipient monitoring, and audit preparation. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements noted in 2 CFR §200.332. Views of responsible officials: HHSC concurs with the recommendation.

Cash Management, Eligibility, Matching and Earmarking, Period of Performance, Suspension and Debarment, Reporting, Subrecipient Monitoring, Special Tests and Provisions – Information Technology – Change Management Federal Agency: U.S. Department of Justice Federal Program Title: Crime Victim Assistance ALN: 16.575 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 15POVC-25-GG-00366-ASSI, 15POVC-24-GG-00728-ASSI, 15POVC-23-GG- 00468-ASSI, 15POVC-22-GG-00468-ASSI, 2020-V2-GX-0040 October 1, 2024 – September 30, 2028, October 1, 2023 – September 30, 2027, October 1, 2022 – September 30, 2026, October 1, 2021 – September 30, 2025, October 1, 2020 – September 30, 2025, October 1, 2019 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Office of the Governor must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During our review of information technology general controls related to network change management, we noted that the organization does not have a formal, documented change control process governing changes and approvals to the network hardware components and systems. As a result, network changes may not be consistently documented, reviewed, or formally approved. For purposes of this control, network changes include any additions, modifications, or removals affecting the network infrastructure, including but not limited to: • Network hardware (e.g., routers, switches, firewalls, wireless devices) • Network device configurations • Network related software, firmware, or operating system components Questioned costs: None. Context: See “Condition.” Cause: Management is aware of this matter and a draft policy initiative is already underway and targeted for completion during fiscal year 2026. Effect: In the absence of a formal documented change management process, there is an increased risk that unauthorized or untested network changes could adversely impact the confidentiality, integrity, or availability of systems and data. Repeat Finding: No Recommendation: We recommend that management finalize and implement the formal, documented network change management process to ensure all changes to network hardware, configurations, and related software are properly requested, reviewed, approved, tested, and documented. Views of responsible officials: A formal but not documented process has been utilized which requires CIO approval of all changes. A Project was instigated in 2024 to formalize and embed the verbal process into a written process with auditable execution logs. The project is in its final stages

Procurement and Suspension and Debarment Federal Agency: U.S. Environmental Protection Agency Federal Program Title: Drinking Water State Revolving Fund (DWSRF) ALN: 66.468 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2521902915 September 1, 2024 - August 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Commission on Environmental Quality (TCEQ) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR §200.318, the recipient or subrecipient must maintain and use documented procedures for procurement transactions under a federal award or subaward, including for acquisition of property or services. These documented procurement procedures must be consistent with State, local, and tribal laws and regulations and the standards identified in §§ 200.317 through 200.327. Per 2 CFR §200.214, recipients and subrecipients are subject to the non-procurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, as well as 2 CFR part 180. The regulations in 2 CFR part 180 restrict making Federal awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from receiving or participating in Federal awards. Condition: Audit procedures included a review of five procurements conducted during the fiscal year to assess whether TCEQ adhered to required procurement procedures and performed vendor eligibility verifications prior to entering into covered transactions. For one procurement, totaling $16,175, the required procurement processes were not followed, and the necessary vendor compliance checks, including verification of suspension and debarment status, were not completed before executing the transaction. Questioned costs: None. Context: See “Condition.” Cause: The procurement was initiated directly by the program area without notifying or coordinating with the Procurement and Contracts Section. Program staff proceeded with the purchase under the assumption that procurement involvement was unnecessary because the selected vendor was the sole provider of the required item. As a result, established procurement procedures and vendor compliance verification processes were not followed. Effect: Failure to follow procurement procedures and complete proper vendor compliance checks prior to entering into a covered transaction may lead to entering contracts with suspended or debarred vendors that could result in noncompliance and questioned costs. Repeat Finding: No Recommendation: TCEQ should provide targeted training to program staff on federal procurement requirements, including the necessity of coordinating all purchases through the P&C Section and completing required vendor compliance checks. Training should emphasize procedures for sole‑source or limited‑source procurements and reinforce staff responsibilities under 2 CFR procurement and internal control standards. Regular refresher sessions and documented guidance will help ensure consistent understanding and adherence to required procurement practices across all program areas. Views of responsible officials: The Financial Administration Division (FAD) will implement the audit’s recommendations. FAD will reinforce the guidance provided through continuous training, documentation, and improved internal controls.

Activities Allowed or Unallowed, Allowable Costs/ Cost Principles, Cash Management, Eligibility, Suspension and Debarment, Reporting, Special Tests and Provisions – Information Technology – User Access Federal Agency: U.S. Department of Agriculture (USDA) Federal Program Title: Food Distribution Cluster Texas 1944 Water Treaty Grant ALN: 10.565, 10.568, 10.560 10.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Food Distribution Cluster 246TX816Y8105, 256TX816Y7105, 246TX818Y8613, 238TX000I1003, 246TX816Q2204 October 1, 2023 - September 30, 2024, October 1, 2024 - September 30, 2025, November 3, 2023 - November 2, 2024, May 23, 2023 - June 30, 2025, October 1, 2023 - September 30, 2024 Texas 1944 Water Treaty Grant FSA25GRA0012028 March 19, 2025 - March 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Department of Agriculture (TDA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of user termination controls, we identified two instances, out of a sample of 14 terminated users, in which access was not removed within the timeframe required by TDA’s System Administrator separation process (i.e., application access removed on the date of the ticket/same day of termination and network access within one business day): Application (TX‑UNPS): User A was terminated on 06/13/2025. Network access was removed on 06/16/2025 (within one business day), but TX‑UNPS application access remained active until 06/19/2025 (removed after four business days), which does not meet the same‑day requirement for application access. Network: User B was terminated on 09/13/2024. Network access was removed on 09/17/2024 (removed after one business day due to weekend/holiday schedule), which does not meet the requirement for removal within one business day. Questioned costs: None. Context: See “Condition.” Cause: The delays appear to be the result of breakdowns in the coordination between HR separation processes and IT access revocation procedures, including delays in communication or gaps in the automated termination workflow. Effect: Failure to remove user access promptly increases the risk of: • Unauthorized access to confidential or sensitive information; • Potential manipulation, loss, or misuse of program data; • Increased exposure to operational and security risks. Although no misuse of access was identified, the presence of active credentials after termination represents a significant control deficiency. Repeat Finding: No Recommendation: We recommend that TDA: • Strengthen coordination between HR and IT functions to ensure immediate notification upon employee separation. • Implement automated workflows that disable all user access promptly upon termination. • Conduct periodic reconciliations of HR separation lists against active user accounts to detect and remove any lingering access. • Enhance monitoring controls, including reporting dashboards or alerts triggered when access is not removed within a defined timeframe. Views of responsible officials: TDA agrees with the finding. TDA acknowledges that improvements can be made to the separation process.

Cash Management – Cash Management Improvement Act Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXLIEA, 2301TXLIEE, 2401TXLIEA, 2401TXLIEI, 2501TXLIEA, 2501TXLIEI October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 31 CFR §205.20, states use clearance patterns to project when funds are paid out, given a known dollar amount and a known date of disbursement. A state must ensure that clearance patterns meet the following standards: (a) A clearance pattern must be auditable. (b) A clearance pattern must accurately represent the flow of Federal funds under the Federal assistance programs to which it is applied. (c) A clearance pattern must include seasonal or other periodic variations in clearance activity. (d) A clearance pattern must be based on at least three consecutive months of disbursement data, unless additional data is required to accurately represent the flow of Federal funds. (e) If a State uses statistical sampling to develop a clearance pattern, the sample size must be sufficient to ensure a 96 percent confidence interval no more than plus or minus 0.25 weighted days above or below the estimated mean. (f) A clearance pattern must extend, at a minimum, until 99 percent of the dollars in a disbursement have been paid out for Federal assistance program purposes. (g) We and a State may agree to other procedures, such as estimates to project when funds are paid out when the dollar amount and/or the timing of disbursements are not known. Condition: The LIHEAP program is included in the Treasury-State Agreement effective for the fiscal year ending August 31, 2025, and it meets the threshold for inclusion under the Cash Management Improvement Act (CMIA). As such, TDHCA is required to prepare Period 1 clearance pattern calculations supported by verifiable disbursement data to ensure federal funds are drawn in accordance with the program’s required average clearance pattern of three days. TDHCA did not prepare a Period 1 clearance pattern calculation for LIHEAP based on at least three consecutive months of disbursement data as required. Although the Treasury-State Agreement specifies a three‑day average clearance pattern for the program, TDHCA did not maintain or provide documentation supporting how this clearance pattern was developed. As a result, the clearance pattern was not auditable, and we were unable to determine whether TDHCA’s practices for drawing federal funds aligned with the CMIA requirements. Questioned costs: None. Context: See “Condition.” Cause: Management noted their clearance pattern reflected their established funding techniques and prior reports; therefore, they overlooked the specific Treasury-State Agreement documentation requirements. Effect: Although we were able to perform testing over TDHCA’s cash management practices for LIHEAP and concluded that no federal interest was earned as a result of timing differences, the absence of a documented Period 1 clearance pattern calculation prevented us from validating the accuracy of the three‑day clearance pattern prescribed in the Treasury–State Agreement. Without an auditable calculation, TDHCA cannot demonstrate that the established clearance pattern is supported by actual disbursement data, which limits assurance that the methodology used for federal draws fully complies with CMIA requirements. Repeat Finding: No Recommendation: TDHCA should establish and implement procedures to ensure that a Period 1 clearance pattern calculation is completed and retained for LIHEAP in accordance with CMIA and Treasury–State Agreement requirements. This calculation should be based on at least three consecutive months of actual disbursement data and documented in a manner that is readily auditable. TDHCA should also provide training to staff responsible for CMIA compliance to ensure they are aware of the requirement to prepare and maintain this calculation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Reporting – Quarterly Performance and Management Report Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Low-Income Home Energy Assistance Program (LIHEAP) ALN: 93.568 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2501TXLIEI October 1, 2024 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §96.82(a), each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. Key Line Items containing critical information include: 1. Section 1 – Total Households Assisted 2. Section 2 – Performance Management 3. Section 3 – Estimated Use of Funds 4. Section 4 – LIHEAP Program Implementation and Support Condition: As part of our testing of the Quarterly Performance and Management Report for award 2501TXLIEI, we selected 2 of the 4 reports submitted during the fiscal year. During our review, we identified a discrepancy in the quarter 1 report (October 1 – December 31). The report stated that $159,463,428 in LIHEAP funds had been obligated by funding source in Section 3 – Estimated Use of Funds; however, supporting documentation reflected obligated funds totaling $174,447,109, resulting in a variance of $(14,983,681). Questioned costs: None. Context: See “Condition.” Cause: An error was made when TDHCA staff entered the amount of funds obligated into the report, and existing internal controls did not detect the error before the report was submitted to U.S. Department of Health and Human Services (HHS) Effect: Inaccurate reporting may lead to misstated financial information at the federal level, hinder management’s ability to make informed decisions, and could affect federal oversight and monitoring of program activity. These discrepancies increase the risk of noncompliance with federal reporting requirements and may impact the integrity of cumulative statewide LIHEAP reporting. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its review and reconciliation procedures for quarterly LIHEAP reporting to ensure that amounts reported are fully supported by accurate and complete documentation. This should include implementing a formal review process that requires verification of reported obligation amounts against source records prior to submission, as well as enhanced training for staff responsible for report preparation. Views of responsible officials: The Texas Department of Housing and Community Affairs acknowledges and agrees with the finding.

Cash Management, Eligibility, Level of Effort, Earmarking, Period of Performance, Subrecipient Monitoring – Information Technology – User Access Federal Agency: U.S. Department of Education (USDE) Federal Program Title: Career and Technical Education - Basic Grants to States ALN: 84.048 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: V048A220043, V048A230043, V048A240043 July 1, 2022 - September 30, 2023, July 1, 2023 - September 30, 2024, July 1, 2024 - September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Higher Education Coordinating Board (THECB) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Additionally, 2 CFR §200.303(e) requires taking reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information. Condition: During testing of access controls, we noted that while THECB performs user access reviews for individuals with network access, the reviews were not documented. The absence of documented evidence prevents verification that the reviews were completed, who performed them, when they were performed, and whether identified issues were appropriately resolved. Questioned costs: None. Context: See “Condition.” Cause: The lack of documented access reviews appears to result from informal review processes and insufficient procedures requiring reviewers to maintain written evidence of the review. Additionally, there may be no standardized template or centralized repository for retention of such documentation. Effect: Without documentation of the network access review, THECB cannot demonstrate that: • Reviews were performed within the applicable audit period • Access rights were validated for appropriateness • Unauthorized or outdated access was identified and removed This lack of documentation increases the risk of unauthorized system access, potential misuse of systems or data, and noncompliance with federal internal control requirements. Repeat Finding: No Recommendation: We recommend that THECB: • Develop and implement a standardized documentation process for all user access reviews, including a required template documenting review date, reviewer identity, scope, results, and remediation actions. • Maintain all documentation in a centralized repository accessible to IT management and audit personnel. • Implement periodic monitoring to ensure reviews are performed timely and documentation is consistently retained. • Consider using automated access review tools to support completeness, timeliness, and auditability of reviews. Views of responsible officials: THECB ITS agrees with the finding.

Reporting – Financial, Performance and Special Reporting Federal Agency: U.S. Department of Labor (DOL) Federal Program Title: Unemployment Insurance (UI) ALN: 17.225 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: UI372522255A48, UI380082260A48, UI382492255A48, 23A03UI0389351, 23A60UR000007, 23A60UB000060, 24A55UI000051, 24A55UT000017, 24A60UR000091, 24A60UD000038, 25A55UE000005, 25A60UB000137, 25A60UB000149, 25A60UB000176, 25A60UB000187, 25A60UD000047, 25A55UI000094, 25A55UT000066, 25A60UR000102 October 1, 2021 – December 31, 2024, January 1, 2022 – September 30, 2024, January 1, 2022 – March 31, 2025, October 1, 2022 – December 31, 2025, January 1, 2023 – September 30, 2025, April 1, 2023 – May 22, 2025, October 1, 2023 – December 31, 2026, October 1, 2023 – September 30, 2024, January 1, 2024 – September 30, 2026, May 17, 2024 – May 17, 2027, July 1, 2024 – December 31, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 1, 2024 – September 30, 2025, July 9, 2024 – July 9, 2027, October 1, 2024 – December 31, 2027, October 1, 2024 – September 30, 2025, January 1, 2025 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: "Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of financial, performance, and special reporting, we identified gaps in TWC’s documentation and oversight of its reporting processes. Specifically, for the ETA 2112 – UI Financial Transaction Summary, we tested three monthly reports, and none contained evidence of review or approval prior to submission. Similarly, for the ETA 9050 – Time Lapse of All First Payments Except Workshare and the ETA 9052 – Nonmonetary Determination Time Lapse Detection performance reports, we tested three monthly submissions for each report type, and all lacked documentation demonstrating that a formal accuracy and completeness review was performed. In addition, our testing of two quarterly ETA 2208A – Quarterly UI Above-Base Reports identified a lack of segregation of duties. For both reports tested, the individual responsible for preparing the report also performed the review function. Questioned costs: None. Context: See “Condition.” Cause: The absence of documented reviews and approvals appears to result from insufficient internal controls over the reporting process, including unclear staff responsibilities. These control gaps contributed to inconsistent application of review procedures and allowed instances where documentation of required oversight did not occur or was performed by the same individual responsible for report preparation. Repeat Finding: No Recommendation: TWC should strengthen internal controls over the reporting process by establishing clear roles and responsibilities for the preparation, review, and approval of all required ETA reports. Management should ensure that each report undergoes a documented, independent review to verify accuracy and completeness before submission. Additionally, TWC should provide targeted training to staff on reporting requirements and internal control expectations to reinforce consistent application of review procedures and prevent situations where the preparer and reviewer are the same individual. Views of responsible officials: Management agrees on the importance of the ETA reports and the accuracy of the information in the reports.

Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2401TXTANF, 2501TXTANF October 1, 2023 – September 30, 2024 and October 1, 2024 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §261.60(a)-(c), a State must report the actual hours that an individual participates in an activity. It is not sufficient to report the hours an individual is scheduled to participate in an activity. For unsubsidized employment, subsidized employment, and on-the-job training, the State may report projected actual hours of employment participation for up to six months based on current, documented actual hours of work. Any time the State receives information that the client's actual hours of work have changed, or no later than the end of any six-month period, the agency must re-verify the client's current actual average hours of work and may report these projected actual hours of participation for another six-month period. Condition: Audit procedures included independently recalculating average work participation hours for a sample of 40 TANF cases and comparing those results to the hours reported to the U.S. Department of Health and Human Services on the ACF‑199 report. For one of the 40 cases tested, the recalculated average work hours did not agree with the hours reported on the ACF‑199. This discrepancy resulted in a net overstatement of 9 hours on the ACF‑199 report. Questioned costs: No. Context: See “Condition.” Cause: The variance in reported hours for the affected case resulted from a system processing error by the third‑party vendor. During extraction from the WorkInTexas (WIT) system, TWC’s case management system, and file creation for transmission to HHSC, certain hour entries were inadvertently duplicated, leading to the double‑counting of participation hours and, consequently, an overstatement in the ACF‑199 reporting. Effect: Inaccurate reporting of work participation hours affects the reliability of the State’s TANF data submitted to the federal government and may compromise the accuracy of the State’s calculated work participation rates. Such reporting inaccuracies increase the risk of noncompliance with federal work verification requirements and may expose the State to potential penalties if similar errors are systemic or not promptly addressed. Repeat Finding: No. Recommendation: TWC, in coordination with the system vendor, should strengthen controls over the extraction, translation, and transmission of work participation hour data used in the ACF‑199 report. Specifically, TWC should: • Require the third-party vendor to implement system safeguards that prevent the duplication of hour entries during data extraction from the WIT system and subsequent file creation. • Establish automated validation checks to detect anomalies such as duplicate lines, unexpected variances, or irregular hour totals prior to ingesting vendor files into TWC systems. • Enhance supervisory review procedures to ensure that data received from third‑party vendors is reconciled to source records and verified for completeness and accuracy before inclusion in federal reporting. Views of responsible officials: TWC’s Divisions of Workforce Development, Information Technology, and Information, Innovation and Insight agree with the recommendations.

Special Provisions- Fraud Detection and Repayment Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Child Care and Development Cluster (CCDF) ALN: 93.489, 93.575, 93.596 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXCDC6, 2201TXCCDD, 2201TXCCDF, 2301TXCCDF, 2301TXCCDD, 2501TXCCDF, 2401TXCCDM, 2401TXCCDF, 2401TXCCDD, 2501TXCCDD, 2501TXCCDM, 2501TXCCDY October 1, 2020 – September 30, 2024, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2025, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026, October 1, 2024 – September 30, 2026, October 1, 2024 – September 30, 2027, and December 21, 2024 – September 30, 2028. Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), Texas Workforce Commission (TWC) must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the Federal award in compliance with federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR §98.60(i), Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing fraud. In order to identify and recover payments, pursuant to TWC’s Childcare Services Guide (November 2024), section G.600: Recovery of Improper Payments, Local Workforce Development Boards (Boards) must attempt recovery of all improper payments. TWC must not pay for improper payments. Board recovery of improper payments must be managed in accordance with TWC policies and procedures. Condition: According to the TWC Division of Fraud Deterrence and Compliance Monitoring’s Standard Operating Procedures for Workforce Board PIRTS Audits, when a Workforce Development Board identifies an improper payment, the Board is required to issue a Notice of Determination informing the participant of their ineligibility, the amount and time period of the improper payment, and the reason for the determination. If the improper payment results from fraud, the Board must issue a first collection letter within 30 days of sending the determination notice to initiate recoupment of the ineligible amount. If repayment is not received or an active payment plan is not established, the Board must issue a final collection letter and refer the participant to TWC for a warrant hold, which restricts the individual from receiving future services until the outstanding amount is recovered. All correspondence is to be documented and maintained in the Program Integrity Reporting Tracking System (PIRTS), the system used by Boards to report and track childcare fact‑finding, fraud determinations, and recoupment activities. As part of our audit procedures, we tested 40 of the 297 closed cases reported to TWC in fiscal year 2025 to verify that TWC followed its procedures related to authenticating that a payment was fraudulent and subsequently recovered payment, if applicable. Of the 40 cases tested, 12 cases did not follow the prescribed procedures and lacked evidence that the Workforce Boards issued the required 1st collection letter within the 30‑day timeframe. Questioned costs: None. Context: See “Condition.” Cause: The exceptions identified occurred because TWC did not provide adequate oversight or monitoring of Workforce Board compliance with established PIRTS procedures. Without routine monitoring, follow‑up, or enforcement mechanisms to ensure Boards issued collection letters within required timeframes, lapses in adherence to the 30‑day requirement went undetected. This lack of oversight contributed to inconsistent application of required fraud‑recovery processes across Boards. Effect: Failure to ensure that Workforce Development Boards issued required first collection letters within the prescribed 30‑day timeframe impeded timely initiation of recoupment efforts for fraudulent childcare payments. This condition increases the risk that improper payments resulting from fraud may not be recovered in a timely manner and that individuals with outstanding fraudulent overpayments may continue to seek or receive services. Repeat Finding: No Recommendation: TWC should strengthen its oversight of Workforce Board compliance with PIRTS requirements by implementing routine monitoring procedures to verify that Boards issue first collection letters within the required 30‑day timeframe. This may include periodic reviews of PIRTS documentation, automated tracking or alerts for timeliness, and follow‑up with Boards when deadlines are missed. Additionally, TWC should provide guidance or refresher training to reinforce expectations and ensure consistent application of improper payment recovery procedures across all Boards. Strengthening these oversight mechanisms will help reduce the risk of delayed collection efforts and improve adherence to established fraud‑deterrence processes. Views of responsible officials: The Texas Workforce Commission (TWC) acknowledges and agrees with the finding and concurs with the recommendation. TWC’s Division of Fraud Deterrence and Compliance Monitoring’s Office of Investigations (FDCM/OI) oversees all matters related to fraud, waste, and abuse with respect to Federal programs TWC passes to its subrecipients, primarily the 28 local workforce development boards (Board). This includes the subsidized childcare program provided for in the above-cited Federal awards. FDCM/OI has historically maintained rigorous internal controls to address fraud in all programs. Additionally, TWC’s Subrecipient Monitoring Department (SRM) tests Board compliance with respect to childcare improper payment reporting and recoupment. TWC currently conducts routine monitoring and follow-up to ensure Boards issue collections letters in a timely fashion. That being said, TWC does agree that our objectives would be better served with more robust measures. Currently, FDCM/OI investigators review a sample of PIRTS reports on a monthly basis to ensure that Boards are uploading all required documentation related to childcare improper payments and undertaking collection efforts. Investigators review two randomly selected cases for each Board per month on a rolling basis for the prior three months. FDCM/OI also conducts periodic PIRTS training and retraining with Board staff. Additionally, the PIRTS system sends automated reminder notifications for Board staff to issue collection letters. FDCM/OI realizes the importance of issuing collection letters in a timely matter. Doing so not only increases the likelihood that important child care funds are remitted, but also assists with additional enforcement activities including prosecution of substantiated fraud. FDCM/OI takes the integrity of child care funds very seriously and will aid prosecution where appropriate.

Allowable Costs/Activities Allowed – Personal Services Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Epidemiology and Laboratory Capacity for Infectious Diseases ALN: 93.323 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6 NU50CK000501-01-08, 6 NU50CK000501-02-17 August 1, 2019 – July 31, 2024, August 1, 2019 – July 31, 2027 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of State Health Services (DSHS) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.430 Standards for Documentation of Personnel Expenses, Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by an internal control system that ensures the charges are accurate, allowable, and properly allocated; (ii) be incorporated into the official records of the non-Federal entity; (iii) reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) encompass federally-assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) comply with the established accounting policies and practices of the non-Federal entity; (vi) support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition: DSHS requires its employees to complete monthly time and leave reporting, regardless of whether the employee works solely on a single federal award or cost objective, or on multiple activities or cost objectives. Each employee has a default task profile based on their position in the agency that determines how their payroll and payroll-related dollars are allocated. Employees are instructed and given training on how to report any deviations from their profile as well as report any vacation time, sick time, leave of absence, etc. Employees are required to certify their time by the 10th of the month for the previous months’ time. Like all DSHS employees, supervisors are required to certify their time monthly. However, their time certification includes an additional affirmation which states the supervisor has performed the following:  Reviewed the default task profile/labor account code for each of their direct reports.  Reviewed the timesheets for all direct reports as compared to the default task profiles/labor account codes for accuracy of time worked and adjusted if necessary.  For direct reports who have reported deviations, reviewed and verified the deviations reported and approved the respective timesheet. This documented affirmation provides sufficient documentation to indicate that the supervisors have reviewed after the fact interim payroll and payroll-related charges made to federal awards based on budget estimates. Audit procedures included a selection of 40 payroll-related expenditures incurred during the fiscal year totaling $191,809. For five of the 40 samples selected, the employee supervisor did not certify their monthly timesheet, and thus did not acknowledge neither the review of the employees’ default task profile/account labor code or their timesheets. Questioned costs: None. Context: See “Condition.” Cause: All five of the exceptions noted were directly reporting to the same supervisor. The monthly timesheets selected were during the months of July and August 2024. The supervisor was recently hired in April 2024 and was unaware of the requirement to certify monthly. Effect: Without the supervisor timesheet certification, there is a lack of sufficient documentation to indicate that they have reviewed after-the-fact interim payroll and payroll-related charges made to the federal awards based on budget estimates. Repeat Finding: No Recommendation: DSHS should enhance new hire training policies and procedures to ensure all new hire trainings clearly address labor account codes, monthly time reporting, and task profiles. Views of responsible officials: DSHS has robust timekeeping controls but recognizes this opportunity to enhance training with reinforcement for new supervisors.

Cash Management – Cash Management Improvement Act Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Epidemiology and Laboratory Capacity for Infectious Diseases ALN: 93.323 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6 NU50CK000501, 6 NU51CK000353 August 1, 2019 – July 31, 2024, August 1, 2019 – July 31, 2027, August 1, 2024 – July 31, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of State Health Services (DSHS) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 31 CFR Part 205, a Federal assistance program must abide by the rules in Subpart A, interest calculation procedures, if it falls within the funding threshold set forth by the Federal government. The dollar threshold is calculated using the most recent Single Audit data. Programs not subject to these rules are considered under Subpart B. Rather than incurring an interest liability for programs in Subpart B, the funds transferred to the State will be limited to the immediate cash needs of the agency and should be times so as to minimize the period between drawdown and disbursement. Condition: The State determines each major program subject to interest liability calculations every year and communicates the covered programs to each agency. Funding techniques and clearance patterns are set out in the Treasury-State Agreement. Per the Texas Cash Management Improvement Act (CMIA) Handbook (based on the Treasury-State agreement), each state agency that administers a major program has the following responsibilities including but not limited to the following:  Review flow of funds for affected programs and determine appropriate funding technique.  Develop sample data and calculate clearance days on federal funds from the time of deposit in the State Treasury until warrants are issued on the funds (Period 1).  Comply with the Subpart B requirements for programs not covered by Subpart A. Per the 2024 Texas Treasury-State Agreement, DSHS was required to submit a Period 1 calculation for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program. Audit procedures included selecting a sample of federal cash draws and verifying that the timing of the federal cash draws was in compliance with the applicable funding techniques specified in the Treasury-State Agreement. Cash draws included in the Period 1 calculation submitted to the Texas Comptroller of Public Accounts’ web application totaled $89,236,255; however, the final amount of expenditures reported on the Schedule of Expenditures of Federal Awards (SEFA) for the program was $289,534,627. Accordingly, the Period 1 calculation submission was understated by $200,298,372 and the calculation of the interest obligation owed to or by the federal government was incorrect. Questioned costs: None. Context: See “Condition.” Cause: DSHS made significant adjustments to the SEFA subsequent to the submission of the Period 1 calculation in the Texas Comptroller of Public Accounts’ web application. Once submitted, the web application is locked and DSHS must request for it to be unlocked in order to make revisions. Due to the timing of the adjustments to the SEFA and the conclusion of audit work, DSHS did not have sufficient time to request and submit the revisions. Effect: The calculation of the interest obligation owed to or by the federal government may be misstated if the Period 1 calculation is incorrect. Repeat Finding: No Recommendation: DSHS should enhance reviews of its SEFA to avoid significant adjustments subsequent to the submission of its Period 1 calculation. Views of responsible officials: DSHS acknowledges and agrees with the finding as stated.

Matching and Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster ALN: 93.044 93.045 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2101TXOACM, 2101TXOAHD, 2101TXOASS 10/1/2020 – 9/30/2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 USC 3029(b) Matching funds; percentage limitation (1) For each fiscal year, not less than 25 percent of the non-Federal share of the total expenditures under the State plan which is required by section 3024(d) of this title shall be met from funds from State or local public sources. (2) Funds required to meet the non-Federal share required by section 3024(d)(1)(D) of this title, in amounts exceeding 10 percent of the cost of the services specified in such section 3024(d)(1)(D) of this title, shall be met from State sources. Condition: During our testing of the program’s matching requirements, we noted the following:  HHSC’s required match under 42 USC 3029(b)(1) for the fiscal year 2021 grant, which ended on September 30, 2023, was $979,430. State administration expenditures totaled $3,917,721, of which 25%, or 979,430 must be from non-Federal sources. HHSC provided a population of $1,206,534 of administration expenditures paid from non-Federal sources used to meet the matching requirement. Of this amount, audit procedures included testing 159 expenditures, totaling $771,585 that were paid from non-Federal sources used to meet the 25% matching requirement. We noted that 134 of the expenditures, totaling $744,159 were not administrative costs incurred by the State. Rather these were amounts paid to subrecipients. Accordingly, allowable non-federal expenditures were $462,376, which is less than the required match amount of $979,430 or 13.6% of the of the cost of state plan administration. HHSC did not meet the matching requirement per 42 USC 3029(b)(1). Additionally, the recipient share of expenditures (line j) and the remaining recipient share to be provided (line k) on the corresponding SF_x0002_425 report for 2101TXOASS was incorrectly reported. HHSC reported the recipient share of expenditures of $7,452,949; however, allowable non-federal expenditures were only $6,708,790.  HHSC calculates its required recipient share of expenditures related to the state and Area Agencies on Aging (AAA’s) costs of administration of area plans and reports it on line i of the SF-425 report. For the fiscal year 2021 grant, we noted that while the match amount was met, the required match as reported on the SF-425 was calculated incorrectly as follows: See chart or table in the Schedule of Findings and Questioned Costs.  HHSC’s required match under 42 USC 3029(b)(2) for the fiscal year 2021 grant, which ended on September 30, 2023, was $11,355,969. Of this amount, $3,785,323 was required to be funded from state sources, while the remaining $7,570,646, would be met by amounts paid by the AAA’s. HHSC provided a calculation of $30,107,759 of expenditures incurred to meet the AAA portion of the requirement. However, [the auditor] was unable to substantiate that amount based on supporting documentation as final expenditures submitted by the AAA’s had been revised, however, HHSC did not revise their calculations. Questioned costs: Unknown Context: See “Condition.” Cause: Management calculates matching requirements and identifies actual expenditures to meet these requirements. For the exceptions noted for 42 USC 3029(b)(1), management failed to exclude unallowable expenditures when identifying expenditures incurred to meet the matching requirements. For the exception noted for 42 USC 3029(b)(2), management did not revise the matching calculation based on final amounts received from the AAA’s. Effect: Failure to meet matching requirements may result in a reduction in federal funding. Furthermore, failure to calculate, review, and approve final matching expenditures may lead to noncompliance with the terms of the grant and questioned costs. Repeat Finding: No. Recommendation: We recommend management enhance existing controls around the review of all expenditures that are used to meet the minimum required matching requirements. Views of responsible officials: HHSC concurs with the finding.

Reporting – Financial Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster ALN: 93.044 93.045 93.053 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXOACM 10/1/2021 – 9/30/2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.328(c), the recipient or subrecipient must submit financial reports as required by the Federal award. Per 2 CFR 200.302(b)(2), the recipient's and subrecipient's financial management system must provide for the following: accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. Condition: Audit procedures included a sample of six SF-425 reports submitted during the fiscal year. For the March 31, 2024, report for the 2201TXOACM award, audit procedures included comparing the reported amounts to the general ledger. We noted the following variances: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See “Condition.” Cause: Amounts in the supporting general ledger documentation were accurate. However, the corresponding line items on the SF-425 report were not reported accurately. Management did not revise the March 31, 2024, report as the report is cumulative and the final report for the 2201TXOACM grant will include the corrected amounts. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: No. Recommendation: We recommend management reconcile all amounts reported on the SF-425 reports to the general ledger or other supporting documentation to ensure completeness and accuracy prior to submission. Views of responsible officials: HHSC concurs with the finding.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 SSBG 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes the subrecipient’s unique entity identifier (UEI). Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Temporary Assistance for Needy Families – The UEI was not included in eight of the eight agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2024. Social Services Block Grant –The UEI was not included in one of the 19 agreements selected for testing. The start and end dates for the agreement was January 1, 2021 – August 31, 2024. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR 200 §200.332 prior to execution is not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: 2023-011 Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: HHSC concurs with the finding.

Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Social Services Block Grant 2401TXSOSR October 1, 2023 – September 30, 2025 Block Grants for Community Mental Health Services 1B09SM085994, 6B09SM085994 October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For awards with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. For awards with period of performance end dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: Social Services Block Grant (SSBG) – Audit procedures included testing 40 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,034. Two of the expenditures, totaling $486, were related to costs incurred prior to the period of performance begin date. The Project Period Start Date per the grant award was October 1, 2023, however costs were incurred on September 6, 2023 and September 11, 2023. Block Grants for Community Mental Health Services (MHBG) – Audit procedures included testing 40 sampled transactions, totaling $1,695,512, from projects with period of performance end dates during the fiscal year for which the obligation had not been paid as of the end of the period of performance. Twelve of the expenditures, totaling $312,929, were not paid within 120 days of the period of performance end date, which is the allowed time period to liquidate obligations. The required liquidation date was December 29, 2023; however, these obligations were paid between January 2, 2024 and April 11, 2024. Questioned costs: Social Services Block Grant: $486 Block Grants for Community Mental Health Services: $312,929 Context: See “Condition.” Cause: The two exceptions for SSBG were related to travel costs where the employee’s supervisor approved the transaction, which was coded to the incorrect grant. For the exceptions noted in the liquidation period testing for MHBG, the late payments are due to the HHSC’s reconciliation and closeout process not being performed in a timely manner. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. In addition, costs paid with non-federal sources remain in the population which is being included on the schedule of federal expenditures (SEFA) for the current fiscal year. Repeat Finding: 2023-016 Recommendation: HHSC should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Additionally, HHSC should verify that all obligations incurred are liquidated during the closeout process and adjustments are not made subsequent to closeout. Views of responsible officials: HHSC concurs with the finding.

Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXSOSR October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including:  TANF Funds Transferred into SSBG –Amount reported on this line item should be consistent with the TANF federal financial report (ACF-196R). The Federal Funds Office (FFO) is responsible for the completeness, accuracy, and timely submission of the Post Expenditure Report. Federal Reporting Fiscal Management personnel are responsible for proper reporting and submission of the ACF-196R. Condition: During testing of key line items for the FY2023 Annual Post Expenditure Report submitted in March 2024, we noted that TANF Funds Transferred into SSBG, as reported on the ACF-196R report was $45,104,976, however, the amount reported on the FY2023 Post Expenditure Report was $40,351,905, resulting in a variance of $4,753,071. Questioned costs: None Context: See “Condition.” Cause: FFO did not properly coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196R were consistent with the amount on the Post Expenditure Report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: 2023-013 Recommendation: We recommend the FFO coordinate with the appropriate Federal Reporting Team personnel regarding amounts noted for the TANF Funds Transferred into SSBG to ensure the amount in the Post Expenditure Report matches with the amount in the ACF-196R. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B09SM087345 October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a sample of 40 general disbursements, totaling $440,324, incurred during the fiscal year. For one general disbursement selected, totaling $7,185, there was no evidence of review and approval of the disbursement prior to payment. Total general disbursements, which excludes salaries and benefits and indirect costs, incurred for the program during the fiscal year was $796,639. Questioned costs: None. Context: See “Condition.” Cause: Management did not retain evidence of the approval for this transaction. Effect: Failure to review expenditure transactions pertinent to a federal award and maintain adequate documentation evidencing review may result in noncompliance with grant terms and conditions as well as payment of unallowed costs. Repeat Finding: No Recommendation: HHSC should enforce policies and procedures to ensure all disbursements are reviewed and approved prior to payment. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.

Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control):  Ninety days for applicants who apply for Medicaid on the basis of disability; and  Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.

Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.

Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows:  Methodology(ies) for allocation of expenditures  A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.

Subrecipient Monitoring Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M18-SG480100, M19-SP480100, M20-SG480100 September 12, 2018 – September 1, 2026, and July 12, 2019 – September 1, 2027, August 13, 2020 – September 1, 2028 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (c), TDHCA must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, TDHCA should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Condition: TDHCA maintains a Master Compliance Subrecipient Monitoring (CMSM) Planning Summary (MPS) to track all active subrecipient contracts that have expenditures in the planning phase to evaluate each subrecipient's fraud risk and risk of noncompliance with the subaward to determine the appropriate subrecipient monitoring to be performed. During our testing, we noted three subrecipient contracts with expenditures during the fiscal year were not included on the MPS for evaluation of fraud risk and risk of noncompliance. Accordingly, no determination was made for the appropriate subrecipient monitoring to be performed for these subrecipients. Questioned costs: None. Context: See “Condition.” Cause: The preparation of the MPS is a manual process wherein a senior analyst identifies the active contracts that have expenditures in the planning phase. The subrecipients were inadvertently omitted due to oversight. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TDHCA establish internal controls that require a review to be completed over the completeness and accuracy of the MPS by an individual other than the preparer. Views of responsible officials: Compliance Subrecipient Monitoring (CMSM) has historically utilized the Department’s Housing Contract system to populate its risk population. “Active” contracts with expenditures are selected for risk consideration while “Expired”, “Closed” or unexpended contracts are excluded to promote internal efficiency in the monitoring process. During interviews with the auditor and the Department’s HOME staff, it was identified that there are circumstances where “Expired” or “Closed” contracts may demonstrate expenditure activity and inadvertently exclude contracts that could be included for risk consideration. Of note, this system generated discrepancy has not contributed to a material variance in contracts considered for risk assessment.

Special Tests and Provisions – Housing Quality Standards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Home Investment Partnerships Program ALN: 14.239 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: M16-SG480100, M18-SG480100, M19-SG480100, M20-SG480100, M21SG480100, M21-SP480100 August 3, 2016 – September 1, 2024, September 12, 2018 – September 1, 2026, July 17, 2019 -September 1, 2027, August 13, 2020 – September 1, 2028, July 30, 2021 – September 1, 2029, September 20, 2021 – September 30, 2030 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), the Texas Department of Housing and Community Affairs (TDHCA) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per CFR 92.504(d)(1)(ii)- Ongoing periodic inspections of HOME-assisted rental housing. During the period of affordability, the participating jurisdiction must perform on-site inspections of HOME-assisted rental housing to determine compliance with the property standards of § 92.251 and to verify the information submitted by the owners in accordance with the requirements of § 92.252. The inspections must be in accordance with the inspection procedures that the participating jurisdiction establishes to meet the inspection requirements of § 92.251. Per CFR 92.504(d)(1)(ii)(A)- The on-site inspections must occur within 12 months after project completion and at least once every 3 years thereafter during the period of affordability. Condition: Audit procedures included testing seven multifamily and 38 single family home properties to verify whether on-site inspections of the HOME-assisted rental property had been completed at least once every 3 years during the period of affordability. During our testing, we noted that one of the seven multifamily property’s last inspection was completed on March 6, 2020. Questioned costs: None. Context: See “Condition.” Cause: The on-site inspection was not completed due to management oversight. Effect: Failure to complete proper inspections over HOME assisted properties may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend that TDHCA strengthen its internal controls to ensure that all properties are inspected at least once during every three years of the period of affordability. Views of responsible officials: Compliance Monitoring Section (CMS) has historically utilized reports from the Compliance Monitoring Tracking System (CMTS) to generate a list of properties to inspect. The list of properties to inspect are then broken up into trips using Excel and assigned to physical inspection staff. During the review, the auditor identified a HOME-rental property that was not inspected within the required three (3) year period. The CMTS system correctly identified the property for timely inspection; the oversight was an internal error in the planning process.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement Program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3–48–SBGP–148–2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TxDOT) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of 40 expenditures, totaling $9,426,808, to test allowability with grant awards. We noted that for one of the 40 samples, TxDOT overpaid an invoice to a vendor by $70,000. Upon detection by the vendor, TxDOT corrected the overpayment by reducing a subsequent payment to the vendor by the $70,000. Questioned costs: None Context: See “Condition.” Cause: The amount requested to be reimbursed was manually entered incorrectly in eGrants. TxDOT did not detect the discrepancy during the review and approval process prior to the payment. Effect: Failure to thoroughly review invoices prior to payment may lead to overpayment or underpayment of funds to vendors and potential questioned costs. Repeat Finding: No Recommendation: We recommend that TxDOT provide additional training to individuals performing reviews of expenditures. We also recommend TxDOT establish internal controls to monitor that reviews of expenditures are being completed to the level of detail required by internal policies and procedures. Views of responsible officials: TxDOT AVN agrees with the finding.

Reporting – Financial Reporting Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 3-48-SBGP-147-2022 September 14, 2022 – September 13, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Department of Transportation (TXDOT): Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TXDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.328(c), the recipient or subrecipient must submit financial reports as required by the Federal award. Per 2 CFR 200.302(b)(2), the recipient's and subrecipient's financial management system must provide for the following: accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. Condition: Audit procedures included a sample of five SF-425, Federal Financial Reports submitted during the fiscal year. For the SF-425 report for the 3-48-SBGP-147-2022 grant award submitted on March 6, 2024, we noted TXDOT did not report the recipient share of expenditures required. The recipient share of expenditures was incurred for the project; however, they were inadvertently omitted from the report. Questioned costs: None Context: See “Condition.” Cause: TXDOT prepares financial reports based on expenditures reported in its Peoplesoft system. The project for grant 3-48-SBGP-147-2022 was set up as 100% federal as the match was being met by the subrecipient. As such, TXDOT was reimbursing the subrecipient at 100% while the subrecipient met the 10% match with local funds. Accordingly, the matching funds, as incurred by the subrecipient, were not considered when preparing and reviewing the SF-425 report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: No Recommendation: We recommend management enhance its internal controls over the review and approval of the SF-425 reports to include a review of the grant award to ensure the subrecipient share of expenditures are reported properly reported. Views of responsible officials: TxDOT AVN agrees with this finding.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Transportation Federal Program Title: Airport Improvement program ALN: 20.106 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), TxDOT must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TxDOT is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: As the direct recipient of grant funding, TxDOT is responsible for reporting first-tier subawards of $30,000 or more in FSRS. Audit procedures included testing 9 subawards made during the fiscal year for FFATA requirements. During our testing, we noted that there was no segregation of duties in the FFATA reporting process as the same employee was preparing and submitting the reports. During our testing, we also noted the following compliance exceptions: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None Context: See “Condition.” Cause: FFATA reports are prepared quarterly rather than monthly. This leads to reports being noncompliant if they are awarded in a month other than the quarter-ending month. Furthermore, TXDOT's policies and procedures do not require a review of FFATA reports prior to submission. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Improperly designed internal controls over reporting may result in a misstatement of amounts reporting on federal reports. Repeat Finding: No Recommendation: We recommend that TXDOT update its policies and procedures to (a) require monthly submission of FFATA reports and (b) establish review and approval of FFATA reports by a person other than the person preparing the report. Views of responsible officials: TxDOT AVN agrees with this finding.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles – Personal Services Federal Agency: U.S. Department of Labor Federal Program Title: Employment Service Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: DV373362255548–01, 23555DV000036–01, 24555DV000076–01 October 1, 2021 – December 31, 2023, October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Nonompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Per 2 CFR 200.430 Standards for Documentation of Personnel Expenses, Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient; (iii) Reasonably reflect the total activity for which the employee is compensated by the recipient or subrecipient, not exceeding 100 percent of compensated activities (iv) Encompass federally-assisted and all other activities compensated by the recipient or subrecipient on an integrated basis but may include the use of subsidiary records as defined in the recipient's or subrecipient's written policy; (v) Comply with the established accounting policies and procedures of the recipient or subrecipient (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition: Audit procedures included a sample of 40 expenditures for incurred for personnel services during the fiscal year to test whether the expenditures for salaries and wages were allowable and based on the records that accurately reflect the work performed. We noted that TVC prepares monthly budget reports that are reviewed by the program’s budget analyst and the respective program director or manager. Expenditures related to personnel services are recorded based on the budgeted amount for each individual. No periodic after-the-fact review is performed to verify that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Questioned costs: None Context: See “Condition.” Cause: The employees working on the federal grant program are budgeted to work on the grant 100% of their time. Management deemed this sufficient to substantiate the final amounts charged to the grant. Effect: Lack of a periodic after-the-fact review to verify that the final amounts charged to the Federal award are accurate, allowable, and properly allocated may result in noncompliance with grant terms and conditions and questioned costs. Repeat Finding: No Recommendation: We recommend that management establish procedures and internal controls to perform an after-the-fact review of personnel services to verify that the final amounts charged to the Federal award are accurate, allowable, and properly allocated. This can be accomplished by a supervisor’s review and approval of the employee’s timesheet each pay period or an annual review where necessary adjustments are made. Views of responsible officials: TVC agrees to the recommendation of documenting review and approvals. To note, the monthly Veteran Employment Services (VES) Forecasts and Payroll reports had been reviewed with VES’s Director and/or Operations Manager as well as VES’s Annual State Plan before submission to the U.S. Department of Labor. VES’s Director or Operations Manager’s signature of approval was never documented for confirmation of review.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles – Indirect Costs Federal Agency: U.S. Department of Labor Federal Program Title: Employment Service Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23555DV000036 – 01, 24555DV000076 – 01 October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.403, except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. (d) Be accorded consistent treatment. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for State and local governments and Indian Tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing requirements of any other federally – financed program in either the current or a prior period. (g) Be adequately documented. Condition: Audit procedures included a sample of five indirect cost expenditures, totaling $1,248,175, incurred during the fiscal year to verify that the rates used were in accordance with the terms and conditions of the award and the amounts claimed were applied to the appropriate base. During our testing, we noted one sample in which an incorrect rate was applied to the base, resulting in $69,481 of unallowed indirect costs. In addition, there was no evidence of review and approval for three of the five expenditures selected for testing, including the expenditure noted in the preceding paragraph. Questioned costs: $69,481 Context: See “Condition.” Cause: Management failed to retain documentation that would support the review and approval of the indirect cost amounts. The exceptions were caused due to high turnover within the agency. Employees who were responsible for the approvals are no longer employed through TVC. Effect: Lack of formal documentation of reviews may result in questioned costs. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TVC enforce establish document retention processes to ensure it has access to documentation for review in the event of management turnover. In addition, we recommend TVC strengthen its controls over the review of the indirect cost calculations to ensure accuracy of costs being calculated. Views of responsible officials: TVC agrees to the recommendation of improved record retention in the event of management turnover. TVC also agrees to the recommendation of strengthening its internal controls over the review of VES’s grant costs associated with the indirect revenues being calculated.

Reporting Federal Agency: U.S. Department of Labor Federal Program Title: Employment Services Cluster ALN: 17.207, 17.801 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23555DV000036 – 01, 24555DV000076 – 01 October 1, 2022 – December 31, 2024, October 1, 2023 – December 31, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Veterans Commission (TVC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included testing of five SF – 425 Federal Financial Reports and five VETS –402 (A/B) Expenditure Detail Reports that were submitted during the fiscal year. During our testing, we noted the following:  SF-425 Federal Financial Reports – there was no evidence of review and approval of the report prior to submission for four of the five reports.  VETS-402 (A/B) Expenditure Detail Reports – there was no evidence of review and approval of the report prior to submission for four of the five reports. Questioned costs: None Context: See “Condition.” Cause: Employees who were responsible for the approvals are no longer employed at TVC. Management was unable to locate documentation that would support the review and approval of reports. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend TVC enforce establish document retention processes to ensure it has access to documentation for review in the event of management turnover. Views of responsible officials: TVC agrees to the recommendation of establishing a document retention process in the event of management turnover.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Labor Federal Program Title: Workforce Innovation and Opportunity Act Cluster ALN: 17.258, 17.259, 17.278 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 23A55AY000040–01–00 April 1, 2023 – June 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Workforce (TWC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TWC is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: As the prime recipient of grant funding, TWC is responsible for reporting first-tier subawards of $30,000 or more in FSRS. Audit procedures included testing 59 subawards made during the fiscal year for FFATA requirements, including subawards made by Texas Education Agency (TEA) using state pass through funds from TWC. TWC passed through $3,000,000 of federal grant funds to TEA who in turn made 33 subawards totaling $2,911,755. Based on Part 3 of the 2024 compliance supplement, transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship. Accordingly, subawards made by TEA should be reported in FSRS by TWC as the prime recipient. The following compliance exceptions were identified: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None Context: See “Condition.” Cause: TWC considered the funds passed through to TEA as a subaward and reported these amounts in FSRS. However, as TEA is an agency of the State of Texas, it does not meet the definition of a subrecipient. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Repeat Finding: No Recommendation: We recommend that, as the prime recipient, TWC coordinate with state pass through entities to obtain the information needed for FFATA reporting in order to be compliant with FFATA requirements. Views of responsible officials: In this situation, TWC disagrees with the applicability of the following statement “Transfers of federal awards to another component of the same auditee under 2 CFR Part 200, Subpart F, do not constitute a subrecipient or contractor relationship” from the Fiscal Year 2024 2 CFR Part 200, Appendix XI Compliance Supplement. According to 2 CFR Part 170, TWC is required to report first-tier subawards. In the case of TWC and TEA, there is an Interagency Agreement Contract (IAC) which designates TEA as a subrecipient of TWC making TEA a first_x0002_tier grantee of TWC. Neither TWC nor TEA considers this funding a “transfer.” The definition of a pass-through entity according to 2 CFR Part 200, means a recipient or subrecipient that provides a subaward to a subrecipient (including lower tier subrecipients) to carry out a federal program. In the case of TWC and TEA, there is an Interagency Agreement Contract (IAC) that establishes a relationship that would not be considered a transfer but a first tier subaward. The IAC establishes TWC as a pass-through entity and TEA as a subrecipient per the definitions of these terms in 2 CFR 200.1. Under the requirements for pass-through entities at 2 CFR 200.332, TWC is responsible for monitoring TEA performance under this subaward which may include enforcement under 2 CFR 200.339 and the recovery of costs associated with subrecipient noncompliance. This contractual consideration and possibility of repayment supports that this relationship is one of pass-through and subrecipient, and not a transfer of a federal award to another component of an auditee. As such, subawards made by TEA are in fact second tier subawards for TWC and TWC has no obligation to report them as established in Appendix A 2 CFR Part 170. The Federal Funding Accountability and Transparency Act of 2006 (FFATA) was passed in the vein of openness and transparency to the public as it relates to Federal spending. Reporting on first-tier subawards took effect October 1, 2010. (See OMB Memorandum for Senior Accountable Officials, “Open Government Directive–Federal Spending Transparency and Subaward and Compensation Data Reporting,” August 27, 2010.) FFATA, § 2—Full Disclosure of Entities Receiving Federal Funding, directed the Office of Management and Budget to “ensure the existence and operation of a single searchable website, accessible by the public at no cost to access, that includes for each Federal award—(A) the name of the entity receiving the award” and other specified information. (See Public Law 109-282, §2(b).) That website is USASpending.gov. On that website, a search by “recipient” does not have an option to search for “State of Texas.” Rather, the search options individually list the Texas Workforce Commission and other Texas state agencies as separate recipients. When TWC makes an interagency pass-through contract to another state agency, TWC has always treated that other state agency as first-tier subrecipient for FFATA reporting purposes. That decision was based on guidance and interpretation of information available when the FFATA subaward reporting requirements took effect in 2010. TWC has continued in that manner with no audit finding on that approach until now. If TWC adheres to the recommendation made by this finding, the public will no longer have access to the interagency contract amounts through USASpending.gov. The USASpending.gov data presented to the public will instead indicate that the subrecipients of another state agency received subawards directly from TWC, which is inaccurate, will make the USASpending.gov data of the other state agency incomplete, and will cause the USASpending.gov data to be inconsistent with both state agencies’ presentation of those subawards in their respective systems and financial statements. In effect, the USASpending.gov data will represent the subawards of the other state agency as TWC’s subrecipients, while TWC’s systems and financial statements will have no record of those subawards beyond FFATA reporting. Similarly, the other state agency’s systems and financial statements will reflect those subawards as its own, but with no related reflection of that relationship in USASpending.gov. If the public were to submit an open records request about the subawards, the State’s response would be delayed by one state agency collecting data from the other, and inconsistent with the public’s expectation as to which state agency issued and managed those subawards. Those effects seem inconsistent with FFATA’s openness and transparency goals.

Period of Performance, Procurement, Suspension and Debarment, Reporting – Information Technology – Logical Security Federal Agency: U.S. Department of Education Federal Program Title: Rehabilitation Service – Vocational Rehabilitation Grants to States ALN: 84.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: H126A220092, H126A230092, H126A240092 October 1, 2021– September 30, 2023, October 1, 2022 – September 30, 2024, and October 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Workforce Commission (TWC) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that TWC is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: RehabWorks is TWC’s electronic case management system for the Vocational Rehabilitation program. Capabilities of the application include the ability to create service records (requisitions), generate service authorizations (purchase orders) and payment authorizations so that program expenditures are attributed to the casefile of the customer on whose behalf the goods or services were purchased in accordance with Federal regulations and the terms of the grant. During our testing of the information technology general controls of RehabWorks, we noted that TWC did not have proper segregation of duties to prevent developers of the application to promote their own changes into the production environment. Six of the 15 RehabWorks developers had access to production functions within the application. Access to migrate changes to the production environment should be restricted appropriately and based on job function to help ensure adequate internal controls are in place and appropriate segregation of duties exist. In general, developers should not have access to migrate changes to the production environment and should not have access privileges above read-only in the application. Questioned costs: None Context: See “Condition.” Cause: TWC’s information technology policies and procedures do not limit the number of developers who have access to production functions within the RehabWorks application. Effect: Failure to segregate user access may result in data loss, alteration or destruction of production data and/or disruption of operations. Repeat Finding: No Recommendation: We recommend that TWC ensure that logical access to promote code changes to production should be limited to mitigate the risk of unapproved changes being implemented in production which may result in data loss, alteration or destruction of production data and/or disruption of operations. Views of responsible officials: TWC’s IT leadership agrees with this observation.

Procurement, and Suspension and Debarment Federal Agency: U.S. Department of Education Federal Program Title: Rehabilitation Services – Vocational Rehabilitation Grants to States ALN: 84.126 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: H126A220092, H126A230092, H126A240092 October 1, 2021– September 30, 2023, October 1, 2022 – September 30, 2024, and October 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), Texas Workforce Commission (TWC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.214, recipients and subrecipients are subject to the nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, as well as 2 CFR part 180. The regulations in 2 CFR part 180 restrict making Federal awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from receiving or participating in Federal awards. Per 2 CFR 180.505 – Who uses SAM.gov Exclusions? (a) Federal agency officials use SAM.gov Exclusions to determine whether to enter into a transaction with a person, as required under § 180.430. (b) Participants also may, but are not required to, use SAM.gov Exclusions to determine if: (1) Principals of their transactions are excluded or disqualified, as required under § 180.320; or (2) Persons with whom they are entering into covered transactions at the next lower tier are excluded or disqualified. (c) The SAM.gov Exclusions are available to the general public. Condition: TWC’s Procurement and Contract Management Handbook (Revised April 2024) states that vendor compliance verifications include checking the Comptroller’s vendor performance tracking system, debarment, federal database checks and other verifications. A vendor that fails a verification may not move forward in the evaluation process and receive a contract award. Audit procedures included testing 34 procurements during the fiscal year to test whether vendor compliance verifications were completed prior to entering into a covered transaction. During our testing, we noted the following instances of noncompliance:  For one procurement, the vendor compliance verification was completed for the incorrect vendor. A search was completed for the director of the organization rather than the legal entity name.  For four of the procurements, a valid date stamp was not available to confirm the verification was completed prior to entering into a covered transaction. Questioned costs: None Context: See “Condition.” Cause: Individuals performing the vendor compliance checks were not adequately trained on the requirements and timeline that must be adhered to per TWC’s Procurement and Contract Management Handbook and federal guidelines. Effect: Failure to complete proper vendor compliance checks prior to entering into a covered transaction may lead to entering into contracts with suspended or disbarred vendors that could result in noncompliance and questioned costs. Repeat Finding: No Recommendation: We recommend that TWC provide additional training to individuals performing vendor compliance checks. We also recommend TWC establish internal controls to monitor that vendor compliance checks are being completed accurately and timely. Views of responsible officials: TWC’s Procurement and Contract Management (PCS) agrees with the recommendations.

Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Defense; National Science Foundation; and U.S. Department of Health and Human Services Assistance Listing Number: See below Pass-Through Agency: Texas A&M University Health Science Center; and Harvard University Award Number: See below Award Period: See below Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No A recipient’s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; indication of who holds the title; acquisition date; cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). A control system must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of the equipment. Any loss, damage, or theft must be investigated (Title 2, CFR, Section 200.313(d)(3)). The Engineering Experiment Station did not maintain accurate and complete property records for 3 (5 percent) of 63 equipment items tested. Specifically:  For two items, the property records contained incorrect locations. The errors occurred because the Engineering Experiment Station either (1) did not enter property records accurately and completely into its asset management system or (2) did not always follow its policies and procedures to update property records as needed.  The Engineering Experiment Station was not able to locate one item selected for testing. As a result, the institution could not demonstrate that the item was properly safeguarded. After auditors brought the issue to the Engineering Experiment Station’s attention, the institution filed a missing or stolen property report. Not maintaining accurate and complete property records and not adequately safeguarding equipment increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the equipment issues discussed above: See chart or table in the Schedule of Findings and Questioned Costs. Recommendation: The Engineering Experiment Station should strengthen controls to ensure that it:  Maintains accurate and complete property records for all equipment acquired with federal funds.  Adequately safeguards its equipment to prevent loss or theft of equipment. Views of Responsible Officials: The Texas A&M Engineering Experiment Station (TEES) acknowledges and agrees with the finding. TEES will work to develop and implement corrective action to further improve processes.

Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Defense; National Aeronautics and Space Administration; National Science Foundation; U.S. Department of Energy; and U.S. Department of Health and Human Services Assistance Listing Number: See below Pass-Through Agency: Southern States Energy Board; and Universities Space Research Association Award Number: See below Award Period: See below Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2021-103, 2018-109, 2015-134, 2014-155, 2013-176, 13-161, and 12-170 A recipient’s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; indication of who holds the title; acquisition date; cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). A control system must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of the equipment. Any loss, damage, or theft must be investigated (Title 2, CFR, Section 200.313(d)(3)). In addition, The University of Texas at Austin’s (University) Handbook of Business Procedures requires that a university inventory barcode (asset tag) be affixed to capitalized or controlled equipment items and the required information be submitted to Inventory Services for processing within 30 days of receipt of equipment. The University did not maintain accurate and complete property records for 12 (19 percent) of 63 equipment items tested. For one item discussed below, the property record contained multiple errors. Specifically:  For six items, the property records contained either no or incorrect serial numbers. Additionally, for two of those items the asset tag numbers located on the items did not match the asset tag numbers in the property records.  For four items, the property records contained incorrect locations. For three of those items, the locations in the property records did not match the current on-campus locations. For the other item, the location in the property record was not updated to indicate that the item had been relocated to Hawaii.  For two items, the property records contained generic default information because the University did not follow its policy to submit the required information to Inventory Services for processing within 30 days of receipt of items.  For one item, the property record indicated the item was in service. However, the item was transferred to the sponsor and the status was not updated in the property record. Those errors occurred because the University either (1) did not enter property records accurately and completely into its asset management system or (2) did not always follow its policies and procedures to update property records as needed. The University relies on unit administrators within each department to provide the required information in the equipment property records. In addition, the University did not follow its process to affix an asset tag for 6 (10 percent) of 61 equipment items tested. Specifically:  For three items, the asset tags were affixed by the University at the time of testing.  For two items, the asset tags could not be located.  For one item, the asset had been relocated to Hawaii and the University could not provide evidence to demonstrate that the asset was appropriately tagged and adequately safeguarded. Not maintaining accurate and complete property records and not adequately safeguarding equipment increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the equipment issues discussed above: See chart or table in the Schedule of Findings and Questioned Costs. Recommendation: The University should strengthen its controls to ensure that it:  Maintains accurate and complete property records for all equipment acquired with federal funds.  Adequately safeguards its equipment to prevent loss or theft of equipment.  Appropriately affixes asset tags to equipment in accordance with its policies and procedures. Views of Responsible Officials: The University acknowledges and agrees with the audit findings. The University will work with the individual departments to improve their understanding of inventory policies and procedures and stress the importance of maintaining accurate records.

Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Defense; and U.S. Department of Health and Human Services Assistance Listing Number: See below Pass-Through Agency: N/A Award Number: See below Award Period: See below Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2021-105 A recipient’s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; indication of who holds the title; acquisition date; cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). The University of Texas Health Science Center at San Antonio (Health Science Center) did not maintain accurate property records for 4 (6 percent) of 62 equipment items tested. Specifically:  For three items, the property records contained incorrect locations. For the first item, the location was not updated when it was moved during a renovation. For the second item, the location was not updated when the department moved to a different floor in the building. For the third item, the property record did not reflect the item’s current location. These errors occurred because the Health Science Center staff responsible for the equipment did not update the property control department when the items were moved.  For one item, the property record contained an incorrect serial number due to a manual entry error. Not maintaining accurate and complete property records increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the equipment issues discussed above: See chart or table in the Schedule of Findings and Questioned Costs. Recommendation: The Health Science Center should strengthen controls to ensure that it maintains accurate property records for all equipment acquired with federal funds. Views of Responsible Officials: UT Health-San Antonio acknowledges and agrees with the finding.

General Controls. The following compliance areas were impacted: Activities Allowed or Unallowed Allowable Costs/Cost Principles Cash Management Equipment and Real Property Management Period of Performance Procurement and Suspension and Debarment Subrecipient Monitoring Special Tests and Provisions – Key Personnel Federal Program Title: Research and Development Cluster Federal Agency: Federal agencies that award Research and Development Cluster funds Assistance Listing Number: Multiple Pass-Through Agency: N/A Award Number: Multiple Award Period: Multiple Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Medical Branch at Galveston (Medical Branch) did not appropriately maintain certain systems it uses to manage its federal research and development awards. The Medical Branch asserted that the maintenance was postponed as the institution was evaluating the most effective approach for implementing certain upgrades. Not ensuring that systems are updated and supported increases the risk of data loss or security breaches. After auditors brought the issue to the institution’s attention, the Medical Branch asserted that the appropriate maintenance was obtained. Recommendation: The Medical Branch should ensure that all systems used to manage federal awards are appropriately maintained and supported. Views of Responsible Officials: Management agrees with the auditor’s recommendation. Through analysis of the exceptions identified in the audit, the University implemented corrective action to reinstate maintenance and support.

Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Defense; and U.S. Department of Health and Human Services Assistance Listing Number: See below Pass-Through Agency: VaxDesign Award Number: See below Award Period: See below Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No A recipient’s property records for equipment acquired with federal funds must be maintained accurately and include all of the following: a description of the equipment; serial number or other identification number; the source of funding for the equipment, including the federal award identification number; indication of who holds the title; acquisition date; cost of the equipment; the percentage of federal participation in the cost of the equipment; the location, use, and condition of the equipment; and ultimate disposition data, including the date of disposal and sale price (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(1)). A control system must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of the equipment. Any loss, damage, or theft must be investigated (Title 2, CFR, Section 200.313(d)(3)). The Medical Branch did not maintain accurate property records for 3 (5 percent) of 61 equipment items tested. Specifically:  For two items, the property records contained incorrect locations. For one item, the location in the property record did not match the current location. For the second item, the location in the property record was not updated with the new room number after a renovation was completed.  For one item, the property record contained a serial number that was recorded incorrectly. In addition, the Medical Branch was unable to locate 8 (13 percent) of 61 equipment items selected for physical inspection. The Medical Branch asserted that the items were transferred to a surplus warehouse in preparation for disposal. However, the Medical Branch was not able to locate those items for testing because it did not have a process in place to track items in the warehouse. As a result, the Medical Branch was not able to demonstrate that those items were adequately safeguarded. Not maintaining accurate and complete property records and not adequately safeguarding equipment increases the risk that equipment may be misused, lost, or stolen. The following awards were affected by the issues discussed above: See chart or table in the Schedule of Findings and Questioned Costs. Two awards were affected by the issues discussed above; however, due to the age of the assets, the award information was no longer available. Recommendation: The Medical Branch should strengthen controls to ensure that it:  Maintains accurate and complete property records for all equipment acquired with federal funds.  Adequately safeguards and tracks all equipment sent to its surplus warehouse until appropriate disposition of that equipment. Views of Responsible Officials: Management agrees with the auditor’s recommendation.

Equipment and Real Property Management Federal Program Title: Research and Development Cluster Federal Agency: U.S. Department of Defense; National Aeronautics and Space Administration; National Science Foundation; and U.S. Department of Health and Human Services Assistance Listing Number: 12.000; 43.000; 47.000; and 93.000 Pass-Through Agency: University of Washington; Northwestern University; University of Toronto; The University of Texas at Arlington; Duke University Medical Center; Medical College of Wisconsin; Rogosin Institute Centers for Medical Research; University of Pittsburgh; Mayo Clinic; University of Pennsylvania; Yale University; University of California, San Diego; and University of Southern California Award Number: Multiple Award Period: Multiple Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No A recipient must conduct a physical inventory of equipment and reconcile the results with its property records at least once every two years (Title 2, Code of Federal Regulations (CFR), Section 200.313(d)(2)). A control system also must be developed to ensure that adequate safeguards are in place to prevent loss, damage, or theft of equipment. Any loss, damage, or theft of equipment must be investigated (Title 2, CFR, Section 200.313(d)(3)). Based on an analysis of a population of 1,330 federal assets, The University of Texas Southwestern Medical Center (Medical Center) did not perform a physical inventory for 257 (19 percent) of those items as required. Although the Medical Center had a process in place to monitor the most recent date each asset was inventoried, the process was not sufficient to ensure a complete physical inventory of all assets was conducted at least once during fiscal years 2023 and 2024. Not performing a biennial inventory of all assets increases the risk that equipment purchased with federal funds may be lost, stolen, or improperly disposed. Recommendation: The Medical Center should strengthen controls to ensure that a complete physical inventory of equipment is conducted at least once every two years. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXTANF, 2301TXTAN3, 2201TXTANF, 2201TXTAN3, 2101TXTANF, 2101TXTAN3 October 1, 2022 – September 30, 2023, October 1, 2021 – September 30, 2022, and October 1, 2020 – September 30, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to United States Codes, Chapter 8 Aliens and Nationality, Chapter 14 – Restricting Welfare and Public Benefits of Aliens, §1611 Aliens who are not qualified aliens ineligible for Federal public benefits is as follows: (a) In general notwithstanding any other provision of law and except as provided in subsection (b), an alien who is not a qualified alien (as defined in section 1641 of this title) is not eligible for any Federal public benefit (as defined in subsection (c)). Condition: According to the DFPS’s Child Protective Services Handbook 2720 Responding to the Eligibility Statements CPS June 2020, IMPACT automatically makes the Emergency Assistance (EA) Eligibility Application/Determination section available when the caseworker completes the Risk Assessment tool and the risk level is ‘high’ or ‘very high.’ The caseworker completes this section, which contains three statements that each require a response of ‘YES’ in order for the child to be eligible for EA benefits. For one of 40 payments to program participants, we noted one of the three statements was answered ‘NO’ in IMPACT, which should have resulted in the determination that the child does not meet the emergency assistance eligibility criteria. However, the child and family were technically eligible for EA at closure of the investigation stage based on documentation. DFPS’s sandbox database reflects a conclusion that the child does meet the emergency assistance eligibility criteria indicating that the three statements had a response of ‘yes ‘at the time of stage closure. However, we were unable to verify a response of ‘yes’ for all three statements in IMPACT. Additionally, during our testing of 40 individual payments to program participants, we noted one participant being eligible based on the EA eligibility criteria in IMPACT. However, the child was not a U.S. citizen, qualified alien, or permanent resident and was ineligible to receive EA benefits. Questioned costs: $842.18. Context: See “Condition.” Cause: Exception related to statements in IMPACT was caused by system limitations. Exceptions related to eligibility determinations were due to management oversight. Effect: Failure to review and maintain accurate information may result in payments made to ineligible participants or overpayments to eligible participants. Repeat finding: 2022-002 Recommendation: DFPS should strengthen its internal controls and remedy system limitations to ensure accurate data is maintained in IMPACT. DFPS should also strengthen its internal controls over eligibility determinations. Views of responsible officials: DFPS acknowledges the incorrect EA Eligibility Determination was marked for question #2 in the EA Eligibility Application/Determination section in IMPACT. The caseworker marked no, but the answer should have been marked yes. Despite this system-generated discrepancy, interviews with family that were documented in the investigation report, did confirm the child was genuinely eligible for Emergency Assistance (EA). Notably, the child did not receive funding during the initial year but was later deemed eligible upon recertification a year later, without a clear understanding of the root cause for why the child was determined to be eligible at recertification. Citizenship: DFPS acknowledges the child was determined to be Emergency Assistance (EA) eligible based on (EA) eligibility criteria in IMPACT. DFPS also agrees the child was a not a US Citizen and therefore was not eligible to receive EA Benefits.

Special Tests and Provisions – Control, Accountability, and Safeguarding of Vaccines and Special Tests and Provisions – Record of Immunization – Information Technology – User Access Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Immunization Cooperative Agreements ALN: 93.268 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6 NH23IP922616 July 1, 2019 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: DSHS utilizes the Child Health Reporting System (CHRS) to track immunizations for childcare, daycares, and colleges. Providers that administer immunizations upload required information into the system for DSHS to meet reporting requirements. During our testing, we noted that the user provisioning process for CHRS does not require formal documentation for requesting and approving system access. Questioned costs: None. Context: See “Condition.” Cause: DSHS does not have established policies and procedures that require a formal request and approval for system access to CHRS. Effect: Failure to complete formal requests and approvals for system access increases the risk of unauthorized users and suspicious activities that may not be identified and investigated. Repeat finding: 2020-027 Recommendation: We recommend that DSHS implement enhanced procedures to ensure that new hire provisioning procedures are approved before access is granted. Views of responsible officials: The remaining portion of this prior year finding addresses only CHRS. CHRS is a system currently used by public and private schools to enter non-confidential, aggregate data eventually posted to the internet as part of the Annual Report of Immunizations Status. Within DSHS, internal CHRS users are from the Infectious Disease Prevention Division and the Vision, Hearing, Spinal Screening (VHSS) program within the Community Health Improvement Division. Access for these users is provisioned as part of the DSHS new hire process. Because CHRS does not contain confidential information, Immunization and VHSS staff want to make the process for schools to enter aggregate data as uncomplicated as possible.

Special Tests and Provisions – Control, Accountability, and Safeguarding of Vaccines Special Tests and Provisions – Record of Immunization Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Immunization Cooperative Agreements ALN: 93.268 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 6 NH23IP922616 July 1, 2019 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Texas Vaccines for Children (TVFC) staff perform compliance visits to assess, support, and educate the site regarding TVFC policies and procedures. Compliance visits must be directly entered in PEAR while the review is being conducted. At the conclusion of a compliance visit, the DSHS Public Health Region (PHR) or Quality Assurance (QA) contractor reviewer must discuss the visit’s outcomes with the vaccine coordinator. The discussion must include a review of the site visit findings and a formal follow-up plan with a timeline addressing noncompliance issues or opportunities for improvement. Monthly reports are run from PEAR to ensure all provider audits are being conducted within a 24-month timeframe. When pulling the monthly report of issues/deficiencies, TVFC staff also review to see that follow-up activities have been completed on time. During fiscal year 2023, review and verification of follow up activities for site reviews conducted by TVFC staff were not formally documented. Thus, we were unable to verify that the reviews were being conducted. Questioned costs: Unknown. Context: See “Condition.” Cause: Internal controls surrounding the site visits conducted are not formally documented. Effect: Lack of formal documentation of reviews may result in missed follow-up actions and potential noncompliance. Repeat finding: No Recommendation: TVFC staff should formally document the review of site visit results, including any relevant follow-up actions, to retain documentation of compliance. Views of responsible officials: DSHS agrees formal documentation of TVFC site visits and site-visit reviews would improve the process.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Homeland Security Federal Program Title: Disaster Grants-Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: FEMA-4332-DR, FEMA-3540-DR, FEMA-4485-DR, FEMA-4586-DR 2017, 2020, 2020, 2021 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Federal Emergency Management Agency (FEMA) evaluates the eligibility of all costs claimed by the applicant. Not all costs incurred as a result of the incident are eligible. Chapter 4 of the Public Assistance Program and Policy Guide states that to be eligible, costs must be:  Directly tied to the performance of eligible work.  Adequately documented.  Reduced by all applicable credits, such as insurance proceeds and salvage values. Authorized and not prohibited under federal, state, territorial, tribal, or local government laws or regulations.  Consistent with applicant’s internal policies, regulations, and procedures that apply uniformly to both federal awards and other activities of the applicant; and  Necessary and reasonable to accomplish the work properly and efficiently. Condition: Audit procedures included a sample of 60 expenditures, totaling $97,118,451, incurred during the fiscal year to validate allowability with the grant award. DSHS was unable to provide the project worksheets for seven out of the 60 samples, totaling $1,878,609. Thus, we were unable to verify that the costs were allowable per the project worksheets. For eight samples, totaling $561,562, the project worksheets associated with the transactions were not approved. Questioned costs: $2,440,171. Context: See “Condition.” Cause: FEMA project worksheets from the Texas COVID pandemic remain open. DSHS is continually adding and removing invoices from its claims with FEMA as final expenditures are deemed eligible and ineligible by FEMA and claims are reimbursed. Five of the invoices reported on the schedule of expenditures of federal awards and submitted for reimbursement were originally under a project worksheet but later withdrawn by DSHS as updated FEMA policies deemed certain costs ineligible. As a result, these transactions were no longer associated with a project worksheet at the time of audit fieldwork. Additionally, two invoices reported on the schedule of expenditures of federal awards had not been submitted to FEMA for reimbursement and do not have project worksheets associated with them at the time of audit fieldwork. Additionally, expenditures reported on the schedule of federal awards are not reconciled to allowable costs after ineligible expenditures are identified. Effect: Amounts reported on the schedule of expenditures of federal awards that are not reconciled to underlying allowable costs may result in disallowed costs. Repeat finding: No Recommendation: We recommend DSHS reconcile all program expenditures, whether they have been incurred, submitted for reimbursement, or reimbursed, to determine the amount to report on the schedule of expenditures of federal awards. Expenditures deemed to be ineligible subsequent to fiscal year end should be removed from the reported amount. Views of responsible officials: During the COVID-19 pandemic, DSHS’ primary focus was getting resources where they were needed most. The intensity of the pandemic resulted in significantly increased workloads and a need for rapid response. DSHS previously identified the need to review expenditures and ensure costs are allowable and align with required parameters. Because of the shifting of FEMA eligibility criteria over time, we agree that modifications are needed to ensure transactions comply with the most recent guidance.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Reporting – Information Technology – Password Configuration Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: MIP is GLO’s accounting application that serves as the agency’s system of record for budget, payroll, cash transactions, accounts receivable, and accounts payable. During our testing, we noted that Active Directory password configurations and the MIP lockout configurations do not adhere to the password policy defined in GLO’s Identification and Authentication policies or defined best practices. Questioned costs: None. Context: See “Condition.” Cause: GLO did not have processes in place to enforce password policies as outlined in the agency’s Identification and Authentication policies. Effect: Failure to follow GLO’s password policy increases the risk of inappropriate access. Repeat finding: No Recommendation: We recommend GLO update their password settings to align with the agency’s password policy. Views of responsible officials: We concur with the finding and the recommendation. Of note is that MIP is a standalone system and doesn’t provide the same password complexity and lockout capability that Active Directory offers, so we will address these individually. The risk associated with not having this same capability in the MIP system is somewhat mitigated by MIP being a system that is only available on-premises or via VPN with a valid Active Directory account.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Reporting – Information Technology – User Access Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Community Development and Revitalization (CDR) division of GLO uses TIGR as its primary grant management system of record. It is used to manage and process CDBG-DR and CDBG-MIT grant transactions. During our testing, we noted one of 13 terminations selected for testing did not have their Active Directory and TIGR access revoked upon termination in accordance with GLO’s Account Management policies, which state: 1.8 All access accounts established for contractors, consultants, vendors, and maintenance accounts must be disabled immediately upon termination or completion of the contract period. 1.9 In the event of involuntary termination of users, access must be removed or disabled prior to or at the same time the user is notified of the termination. The employee was terminated on July 5, 2023, however, their access was not removed. Subsequent to audit procedures, management terminated access to the Active Directory on September 25, 2023, and TIGR on September 28, 2023. Management was unable to provide evidence to support that neither system had been accessed between the date of the termination and the date that the system access was removed. We also noted that while management affirmed that a privileged user access review was completed for Active Directory accounts, there was no evidence maintained of the completion date, who the review was performed by, or frequency of review. Questioned costs: None. Context: See “Condition.” Cause: The exception related to the terminated employee was caused by a delay in communication between multiple departments within GLO. The exception related to user access reviews was caused by GLO not maintaining adequate documentation. Effect: Failure to disable and archive accounts for users that have been terminated increases the risk of inappropriate access and noncompliance. Failure to maintain adequate documentation of user access reviews may result in omission of steps in the review process. Repeat finding: No Recommendation: We recommend GLO enhance the existing process to allow for timely communication of terminated employees. Additionally, we recommend GLO develop a policy that outlines the documentation of user access reviews. Views of responsible officials: We concur with the finding and the recommendation and will take action to address the concerns.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B-18-DP-48-0002 January 12, 2021 – January 12, 2033 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: GLO’s Contract Department determines subawards that are required to be reported in FSRS under FFATA reporting requirements. These subawards are subsequently provided to GLO’s Federal Finance and Grants Management to report in FSRS. During our testing, we noted the following exceptions: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See “Condition.” Cause: Subawards were inadvertently omitted from the information provided to Federal Finance and Grants Management resulting in untimely submission. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Repeat finding: No Recommendation: We recommend that management establish standard operating procedures in order to guarantee accurate support and timely communication between departments to ensure timely submission of required reports. Views of responsible officials: We agree that two sub-awards were inadvertently omitted from the information provided to Federal Finance and Grants Management, resulting in an untimely submission.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services Block Grants for Prevention and Treatment of Substance Abuse ALN: 93.558 93.667 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM083999-01M001, 6B09SM083830-01M001 October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01M003 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat finding: 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC agrees with the finding but does not concur with the recommendation insofar as it makes a specific designation of CAPPS-Financials as the system to ensure compliance.

Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.558 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes:  Subrecipient’s unique entity identifier (UEI)  Federal award identification number (FAIN)  Federal award date of award to the recipient by the federal agency  Assistance listings number and title  Indirect cost rate for the federal award (including if the de minimis rate is charged) Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted: TANF – For a sample of 17, the contracts did not include:  UEI (one sample)  FAIN (four samples)  Federal award date (four samples)  Assistance listings numbers and title (four samples)  Indirect cost rate, including if the de minimis rate is charged (four samples) SSBG – For 11 of 19 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. MHBG – For 7 of 8 samples, the contract did not include neither the FAIN nor the federal award date of award to the recipient by the federal agency. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: No Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Temporary Assistance for Needy Families (TANF) - HHSC concurs with the finding. Social Services Block Grants (SSBG)/ Mental Health Block Grants (MHBG) - HHSC concurs with the finding.

Special Tests and Provisions – Penalty for Refusal to Work Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) ALN: 93.558 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR 261.14, if an individual refuses to engage in work required under section 407 of the Act, the State must reduce or terminate the amount of assistance payable to the family, subject to any good cause or other exceptions the State may establish. Such a reduction is governed by the provisions of § 261.16. The State must, at a minimum, reduce the amount of assistance otherwise payable to the family pro rata with respect to any period during the month in which the individual refuses to work. The State may impose a greater reduction, including terminating assistance. A State that fails to impose penalties on individuals in accordance with the provisions of section 407(e) of the Act may be subject to the State penalty specified at § 261.54. The State’s policy is to reduce benefits 100% for non_x0002_cooperation. Condition: HHSC works with the Texas Workforce Commission (TWC) to administer the CHOICES program at the Texas Local Workforce Development Boards (Workforce Boards). TWC sends sanctions initiated by the Workforce Boards to HHSC within seven calendar days of the date of non-cooperation. Subsequently, HHSC has five working days to process and apply the sanction as per policy. A sample of 40 beneficiaries who should have had their benefits reduced was selected for review, which resulted in the following:  For two cases, the benefits were not reduced timely by one month, resulting in an overpayments of $654.  For one case, the benefits were not reduced timely by three months, resulting in an overpayment of $1,179. Questioned costs: $1,833. Context: See “Condition.” Cause: Upon receipt of the sanctions from TWC, HHSC did not apply them within the timeline set by policy. Effect: Non-cooperating beneficiaries received TANF benefit payments they were not entitled to. Repeat finding: No Recommendation: Sanction requests should be applied timely per policy to ensure ineligible beneficiaries do not receive benefits. Views of responsible officials: HHSC concurs with the finding.

Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass_x0002_through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. Title 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: 1. The number of eligible individuals who received services paid for in part or in whole with federal funds under the SSBG. 2. The amount of Social Services Block Grant funds spent in providing each service. Condition: During testing of key line items noted above in the FY2022 Annual Post Expenditure Report submitted in March 2023, we noted the following variances between the amounts reported and supporting documentation: Key Line Item 1 Children  Family Planning Services – variance of 1,796  Prevention and Intervention – variance of 9,866  Protective Services – Children – variance of 13,511 Adults Age 59 Years and Younger  Family Planning Services – variance of 107,476  Prevention and Intervention – variance of 19,398  Protective Services – Adults – variance of 21,973  Other Services – variance of 10,733 Adults Age 60 Years and Older  Family Planning Services – variance of 4,549  Prevention and Intervention – variance of 868  Protective Services – Adults – variance of 71,969  Other Services – variance of 14,408 Adults of Unknown Age  Prevention and Intervention – variance of 151 Key Line Item 2 SSBG Allocation  Foster Care Services – Children – variance of ($77,124)  Information & Referral – variance of $2,116  Protective Services – Adults – variance of ($59,467)  Protective Services – Children – variance of ($114,243) Funds Transferred into SSBG  Protective Services – Children – variance of ($6,948,063) Expenditures of All Other Federal, State, and Local Funds  Family Planning Services – variance of $172,504,171  Foster Care Services – Children – variance of $674,230,152  Information & Referral – variance of $35,508,405  Protective Services – Adults – variance of $67,694,139  Protective Services – Children – variance of $1,145,408,512  Other Services – $171,788,478 Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure the completeness and accuracy of the report. Additionally, HHSC did not follow current policies and procedures regarding record retention. More specifically, all variances listed for key line item 1 were due to lack of supporting documentation except for the Protective Services – Children variance of 13,511, which was the difference between amounts reported and supporting documentation provided. All variances for key line item 2 were due to lack of supporting documentation except the four amounts listed under SSBG Allocation, which are a result difference between amounts reported and supporting documentation provided. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend management revise its internal controls to reconcile expenditures reported on federal reports to federal expenditures in the general ledger. Additionally, HHSC should implement or revise policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program (CHIP) ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control):  Ninety days for applicants who apply for Medicaid on the basis of disability; and  Forty-five days for all other applicants. Condition: Audit procedures included a review of 40 CHIP eligibility applications submitted by fiscal year 2023 for benefit recipients to determine whether the eligibility determination was made within 45 days. Of the 40 applications, we identified eight applications for which the eligibility determination was not made within 45 days. The eligibility determinations of these eight applications were made within 46-75 days of the submission date and did not have an administrative or other emergency circumstance. Questioned costs: None. Context: See “Condition.” Cause: Current policies and procedures surrounding the timely processing of benefit applications are not being properly implemented. Effect: Failure to process CHIP applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat finding: No Recommendation: HHSC should enforce existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timeline. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance. Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual).  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers for CHIP, which resulted in one exception for the following:  A copy of the completed application was not included in the file.  Enrollment of the provider was not completed within the last 5 years.  Verification of the provider’s license was not included in the file.  Required information on ownership and control was not disclosed.  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk.  A copy of the provider agreement was not included in the files.  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk.  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving CHIP funds. Repeat Finding: No Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in CHIP. Views of responsible officials: HHSC concurs with the finding.

Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1B09SM087345, 6B09SM087345, 1B09SM087322-01 October 1, 2022 – September 30, 2024, October 17,2022 – October 16, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For projects with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. We noted the following instances of noncompliance:  For the two sampled transactions, totaling $56,997, one of the expenditures, totaling $31,254, was related to costs incurred prior to the period of performance begin date. Questioned costs: $31,254. Context: See “Condition.” Cause: Current controls are not at the correct precision level to detect costs charged outside of the period of performance. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat finding: No Recommendation: HHSC should enhance and/or modify existing controls to ensure that costs charged to a project have service dates within the period of performance stated in the federal award. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid, which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. HHSC did not perform risk assessments over the remaining 57 systems during the two-year period. Questioned costs: None. Context: See “Condition.” Cause: HHSC is not adhering to its’ current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: No Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual)  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers each for Medicaid, which resulted in the following (sampled exceptions noted in parentheses):  A copy of the completed application was not included in the file. (9 providers)  Enrollment of the provider was not completed within the last 5 years. (7 providers)  Verification of the provider’s license was not included in the file. (7 providers)  Required information on ownership and control was not disclosed. (11 providers)  Supporting documentation was not included in the file indicating the provider consented to a criminal background check. (9 providers)  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. (13 providers)  A copy of the provider agreement was not included in the files. (13 providers)  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. (13 providers)  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. (9 providers) Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat finding: 2022-014, 2021-008 Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: HHSC concurs with this repeat finding.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Change Management Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: System changes that were applied to the production Texas Travel Industry Recovery Grant Program (TTIR) environment were not documented in accordance with appropriate change management procedures. We were unable to verify that changes were requested, approved, and segregation of duties existed within the process for five of the five samples selected for testing. Questioned costs: None. Context: See “Condition.” Cause: OOG currently utilizes emails and Microsoft Teams messages to transmit information during the change management process request and approval process. However, documentation from these methods was not retained. Effect: Failure to formally document system changes could result in undocumented or unauthorized changes to the application. Repeat finding: No Recommendation: We recommend formally documenting and retaining the request and approval of all changes related to the TTIR application. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the documented evidence of Change Management execution is insufficient. While the change management procedure is in practice cohesive and in continued use, the documentation of such and evidence of the repeatability thereof, is insufficient for the Texas Travel Industry Recovery Grant Program (TTIR) Portal.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Logical Access Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year. Questioned costs: None. Context: See “Condition.” Cause: Management’s timeline to complete the user access review was delayed. Effect: Failure to perform user access reviews in a timely manner could result in undetected inappropriate access or inappropriate changes to the application. Repeat finding: No Recommendation: We recommend that OOG enforce current policies and procedures in relation to eGrants to complete timely user access reviews and document the results. The user access review should include a review of all privileged accounts on a periodic basis to verify that all active accounts are supported by a business purpose. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year.

Reporting Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and NoncomplianceCriteria or specific requirement: Per 2 CFR section 200.303(a), the a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Compliance and Reporting Guidance Version 5.0, for purposes of reporting in the SLFRF portal, an obligation is an order placed for property and services, contracts and subawards made, and similar transactions that require payment. Condition: OOG is the prime recipient of SLFRF funds for the State of Texas. Per Senate Bill 8, funds are passed through to other state agencies to expend on programs established by the Senate Bill. On a quarterly basis, OOG receives ‘Agency Reconcilers’ from each state agency with reported amounts for each of their respective programs per Senate Bill 8 in order to prepare the state-wide Project and Expenditure Report. Audit procedures included testing of the December 31, 2022 and March 31, 2023 Project and Expenditure Reports, which combined Agency Reconcilers for 33 programs and 41 programs, respectively. We compared the amounts reported on the Project and Expenditure Reports as submitted to Treasury to the amounts noted on the ‘Agency Reconcilers’ submitted by the pass-through state agencies noting the following variances by key line item: December 31, 2022 Project and Expenditure Report  OOG was unable to provide the Agency Reconciler for five programs. As such, we were unable to validate all key line items reported for those agencies.  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for nine programs, resulting in a variance of ($61,450,208).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 12 programs, resulting in a variance of $333,636,497.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for five programs, resulting in a variance of ($85,590,747)  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($74,511). March 31, 2023 Project and Expenditure Report  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 15 programs, resulting in a variance of ($115,194,311).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 22 programs, resulting in a variance of $572,738,964.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for eight programs, resulting in a variance of ($20,661,270).  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($32,479). Questioned costs: None. Context: See “Condition.” Cause: Variances related to cumulative obligations were due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances were due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. OOG reported amounts reported in its eGrants system rather than the amounts reported by the state agencies. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported to the federal government. Repeat finding: No Recommendation: We recommend management enhance its internal controls to ensure obligations reported on federal reports meet the definition of an obligation per SLFRF Compliance and Reporting Guidance Version 5.0 and that amounts reported by the state agencies reconcile to the amounts reported in eGrants and the Project and Expenditures Reports. Management should reconcile discrepancies between eGrants and the amounts reported by the state agencies and obtain revised Agency Reconcilers, if appropriate. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the variances related to cumulative obligations are due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances are due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. When variances occurred, it was typically the result of data entry errors within the Agency Reconcilers. In these cases, the OOG deferred to the amounts reported in its eGrants system rather than the amounts reported by the state agencies in the Agency Reconcilers.

Reporting – PR28 Financial Summary Report Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B-22-DC-48-004 September 1, 2022 – September 1, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per U.S. Department of Housing and Urban Development (HUD) notice CPD-21-11, when generating the PR28 PER Financial Summary in IDIS, states have the ability to enter various adjustment parameters to data summarized from within IDIS. These adjustments are specific to each individual PR28 PER Financial Summary and are displayed in the report output. For any PR28 PER Financial Summary where the grantee made adjustments, the grantee must attach an explanation to the report. Condition: Texas Department of Agriculture (TDA) is required to submit the PR28 Financial Summary report and record any necessary adjustments to the financial report. During our testing, we noted TDA did not make the necessary adjustments to match supporting documentation from TDA accounting systems. The following adjustments were not reported as follows:  Line B13: Adjustment to compute total set aside for State Administration - $421,994  Line B21: Adjustment to compute total redistributed – ($2,630,787)  Line B24: Adjustment to compute total not yet distributed - $2,181,312  Line D47: Adjustments to compute total subject to PS cap – ($5,756)  Line D56: Adjustments to compute total subject to P/A cap – ($5,756) Questioned costs: None. Context: See "Condition" Cause: While management maintained supporting documentation, they failed to make the appropriate adjustments to PR28 Financial Summary Report. Effect: Failure to report accurate data on the PR28 Financial Summary report could compromise HUD’s ability to monitor CDBG expenditures and compliance with statutory requirements. Repeat finding: No Recommendation: TDA should enhance internal controls surrounding reporting to ensure accurate data is being outputted in accordance with the requirements of the respective report. Views of responsible officials: TDA agrees with the finding. TDA acknowledges that the appropriate adjustments are not reflected in the PR-28 report originally submitted for Program Year 2022.

Reporting – FFATA Federal Agency: U.S. Department of Agriculture U.S. Department of Housing and Urban Development Federal Program Title: Child Nutrition Cluster (CNC) Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (CDBG) ALN: 10.553, 10.555, 10.556, 10.559, 10.582 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: CNC 236TX332N1099, 236TX332N1199, 236TX375L1603 October 1, 2022 – September 30, 2023 CDBG B-21-DC-48-0001, B-22-DC-48-0001 September 1, 2021 – September 1, 2028, September 1, 2021 – September 1, 2028, September 1, 2022 – September 1, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Texas Department of Agriculture (TDA) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). During our testing, we noted the following compliance exceptions: Child Nutrition Cluster- Fresh Fruit and Vegetable Program (ALN 10.582) See chart or table in the Schedule of Findings and Questioned Costs. Child Nutrition Cluster- National School Lunch Program (ALN 10.555) See chart or table in the Schedule of Findings and Questioned Costs. Community Development Block Grant (ALN 14.228) See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See "Condition." Cause: As related to ALN 10.582 and 10.555, TDA reports expenditures at the end of the subaward period rather than reporting subawards over $30,000 by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. This was due to the nature of the subaward agreements, where subaward amounts are not specified in the agreement and subrecipients are reimbursed based on actual expenditures incurred each month. As related to subawards not reported for ALN 10.555, TDA did not attempt to report subawards during the fiscal year due to significant technical difficulties encountered uploading subaward data into the FSRS in previous periods. As related to 14.228, reports were submitted late due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TDA should revise its current policies and procedures to ensure all subaward/ subaward amendment obligations over $30,000 are identified and submitted in FSRS by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. Additionally, TDA should attempt to submit subaward information as required. If unsuccessful due to technical matters related to FSRS, TDA should retain documentation of the resolution efforts and submit subaward information immediately after the matter has been resolved. Views of responsible officials: CNC – TDA FND agrees with the [the auditor]’s recommendation. CDBG – TDA agrees with the finding. TDA acknowledges the FFATA reports were not submitted timely.

Eligibility Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 – 2021, 1505-0270 – 2021. January 6, 2022 – December 29, 2022 and May 5, 2021 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: According to Treasury’s Emergency Rental Assistance (ERA) Frequently Asked Questions (FAQs) Revised August 25, 2021, in ERA1, grantees must make reasonable efforts to obtain the cooperation of landlords and utility providers to accept payments from the ERA program. Outreach will be considered complete if (i) a request for participation is sent in writing, by mail, to the landlord or utility provider, and the addressee does not respond to the request within seven calendar days after mailing; (ii) the grantee has made at least three attempts by phone, text, or e-mail over a five calendar-day period to request the landlord or utility provider’s participation; or (iii) a landlord confirms in writing that the landlord does not wish to participate. The final outreach attempt or notice to the landlord must be documented. According to Treasury’s ERA Frequently Asked Questions (FAQs) Revised August 25, 2021, Grantees must obtain, if available, a current lease, signed by the applicant and the landlord or sublessor, that identifies the unit where the applicant resides and establishes the rental payment amount. If a household does not have a signed lease, documentation of residence may include evidence of paying utilities for the residential unit, an attestation by a landlord who can be identified as the verified owner or management agent of the unit, or other reasonable documentation as determined by the grantee. In the absence of a signed lease, evidence of the amount of a rental payment may include bank statements, check stubs, or other documentation that reasonably establishes a pattern of paying rent, a written attestation by a landlord who can be verified as the legitimate owner or management agent of the unit, or other reasonable documentation as defined by the grantee in its policies and procedures. According to the Texas Rent Relief Program Policies effective June 21, 2021, a household can request and receive rent assistance up to the total amount of monthly contracted rent listed on the lease. In the rare cases in which a tenant is applying without landlord cooperation, AND a lease does not exist, the tenant will be required to provide receipts for their 3 most recent rent payments in order to establish a pattern. Condition: During our testing of 60 individual payments to program participants, we noted the following exceptions:  For one sampled payment totaling $1,950, only one outreach to the landlord was attempted by phone instead of the required minimum of three.  For one sampled payment totaling $3,277, the landlord confirmed they were not willing to participate, however, it was not obtained in writing.  For one sampled payment, the prorated calculation for monthly rent was incorrect, resulting in an overpayment of $203. Questioned costs: $5,430. Context: See "Condition" Cause: The reviewer did not adhere to procedures related to outreach and obtaining required documentation. Additionally, the processing vendor miscalculated the rental assistance. Effect: Failure to accurately calculate and perform outreach for rental assistance under the program may result in overpayments to tenants or payments to ineligible tenants. Repeat finding: 2022-022, 2021-012 Recommendation: We recommend management enhance current policies and procedures to ensure all program requirements are adhered to prior to making benefit payments. Views of responsible officials: Management agrees with the finding and recommendation

Subrecipient Monitoring Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 – 2021, 1505-0270 – 2021. January 6, 2022 – December 29, 2022 and May 5, 2021 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (d) through (f), all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: TDHCA maintains a Master Planning Summary (MPS) to track all active subrecipient contracts that have expenditures in the planning phase, which are to be considered for sampling and potential selection for review. During our testing, we noted one subrecipient contract with expenditures during the fiscal year that was not included in the MPS for potential selection for a review. Questioned costs: None. Context: See “Condition.” Cause: Management is not adhering to the subrecipient monitoring procedures to ensure all active subrecipient contracts with expenditures incurred during the fiscal year are at least considered for review by being included in the MPS. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat finding: No Recommendation: We recommend that TDHCA strengthen its internal controls to ensure that all subrecipients are included in the MPS and subject to review. Views of responsible officials: The Department’s Compliance Subrecipient Monitoring (CMSM) staff acknowledges that a subrecipient was erroneously not included in the Master Planning Summary. However, the Department’s procedures for risk assessment and monitoring activities for this review period remain compliant with 2 CFR section 200.303(a) as well as 2 CFR section 200.331(6)(b). Risk assessment for non-formula funded contracts is 100% risk based. Both risk assessment and subsequent monitoring functions represent a snapshot of the Department’s pass-through activities and 100% review is not required. It is the Department’s stance that this error does not materially impact the risk assessment process or the scope of this audit.

Special Tests and Provisions – ERA Funds Reallocation Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0270 – 2021 May 5, 2021 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.302, the non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per Treasury’s ERA2 Reallocation Guidance Updated November 15, 2022, the ERA2 statute requires Treasury to identify funds for reallocation from amounts allocated to eligible Grantees, but not yet paid out to them. Specifically, the statute provides that beginning on March 31, 2022, Treasury must “reallocate funds allocated to eligible grantees … but not yet paid,” according to a procedure established by Treasury. Condition: Audit procedures included a review of the ERA2 Quarter 3 2022 (July-September) and ERA2 Quarter 4 2022 (October-December) Compliance Reports. We noted that $6,777,186 was double counted on the ‘Cumulative Amount of Award Obligated as of the end of the Reporting Period’ amount in the ERA2 Quarter 4 2022 Compliance Report. Questioned costs: None. Context: See "Condition" Cause: Obligated amounts were duplicated when preparing the supporting worksheets due to management oversight. Effect: Inaccurate supporting data when calculating reallocation expenditure ratios may result in an incorrect amount of excess funds subject to recapture by Treasury. Repeat finding: 2022-025 Recommendation: We recommend management enhance its internal controls over the review of supporting reallocation expenditure ratio calculations. Views of responsible officials: Management agrees with the finding and recommendation

Eligibility Federal Agency: U.S. Department of the Treasury Federal Program Title: Homeowner Assistance Fund Program ALN: 21.026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0269 – 2021 May 3, 2021 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of 60 individual payments to program participants, we noted the following exceptions for one sampled payment:  The servicer failed to provide an original loan amount. While the deed of trust was used to confirm conforming loan limits, it was not retained. The deed of trust was subsequently provided, however, we were unable to verify that the applicant provided a deed of trust prior to approval.  The applicant was enrolled in the Mortgage Reinstatement Program, which states that the debt to-income ratio must be between 31.01% and 55.0% and the applicant states they can afford to make the mortgage payments. We noted that the while the applicant had a 32.01% debt-to-income ratio, they stated they cannot afford to continue mortgage payments. As such, the applicant should have been enrolled in the Reinstatement plus Monthly payment assistance (R+U) program, which provides full monthly payment assistance to homeowners who are past due on their mortgage and unable to make full mortgage payments due to a continuing financial hardship associated with the Coronavirus pandemic. Questioned costs: None. Context: See "Condition" Cause: Management did not retain documentation to support eligibility determinations in the case file. With respect to program placement, the applicant was enrolled in the incorrect program due to changes in program types concurrently taking place. Effect: Ineffective controls over loan eligibility could result in payments on ineligible loans. Additionally, incorrectly placing participants in programs may result in ineligible payments or erroneously denying payments. Repeat finding: No Recommendation: We recommend enhancing current policies and procedures to ensure that the case auditors and supervisors are: (1) not approving applications with incomplete documentation and (2) properly placing participants in the correct program. Views of responsible officials: Management concurs with the control deficiency.

Reporting Federal Agency: U.S. Department of the Treasury Federal Program Title: Homeowner Assistance Fund Program ALN: 21.026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0269 – 2021 May 3, 2021 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Department of Treasury’s Homeowner Assistance Fund (HAF) guidance on participant compliance and reporting responsibilities, HAF participants are required to submit quarterly reports (PRA 1505-0269) that include data regarding programs, expenditures, demographic distribution, civil rights compliance, equity indicators, community engagement efforts, and programmatic data. To provide public transparency on whether programs are using practices that promote on-time and on-budget delivery, Treasury will seek information from HAF participants on their workforce plans and practices related to HAF programs. The reports contain key line items with critical information as follows: 1. Administrative Expenses - Quantifiable Objective Criteria: Obligations and expenditures do not exceed 15% for admin expenses. 2. Services, Counseling & Education - Quantifiable Objective Criteria: Obligations and expenditures do not exceed 5% for legal services, counseling, and education. Condition: Audit procedures included a review of the key line items within the quarterly reports for the periods ending December 31, 2022 and March 31, 2023. While TDHCA did not exceed the percentage maximums for each key line item, we noted the following variances for Administrative Obligations and Expenses: December 31, 2022 Report  Obligations – Total cumulative obligations reported was $121,740,816, however the amount per supporting documentation provided was $95,675,808, resulting in a variance of $26,065,008.  Expenditures – Total cumulative expenditures reported was $32,309,867, however, the amount per supporting documentation was $31,498,881 resulting in a variance of $810,986.  Specific to contracts with CDCs, Housing Counselors, Affordable Housing Providers for Intake Centers and Outreach, review of the expenditure detail indicated that the $1,781,278 of cumulative expenditures reported included other costs not related to this category. March 31, 2023 Report  Obligations – Total cumulative obligations reported was $104,384,814, however, the amount per supporting documentation was $96,426,918, resulting in a variance of $7,957,896.  Expenditures – Total cumulative expenditures reported was $41,113,838, however, the amount per supporting documentation was $45,208,650, resulting in a variance of ($4,094,812).  Specific to contracts with expenditures for CDCs, Housing Counselors, Affordable Housing Providers for Intake Centers and Outreach, review of the expenditure detail indicated that the $0 of cumulative expenditures reported is incorrect. We noted cumulative expenditures for 100% intake of $2,324,512. These are at minimum expenditures as there are subrecipient contracts allocated between intake, counseling, and legal. which TDHCA did incur expenditures in Q1 2023 and previous quarters. Management was unable to provide an analysis of these expenditures to allocate the respective portion to intake. Questioned costs: None. Context: See "Condition" Cause: TDHCA reported budgeted amounts rather than obligated amounts as defined by the U.S. Treasury Homeowner Assistance Fund Guidance on Participant Compliance and Reporting Responsibilities. Additionally, TDHCA’s controls over the review of reports were not operating at a precision level that would identify reported amounts that do not agree to supporting documentation. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported to the federal government. Repeat finding: No Recommendation: We recommend management enhance its internal controls to ensure obligations reported on federal reports meet the definition of an obligation per Treasury and that amounts agree to supporting documentation. Views of responsible officials: Management concurs with the control deficiency.

Reporting – Financial and Special Reporting for FFATA Federal Agency: U.S. Department of Homeland Security Federal Program Title: Disaster Grants - Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: PA-06-TX-4485, PA-06-TX-4586 March 25, 2020 – March 25, 2028, February 19, 2021 – February 19, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The action is to be reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: For one of the nine financial reports tested during the fiscal year, we noted the Texas Division of Emergency Management (TDEM) incorrectly reported total federal funds authorized amount of $14,451,281,005. TDEM should have reported total federal funds authorized amount of $14,450,861,018, resulting in a reported variance of $419,988. During our testing of special reporting for FFATA, we noted the following instances of noncompliance: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See "Condition" Cause: Specific to financial reporting, the variance is due to a manual error in transferring data from the Smartlink report used to report the total federal funds authorized amount to the financial report. TDEM did not reduce the total federal funds authorized for the Hazard Mitigation projects included in the Smartlink report. The untimely submission of the FFATA report was due to the utilization of a new third-party application where gaps were later identified.

Effect: Reporting inaccurate information on financial reports could impact the federal agency’s ability to accurately capture key information in order to assess the performance of the program. Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines.

Repeat finding: No Recommendation: TDEM should enhance its internal controls to ensure manual errors on financial reports are identified and FFATA reports are identified in a timely manner in order to be reported in FSRS within the required timeline. Views of responsible officials: Specific to the financial reporting, it appears there was a malfunction with the federal system adhoc legacy inquiry reporting tool when generating federal financial reports containing the total federal funds authorized. The federal system’s malfunction produced a comingled program report which caused an overage in total federal funds authorized. TDEM no longer generates reports from the unreliable federal system adhoc legacy inquiry module. As of October 2023, we began utilizing the federal system APEX reports. TDEM has followed up with the Federal Support Center for the Payment Management System multiple times to determine what is causing the federal system to report inaccuracies, however they have failed to address the issue at hand, have stated that “soon the legacy adhoc will no longer be available”, and are encouraging grantees to only use the APEX reports – seemingly due to the inaccuracies, such as the one noted here, that the federal system generates. Regarding the FFATA reporting, a new automated report developed by a third-party vendor to streamline the reporting timeline was being utilized after an internal testing phase had transpired. A gap was later identified which inadvertently created the timing delay.

Reporting – Special Reporting Federal Agency: U.S. Department of Education Federal Program Title: Education Stabilization Fund ALN: 84.425R Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: S425R210043 February 25, 2021 – September 30, 2022 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Office of Elementary and Secondary Education, all grantees are required to report on ESSER funds received under the Coronavirus Aid, Relief, and Economic Security (CARES) Act; the Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act; and the American Rescue Plan (ARP) Act. Grantees must submit an annual report describing how the State and subrecipients used the awarded funds during the performance period. Condition: Audit procedures included a review of 40 subrecipients/ local education agencies (LEAs) whose data was reported on key line item 3.b10 - Number of specific positions supported with ESSER Fund. Of the 40 subrecipients, the number of paraprofessionals, the number of school counselors, school psychologists and/or social workers, and number of classroom educators, not covered by previous categories for one LEA was reported incorrectly in the Annual Report by TEA compared to the information the LEA submitted. Information was transposed with another LEA, causing that LEA’s information to be incorrect as well. Additionally, one LEA submitted corrected information, which was not subsequently corrected by TEA in the Annual Report. Questioned costs: None. Context: See “Condition.” Cause: Current controls are not at the correct precision level to detect variances in data reported in the Annual Report compared to information submitted by LEAs. Effect: Failure to report accurate information may result in noncompliance with terms of the grant award. Repeat finding: No Recommendation: TEA should enhance and/or modify existing controls to ensure information submitted by the LEAs is reported completely and accurately on the Annual Report. Views of responsible officials: TEA agrees an error was made during the upload of the LEA submitted corrected CROSSACT data. The corrective actions below will be implemented to prevent future occurrence.

Subrecipient Monitoring Federal Agency: U.S. Department of Education Federal Program Title: Adult Education- Basic Grants to States ALN: 84.002 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: V002A200044, V002A210044, V002A220044, V002A230044 July 1, 2020 – September 30, 2021, July 1, 2021 – September 30, 2022, July 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (d) through (f), TWC must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: Per review of TWC's Subrecipient Monitoring Department's (SRM) Annual Monitoring Plan, the Adult Education and Literacy (AEL) program is designed to meet the education and training needs of adults. SRM will continue to work closely with the Workforce Development Division to identify the fiscal and program areas that present the highest risk to the Agency. SRM will also conduct data validation reviews of all AEL providers, once during each five-year grant period. During our testing, we noted seven AEL subrecipients were excluded from the SRM Plan and no reviews or data validations were performed within the previous five years. Questioned costs: None. Context: See “Condition.” Cause: Management is not adhering to the subrecipient monitoring procedures to ensure all Adult Education and Literacy subrecipients have a data validation review once during each five-year granting period. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend that TWC strengthen its internal controls to ensure that monitoring over all subrecipients is completed. Views of responsible officials: The Texas Workforce Commission acknowledges and agrees with the finding with one observation. Follow-up review indicates that only 6 of 7 AEL subrecipients tested were not included in the risk assessment. ‘Restore Education’ was, in fact, assessed. It was SRM’s understanding from prior guidance that the types of AEL subrecipients tested as part of this audit were not applicable to SRM’s risk assessment process. We have confirmed with TWC’s AEL program staff that they should have been in scope for SRM’s annual and mid-year risk assessments.

Eligibility Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; 84.379; and 93.264 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224051; Federal Work-Study Program, P033A224051; Federal Pell Grant Program, P063P222282; Federal Direct Student Loans, P268K232282; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232282; and Nurse Faculty Loan Program (NFLP), 1 E01HP45821-01-00 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $1,409 Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). Direct Subsidized and Unsubsidized Loans have annual and aggregate limits that are the same for all students at a given grade level and dependency status. In general, a loan may not be more than the amount the borrower requests, the borrower’s unmet financial need, the borrower’s COA, or the borrower’s maximum borrowing limit. (U.S. Department of Education 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 5). Lamar University (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s classification (undergraduate or graduate), dependency (dependent or independent), residency (in-state or out-of-state), living status (on-campus, off-campus, or at home with parents), and enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time). Budgeting rules within the University’s student information system are established to assign various budget components based on the factors noted above. For 23 (38 percent) of 61 students tested, the University incorrectly calculated the COA. Specifically, the University did not adjust the students’ COA to reflect the students’ actual enrollment as of the census date. The University experienced turnover in the Student Financial Aid department during the 2022–2023 award year, and could not provide a cause for those errors. The University asserted that it implemented a process to recalculate students’ COAs based on their actual enrollment at census beginning with the Fall 2023 term; however, the errors discussed above occurred before that process was in place. As a result, the University overawarded two students. • One of those students was assigned an overstated COA for the Fall 2022 term based on three-quarter-time enrollment although the student’s actual enrollment was half-time. The student was awarded $5,294 in Subsidized Direct Loans, which exceeded the student’s financial need, resulting in $1,113 in questioned costs associated with ALN 84.268, Federal Direct Student Loans, award number P268K232282. • The other student was assigned an overstated COA for the Spring 2023 term based on full-time enrollment although the student did not attend during the term. The student was awarded $10,142 in Unsubsidized Direct Loans, which exceeded the student’s actual COA, resulting in $296 in questioned costs associated with ALN 84.268, Federal Direct Student Loans, award number P268K232282. The University did not have adequate controls in place to review budgets used in the calculation of COA and accurately assign those budgets to students. Incorrectly calculating COA increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students’ COA budgets in accordance with its process and does not overaward financial assistance to students. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; and 84.063 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224051; and Federal Pell Grant Program, P063P222282 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Fiscal Operations Report and Application to Participate (FISAP): An institution participating in campus-based programs is required to annually submit the FISAP to the Secretary of the U.S. Department of Education to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year (Title 34, Code of Federal Regulations (CFR), Section 674.19(d); and U.S. Department of Education, Fiscal Operations Report for 2022–23 and Application to Participate for 2024– 25 (FISAP) Instructions). The institution must ensure that the information is accurately reported on the form and at the time specified by the Secretary of the U.S. Department of Education (Title 34, CFR, Section 674.19(d)(2)). Lamar University (University) did not maintain adequate support for its FISAP. Specifically, the University did not have support for the total Federal Pell Grants expenditures for the 2022–2023 award year reported in Part II, Section E. Assessments and Expenditures, Line 23. In addition, the supporting documentation provided by the University for the total Federal Supplemental Educational Opportunity Grants (FSEOG) expenditures for undergraduate independent students with income from $0 to $1,999 for the 2022–2023 award year did not match the amount reported in Part IV, Section A. Distribution of Program Recipients and Expenditures by Type of Student, Line 12(d). The University asserted that those issues were due to human error. As a result, auditors were unable to determine whether the information on the FISAP for those line items was accurate and fairly presented in accordance with requirements. Recommendation: The University should maintain adequate support for information reported on its FISAP to ensure that information is accurate. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; 84.379; and 93.264 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224051; Federal Work-Study Program, P033A224051; Federal Pell Grant Program, P063P222282; Federal Direct Student Loans, P268K232282; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232282; and Nurse Faculty Loan Program (NFLP), 1 E01HP45821-01-00 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Award and Disbursement Notifications: Before an institution disburses Title IV, Higher Education Act of 1965 (HEA) program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each Title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans (Title 34, Code of Federal Regulations (CFR), Section 668.165(a)(1)). If an institution credits a student’s ledger account with Federal Direct Student Loan (Direct Loan) funds or Teacher Education Assistance for College and Higher Education (TEACH) Grant funds, the institution must notify the student or parent of (1) the anticipated date and amount of the disbursement, (2) the student’s or parent’s right to cancel all or a portion of that loan or grant and have the loan or grant proceeds returned to the U.S. Department of Education, and (3) the procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan or grant, or loan or grant disbursement (Title 34, CFR, Section 668.165(a)(2)). The institution must provide the notice in writing no earlier than 30 days before, and no later than 30 days after, crediting the student’s ledger account at the institution (Title 34, CFR, Section 668.165(a)(3)). For 21 (34 percent) of 62 disbursements tested, Lamar University (University) did not send an award or disbursement notification as required. Specifically: • For 20 students that received Direct Loan disbursements, the University did not send a disbursement notification. The University asserted those errors occurred because the University was utilizing a manual process to send out the disbursement notifications, and on those days when the employee charged with performing the manual process was not present, the notifications were not sent to students. • For one student who received Title IV funds, the University did not send an award notification. This error occurred because the University manually packaged the student’s awards after clearing a verification requirement, and the University did not have an adequate process in place to ensure that students who are manually awarded receive an award notification. Not receiving award and disbursement notifications impairs students’ and parents’ ability to budget for the cost of attending or exercise the option to cancel their loans or grants. Promissory Notes: Institutions must establish a process to make loans consistent with institutional policies and federal laws and regulations, including the completion of the following during disbursement: (1) signed promissory note, and (2) disclosure of terms and conditions (Nurse Faculty Loan Program (NFLP) Administrative Guidelines, 42 United States Code (U.S.C.) 297n-1 (Public Health Service Act Section 846A)). The University did not have a process in place to require a promissory note for NFLP loans prior to disbursement. NFLP loans were incorrectly identified in the student information system as a grant instead of a loan. As a result, the student information system did not place a required hold on disbursements until the promissory note requirement was completed. Not requiring a signed promissory note prior to disbursement of loan funds could limit the University’s ability to enforce repayment of the loan. Recommendations: The University should: • Strengthen its controls to ensure that it identifies all students that require an award or disbursement notification, and sends those notifications to the students. • Configure controls in the student information system to require promissory notes for applicable loans. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224051; Federal Pell Grant Program, P063P222282; Federal Direct Student Loans, P268K232282; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232282 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $19,357 Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs, and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). In determining the percentage of the payment period or period of enrollment completed for a student who withdraws from a program offered in modules, an institution must (1) include all days within the period that the student was scheduled to complete prior to ceasing attendance and (2) exclude any scheduled breaks of at least five consecutive days when the student was not scheduled to attend a module or other course offered during that period of time. Scheduled breaks include both those that take place within and between modules (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). An institution must offer to disburse directly to a student, or parent in the case of a parent PLUS loan, any amount of a post-withdrawal disbursement of loan funds that is not credited to the student's account. The institution must make a direct disbursement of any loan funds that make up the post-withdrawal disbursement only after obtaining the student's, or parent's in the case of a parent PLUS loan, confirmation that the student or parent still wishes to have the loan funds disbursed (Title 34, CFR, Section 668.22(a)(6)(ii)(B)). Lamar University (University) made errors in Title IV return calculations for 25 (41 percent) of 61 students tested. Specifically, the University did not exclude any break days from the Spring 2023 term or days between modules as required. Those errors resulted in the University returning a total of $3,481 associated with ALN 84.268, Federal Direct Student Loans, award number P268K232282, and $1,802 associated with ALN 84.063, Federal Pell Grant Program, award number P063P222282, less Title IV funds than required. • For 2 of those 25 students, the University also used an inaccurate withdrawal date in the return calculation. • For 1 of those 25 students, the University also did not identify that the student was eligible to receive a post withdrawal disbursement of loan funds and therefore did not offer to disburse those loan funds to the student as required. In addition, for 8 (13 percent) of 61 students tested who did not have a return of Title IV funds made, the University did not perform a return calculation as required. The University asserted it did not consistently follow its procedures in identifying students who required a Title IV return calculation due to staff turnover and newer staff needing additional training. As a result, the University did not return a total of $13,707 associated with ALN 84.268, Federal Direct Student Loans, award number P268K232282, and $367 associated with ALN 84.063, Federal Pell Grant Program, award number P063P222282 as required. The errors discussed above occurred because the University did not configure its information system to accurately calculate returns and because of manual errors that the University made in performing the return calculations. In addition, the University did not have an adequate monitoring process to identify those errors. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Timeliness of Returns: An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 5 (8 percent) of 59 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. The University returned the funds for those students 47 to 143 days after it determined that the students withdrew. For 2 of those students, the University determined the withdrawal dates and performed the return calculations; however, it did not return the Title IV funds within the required 45-day time frame due to an oversight in processing the return of those funds. For three of those students, the University asserted that it determined that the return calculations required corrections, which resulted in the returns not being performed timely. Not making returns within required time frames reduces the funds available to the U.S. Department of Education for its program management. Recommendations: The University should: • Strengthen its controls to ensure that it accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. • Accurately determine the number of days in the payment period and exclude any scheduled breaks as required. • Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations and returns Title IV funds in a timely manner. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222282; and Federal Direct Student Loans, P268K232282 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less_x0002_than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). Lamar University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 7 (12 percent) of 60 students tested, the University did not accurately report campus- and program level data elements or did not report enrollment status changes to NSLDS. Specifically: • For two students, the University incorrectly reported the students’ enrollment status as withdrawn, rather than graduated. The incorrect enrollment status was reported at both the campus and program levels to NSLDS. In addition, those statuses were not received by NSLDS until 130 and 134 days after the students graduated. • For two students, the University did not report the withdrawn status at the campus and program levels to NSLDS as required. • For two students, the University incorrectly reported the students’ graduated status effective date at the campus level. However, the graduated effective date for both students was correctly reported at the program level. The effective date reported at the campus level should be the same date reported at the program level because those dates reflect the same enrollment status change. • For one student, the University incorrectly reported the student’s enrollment status at the campus and program levels. The University initially reported the correct enrollment status; however, subsequent submissions to NSLDS overwrote that enrollment status with an incorrect enrollment status. The errors discussed above occurred because the University (1) did not ensure that all graduated students were included on the graduation transmission file to NSC, (2) did not fully address error reports provided by NSC, and (3) did not have a formally documented policy or review to ensure consistent and accurate enrollment reporting. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its controls to ensure that all status changes are reported accurately and in a timely manner to NSLDS. Views of Responsible Officials: The University accepts and confirms the findings. Through assessing and identifying the exceptions in the audit the University will work to develop and enforce the beneficial measures needed to refine our procedures.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.268 Pass-Through Agency: N/A Award Number: Federal Direct Student Loans, P268K232301 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal Direct Student Loans: Direct Unsubsidized Loans have higher annual limits for certain graduate and professional health professions students. Schools may award the increased unsubsidized amounts to students who are enrolled at least half-time in certain health professions programs. The increased unsubsidized amounts that an eligible health professions student may receive are in addition to the regular $20,500 Direct Unsubsidized Loan annual loan limit for graduate and professional students. For programs with an academic year covering 10 or 11 months, the annual additional unsubsidized loan limit must be prorated. The prorated annual loan limit is determined by dividing the applicable loan limit for a nine-month academic year by nine, and then multiplying the result by 10 or 11. (U.S. Department of Education 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 5). Based on a review of the full population of student financial assistance recipients, Sam Houston State University (University) overawarded a total of $239,932 in Unsubsidized Direct Loans to 133 students. Due to an incorrect proration methodology, the University awarded first- and second-year students in the Doctor of Osteopathic Medicine program in excess of their Unsubsidized Direct Loan annual limit. Specifically, the University prorated the sum of the annual and increased additional annual limits, instead of prorating only the increased additional annual limit. After auditors brought the errors to the University’s attention, it returned the excess Unsubsidized Direct Loan funds; therefore, there were no questioned costs. Recommendation: The University should use the appropriate methodology when prorating Unsubsidized Direct Loans for eligible health professions students to ensure that loans are disbursed within the student’s applicable annual limit. Views of Responsible Officials: The University acknowledges and agrees with the findings of this audit. Management recognizes that increased unsubsidized amounts for eligible health professions are to be calculated by prorating the additional months then dividing the applicable loan limit for a nine-month academic year by nine, and then multiplying the result by 10 or 11, depending on the months of the program.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224110; Federal Pell Grant Program, P063P222301; Federal Direct Student Loans, P268K232301; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232301 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). For distance education, documenting that a student has logged into an online class is not sufficient to demonstrate academic attendance by the student. An institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity. Only active participation by a student in an instructional activity related to the student's course of study that meets the definition of “academic engagement” in Title 34, CFR, Section 600.2 and takes place during a payment period or period of enrollment qualifies as attendance in an academically related activity (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). For 1 (4 percent) of 24 students tested, Sam Houston State University (University) did not have evidence of academic engagement in the distance education course from which the student’s withdrawal date was determined. The University relies on the last dates of academic activity provided by instructors to determine the withdrawal date for Return of Title IV purposes for students who unofficially withdraw. The student’s record did not reflect evidence of academic activity for the distance education course, and the University asserted that the last day of attendance provided by the instructor was inaccurate. The University did not have a process in place to require instructors to provide or maintain evidence of academic engagement in distance education courses. As a result, the University did not perform a return calculation because it incorrectly determined that the student completed over 60 percent of the period. After auditors brought the issue to the University’s attention, the University performed a return calculation and returned Title IV funds as required; therefore, there were no questioned costs. Having a process that does not consistently calculate and return the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Recommendation: The University should ensure that evidence of academic engagement is consistently documented for students in distance education courses. Views of Responsible Officials: The University acknowledges and agrees with the findings of this audit. Management acknowledges the responsibility to accurately verify the academic engagement and document it for students enrolled in distance education courses.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224131; Federal Work-Study Program, P033A224131; Federal Pell Grant Program, P063P222320; Federal Direct Student Loans, P268K232320; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232320 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). Tarleton State University (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s tuition rate (guaranteed or variable), program, courses, classification (undergraduate or graduate), residency (in-state or out-of-state); living status (on-campus, off-campus, or with parent), and enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time). Budgeting rules within the University’s student information system are established to assign various budget components based on the factors noted above. For 62 (100 percent) of 62 students tested, the University incorrectly calculated the COA. Specifically, the University used the 2021–2022 award year budgets instead of the 2022–2023 award budgets because it did not update the COA budget components in its student information system for the new award year. As a result, the COAs for those students were understated by a total of $148,781. This error would have affected the COA for all students in the Fall 2022 and Spring 2023 terms. However, because the students’ budgets were understated, this error did not result in overawards of financial assistance; therefore, there were no questioned costs. The University did not have adequate controls in place to review budgets used in the calculation of COA and accurately assign those budgets to students. Incorrectly calculating COA increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students’ COA budgets in accordance with its process. Views of Responsible Officials: The University has carefully reviewed the findings outlined in the recent financial aid audit report, and we acknowledge and agree with the identified areas for improvement. Your thorough examination has provided valuable insights into our financial aid processes, and we appreciate the effort invested in ensuring transparency and accountability. In response to the findings, we are committed to taking immediate and comprehensive corrective actions to address the identified issues and enhance the overall effectiveness of our financial aid management. Our team is already in the process of developing a detailed Corrective Action Plan that will outline the specific steps we will take to rectify the noted deficiencies. We understand the importance of financial aid in supporting our students' academic endeavors, and we are dedicated to ensuring that our processes align with the highest standards of integrity and compliance.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.379 Pass-Through Agency: N/A Award Number: Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232320 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Award and Disbursement Notifications: Before an institution disburses Title IV, Higher Education Act of 1965 (HEA) program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each Title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans (Title 34, Code of Federal Regulations (CFR), Section 668.165(a)(1)). If an institution credits a student’s ledger account with Federal Direct Student Loan (Direct Loan) funds or Teacher Education Assistance for College and Higher Education (TEACH) Grant funds, the institution must notify the student or parent of (1) the anticipated date and amount of the disbursement, (2) the student’s or parent’s right to cancel all or a portion of that loan or grant and have the loan or grant proceeds returned to the U.S. Department of Education, and (3) the procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan or grant, or loan or grant disbursement (Title 34, CFR, Section 668.165(a)(2)). The institution must provide the notice in writing no earlier than 30 days before, and no later than 30 days after, crediting the student’s ledger account at the institution (Title 34, CFR, Section 668.165(a)(3)). Tarleton State University (University) did not send appropriate award and disbursement notifications to TEACH Grant recipients. Specifically, the University’s TEACH award notification did not describe how and when funds would be disbursed, while the TEACH disbursement notification did not include the date of disbursement, student’s right to cancel all or part of the loan, and guidance for the procedures and time for canceling the loan. Not providing sufficient award and disbursement notifications impairs students’ and parents’ ability to budget for the cost of attending or exercise the option to cancel their loans or grants. Recommendation: The University should ensure that award and disbursement notifications for TEACH recipients contain all required elements. Views of Responsible Officials: The University has carefully reviewed the findings outlined in the recent financial aid audit report, and we acknowledge and agree with the identified areas for improvement. Your thorough examination has provided valuable insights into our financial aid processes, and we appreciate the effort invested in ensuring transparency and accountability. In response to the findings, we are committed to taking immediate and comprehensive corrective actions to address the identified issues and enhance the overall effectiveness of our financial aid management. Our team is already in the process of developing a detailed Corrective Action Plan that will outline the specific steps we will take to rectify the noted deficiencies. We understand the importance of financial aid in supporting our students' academic endeavors, and we are dedicated to ensuring that our processes align with the highest standards of integrity and compliance.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224131; Federal Pell Grant Program, P063P222320; Federal Direct Student Loans, P268K232320; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232320 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $12,259 Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs, and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). In determining the percentage of the payment period or period of enrollment completed for a student who withdraws from a program offered in modules, an institution must (1) include all days within the period that the student was scheduled to complete prior to ceasing attendance and (2) exclude any scheduled breaks of at least five consecutive days when the student was not scheduled to attend a module or other course offered during that period of time. Scheduled breaks include both those that take place within and between modules (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). For a program offered in modules, a student is not considered to have withdrawn if the student successfully completes any of the following: (1) a module that includes 49 percent or more of the number of days in the payment period, excluding scheduled breaks of five or more consecutive days and all days between modules; (2) a combination of modules that together contain 49 percent or more of the number of days in the payment period, excluding scheduled breaks of five or more consecutive days and all days between modules (Title 34, CFR, Section 668.22(a)(2)(ii)(A)(2)); or (3) coursework equal to or greater than the coursework required for the institution’s definition of a half-time student under 34 CFR 668.2(b) for the payment period (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 1). An institution must disburse directly to a student any amount of a post-withdrawal disbursement of grant funds that is not credited to the student's account. The institution must make the disbursement as soon as possible, but no later than 45 days after the date of the institution's determination that the student withdrew. The institution must offer to disburse directly to a student, or parent in the case of a parent PLUS loan, any amount of a post withdrawal disbursement of loan funds that is not credited to the student's account. The institution must make a direct disbursement of any loan funds that make up the post-withdrawal disbursement only after obtaining the student's, or parent's in the case of a parent PLUS loan, confirmation that the student or parent still wishes to have the loan funds disbursed (Title 34, CFR, Section 668.22(a)(6)(ii)(B)). For 58 (97 percent) of 60 students tested, Tarleton State University (University) incorrectly calculated the amount of Title IV funds to be returned or returned the incorrect amount of funds. Specifically: • For 56 students, the University did not exclude any break days from the Fall 2022 term as required, and it incorrectly excluded 5 break days rather than 8 break days from the Spring 2023 term. Those errors occurred because the University did not load the correct break days into its student information system when setting up the payment period; therefore, this issue would have affected all students who withdrew from the Fall 2022 and Spring 2023 terms. Additionally: o For 2 of those 56 students, the University did not identify that the students were eligible to receive a post-withdrawal disbursement and therefore did not disburse those grant funds or offer to disburse those loan funds to the students as required. o For 4 of those 56 students, the University incorrectly determined the number of days in the payment period or used an incorrect withdrawal date for students enrolled in modules. • For 2 students enrolled in the Summer 2023 term, the University did not follow the return of Title IV requirements related to modular terms. For one student, the University incorrectly used the number of days in the full payment period rather than only the days within the period that the student was scheduled to complete prior to ceasing attendance. For the other student, the University failed to identify that the student successfully completed coursework equal to or greater than the coursework required for a half-time student and therefore should not have been considered withdrawn. The University asserted that this error occurred because staff misinterpreted the half-time withdrawal exemption requirements. As a result of the errors discussed above, the University returned a total of $1,992 associated with ALN 84.268, Federal Direct Student Loans, award number P268K232320, and $374 associated with ALN 84.063, Federal Pell Grant Program, award number P063P222320 less Title IV funds than required for the students tested in the sample. In addition, for 10 (17 percent) of 60 students tested who did not have a return of Title IV funds made, the University did not perform a return calculation as required. • For 6 students, the University did not exclude break days from its determination of whether the students completed 60 percent or more of the payment period as required. As a result, the University incorrectly determined that the students earned their aid and did not return a total of $7,679 associated with ALN 84.268, Federal Direct Student Loans, award number P268K232320, and $1,053 associated with ALN 84.063, Federal Pell Grant Program, award number P063P222320 as required. • For 4 students, the University incorrectly used the number of days in the full payment period in its determination of whether the students successfully completed 49 percent or more of the number of days in the payment period. As a result, the University incorrectly determined that the students earned their aid and did not return a total of $1,161 in questioned costs associated with ALN 84.268, Federal Direct Student Loans, award number P268K232320 as required. The errors discussed above occurred because the University did not configure its information system to accurately calculate returns and because of manual errors that the University made in performing return calculations. In addition, the University did not have an adequate monitoring process to identify those errors. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Recommendations: The University should: • Strengthen its controls to ensure that it accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. • Accurately determine the number of days in the payment period and configure its student information system to exclude any scheduled breaks, as required. • Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations and returns Title IV funds. Views of Responsible Officials: The University has carefully reviewed the findings outlined in the recent financial aid audit report, and we acknowledge and agree with the identified areas for improvement. Your thorough examination has provided valuable insights into our financial aid processes, and we appreciate the effort invested in ensuring transparency and accountability. In response to the findings, we are committed to taking immediate and comprehensive corrective actions to address the identified issues and enhance the overall effectiveness of our financial aid management. Our team is already in the process of developing a detailed Corrective Action Plan that will outline the specific steps we will take to rectify the noted deficiencies. We understand the importance of financial aid in supporting our students' academic endeavors, and we are dedicated to ensuring that our processes align with the highest standards of integrity and compliance.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222320; and Federal Direct Student Loans, P268K232320 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective, and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). Enrollment is reported for a specific location of each campus; that is, the eight-digit Office of Postsecondary Education Identification (OPEID) number. Most students are enrolled in coursework at only one location. However, for students who are taking coursework at multiple locations of the same school, the school must determine which location is the student’s “primary location” and report the combined enrollment for the student using that location to NSLDS. A student’s “primary location” is the location where the student is taking more coursework than at any other location. Reporting a student’s enrollment at the main campus does not satisfy the enrollment reporting requirement if aid was disbursed or the student was physically attending school at a different location (NSLDS Enrollment Reporting Guide, November 2022, Chapters 4 and 6). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). Tarleton State University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 20 (33 percent) of 61 students tested, the University did not report or did not accurately report campus- or program-level data elements to NSLDS. Specifically: • For 19 students, the University incorrectly reported the OPEID number of the main campus instead of the OPEID number of the location where the students were taking the majority of their coursework. The University asserted that it reports the main campus OPEID number for all students to NSLDS, which would result in errors affecting all students who did not take the majority of their coursework at the main campus location. Additionally: o For 1 of those 19 students, the University did not report an enrollment status to NSLDS at the campus or program level. The University asserted that it reported the student’s enrollment and graduated statuses to NSC; however, those statuses were not reported to NSLDS. o For 1 of those 19 students, the program begin date was reported incorrectly. The University reported the program begin date for a program from which the student had withdrawn, instead of the first day of the term in which the student began attendance in a new program. • For one student, the University did not accurately report the student’s graduated status at the campus level to NSLDS. The student’s status was reported as graduated at the program level but was reported as withdrawn at the campus level. In addition, the withdrawn status was not received by NSLDS until 132 days after the student graduated. The University had a process to monitor enrollment information reported to NSC; however, that process was not sufficient to identify the errors discussed above. Not reporting student information accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its controls to ensure that campus- and program-level data elements are reported accurately and in a timely manner to NSLDS. Views of Responsible Officials: The Office of the Registrar has thoroughly reviewed the findings related to enrollment reporting, specifically concerning instances highlighted in the recent financial aid audit report. We acknowledge and agree with the identified discrepancies and are committed to addressing these issues promptly. For the student in question where the program begin date was reported incorrectly, we recognize the significance of accurately reporting program begin dates and maintaining accurate and consistent reporting across relevant systems. Regarding the case where the graduated status was inaccurately reported at the campus level, we understand the impact of such discrepancies and the delay in reporting. We recognize the importance of precise and timely enrollment reporting, and we are committed to enhancing our processes to prevent similar issues in the future. Our team is actively working on these corrective measures, and we aim to demonstrate significant improvements in the accuracy and timeliness of our reporting.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; 84.379; and 84.408 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A234136; Federal Work-Study Program, P033A224136; Federal Pell Grant Program, P063P225286; Federal Direct Student Loans, P268K235286; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T235286; and Postsecondary Education Scholarships For Veteran's Dependents (Iraq and Afghanistan Service Grant (IASG)), P408A225286 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: Unknown Repeat Finding: No Satisfactory Academic Progress: A student is eligible to receive Title IV, Higher Education Act of 1965 (HEA) program assistance if the student maintains satisfactory academic progress in his or her course of study according to the institution’s published standards of satisfactory academic progress (SAP) that satisfy the provisions of Title 34, Code of Federal Regulations (CFR), Section 668.34 (Title 34, CFR, Section 668.32(f)). An institution’s SAP policy must include a qualitative component that consists of grades or comparable factors that are measurable against a norm and a quantitative component that consists of the pace at which students must progress through their program to ensure that they will graduate within the maximum time frame required to complete their education (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 1, Chapter 1). For an undergraduate program measured in credit hours, a period that is no longer than 150-percent of the published length of the educational program, as measured in credit hours, should be used to determine the maximum time frame for the quantitative component of SAP (Title 34, CFR, Section 668.34(b)(1)). For 1 (2 percent) of 45 students tested, Texas A&M University (University) did not calculate SAP in accordance with its policy. Specifically, the University did not update the program hours for the Bachelor of Science in Nursing program in its student information system when it changed the program length from 123 hours to 120 hours during the 2017–2018 award year. Therefore, this issue would have affected all students enrolled in the program. As a result, the maximum time frame calculation incorrectly allowed students to exceed the maximum hours without failing SAP. Incorrectly calculating the maximum time frame increases the risk that students could receive financial assistance for which they are not eligible. Recommendation: The University should ensure that the maximum time frame is configured in its student information system with the accurate number of credit hours for each degree program. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P225286; and Federal Direct Student Loans, P268K235286 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). To protect a student’s interest subsidy, institutions are required to report a graduated status for students who have completed their course of study (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4 and Appendix C). For instances in which a student completes one academic program and then enrolls in another academic program at the same school, the school must report two separate enrollment transactions: one showing the completion of the first program and its effective date and credential level, and the other showing the enrollment in the second program and its effective date (Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Texas A&M University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Additionally, NSC completes the roster file on the University’s behalf and communicates status changes to NSLDS, as applicable. Although the University uses the services of NSC, it is still ultimately the University’s responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 2 (3 percent) of 61 students tested, the University did not accurately report graduated status changes to NSLDS. Both students graduated from the Doctor of Veterinary Medicine program, but were reported to NSLDS as withdrawn. After auditors brought this to the University’s attention, the University determined that the issue was caused by the students being on two separate reports sent to NSC. NSC included the students on a warning file provided to the University to review and correct. However, the University did not complete a review of the warning file or make updates to those students’ enrollment status. As a result, NSC subsequently submitted a withdrawn status for those students. The University asserted the issue affected 158 additional Doctor of Veterinary Medicine program graduates, and indicated it was in the process of updating NSLDS with the correct enrollment status. Not reporting student status changes accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its process of reporting graduated students and ensure that warning files related to graduated students are addressed and corrected. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Southern University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always ensure that (1) access to modify information and process transactions in the student information system and (2) administrative access at the network level was limited to only current employees and users who needed that access based on their job responsibilities. The University had a process to review user access to its systems; however, it did not always implement changes based on the results of that review. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made to those systems. Recommendation: The University should ensure that user access to its student information system and administrative access to its network is appropriately limited to employees based on current job responsibilities. Views of Responsible Officials: The Office of Technology acknowledges and agrees with the finding.

Eligibility Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; 84.379; and 93.925 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224145; Federal Work-Study Program, P033A224145; Federal Pell Grant Program, P063P222327; Federal Direct Student Loans, P268K232327; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232327; and Scholarships for Health Professions Students from Disadvantaged Backgrounds – Scholarships for Disadvantaged Students (SDS), 5 T08HP39322-03-00, 5 T08HP39282-03-00 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2020-113, 2017-119, 2016-109 Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). Texas Southern University (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s classification (undergraduate or graduate); residency (in-state or out-of-state); living status (on_x0002_campus, off-campus, or with parent); and enrollment level (full-time, three-quarter-time, half-time, or less-than_x0002_half-time). Budgeting rules within the University’s student information system are established to assign various budget components based on the factors noted above. For 7 (11 percent) of 65 students tested, the University incorrectly calculated the COA. Specifically, the University assigned an incorrect amount for books and supplies for these students. Those errors occurred because the University decreased the default amount for the books and supplies budget component but did not update the algorithmic budget table in its student information system to reflect that change. As a result, the COA was overstated by $40 for each of those students. The errors discussed above did not result in overawards of financial assistance; therefore, there were no questioned costs. However, by incorrectly calculating COA, the University increases the risk of overawarding or underawarding financial assistance to students. Federal Pell Grant: When awarding Federal Pell Grant assistance to students, institutions use the payment and disbursement schedules provided each year by the U.S. Department of Education for determining award amounts (Title 34, CFR, Section 690.62(a)). Those schedules provide the maximum annual amount a student would receive for a full academic year for a given enrollment status, EFC, and COA. There are separate schedules for three-quarter time, half-time, and less-than-half-time students (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 3; and Title 34, CFR, Section 690.63(b)). For 2 (3 percent) of 65 students tested who received Federal Pell Grants, the University did not award the correct amount of Federal Pell Grant assistance. Specifically, the University awarded those students less than they were eligible to receive. The University did not identify additional credit hours from late registration in the students’ Federal Pell Grant award determinations. As a result, the students were underawarded a total of $1,544 in Federal Pell Grant assistance. Federal Direct Student Loans: A borrower who has reached the aggregate borrowing limit for Direct Subsidized Loans and Direct Unsubsidized Loans may not receive additional loans. Once the loans are repaid, in full or in part, the borrower may apply for additional loans. The aggregate unpaid principal amount of all Direct Subsidized Loans made to a student may not exceed $23,000 for any student who has not successfully completed a program of study at the undergraduate level (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 5; and Title 34, CFR, Section 685.203(d)(1)). The University did not always disburse Federal Direct Student Loans in accordance with applicable limits. Specifically, the University exceeded the aggregate limit for Subsidized Direct Loans. Auditors determined that a student had been awarded $500 in excess of the aggregate limit of $23,000. The University manually cleared a hold to enforce the loan limit, without properly reviewing or adjusting the student’s loan. After auditors brought the overaward issue to the University’s attention, it returned the loan funds; therefore, there were no questioned costs. However, by not properly reviewing account holds, the University increases the risk of overawarding financial assistance to students. Satisfactory Academic Progress: A student is eligible to receive Title IV, Higher Education Act of 1965 (HEA) program assistance if the student maintains satisfactory academic progress in his or her course of study according to the institution’s published standards of satisfactory academic progress (SAP) that satisfy the provisions of Title 34, CFR, Section 668.34 (Title 34, CFR, Section 668.32(f)). An institution’s SAP policy must include a qualitative component that consists of grades or comparable factors that are measurable against a norm and a quantitative component that consists of the pace at which students must progress through their program to ensure that they will graduate within the maximum time frame required to complete their education. For a graduate program, a period defined by the institution that is based on the length of the educational program should be used to determine the maximum time frame for the quantitative component of SAP (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 1, Chapter 1; and Title 34, CFR, Section 668.34(b)). Additionally, an institution’s SAP policy should provide that, if at the time of evaluation, the student has not achieved the required grade point average, is not successfully completing his or her program of study at the required pace, or has not completed the program within the maximum time frame, the student is no longer eligible for Title IV aid. The policy should provide specific procedures for disbursements to students on financial aid warning or probation status and permit the student to appeal a determination; it should also provide specific procedures for re-establishing eligibility to receive Title IV aid and the basis on which a student may file an appeal (Title 34, CFR, Section 668.34(a)). For 1 (2 percent) of 65 students tested, the University did not calculate SAP in accordance with its policy. The student re-enrolled in the Fall 2022 term after a gap in attendance, and the University did not perform a manual SAP calculation, which would have shown that the student did not meet the minimum required pace as defined in the University’s SAP policy. The student would have been required to submit an appeal, and have that appeal approved, to receive financial assistance. The student was initially overawarded $6,184. Part of the funds were returned as a result of a Return of Title IV Funds calculation after the student withdrew, and the remaining funds were returned after auditors brought the issue to the University’s attention. Therefore, there were no questioned costs. Not calculating SAP compliance increases the risk that students could receive financial assistance for which they are not eligible. Institutional Student Information Records (ISIR): The U.S. Department of Education automatically distributes (or “pushes”) to institutions certain ISIR transactions processed by the Central Processing System (CPS); it then requires the institutions to take some sort of action. An example of a pushed ISIR would be a student-corrected ISIR that causes a change to the EFC. Institutions are required to review all pushed ISIRs and assess any potential effect on students’ eligibility for assistance (Technical Reference for Electronic Date Exchange (EDE) 2022-2023). The University did not have a process to address errors to ensure that all ISIR data was loaded accurately and completely into its student information system. Specifically, the University did not reconcile records received from CPS-pushed ISIRs to the University’s student information system records during the Fall 2022 term and part of the Spring 2023 term. As a result, some eligible students did not receive their financial assistance until making an inquiry of the University. Recommendations: The University should: • Ensure that it accurately configures COA budget components within its student information system. • Award students Federal Pell Grant assistance based on actual enrollment. • Disburse Subsidized Direct Loans within the student’s applicable aggregate limit. • Ensure that all students are evaluated for Satisfactory Academic Progress prior to disbursing financial assistance. • Properly reconcile all records received from CPS-pushed ISIRs. Views of Responsible Officials: Cost of Attendance (COA): The Office of Student Financial Success agrees with the auditor’s findings indicating that 7 of 65 students tested had an incorrect COA specifically related to the students’ books and supplies portion of the budget. Views of Responsible Officials: Federal Pell Grant: The Office of Student Financial Success agrees with the findings that 2 of 65 students tested were not awarded the correct amount of Federal Pell grant funds. Views of Responsible Officials: Federal Direct Student Loans: The Office of Student Financial Success agrees with the finding that 1 student did not receive federal student loans in accordance with applicable limits. Views of Responsible Officials: Satisfactory Academic Progress: The Office of Student Financial Success agrees with the finding that 1 of 65 students did not receive an SAP calculation in accordance with TSU policy. Views of Responsible Officials: Institutional Student Information Records (ISIR): The Office of Student Financial Success agrees with the finding related to Institutional Student Information Records.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224145; Federal Work-Study Program, P033A224145; Federal Pell Grant Program, P063P222327; Federal Direct Student Loans, P268K232327; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232327 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Award and Disbursement Notifications: Before an institution disburses Title IV, Higher Education Act of 1965 (HEA) program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each Title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans (Title 34, Code of Federal Regulations (CFR), Section 668.165(a)(1)). If an institution credits a student’s ledger account with Federal Direct Student Loan (Direct Loan) funds or Teacher Education Assistance for College and Higher Education (TEACH) Grant funds, the institution must notify the student or parent of (1) the anticipated date and amount of the disbursement, (2) the student’s or parent’s right to cancel all or a portion of that loan or grant and have the loan or grant proceeds returned to the U.S. Department of Education, and (3) the procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan or grant, or loan or grant disbursement (Title 34, CFR, Section 668.165(a)(2)). The institution must provide the notice in writing no earlier than 30 days before, and no later than 30 days after, crediting the student’s ledger account at the institution (Title 34, CFR, Section 668.165(a)(3)). For 61 (100 percent) of 61 disbursements tested, Texas Southern University (University) did not send an award or disbursement notification as required. The University asserted it did not send award notifications to students because it relied on the Common Origination and Disbursement (COD) Disclosure Statements sent by the Department of Education. However, the COD Disclosure Statements did not include all required elements of the award notification. In addition, the University did not consistently send disbursement notifications for the Fall 2022 term, and did not send any disbursement notifications for the Spring 2023 term. The issues with disbursement notifications were attributed to both manual error and disabling of the University’s automated processes. Further, the disbursement notifications that were sent for the Fall 2022 term did not include all required elements. Not receiving award and disbursement notifications impairs students’ and parents’ ability to budget for the cost of attending or exercise the option to cancel their loans or grants. Allowable Charges and Credit Balance Authorizations: An institution may credit a student's ledger account with Title IV, HEA program funds to pay for allowable charges associated with the current payment period. Allowable charges are: (1) the amount of tuition, fees, and institutionally provided room and board assessed the student for the payment period or the prorated amount of those charges if the institution debits the student's ledger account for more than the charges associated with the payment period; and (2) the amount incurred by the student for the payment period for purchasing books, supplies, and other educationally related goods and services provided by the institution for which the institution obtains the student's or parent's authorization under Section 668.165(b) (Title 34, CFR, Section 668.164(c)(1)). A Title IV, HEA credit balance occurs whenever the amount of Title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period. A Title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than (1) fourteen days after the balance occurred if the credit balance occurred after the first day of class within a payment period; or (2) fourteen days after the first day of class of a payment period if the credit balance occurred on or before the first day of class within that payment period (Title 34, CFR, Section 668.164(h)). If an institution obtains written authorization from a student or parent, as applicable, the institution may: (1) use the student’s or parent’s Title IV, HEA program funds to pay for charges that are included in that authorization, and (2) hold on behalf of the student or parent any Title IV, HEA program funds that would otherwise be paid directly to the student or parent as a credit balance, unless the Secretary provides funds to the institution under the reimbursement payment method or the heightened cash monitoring payment method (Title 34, CFR, Section 668.165(b)(1)). An institution may not use Title IV funds to pay finance charges or fees that are incurred because a student uses a financing method provided by the school to pay for educational expenses over time. Because students or families choose to incur these additional expenses rather than paying the balance due at registration, the additional charges are not considered educational expenses, and may not be included in a student’s cost of attendance. (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 2). For 8 (13 percent) of 61 students tested, the University used Title IV funds to pay unallowable charges. Specifically, the University credited the students’ ledger accounts during the payment period for installment handling charges and late installment charges. Although the University obtained authorization from the students to apply Title IV funds to charges other than tuition, fees, or institutionally provided room and board, that authorization did not extend to those unallowable charges. For 6 (11 percent) of 57 students tested, the University did not return credit balances to students or parents within 14 days of the disbursement date or first day of class. Specifically, the University returned credit balances to those students between 21 and 78 days. The University asserted those errors were caused by changes to the term allocations, and inadequate tracking of credit balances and associated refunds. Not receiving all Title IV funds a student is entitled to, or not receiving those funds in a timely manner, impairs students’ and parents’ ability to budget for the cost of attending. Recommendations: The University should strengthen its controls to ensure that: • It identifies all students that require an award or disbursement notification, and sends those notifications to the students. • Award and disbursement notifications include all required elements. • It does not credit student ledger accounts for unallowable charges. • Credit balances caused by the awarding of Title IV funds are returned to students in a timely manner. Views of Responsible Officials: Award and Disbursement Notifications: The Office of Student Financial Success agrees with the finding related to award and disbursement notifications. Views of Responsible Officials: Allowable Charges and Credit Balance Authorizations: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224145; Federal Pell Grant Program, P063P222327; Federal Direct Student Loans, P268K232327; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232327 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs, and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). For 8 (13 percent) of 61 students tested, Texas Southern University (University) incorrectly calculated the amount of Title IV funds to be returned for unofficially withdrawn students. Specifically, those 8 students were enrolled in the Fall 2022 term, and the University did not use the last date of attendance identified in the University’s automated report process. For return of Title IV funds, the University uses an automated report process to identify students who have unofficially withdrawn from a term; however, that process was inconsistently followed or not completed in determining the students’ withdrawal dates. The incorrect withdrawal dates used by the University were prior to the students’ actual withdrawal dates, which resulted in the University returning more Title IV funds than required for those students; therefore, there were no questioned costs. Those errors occurred because the University did not have an adequate process to determine the withdrawal dates of students who unofficially withdrew from the University. Timeliness of Returns: For an institution that is not required to take attendance, the institution must determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the earliest end date of (1) the payment period or period of enrollment, (2) the academic year in which the student withdrew, or (3) the educational program from which the student withdrew (Title 34, CFR, Section 668.22(j)(2)). An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 35 (57 percent) of 61 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. Specifically: • For 23 students who unofficially withdrew in the Fall 2022 term, the University did not determine the withdrawal date within the required 30-day time frame, nor did it return the Title IV funds within the required 45-day time frame. The University determined the withdrawal date and returned the Title IV funds at the end of the Spring 2023 term. • For 9 students who unofficially withdrew in the Spring 2023 term, the University did not determine the students’ withdrawal date within the required 30-day time frame. The University determined the withdrawal date for those students between 31 and 52 days after the end of the period of enrollment. • For 3 students who withdrew in the Fall 2022 term, the University determined the withdrawal dates and performed the return calculations; however, it did not return the Title IV funds within the required 45-day time frame. The University asserted that for two students, this was due to an oversight in processing the return of those funds. The University returned the funds for those two students 71 and 115 days after it determined that the students withdrew. For the third student, the University completed a return calculation but did not return the funds as required. After auditors brought this error to the University’s attention, the University returned the funds to the U.S. Department of Education; therefore, there were no questioned costs. Those errors occurred because the University did not have an effective monitoring process to identify those errors and because of manual errors the University made in performing the return calculations. Not making returns within the required time frame reduces the funds available to the U.S. Department of Education for its program management. Recommendations: The University should: • Strengthen its process to ensure that it accurately determines the withdrawal date for students who unofficially withdraw from the University in a timely manner. • Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations and returns Title IV funds in a timely manner. Views of Responsible Officials: Return of Title IV Calculations: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes. Views of Responsible Officials: Timeliness of Returns: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222327; and Federal Direct Student Loans, P268K232327 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2020-115 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective, and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). Texas Southern University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3). For 10 (17 percent) of 60 students tested, the University did not accurately report campus- or program level data elements to NSLDS. Specifically, the program length was reported incorrectly for the students’ master’s degree or doctoral degree programs. Additionally, for 1 of those 10 students, the University inaccurately reported the effective date of the student’s graduated status at the campus and program levels. The date reported was eight days before the actual date of graduation for the student. For 17 (45 percent) of 38 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the students’ enrollment status was not reported to NSLDS in a timely manner. Specifically: • For 13 students, the University reported the students’ graduated status to NSLDS between 73 and 100 days after the students graduated. • For 2 students, the University reported the students’ enrollment level change to NSLDS 89 and 95 days after the effective date of the status change. • For 2 students, the University reported the students’ withdrawal status to NSLDS 68 and 70 days after the students’ withdrawal date. The errors discussed above occurred because the University (1) did not configure its information system to accurately report student enrollment information to NSLDS, (2) does not have a process to monitor student enrollment and program information reported to NSLDS, and (3) does not have a reporting process that allows it to make corrections to ensure that it certifies and submits graduated statuses in a timely manner. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayments schedules. Recommendation: The University should develop and implement controls to ensure that campus- and program-level data elements are reported to NSLDS accurately and in a timely manner. Views of Responsible Officials: Campus and Program Level Data: Texas Southern University agrees with the finding related to not accurately reporting campus or program level data elements to NSLDS. Views of Responsible Officials: Enrollment Status Updates: Texas Southern University agrees with the finding related to not accurately reporting enrollment status updates to NSLDS in a timely manner. Views of Responsible Officials: Accurate Attendance Reporting: Texas Southern University agrees with the finding related to not accurately reporting enrollment status updates to NSLDS in a timely manner.

Special Tests and Provisions – Gramm-Leach-Bliley Act - Student Information Security Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Gramm-Leach-Bliley Act: Institutions must protect sensitive data, including information obtained in support of the administration of federal student financial assistance programs, as required by the Gramm-Leach-Bliley Act (GLBA) (Public Law 106-102). Under their Program Participation Agreement (PPA) and the GLBA, postsecondary educational institutions must protect student financial aid information, with particular attention to information provided by the Department of Education or otherwise obtained in support of the administration of the Title IV Federal student financial aid programs (Dear Colleague Letter, July 1, 2016 (GEN-16-12)). Institutions are required to develop, implement, and maintain an information security program that includes the minimum elements in Title 16, Code of Federal Regulations (CFR), Section 314.4. In addition, the institution must designate a qualified individual responsible for overseeing, implementing, and enforcing the institution’s information security program (Title 16, CFR, Section 314.4(a)). Texas Southern University (University) did not implement an information security program as required by the GLBA. The University did not have a written information security program (and therefore did not address any of the minimum elements), and it did not designate a Qualified Individual responsible for implementing and monitoring its information security program. The University asserted that this was due to significant staffing issues in its Information Technology Department. Not implementing the required safeguards in an information security program and designating a Qualified Individual to implement and enforce those safeguards increases the University’s risk of data breach or loss. Recommendations: The University should: • Develop and implement an information security program that contains all elements required by the GLBA and the Code of Federal Regulations. • Designate a Qualified Individual responsible to implement and monitor its information security program. Views of Responsible Officials: Gramm-Leach-Bliley Act: The University acknowledges and agrees with the findings.

Eligibility Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; 84.379; 84.408; and 93.925 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224122; Federal Work-Study Program, P033A224122; Federal Pell Grant Program, P063P220387; Federal Direct Student Loans, P268K230387; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T230387; Postsecondary Education Scholarships For Veteran's Dependents (Iraq and Afghanistan Service Grant (IASG)), P408A220387; and Scholarships for Health Professions Students from Disadvantaged Backgrounds - Scholarships for Disadvantaged Students (SDS), 5 T08HP39298-03-00 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, CFR, Sections 668.2, 673.5, and 685.301). Texas State University (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s classification (undergraduate or graduate); residency (in-state or out-of-state); housing status (on_x0002_campus, off-campus, or living with parent); and enrollment status (full-time, three-quarter-time, half-time, or less_x0002_than-half-time). Budgeting rules within the University’s student financial assistance system are established to assign various budget components based on the factors noted above. For 1 (2 percent) of 44 students tested, the University incorrectly calculated the COA. Specifically, the University assigned a less-than-half-time COA when the student was enrolled full-time. As a result, the student’s COA was understated by $9,545. After auditors brought the issue to the University’s attention, it identified a total of 84 total students who were affected, including 56 students who received Title IV financial assistance. Those errors occurred because the University did not recalculate the COA for students in the Pathway program after enrollment was finalized for the Spring 2023 term. The errors discussed above did not result in overawards of financial assistance; therefore, there were no questioned costs. However, by incorrectly calculating COA, the University increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students’ COA budgets for the Pathway program in accordance with its process. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). Texas Tech University (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate level of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222328; and Federal Direct Student Loans, P268K232328 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $562 Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations, Sections 668.2, 673.5, and 685.301). Texas Tech University (University) uses algorithmic budgeting to build COA budgets based on student classification (undergraduate or graduate), academic program (for example, certain programs have increased tuition costs), enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time), living status (on_x0002_campus, off-campus, or living with parents), and residency (in-state or out-of-state). Budgeting rules within the University’s student information system are established to assign various budget components based on the student’s reported expected enrollment. For 3 (5 percent) of 65 students tested, the University incorrectly calculated the COA. Specifically: • For one student, the University assigned an incorrect loan fee to the COA. The University manually canceled the student’s loan, but asserted that it did not remove the fee because the student was still eligible to receive the loan. As a result, the student’s COA was overstated by $60. • For one student, the University did not adjust the student’s COA budget to reflect the student’s actual enrollment. The University manually assigned a three-quarter-time budget to the student. Due to the manual update, the COA was not subject to an automated update process to adjust the COA to less-than-half-time status at census. In addition, the student was not included in the University’s process for reviewing manually updated budgets. As a result, the student’s COA was overstated by $4,157, and the student was overawarded $562 associated with ALN 84.063, Federal Pell Grant Program, award number P063P222328. • For one student, the University did not adjust the student’s tuition and fees budget component to reflect a change in the student’s academic program. The student’s major changed after the initial budget had been assigned. As a result, the student’s COA was overstated by $903; however, the University did not overaward financial assistance to that student. Incorrectly calculating COA increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students’ COA budgets in accordance with its process and does not overaward financial assistance to students. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222328; and Federal Direct Student Loans, P268K232328 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Award Notifications: Before an institution disburses Title IV, Higher Education Act of 1965 (HEA) program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each Title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans (Title 34, Code of Federal Regulations (CFR), 668.165(a)(1)). For 7 (16 percent) of 43 disbursements tested, Texas Tech University (University) did not send an award notification or sent an award notification that did not include all required information. Specifically: • For four students who enrolled in the Fall 2022 term after August 1, 2022, the University did not send an award notification. The University sent award notifications to all students enrolled for the Fall 2022 term prior to that date. However, it did not have a process in place to identify and send award notifications to students who enrolled after that date. Therefore, this issue would have affected all students who enrolled in the Fall 2022 term after August 1, 2022. • For three students who enrolled in the Spring 2023 term, the award notifications did not contain the type or amount of funds that the student or his or her parent could expect to receive. The University notified students of expected financial assistance through email, and the award notification emails for the Fall 2022 term contained a hyperlink for students to access their account in the student information system to review the expected loan types and amounts. However, the award notification emails for the Spring 2023 term did not contain that hyperlink. This issue would have affected all students who enrolled after August 1, 2022, and only for the Spring 2023 term. The University did not have adequate controls in place to ensure that all students received award notifications and that the notifications contained all required elements. Not receiving award notifications, or receiving incomplete award notifications, impairs students’ and parents’ ability to budget for the cost of attending. Recommendations: The University should: • Strengthen its controls to ensure that it identifies all students that require an award notification, and sends those notifications to the students. • Ensure that award notifications contain all required elements. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; 84.379; and 84.408 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224151; Federal Pell Grant Program, P063P222328; Federal Direct Student Loans, P268K232328; Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232328; and Postsecondary Education Scholarships For Veteran's Dependents (Iraq and Afghanistan Service Grant (IASG)), P408A222328 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: Unknown Repeat Finding: No When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). For distance education, documenting that a student has logged into an online class is not sufficient to demonstrate academic attendance by the student. An institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity. Only active participation by a student in an instructional activity related to the student’s course of study that meets the definition of “academic engagement” in Title 34, CFR, Section 600.2 and takes place during a payment period or period of enrollment qualifies as attendance in an academically related activity (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). For 1 (5 percent) of 20 students tested, Texas Tech University (University) did not have evidence of academic engagement in the distance education course from which the student’s withdrawal date was determined. The University asserted that when an instructor submits a failing grade for a student, the instructor is required to provide the date of last academic activity. That date is recorded in the University’s student information system and used by the University to determine the unofficial withdrawal date for Return of Title IV purposes. However, the University did not have a process in place to require instructors to provide or maintain evidence of academic engagement in distance education courses. As a result, the University could not demonstrate that the student participated or otherwise engaged in an academically related activity in that course to support the last date of attendance used by the University for Return of Title IV purposes. Having a process that does not consistently calculate and return the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Recommendations: The University should: • Ensure that evidence of academic engagement is consistently documented for students in distance education courses. • Strengthen its controls to ensure that it accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222328; and Federal Direct Student Loans, P268K232328 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2020-117 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less_x0002_than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For instances in which a student completes one academic program and then enrolls in another academic program at the same school, the school must report two separate enrollment transactions: one showing the completion of the first program and its effective date and credential level, and the other showing the enrollment in the second program and its effective date (Dear Colleague Letter, March 30, 2012 (GEN-12-06)). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). Texas Tech University (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 5 (8 percent) of 60 students tested, the University did not report campus- or program-level data elements accurately or in a timely manner to NSLDS. Specifically: • For three students, the enrollment effective date was correctly reported as the first day of the Summer 2023 term to NSLDS at the program level; however, the enrollment effective date was incorrectly reported as the day after the last day of the Spring 2023 term at the campus level because it did not align with the date reported at the program level. The effective date reported at the campus level should be the same date reported at the program level because those dates reflect the same enrollment status change. • For one student, the University incorrectly reported the student’s program-level enrollment status and the student’s program begin date as the day after the last day of the Spring 2023 term. The enrollment status should have been reported at the program level as full-time effective the first day of the Fall 2023 term. • For one student, the campus-level enrollment status change should have been reported as graduated, but it was incorrectly reported as withdrawn. Additionally, the student was pursuing dual majors, and the program level enrollment status was correctly reported as graduated for one program in a timely manner but incorrectly reported as withdrawn for the second program. The incorrect campus-level enrollment change and program level enrollment change were reported to NSLDS 135 days after the effective date of the graduation. The errors discussed above were caused by issues related to the configuration of the enrollment reporting processes in the University’s student information system. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayments schedules. Recommendations: The University should: • Strengthen its controls to ensure that campus-level and program-level data elements are reported to NSLDS accurately and in a timely manner. • Ensure that dual-major graduated statuses are reported to NSLDS accurately and timely for all programs. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Special Tests and Provisions – Additional Locations Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.268 Pass-Through Agency: N/A Award Number: Federal Direct Student Loans, P268K232328 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $3,452,367 Repeat Finding: No Eligibility and Certification Approval Report: Each institution’s most recent Eligibility and Certification Approval Report (ECAR) lists the institution’s main campus and any additional approved locations. For any other locations at which an institution offers 50 percent or more of an eligible program, the institution must notify the U.S. Department of Education of that location if the institution plans to disburse Title IV funds to students enrolled at that location (Title 34, Code of Federal Regulations (CFR), Section 600.21(a)(3)). An institution may not disburse Title IV funds to students at that location before it reports to the U.S. Department of Education about that location (Title 34, CFR, Section 600.21(d)). Texas Tech University’s (University) most recent ECAR did not include all additional locations. Specifically, the University offered more than 50 percent of an eligible program at the School of Veterinary Medicine at Amarillo; however, the University did not include the location on its most recent ECAR nor did it submit notice or an application for approval of additional location as required. The University asserted that the error occurred due to turnover of the Primary Designee responsible for requesting approval of the new location, which resulted in the University failing to adequately review its ECAR to ensure that it reported all locations at which it offered more than 50 percent of an eligible program. The University disbursed $3,452,367 in federal student financial assistance to 108 students at the unreported location during the 2022–2023 award year. Those disbursements were associated with ALN 84.268, Federal Direct Student Loans, award number P268K232328, and were considered questioned costs. After auditors brought the issue to the University’s attention, the University added the location to its ECAR and the School of Veterinary Medicine at Amarillo was approved on July 26, 2023. Recommendation: The University should update its ECAR as required, and ensure that it does not disburse federal financial assistance to students at locations that are not approved by the U.S. Department of Education. Views of Responsible Officials: Texas Tech University acknowledges and agrees with the findings. Texas Tech University has worked to develop and implement corrective action to further improve processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P223367; and Federal Direct Student Loans, P268K233367 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2016-122 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less_x0002_than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective, and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate(NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). Texas Tech University Health Sciences Center (Health Sciences Center) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the Health Sciences Center reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the Health Sciences Center uses the services of NSC, the Health Sciences Center still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3.3). For 6 (10 percent) of 62 students tested, the Health Sciences Center did not accurately report campus level enrollment effective dates or did not report enrollment status changes to NSLDS. Specifically: • For one student, the enrollment status effective date was reported incorrectly at the campus-level. The student’s enrollment status for the Spring 2023 term decreased from full-time to less-than-half-time in April 2023; however, the effective date was reported as January 2023. • For five students, the Health Sciences Center did not report the students’ enrollment status changes to NSLDS. Two of those students withdrew, two students graduated, and one student received an approved leave of absence. The Health Sciences Center asserted that the errors discussed above were caused by issues related to the configuration of the enrollment reporting processes in the Health Sciences Center’s student information system, manual reporting errors, and not having adequate controls to ensure that student enrollment information reported to NSC was accurately reported to NSLDS. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The Health Sciences Center should strengthen its controls to ensure that campus-level enrollment statuses and effective dates are reported accurately and in a timely manner to NSLDS. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: 2020-142 General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. Specifically, a user was granted administrative access in the student information system, which included the ability to modify information and process transactions, such as authorizing and disbursing aid. The University did not remove the administrative access after the user’s specific job responsibilities no longer required that level of access. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: To the point that The University of Texas at Arlington (University) did not appropriately restrict user access to its student information system. OIT and Financial Aid acknowledge that a user was given elevated access that was not removed when the assigned maintenance task was completed.

Cash Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 93.264; and 93.364 Pass-Through Agency: N/A Award Number: Nurse Faculty Loan Program (NFLP), 2 E01HP28792-04-00; and Nursing Student Loans (NSL), 1 E4CHP46343-01-00 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $19,593 Repeat Finding: No Institutions must maintain advance payments of federal awards in interest-bearing accounts (Title 2, Code of Federal Regulations (CFR), Section 200.305(b)(8)). Interest earned amounts up to $500 per year may be retained by the non-federal entity for administrative expense. Any additional interest earned on federal advance payments deposited in interest-bearing accounts must be remitted annually to the Department of Health and Human Services Payment Management System (PMS) through an electronic medium using either the Automated Clearing House (ACH) network or a Fedwire Funds Service payment (Title 2, CFR, Section 200.305(b)(9)). The University of Texas at Arlington (University) did not remit interest to the Department of Health and Human Services’ PMS as required. Specifically, the University: • Maintained advance payments of Nurse Faculty Loan Program (NFLP) funds in an interest-bearing account, which earned $17,803 in interest in fiscal year 2023. • Maintained advance payments of Nursing Student Loan (NSL) funds in an interest-bearing account, which earned $2,290 in interest in fiscal year 2023. The University asserted it was not aware of the requirement to remit interest for NFLP and NLS, and believed the earnings on interest could be retained as a source of additional funds for lending to students. After the $500 allowance for administrative expenses, the University would be required to remit interest totaling $17,553 associated with ALN 93.264, Nurse Faculty Loan Program, award number 2 E01HP28792-04-00 and $2,040 associated with ALN 93.364, Nursing Student Loans, award number 1 E4CHP46343-01-00, which are considered questioned costs. Recommendation: The University should ensure that interest in excess of $500 per year earned on federal cash draws is remitted annually to the Department of Health and Human Services. Views of Responsible Officials: The University has been adhering to the guidance found in the Nursing Faculty and Student Loan award documentation as well as the guidance found in the HRSA EHB Guidance Document regarding interest earned on the advanced payments. The guidance found in these documents states that interest earned in these loan funds should be maintained in an interest-bearing account and deposited in the loan fund. It further states that the interest earned can be retained as an important source of additional funds for lending to students. However, as a result of the finding from this audit, the University acknowledges that interest in excess of $500 must be remitted annually to the Department of Health and Human Services. Corrective Action Plan: The University will remit annually any interest earned in excess of $500 to the Department of Health and Human Services. Implementation Date: 2/2024 Responsible Person: Andrea Wright, Executive Director of Accounting Service

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224172; Federal Pell Grant Program, P063P222335; and Federal Direct Student Loans, P268K232335 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). The University of Texas at Arlington (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s classification (undergraduate or graduate), dependency (dependent or independent), residency (in-state or out-of-state), living status (on-campus, off-campus, or with parents), and enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time). Budgeting rules within the University’s student information system are established to assign various budget components based on the factors noted above. For 3 (5 percent) of 63 students tested, the University incorrectly calculated the COA. Specifically: • For two students, the University understated the COA by assigning a books component that did not reflect the students’ actual enrollment status. Those errors occurred because the University budgeted the students’ books at half-time enrollment instead of full-time enrollment. The University attributed the cause to human error associated with a manual budget rebuild in the student information system. As a result, the COA was understated by $200 for each of those students. • For one student, the University assigned an incorrect budget for the cost of tuition and fees component during the Summer 2022 term. The University attributed the cause to human error. As a result, the COA was understated by $198. The errors discussed above did not result in overawards of financial assistance; therefore, there were no questioned costs. However, by incorrectly calculating COA, the University increases the risk of overawarding or underawarding financial assistance to students. Federal Pell Grant: A student is eligible to receive a Federal Pell Grant for the period of time required to complete his or her first undergraduate baccalaureate course of study (Title 34, CFR, Section 690.6(a)). When awarding Federal Pell Grant assistance to students, institutions use the payment and disbursement schedules provided each year by the U.S. Department of Education for determining award amounts (Title 34, CFR, Section 690.62(a)). Based on a review of the full population of student financial assistance recipients, the University awarded a total of $1,593 in Federal Pell Grant assistance to 2 post-baccalaureate students who were not eligible for that assistance. The University asserted queries designed to identify these issues were not run timely due to staffing issues within the Financial Aid department. After auditors brought those errors to the University’s attention, the University returned the funds to the U.S. Department of Education; therefore, there were no questioned costs. For 1 (2 percent) of 63 students tested, the University did not award Federal Pell Grant assistance to an eligible student. Specifically, the student was eligible to receive $1,790 in Federal Pell Grant assistance, but did not receive an award from the University. The University asserted that the error occurred because the student made a late registration change and was missed on the University’s add report. As a result, the student was underawarded Federal Pell Grant assistance; therefore, there were no questioned costs. Federal Direct Student Loans: Direct Subsidized and Unsubsidized Loans have annual and aggregate limits that are the same for all students at a given grade level and dependency status. In general, a loan may not be more than the amount the borrower requests, the borrower’s unmet financial need, the borrower’s COA, or the borrower’s maximum borrowing limit. (U.S. Department of Education 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 5). For 1 (2 percent) of 63 students tested, the University did not disburse Direct Loans in accordance with applicable limits. Specifically, the University disbursed a Subsidized Direct Loan in excess of the student’s aggregate Subsidized Direct Loan and Total Direct Loan limits. After auditors brought the overaward issue to the University’s attention, it returned the loan funds; therefore, there were no questioned costs. The University asserted that error occurred because the University did not receive an updated history file in a timely manner due to issues with the National Student Loan Data System (NSLDS). Federal Supplemental Educational Opportunity Grants (FSEOG): The FSEOG program provides grants to eligible undergraduate students. Institutions are required to award FSEOG first to Federal Pell Grant recipients who have the lowest EFC. If an institution has FSEOG funds remaining after giving FSEOG awards to all Federal Pell Grant recipients, it can then award the remaining FSEOG funds to eligible students with the lowest EFCs who did not receive Federal Pell Grants (Title 34, CFR, Section 676.10). Based on a review of the full population of student financial assistance recipients, the University awarded a total of $750 in FSEOG assistance to a student who was working towards a second bachelor’s degree and thus was not eligible for that assistance. The student was awarded FSEOG in the Spring 2023 term after earning a first bachelor’s degree in the Fall 2022 term. The University asserted this was a manual error caused by a counselor canceling the student’s Federal Pell Grant, but failing to cancel the student’s FSEOG award. After auditors brought the issue to the University’s attention, it removed the grant funds from the student’s account; therefore, there were no questioned costs. Recommendations: The University should: • Strengthen its controls to ensure that it correctly calculates students’ COA budgets in accordance with its process. • Award Federal Pell Grant assistance only to eligible students. • Ensure that students are awarded Federal Pell Grants for which they are eligible. • Disburse Subsidized Direct Loans within the student’s applicable aggregate limit. • Award FSEOG assistance only to eligible students. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222335; Federal Direct Student Loans, P268K232335; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232335 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No COD Reporting: Institutions must submit Federal Pell Grant, Iraq and Afghanistan Service Grant, Direct Loan, and Teacher Education Assistance for College and Higher Education (TEACH) Grant disbursement records to the Common Origination and Disbursement (COD) system no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. Reporting this information helps ensure that institutions have the most accurate information available about students’ federal awards and helps prevent an institution from overawarding students (Title 34, Code of Federal Regulations (CFR), Section 690.83(b); U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 1; and Federal Register, Volume 88, Number 120). Certain data elements are required to be reported as part of a student’s origination and disbursement record, including the student’s Social Security number, Central Processing System (CPS) transaction number, enrollment date, cost of attendance, the start and end dates for the academic term, disbursement amount, and disbursement date (2022-2023 COD Technical Reference, Volume II). For 5 (8 percent) of 61 students tested, the University of Texas at Arlington (University) did not accurately report all origination record data elements to the COD system. Two of those students had both errors discussed below. Specifically, • For four students, the University reported an incorrect academic end date for one or more Direct Loan originations made on behalf of the students during the award year. • For three students, the University reported an incorrect cost of attendance for one or more Federal Pell Grant and/or Direct Loan originations made on behalf of the students during the award year. The University asserted that its developer was unable to identify the specific cause of these errors, but determined that the errors were related to an automated process rather than a manual change. In addition, the University did not have a sufficient monitoring process in place to identify those discrepancies. Not accurately reporting information to the COD system could result in the institution overawarding federal funds. Recommendation: The University should strengthen its controls to ensure that academic end dates and cost of attendance are reported to the COD system accurately. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222335; and Federal Direct Student Loans, P268K232335 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 5 (8 percent) of 61 students tested who withdrew and required a return of Title IV funds, the University of Texas at Arlington (University) did not return the funds within the required time frame. Specifically, the University returned the Title IV funds to the U.S. Department of Education between 101 to 390 days after the University determined the students withdrew. For four of those students, the updates to the students’ returns occurred after auditors selected those students for review. The error for the other student was identified by the University, but the funds were not returned in a timely manner. After the University became aware of the errors, it returned those funds to the U.S. Department of Education; therefore, there were no questioned costs. The University did not have an adequate monitoring process to ensure that Title IV funds were returned within the required time frame. Not making returns within the required time frames reduces the funds available to the U.S. Department of Education for its program management. Recommendation: The University should ensure that it returns Title IV funds within required time frames. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222335; and Federal Direct Student Loans, P268K232335 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2020-143 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). The University of Texas at Arlington (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 18 (30 percent) of 61 students tested, the University did not accurately report campus- and program level data elements to NSLDS. One of those students was affected by two of the errors discussed below. Specifically: • For 13 students, the University incorrectly reported the students’ enrollment status at the program level to NSLDS. Six students were reported as less-than-half-time instead of half-time, and seven students were reported as half-time instead of full-time. Those errors occurred because the enrollment reporting processes in the University’s student information system were not configured appropriately for the Graduate Nursing program. • For four students, the enrollment effective date was reported correctly to NSLDS at the program level; however, the University incorrectly reported the first day of the Spring 2023 term as the enrollment effective date at the campus level. The effective date reported at the program level should have been the same date reported at the campus level because those dates reflect the same enrollment status change. As noted above, those errors were caused by issues with the configuration of the enrollment reporting processes for the Graduate Nursing Program. • For two students, the University did not report the students’ graduated status or did not accurately report the graduated status at the campus and program levels to NSLDS. One student’s graduated status was accurately reported at the campus level, but was reported as withdrawn at the program level. The other student was inaccurately reported as withdrawn at both the campus- and program-levels. Those errors occurred because the students’ statuses required manual reporting and were overlooked. Not reporting student enrollment and program information accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its controls to ensure that all status changes are reported accurately to NSLDS. Views of Responsible Officials: The University acknowledges and agrees with the finding. The University will work to develop and implement corrective action to improve and update the processes.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education U.S. Department of Health and Human Services Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas at Austin (University) did not appropriately restrict user access to its student information system. Specifically, an employee retained the ability to modify student financial aid awards after transitioning from the Office of Student Financial Aid to another department within the University. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, one of the University’s departments did not enable the control designed to prevent developers from migrating their own code changes into production. Not having sufficient segregation of duties controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance. Recommendations: The University should: • Ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. • Strengthen its controls over its change management process to ensure adequate segregation of duties. Views of Responsible Officials: The University acknowledges and agrees with the finding. In this case, the employee transitioned from the Office of Scholarships and Financial Aid (OSFA) to the Student Financial Aid implementation project. It was intended for this employee to retain his prior access for a time so he could help provide backstop support while his duties were transitioned to other employees within OSFA. This access should have been removed once his duties were successfully transitioned. Views of Responsible Officials: The University acknowledges and agrees with the finding. However, technical limitations in the current financial aid management system require that a particular mainframe programming library be exempted from the change control mechanisms that are used in all other libraries that can update student financial aid information.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224173; Federal Pell Grant Program, P063P222336; and Federal Direct Student Loans, P268K232336 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs, and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). For 1 (2 percent) of 60 students tested, the University of Texas at Austin (University) incorrectly calculated the amount of Title IV funds to be returned. Specifically, the University initially determined that the student officially withdrew on March 10, 2023, and the University incorrectly determined that the student completed more than 60 percent of the term. The University subsequently incorrectly determined that the student unofficially withdrew on February 10, 2023, and processed a return of Title IV funds in the amount of $18,742. After auditors brought the error to the University’s attention, it re-performed the return calculation using the correct date of withdrawal and reinstated the appropriate amount of funds to the student. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Coronavirus Aid, Relief, and Economic Security (CARES) Act: Section 3508 of the CARES Act directs the Secretary to waive the statutory requirement for institutions to return Title IV funds (R2T4) as the result of student withdrawals related to a qualifying emergency. For any student who begins attendance in a payment period or period of enrollment that includes March 13, 2020, or begins between March 13 and the later of December 31 or the last date that the national emergency is in effect, and subsequently withdraws from the period as a result of COVID-19-related circumstances, an institution is not required to return Title IV funds. The CARES Act requires an institution to report to the Department information specific to each student for whom it was not required to return Title IV funds under the waiver exception. An institution must determine the total amount of grant and loan assistance that otherwise would have been returned, identified in Step 5 of the R2T4 calculation, had the calculation been performed. Therefore, it will continue to be necessary for institutions to perform an R2T4 calculation for each student covered by the CARES Act R2T4 waiver (Electronic Announcement titled UPDATED Guidance for interruptions of study related to Coronavirus (COVID-19), June 16, 2020). For 1 (50 percent) of 2 students tested who were eligible for relief under the CARES Act, the University incorrectly processed a return of Title IV funds. The University determined that the student was eligible to receive an R2T4 waiver under Section 3508 of the CARES Act. However, the University subsequently processed a return of Title IV funds for the student. The University asserted that error occurred because the student was listed on a census report showing students who did not enroll in sufficient hours to receive aid, and the student’s Title IV funds were incorrectly returned because the student’s CARES Act R2T4 waiver was overlooked. After auditors brought the error to the University’s attention, it reinstated the student's aid and reported to the U.S. Department of Education that the student qualified for relief under the CARES Act waiver exemption and reported the amount of relief given. Not accurately identifying students who qualify for a waiver could result in those students not receiving aid to which they are entitled. Timeliness of Returns: An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 1 (2 percent) of 58 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. The University performed the return calculation and executed a transaction to return the funds within its student information system; however, the University did not return the Title IV funds to the U.S. Department of Education within the required 45-day time frame due to an error in processing the return of those funds. After auditors selected the student for testing, the University returned Title IV funds as required; therefore, there were no questioned costs. Not returning funds within the required time frame reduces the information available to the U.S. Department of Education for its program management. The University had a process to review its calculations for returns of Title IV funds; however, it did not have adequate controls to ensure that it identified the errors discussed above. Recommendations: The University should strengthen its controls to ensure that it: • Accurately calculates returns of Title IV funds when required, including review of the variables it uses in those calculations. • Performs return of Title IV calculations and returns funds within the required time frame. Views of Responsible Officials: The University acknowledges and agrees with the finding. For 1 (2 percent) of 58 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. For 1 (2 percent) of 60 students tested, the University incorrectly calculated the amount of Title IV funds to be returned. For 1 (50 percent) of 2 students tested eligible for relief under the CARES Act, the University incorrectly processed a return of Title IV funds. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to improve the processes further.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222336; and Federal Direct Student Loans, P268K232336 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). Institutions may not be immediately aware of a student’s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4; and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). The University of Texas at Austin (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 4 (7 percent) of 61 students tested, the University did not accurately report program-level data elements to NSLDS. Specifically, the University incorrectly reported the program enrollment effective date as the first date of the term, rather than the actual effective date of the students’ enrollment status change. The University asserted those errors were caused by changes implemented in its automated enrollment reporting process to reflect the new 2023 academic calendar. Not reporting student status changes accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its controls to ensure that program enrollment effective dates are reported to NSLDS accurately. Views of Responsible Officials: The University acknowledges and agrees with the Program Enrollment Effective Date finding. Program Enrollment Effective Date is defined as the date a student’s enrollment status changes during a semester of enrollment (i.e. student’s enrollment status changes from full-time to half-time status). For 4 (7 percent) of 61 students tested, the University did not accurately report program-level data elements to NSLDS. Specifically, the University incorrectly reported the program enrollment effective date as the first date of the term, rather than the date the students’ enrollment status actually changed. The University asserted those errors were caused by required changes to its automated enrollment reporting process to accommodate the newly implemented structure of its academic calendar. Through analysis of the exceptions identified in the audit, the University has developed and implemented corrective action to further improve the processes.

Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.038 Pass-Through Agency: N/A Award Number: Federal Perkins Loan Program, award number N/A Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Institutions must retain promissory and master promissory notes (MPNs) and repayment records for each Perkins Loan program loan made. Institutions are required to keep original paper promissory notes or original paper MPNs and repayment schedules in a locked, fireproof container. The original promissory notes and repayment schedules must be kept until the loans are satisfied (Title 34, Code of Federal Regulations (CFR), Section 674.19(e)(4)). An institution shall retain disbursement and electronic authentication and signature records for each loan made using an MPN for at least three years from the date the loan is canceled, repaid, or otherwise satisfied. (Title 34, CFR, Section 674.19(e)(3)(i)). The University of Texas at Austin (University) did not consistently maintain paper Perkins Loan records in a locked, fire-proof container, as required. Paper records for open Perkins Loans were properly maintained; however, paper records for retired Perkins Loans were stored in paper boxes in the basement storage room of the Student Accounts Receivable Office. The University asserted that only staff in the Student Accounts Receivables Office have access to the storage room with electronic key cards, and that the records were stored in boxes because the University did not have sufficient filing cabinet storage available. Not appropriately storing paper records results in noncompliance with the Federal Perkins loan program record retention requirements and increases the risk of data loss or breach. Recommendation: The University should ensure that retired Perkins Loan original paper promissory notes or original paper MPNs and repayment schedules are stored in a locked, fireproof container for the prescribed period. Views of Responsible Officials: The University acknowledges and agrees with the finding. The University will work to develop and implement corrective action to further improve the processes.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224174; Federal Work-Study Program, P033A224174; Federal Pell Grant Program, P063P223234; Federal Direct Student Loans, P268K233234; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T233234 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, CFR, Sections 668.2, 673.5, and 685.301). The University of Texas at Dallas (University) established different COA budgets for each term based on a student’s tuition rate (guaranteed or variable); classification (undergraduate or graduate); residency (in-state and out-of-state); living status (on-campus, off-campus, or at home); and enrollment level (full-time, three-quarter-time, half-time, or less-than-half-time). Budgeting formulas within the University’s student information system are used to assign various budget components based on the factors noted above. The University did not always accurately configure COA budget components in its student information system. Specifically, the University incorrectly set the Summer transportation budget for a certain group of students—undergraduate students with a guaranteed tuition rate who were in-state residents living at home and enrolled half-time—to $640 instead of $928. After auditors brought the issue to the University’s attention, it identified 299 students who were affected. As a result, the COA for those students was understated by a total of $86,112 for the Summer 2023 term. The errors discussed above did not result in overawards of financial assistance; therefore, there were no questioned costs. However, by incorrectly calculating COA, the University increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should ensure that it accurately configures COA budget components within its student information system. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes. While reviewing the population for submission to the auditors, the University determined that the above error had occurred. Since the timing was still within the summer semester, we corrected the COA component error and provided institutional grant funding for those students who had increased need due to the update in their summer transportation budget. There were only 2 students who needed to have their loans repackaged to avoid under awarding federal aid, which was done.

Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.038 Pass-Through Agency: N/A Award Number: Federal Perkins Loan Program, award number N/A Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Institutions must retain promissory and master promissory notes (MPNs) and repayment records for each Perkins Loan program loan made. Institutions are required to keep original paper promissory notes or original paper MPNs and repayment schedules in a locked, fireproof container. The original promissory notes and repayment schedules must be kept until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. After the loan obligation is satisfied, the institution shall return the original or a true and exact copy of the note marked “paid in full” to the borrower, or otherwise notify the borrower in writing that the loan is paid in full and retain a copy for the prescribed period (Title 34, Code of Federal Regulations (CFR), Section 674.19(e)(4)). For 9 (100 percent) of 9 retired loans tested, the University of Texas at Dallas (University) did not send paid-in-full notifications to those borrowers, as required. As a result, the University did not maintain the required documentation of the paid-in-full notifications to those borrowers after their loan obligations were satisfied. Those errors occurred because the University’s third-party Perkins Loan servicer erroneously excluded the paid-in-full letter service from its contract renewal with the University, and the University failed to identify the discrepancy. The University provided auditors with correspondence from the servicer in which the servicer accepted responsibility for the oversight. The servicer stated that it would send the paid-in-full letters to borrowers retroactively. Not maintaining adequate documentation results in noncompliance with the Federal Perkins loan program record retention requirements. Additionally, not notifying borrowers of their loans’ paid-in-full status increases the risk of borrowers making overpayments on their loans. Recommendation: The University should ensure that paid-in-full notifications are sent to all borrowers who satisfy their Perkins Loan obligations, and retain a copy of each notification for the prescribed period. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes. For many years, the University's Perkins Loan portfolio was being serviced by Campus Partners. Shortly after Heartland ECSI acquired Campus Partners, the University made the decision to fully transfer their Perkins Loan services to ECSI. This transition was intended to not only continue receiving the services provided by our current servicer, but also to enhance services in other areas. During the early stages of this transition our team was very involved in determining which services would be included in the contract. It was determined that there were services considered standard with Campus Partners that were not included with ECSI; the paid-in-full letter was one of these services. The Bursar management team noticed this discrepancy and mentioned this to our ECSI Client Relationship Coordinator dated April 27, 2017. Based on the information provided, it was our understanding that the paid-in-full letter service would be an active service with ECSI. Since ECSI does not retain copies of these letters, we had no reason to question whether this service was being done. During this audit, it was brought to our attention that the most recent contract renewal with ECSI did not indicate that they were providing the paid- in-full letters on our behalf. As the Bursar Office began to research this process, we were told by an ECSI representative that they did not see this service being provided to our borrowers. After further communication with our Client Relationship Coordinator, it was determined that ECSI did not "turn on" this service after the order request was submitted to their implementation team, as determined via email on October 12, 2023. The University understands it's our responsibility to ensure processes are being completed by all servicing organizations. In response, ECSI has submitted an order for this service to be activated for all future accounts. They have also agreed to send paid in full notices to all borrowers dating back to the beginning of our contract, as well as revising the contract to ensure this service is included moving forward.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222338; and Federal Direct Student Loans, P268K232338 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less_x0002_than-half-time status, the institution must use the effective date that the student changed to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1 and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). To protect a student’s interest subsidy, institutions are required to report a graduated status for students who have completed their course of study (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4 and Appendix C). Institutions may not be immediately aware of a student’s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4; and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). The University of Texas at El Paso (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 3 (5 percent) of 62 students tested, the University did not accurately report campus- and program level enrollment effective dates or did not report enrollment status changes to NSLDS. Specifically: • For two students, the effective date of the students’ withdrawn status was reported incorrectly at both the campus and program levels. The University reported one student’s withdrawal effective date as the end of the payment period, instead of the actual date of withdrawal. The University determined the second student never attended the Summer 2023 term and reported an incorrect withdrawal date instead of the student’s actual last date of attendance, which was the last day of the Fall 2022 term. • For one student, the University did not report an enrollment status change to NSLDS. The student’s enrollment status decreased from three-quarter-time to less-than-half-time after the University approved a medical withdrawal for certain courses after the term had ended, and the University did not report that change. For 2 (12 percent) of 17 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the students’ enrollment status was not reported to NSLDS in a timely manner. Specifically, both students’ graduated status was received by NSLDS 73 days after the students graduated. The University had a process to monitor enrollment information reported to NSC and NSLDS; however, that process was not sufficient to identify the errors discussed above. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendations: The University should: • Strengthen its controls to ensure that campus- and program-level enrollment statuses and effective dates are reported to NSLDS accurately. • Ensure that all graduated statuses are reported to NSLDS in a timely manner. Views of Responsible Officials: The University acknowledges the findings and recommendations. Staff members have begun working on the corrective action plan to improve the processes and implement any necessary changes by the end of the spring 2024 semester.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224169; Federal Pell Grant Program, P063P223294; Federal Direct Student Loans, P268K233294; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T233294 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: $64,905 Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). The University of Texas at San Antonio (University) made errors in Title IV return calculations for 14 (56 percent) of 25 students tested. Those errors occurred because the University did not exclude break days from its calculations of returns of Title IV funds for the Spring 2023 term as required; therefore, that issue would have affected all students who withdrew from the Spring 2023 term and had a return calculation performed. Although the amount of unearned Title IV assistance calculated for those students was incorrect, there were no questioned costs because the University returned more funds than required. In addition, for 3 (12 percent) of 25 students tested who did not have a return of Title IV funds made, the University did not perform a return calculation as required. Those errors occurred because the University incorrectly used 7 break days instead of 8 break days when determining whether students who withdrew from the Spring 2023 term had completed 60 percent or more of the term. As a result, the University did not perform return calculations and return funds as required for students who withdrew between March 26 and March 28, 2023, which resulted in total questioned costs of $50,146 associated with ALN 84.268, Federal Direct Student Loans, award number P268K233294, and $14,759 associated with ALN 84.063, Federal Pell Grant Program, award number P063P223294. The University did not have an adequate monitoring process to identify those errors. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Recommendations: The University should: • Accurately determine the number of days in the payment period and exclude any scheduled breaks as required. • Strengthen its controls to ensure that it detects and corrects errors in return of Title IV calculations and returns Title IV funds. Views of Responsible Officials: The University acknowledges and agrees with the finding that were the result of staff turnover. Through analysis of the exceptions identified in the audit, the University has worked to develop and implement corrective action.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P223294; and Federal Direct Student Loans, P268K233294 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Enrollment is reported for a specific location of each campus; that is, the eight-digit Office of Postsecondary Education Identification (OPEID) number. Most students are enrolled in coursework at only one location. However, for students who are taking coursework at multiple locations of the same school, the school must determine which location is the student’s “primary location” and report the combined enrollment for the student using that location to NSLDS. A student’s “primary location” is the location where the student is taking more coursework than at any other location. Reporting a student’s enrollment at the main campus does not satisfy the enrollment reporting requirement if aid was disbursed or the student was physically attending school at a different location (NSLDS Enrollment Reporting Guide, November 2022, Chapters 4 and 6). The University of Texas at San Antonio (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 2 (8 percent) of 26 students tested, the University inaccurately reported the OPEID number to NSLDS. Specifically for those students, the University incorrectly reported the OPEID number of the main campus, instead of the OPEID number of the location where the students were taking the majority of their coursework. The University asserted that it reports the main campus OPEID number for all students to NSLDS; therefore, the errors discussed above would have affected all students who did not take the majority of their coursework at the main campus location. Not reporting student information accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should implement a process to ensure that it accurately reports the OPEID number to NSLDS for students who take the majority of their coursework at a location other than the main campus. Views of Responsible Officials: The University acknowledges and agrees with the finding, which has had no impact on accurately reporting the enrollment levels of our students to NSLDS.

Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.038 Pass-Through Agency: N/A Award Number: Federal Perkins Loan Program, award number N/A Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Institutions must retain promissory and master promissory notes (MPNs) and repayment records for each Perkins Loan program loan made. Institutions are required to keep original paper promissory notes or original paper MPNs and repayment schedules in a locked, fireproof container. The original promissory notes and repayment schedules must be kept until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. After the loan obligation is satisfied, the institution shall return the original or a true and exact copy of the note marked “paid in full” to the borrower, or otherwise notify the borrower in writing that the loan is paid in full and retain a copy for the prescribed period (Title 34, Code of Federal Regulations (CFR), Section 674.19(e)(4)). For 25 (100 percent) of 25 retired loans tested, the University of Texas at San Antonio (University) did not send paid-in-full notifications to those borrowers, as required. As a result, the University did not maintain the required documentation of the paid-in-full notifications being sent to those borrowers after their loan obligations were satisfied. Not maintaining adequate documentation results in noncompliance with the Federal Perkins loan program record retention requirements. Additionally, not notifying borrowers of their loans’ paid-in-full status increases the risk of borrowers making overpayments on their loans. The University asserted the errors discussed above occurred because it believed the University’s third-party Perkins Loan servicer was responsible for sending the paid-in-full notifications. The University was unable to provide its contract with the third-party Perkins Loan servicer. However, the University obtained a list of services rendered from the servicer, which showed the paid-in-full letter service was not a service included in the contract. Recommendation: The University should ensure that paid-in-full notifications are sent to all borrowers who satisfy their Perkins Loan obligations, and retain a copy of each notification for the prescribed period. Views of Responsible Officials: UTSA acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, UTSA will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222337; and Federal Direct Student Loans, P268K232337 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). To protect a student’s interest subsidy, institutions are required to report a graduated status for students who have completed their course of study (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4 and Appendix C). Institutions may not be immediately aware of a student’s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4; and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). For 6 (10 percent) of 61 students tested, the University of Texas Health Science Center at San Antonio (Health Science Center) did not accurately report the program begin date to NSLDS. Specifically, those students began attendance in the program on July 29, 2019; however, the Health Science Center reported a program begin date of either January 6, 2020, or May 18, 2020. The Health Science Center asserted those errors were caused by the CIP code year conversion from 2010 to 2020 within the Health Science Center Registrar’s Office. After auditors brought those errors to the Health Science Center’s attention, the Health Science Center corrected the program begin date for all six students. Not reporting student program information accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The Health Science Center should strengthen its controls to ensure that program begin dates are reported to NSLDS accurately. Views of Responsible Officials: The University acknowledges noncompliance of validating program start dates aligned to Classification of Instructional Program (CIP codes) and graduated student status. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to improve processes.

Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.038 Pass-Through Agency: N/A Award Number: Federal Perkins Loan Program, award number N/A Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Institutions must retain promissory and master promissory notes (MPNs) and repayment records for each Perkins Loan program loan made. Institutions are required to keep original paper promissory notes or original paper MPNs and repayment schedules in a locked, fireproof container. The original promissory notes and repayment schedules must be kept until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. After the loan obligation is satisfied, the institution shall return the original or a true and exact copy of the note marked “paid in full” to the borrower, or otherwise notify the borrower in writing that the loan is paid in full and retain a copy for the prescribed period (Title 34, Code of Federal Regulations (CFR), Section 674.19(e)(4)). For 17 (100 percent) of 17 retired loans tested, the University of Texas Health Science Center at San Antonio (Health Science Center) did not send paid-in-full notifications to those borrowers, as required. As a result, the Health Science Center did not maintain the required documentation of the paid-in-full notifications to those borrowers after their loan obligations were satisfied. The Health Science Center asserted that it was unaware of this requirement and that it only provided paid-in-full confirmations when requested by the borrower. Not maintaining adequate documentation results in noncompliance with the Federal Perkins loan program record retention requirements. Additionally, not notifying borrowers of their loans’ paid-in-full status increases the risk of borrowers making overpayments on their loans. Recommendation: The Health Science Center should ensure that paid-in-full notifications are sent to all borrowers who satisfy their Perkins Loan obligations and retain a copy of each notification for the prescribed period. Views of Responsible Officials: The University acknowledges non-compliance with Perkins loan recordkeeping and will implement corrective action to improve processes.

General Controls. The following compliance areas were impacted: Eligibility Reporting Special Tests and Provisions - Disbursements To or On Behalf of Students Special Tests and Provisions - Return of Title IV Funds Special Tests and Provisions - Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency Questioned Costs: None Repeat Finding: No General Controls: An institution must establish and maintain effective internal control over federal awards that provides reasonable assurance that the institution is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award (Title 2, Code of Federal Regulations (CFR), Section 200.303(a)). The University of Texas Permian Basin (University) did not appropriately restrict user access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. The University had a process to periodically review user access; however, that review was not sufficient to identify the inappropriate access. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems. Recommendation: The University should ensure that user access to its student information system is appropriately limited based on a user’s job responsibilities. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement further access limitations and enhanced its periodic review of access.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.033; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224178; Federal Work-Study Program, P033A224178; Federal Pell Grant Program, P063P223265; Federal Direct Student Loans, P268K233265; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T233265 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Cost of Attendance: The determination of the federal student financial assistance award amount is based on financial need. Financial need is defined as a student’s cost of attendance (COA) minus the expected family contribution (EFC) (Title 20, United States Code (USC), Chapter 28, Subchapter IV, Section 1087kk). COA refers to the “tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study.” An institution also may include an allowance for books, supplies, transportation, miscellaneous personal expenses, and room and board (Title 20, USC, Chapter 28, Section 1087ll). For Title IV programs, the EFC is the amount a student and his or her family are expected to pay for educational expenses; it is computed by the federal central processor and included on the student’s Institutional Student Information Record (ISIR) provided to the institution. An overaward exists when a student’s financial aid exceeds the student’s need. Therefore, awards must be coordinated among the various programs and with other federal and non-federal assistance to ensure that total assistance is not awarded in excess of the student’s financial need (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 4, Chapter 3; and Title 34, Code of Federal Regulations (CFR), Sections 668.2, 673.5, and 685.301). The University of Texas Permian Basin (University) uses algorithmic budgeting to build COA budgets for each term based on a student’s classification (undergraduate or graduate), program (in-person or online), residency (in_x0002_state or out-of-state), living status (on-campus, off-campus, or at home with parents), and enrollment level (full_x0002_time, three-quarter-time, half-time, or less-than-half-time). Budgeting rules within the University’s student information system are established to assign various budget components based on the factors noted above. For 60 (98 percent) of 61 students tested, the University incorrectly calculated the COA. For some of the students discussed below, there were multiple errors in the COA calculation. Specifically: • For 38 students, the University assigned an incorrect amount for the fees, loan fees, and/or transportation budget components. Those errors occurred because the amounts were incorrectly loaded into the budget tables in the University’s student information system. The University asserted that it discovered these issues in April 2023, and attempted to manually update individual student accounts that were affected. As a result, the COA for those students was overstated, and three students were overawarded a total of $2,871. After auditors brought the overawards to the University’s attention, it returned funds to the U.S. Department of Education; therefore, there were no questioned costs. • For 15 students, the University assigned an in-person budget instead of an online advanced budget. Those errors occurred because the University failed to consistently communicate which programs were offered online to the financial aid office, which would have helped ensure that the student information system was updated appropriately. As a result, the COA for those students was overstated, and one of those students was overawarded a Subsidized Direct Loan in the amount of $919. After auditors brought the overaward to the University’s attention, it returned funds to the U.S. Department of Education; therefore, there were no questioned costs. • For 12 students, the University incorrectly assigned an additional room and board fee. As a result, the COA was overstated by $50 per term for each of those students; however, the University did not overaward financial assistance to those students. • For eight students, the University did not adjust the students’ COA to reflect the students’ actual enrollment. The University did not have a process to freeze student enrollment levels in order to recalculate COA after census. As a result, the COA for those students was overstated; however, the University did not overaward financial assistance to those students. The University did not have adequate controls in place to review budgets used in the calculation of COA and accurately assign those budgets to students. Incorrectly calculating COA increases the risk of overawarding or underawarding financial assistance to students. Recommendation: The University should strengthen its controls to ensure that it correctly calculates students’ COA budgets in accordance with its process and does not overaward financial assistance to students. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to implement additional controls as it relates to calculation of the Cost of Attendance.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Direct Student Loans, P268K233265; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T233265 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Award and Disbursement Notifications: Before an institution disburses Title IV, Higher Education Act of 1965 (HEA) program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each Title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans (Title 34, Code of Federal Regulations (CFR), Section 668.165(a)(1)). If an institution credits a student’s ledger account with Federal Direct Student Loan (Direct Loan) funds or Teacher Education Assistance for College and Higher Education (TEACH) Grant funds, the institution must notify the student or parent of (1) the anticipated date and amount of the disbursement, (2) the student’s or parent’s right to cancel all or a portion of that loan or grant and have the loan or grant proceeds returned to the U.S. Department of Education, and (3) the procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan or grant, or loan or grant disbursement (Title 34, CFR, Section 668.165(a)(2)). The institution must provide the notice in writing no earlier than 30 days before, and no later than 30 days after, crediting the student’s ledger account at the institution (Title 34, CFR, Section 668.165(a)(3)). For 9 (15 percent) of 61 disbursements tested, the University of Texas Permian Basin (University) did not send a disbursement notification as required. Specifically, those nine students received Direct Loan disbursements, and the University did not send disbursement notifications because the University’s automated process used to identify and send disbursement notifications to students was not configured to include students whose disbursements were made manually within the student information system. The University asserted that it identified this issue in May 2023 and corrected the process in its student information system, but did not retroactively send the missing disbursement notifications for the Fall 2022 or Spring 2023 term. In addition, the University did not have a process in place to send award or disbursement notifications to TEACH Grant recipients. This error occurred because the University’s automated processes used to identify and send award and disbursement notifications to students was not configured to include TEACH Grants. The University asserted that it identified this issue in May 2023 and corrected the processes in its student information system, but it did not retroactively send missing disbursement notifications for the Fall 2022 or Spring 2023 term. Not receiving award and disbursement notifications impairs students’ and parents’ ability to budget for the cost of attending or exercise the option to cancel their loans or grants. Recommendation: The University should strengthen its controls to ensure that it identifies all students that require an award or disbursement notification, and sends those notifications to the students. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to ensure that disbursement notifications for Federal Direct Loans and TEACH grants go out to all applicable students.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224178; Federal Pell Grant Program, P063P223265; Federal Direct Student Loans, P268K233265; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T233265 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs, and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). For a program offered in modules, a student is not considered to have withdrawn if the student successfully completes either (1) a module that includes 49 percent or more of the number of days in the payment period, excluding scheduled breaks of five or more consecutive days and all days between modules; or (2) a combination of modules that together contain 49 percent or more of the number of days in the payment period, excluding scheduled breaks of five or more consecutive days and all days between modules (Title 34, CFR, Section 668.22(a)(2)(ii)(A)(2)). For 3 (6 percent) of 48 students tested who did not have a return of Title IV funds made, the University of Texas Permian Basin (University) did not perform a return calculation as required. Specifically: • For two students who were enrolled in module courses, the University did not perform a return calculation because it incorrectly determined that the students completed 49 percent or more of the number of days in the payment period. The University asserted that staff misinterpreted the 49 percent withdrawal exemption requirements. • For one student, the University did not perform a return calculation and return funds as required due to staff oversight. After auditors brought those errors to the University’s attention, the University performed the return calculations and returned the funds to the U.S. Department of Education; therefore, there were no questioned costs. In addition, the University made errors in Title IV return calculations for 11 (48 percent) of 23 students tested. Specifically, the University did not exclude any break days from the students’ return calculations as required. Those errors occurred because the University did not load the break days into its student information system when setting up the payment periods for the standard Fall 2022 and Spring 2023 terms; therefore, this issue would have affected all students who withdrew from those terms. As a result, the University returned a total of $284 less than it should have for 2 of those 11 students. After auditors brought the issue to the University’s attention, the University returned those funds to the U.S. Department of Education; therefore, there were no questioned costs. • For 3 of those 11 students, the University also incorrectly adjusted the students’ Direct Loans disbursements prior to performing the return calculation. As a result of those errors, the University returned more funds than required; therefore, there were no questioned costs. The University did not have an adequate monitoring process to identify the errors discussed above. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return. Timeliness of Returns: An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 3 (13 percent) of 23 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. The University returned the Title IV funds to the U.S. Department of Education 46 and 203 days after the University determined that the students withdrew. The University did not have adequate controls in place to ensure that Title IV funds were returned within the required 45-day time frame. Not making returns within required time frames reduces the funds available to the U.S. Department of Education for its program management. Recommendations: The University should: • Configure its student information system to exclude any scheduled breaks as required. • Strengthen its monitoring controls to ensure that it detects and corrects errors in return of Title IV calculations and returns Title IV funds in a timely manner. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University has worked to ensure procedures and interpretation of the regulations for the Return to Title IV have been updated to result in correct and timely return of Title IV funds.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P223265; and Federal Direct Student Loans, P268K233265 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective, and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). Institutions may not be immediately aware of a student’s enrollment status change when it happens. When the institution does become aware of such a change, it must report the status change using the actual enrollment status effective date, not the date when the institution became aware of the change (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4; and U.S. Department of Education Electronic Announcement, NSLDS Enrollment Reporting - Submission Dates, Effective Dates and Certification Dates, April 20, 2017). For instances in which a student completes one academic program and then enrolls in another academic program at the same school, the school must report two separate enrollment transactions: one showing the completion of the first program and its effective date and credential level, and the other showing the enrollment in the second program and its effective date (Dear Colleague Letter, March 30, 2012 (GEN-12-06)). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). The University of Texas Permian Basin (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 8 (13 percent) of 61 students tested, the University did not report enrollment status changes or did not accurately report campus- and program-level data elements to NSLDS. Specifically: • For three students, the effective date for the students’ withdrawn status was reported incorrectly. Those students were determined to have never attended the Spring 2023 term. The University incorrectly reported the last day of the Spring 2023 term as the effective date at the campus and program level, rather than the students’ actual last date of attendance. • For two students, enrollment status changes were inaccurately reported at the campus and program levels. Both students were enrolled full-time in the Spring 2023 term and had enrollment changes to half-time; however, the University incorrectly reported to NSLDS a less-than-half-time status for one student and a withdrawn status for the other student. • For two students, the University incorrectly reported the effective date of enrollment status changes at the campus and program levels. • For one student, the enrollment status for the Spring 2023 term was reported incorrectly at the campus and program levels because the University used graduate-level enrollment rather than undergraduate-level enrollment. The University asserted that the student was enrolled as an undergraduate in the Spring 2023 term and as an undergraduate and graduate in the Summer 2023 term. This error was caused by the University not submitting the student’s undergraduate program information to NSLDS. For 3 (9 percent) of 33 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the students’ enrollment status was not reported to NSLDS in a timely manner. Specifically, the University reported the 3 students’ withdrawn status 118 days after it became aware that the students either never attended or unofficially withdrew from the Spring 2023 term. The issues discussed above occurred because the University (1) did not configure its student information system to accurately report student enrollment and program information to NSLDS, (2) did not establish formal and documented policies over student enrollment reporting until policies were requested by auditors, and (3) did not have an adequate process to monitor student enrollment and program information reported to NSLDS. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayments schedules. Recommendation: The University should strengthen its controls to ensure that campus- and program-level data elements are reported accurately and in a timely manner to NSLDS. Views of Responsible Officials: The University acknowledges and agrees with the finding. Through analysis of the exceptions identified in the audit, the University is working to ensure that procedures and queries used for exporting enrollment information to the National Student Clearinghouse are updated so that reporting is accurate and timely.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222296; and Federal Direct Student Loans, P268K232296 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less_x0002_than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). The University of Texas Rio Grande Valley (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 2 (3 percent) of 62 students tested, the University inaccurately reported the students’ program-level graduated status effective date to NSLDS. For those students, the graduated status effective date was reported correctly to NSLDS at the campus level; however, a different effective date was incorrectly reported at the program level for the students’ graduated status. The effective date reported at the program level should be the same date reported at the campus level because those dates reflect the same graduated status change. The University identified and corrected the program-level effective date for one of those students after auditors selected the student for testing. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should strengthen its controls to ensure that program-level data elements are reported to NSLDS accurately. Views of Responsible Officials: UTRGV acknowledges and concurs with the audit finding. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the process.

Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; and 84.063 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224166; and Federal Pell Grant Program, P063P222333 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal Supplemental Educational Opportunity Grants (FSEOG): The FSEOG program provides grants to eligible undergraduate students. Institutions are required to award FSEOG first to Federal Pell Grant recipients who have the lowest expected family contribution (EFC). If an institution has FSEOG funds remaining after giving FSEOG awards to all Federal Pell Grant recipients, it can then award the remaining FSEOG funds to eligible students with the lowest EFCs who did not receive Federal Pell Grants (Title 34, Code of Federal Regulations (CFR), Section 676.10). If the total amount of calculated Title IV grant or loan assistance, or both, that a student earned is greater than the total amount of Title IV grant or loan assistance, or both, that was disbursed to the student, as of the date that the institution determines that the student has withdrawn, the difference between those amounts must be treated as a post-withdrawal disbursement in accordance with Title 34, CFR, Section 668.22(a)(6) and Section 668.164(i) (Title 34, CFR, Section 668.22(a)(5)). The institution must disburse directly to a student any amount of a post-withdrawal disbursement of grant funds that is not credited to the student’s account. The institution must make the disbursement as soon as possible, but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(a)(6)(ii)(B)(1)). Based on a review of the full population of student financial assistance recipients, the University of Houston (University) awarded a total of $6,500 in FSEOG assistance to 5 students who did not also receive a Federal Pell Grant. Specifically: • For three students, the University did not award Federal Pell Grants to those students because the students reported on their Free Application for Federal Student Aid (FAFSA) that they had earned a bachelor’s degree or were working on a degree beyond a bachelor's degree. After auditors brought these errors to the University’s attention, the University canceled the FSEOG awards to those students; therefore there were no questioned costs. • For one student, the University did not award a Federal Pell Grant to the student for the term in which the student received FSEOG funds. Due to a manual error, the University applied the student’s Federal Pell Grant to the wrong term. After auditors brought the error to the University’s attention, the University corrected the Federal Pell Grant award to the correct term; therefore there were no questioned costs. • For one student, the University did not award a Federal Pell Grant to the student due to a hold that was placed on the student’s account for an incomplete task. After auditors brought the error to the University’s attention, the University reviewed the student’s account and determined the hold should be removed. The University processed a post-withdrawal disbursement of Federal Pell Grant funds 324 days after the date of the University’s determination that the student withdrew. There were no questioned costs as a result of this error. Although the University had monitoring controls in place to ensure accurate awarding of federal funds, it did not have an adequate process to identify the errors discussed above. Recommendations: The University should: • Award FSEOG funds only to eligible students. • Complete post-withdrawal disbursements within a timely manner. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Disbursement To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222333; Federal Direct Student Loans, P268K232333; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232333 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Allowable Charges: An institution may credit a student's ledger account with Title IV, Higher Education Act of 1965 (HEA) program funds to pay for allowable charges associated with the current payment period. Allowable charges are: (1) the amount of tuition, fees, and institutionally provided room and board assessed the student for the payment period or the prorated amount of those charges if the institution debits the student's ledger account for more than the charges associated with the payment period; and (2) the amount incurred by the student for the payment period for purchasing books, supplies, and other educationally related goods and services provided by the institution for which the institution obtains the student’s or parent’s authorization under Section 668.165(b) (Title 34, Code of Federal Regulations (CFR), Section 668.164(c)(1)). If an institution obtains written authorization from a student or parent, as applicable, the institution may: (1) use the student’s or parent’s Title IV, HEA program funds to pay for charges that are included in that authorization, and (2) hold on behalf of the student or parent any Title IV, HEA program funds that would otherwise be paid directly to the student or parent as a credit balance, unless the Secretary provides funds to the institution under the reimbursement payment method or the heightened cash monitoring payment method (Title 34, CFR, Section 668.165(b)(1)). An institution may not use Title IV funds to pay finance charges or fees that are incurred because a student uses a financing method provided by the school to pay for educational expenses over time. Because students or families choose to incur these additional expenses rather than paying the balance due at registration, the additional charges are not considered educational expenses, and may not be included in a student’s cost of attendance. (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 2). For 13 (21 percent) of 62 students tested, the University of Houston (University) used Title IV funds to pay unallowable charges. Some of those students were affected by both errors discussed below. Specifically: • For eight students, the University credited student ledger accounts during the payment period for unallowable charges unrelated to tuition, fees, or institutionally provided room and board. The unallowable finance charges paid with Title IV funds included various fees (credit card processing, severance of service, installment origination, and late fees), and various loan charges. Those charges are unallowable whether the University obtains student or parent authorization or not. The University asserted it is conducting a comprehensive review of all charges to determine allowability for Title IV funds. • For eight students, the University credited student ledger accounts during the payment period for charges other than tuition, fees, or institutionally provided room and board without obtaining the authorization of the student or parent. The unallowable charges paid with Title IV funds included various parking and garage related fees, meal plan tax charges, and book loan university fund charges. Those errors occurred because the University did not have a process to obtain written authorization from a student or parent to apply Title IV funds to charges other than tuition, fees, and institutionally provided room and board. Not receiving all Title IV funds a student is entitled to impairs students’ and parents’ ability to budget for the cost of attending. Recommendations: The University should strengthen its controls to ensure that: • It does not credit student ledger accounts for unallowable charges. • It obtains written authorization from students or parents prior to crediting student ledger accounts for certain charges. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224166; Federal Pell Grant Program, P063P222333; Federal Direct Student Loans, P268K232333; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232333 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The institution must return the lesser of the total amount of unearned Title IV assistance calculated above or an amount equal to the total institutional charges incurred by the student for the payment period or period of enrollment multiplied by the percentage of Title IV grant or loan assistance not earned by the student. For purposes of this calculation, “institutional charges” are tuition, fees, room and board (if the student contracts with the institution for the room and board), and other educationally related expenses assessed by the institution (Title 34, CFR, Section 668.22(g)). The institutional charges used in the calculation are usually the charges that were initially assessed to the student for the entire payment period or period of enrollment, as applicable. Initial charges may be adjusted only by those changes the institution made prior to the student’s withdrawal, such as a change in enrollment status unrelated to the withdrawal (U.S. Department of Education, 2022- 2023 Federal Student Aid Handbook, Volume 5, Chapter 1, Section: Institutional Charges). The University of Houston (University) made errors in Title IV return calculations for 18 (30 percent) of 60 students tested. Specifically: • For 15 students, the University made errors in determining the amount of institutional charges to be used in the return calculation by including unallowable charges in its calculation for those students. • For two students, the University returned the incorrect amount of Title IV funds due to manual entry errors. For one of those students, the University also incorrectly included unallowable charges in the student’s return calculation as discussed above. • For one student, the University incorrectly canceled the student’s Federal Pell Grant award before its calculation. The University asserted that was due to a processing error in its student information system. There were no questioned costs as a result of those errors because for each student the University returned more than the required amount or the error did not affect the amount of Title IV grant or loan assistance to be returned. Distance Education: For distance education, documenting that a student has logged into an online class is not sufficient to demonstrate academic attendance by the student. An institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity. Only active participation by a student in an instructional activity related to the student’s course of study that meets the definition of “academic engagement” in Title 34, CFR, Section 600.2 and takes place during a payment period or period of enrollment qualifies as attendance in an academically related activity (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). For 1 (7 percent) of 14 students tested, the University did not have evidence of academic engagement in the distance education course from which the student’s withdrawal date was determined. The University relies on the last dates of academic activity provided by instructors to determine the withdrawal date for return of Title IV purposes for students who unofficially withdraw. However, the University did not have an adequate review process in place to ensure that it maintained documentation supporting attendance in distance education courses. As a result, the University could not demonstrate that the student participated or otherwise engaged in an academically related activity in that course to support the last date of attendance used by the University for return of Title IV purposes. The University did not have an adequate monitoring process to identify the errors discussed above. Not having a process that consistently calculates and returns the correct amount of Title IV funds increases the risk that the University could return the incorrect amount of Title IV funds. Recommendations: The University should: • Calculate institutional charges in accordance with U.S. Department of Education requirements. • Ensure that evidence of academic engagement is consistently documented for students in distance education courses. • Strengthen its monitoring controls to ensure that it detects and corrects errors in its calculation of Title IV funds to return. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222333; and Federal Direct Student Loans, P268K232333 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the campus-level enrollment for the student, including enrollment status and the effective date of that enrollment status. For enrollment status changes to three-quarter-time, half-time, and less than-half-time status, the institution must use the effective date that the student dropped to those particular statuses (NSLDS Enrollment Reporting Guide, November 2022, Chapter 1, 4, 7, and Appendix C). Institutions also are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective and the program begin date is the date the student first began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For a student who has graduated, institutions that initially report a withdrawn status must subsequently report the student as having graduated by certifying a “G” status at the campus level and/or program level as appropriate (NSLDS Enrollment Reporting Guide, November 2022, Chapter 4, Section 4.4.3). The University of Houston (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes to NSLDS when required. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3, Section 3.3). For 3 (5 percent) of 61 students tested, the University did not report graduated status changes or did not accurately report graduated status changes at the campus and program levels to NSLDS. Specifically: • For two students, the University did not report a graduated status at the program level. However, the graduated status for both students was correctly reported at the campus level. The University asserted that it reported the graduated statuses to NSC; however, NSLDS had no record found reported for the program level. • For one student, a graduated status was not reported at the campus level, and the effective date of the graduated status was incorrectly reported at the program level. The University asserted that it reported the graduated status accurately to NSC. For 24 (75 percent) of 32 students tested who received a Direct Loan and ceased to be enrolled on at least a half-time basis or changed their permanent address, the student’s enrollment status was not reported to NSLDS in a timely manner. Specifically: • For 23 students, the students’ graduated status for the Spring 2023 term was not received by NSLDS until 85 days after that status became effective on May 11, 2023. The University certified and submitted the graduation file to NSC on June 22, 2023; however, the statuses were not received by NSLDS until August 4, 2023. • For one student, the University reported the status change 146 days after the student’s graduated status became effective. The errors discussed above occurred because the University did not have a process to ensure that student enrollment and program information reported to NSC was accurately reported to NSLDS in a timely manner. Not reporting student status changes accurately and in a timely manner could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayment schedules. Recommendation: The University should develop and implement controls to ensure that campus-level and program-level data elements are reported to NSLDS accurately and in a timely manner. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Special Tests and Provisions - Gramm-Leach-Bliley Act - Student Information Security Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Cross-cutting Pass-Through Agency: N/A Award Number: Cross-cutting Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Gramm-Leach-Bliley Act: Institutions must protect sensitive data, including information obtained in support of the administration of federal student financial assistance programs, as required by the Gramm-Leach-Bliley Act (GLBA) (Public Law 106-102). Under their Program Participation Agreement (PPA) and the GLBA, postsecondary educational institutions must protect student financial aid information, with particular attention to information provided by the Department of Education or otherwise obtained in support of the administration of the Title IV Federal student financial aid programs (Dear Colleague Letter, July 1, 2016 (GEN-16-12)). Institutions are required to develop, implement, and maintain an information security program that includes the minimum elements in Title 16, Code of Federal Regulations (CFR), Section 314.4. Those minimum requirements include conducting a periodic inventory of data, noting where it is collected, stored, or transmitted (Title 16, CFR, Section 314.4(c)(1)). In addition, the institution must designate a qualified individual responsible for overseeing, implementing, and enforcing the institution’s information security program (Title 16, CFR, Section 314.4(a)). The University of Houston’s (University) information security program did not address the implementation of all minimum safeguards as required by the GLBA. Specifically, while the University had designated a Qualified Individual to coordinate its information security program and had a written information security program in place, that program did not meet the requirements for conducting a periodic inventory of data. Not implementing all required safeguards in its information security program increases the University’s risk of data breach or loss. Recommendation: The University should ensure that all elements required by the GLBA are documented and implemented in its information security program. Views of Responsible Officials: The University acknowledges and agrees with the findings. Through analysis of the exceptions identified in the audit, the University will work to develop and implement corrective action to further improve the processes.

Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.379 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222293; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232293 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No COD Reporting: Institutions must submit Federal Pell Grant, Iraq and Afghanistan Service Grant, Direct Loan, and Teacher Education Assistance for College and Higher Education (TEACH) Grant disbursement records to the Common Origination and Disbursement (COD) system no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. Reporting this information helps ensure that institutions have the most accurate information available about students’ federal awards and helps prevent an institution from overawarding students (Title 34, Code of Federal Regulations (CFR), Section 690.83(b); U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 3, Chapter 1; and Federal Register, Volume 88, Number 120). Certain data elements are required to be reported as part of a student’s origination and disbursement record, including the student’s Social Security number, Central Processing System (CPS) transaction number, enrollment date, disbursement amount, and disbursement date (2022-2023 COD Technical Reference, Volume II). For 2 (3 percent) of 63 students tested, the University North Texas (University) did not accurately report all disbursement record data elements to the COD system. Specifically: • For one student, the University reported an incorrect disbursement date for two TEACH disbursements made to the student during the award year. The University’s process is to manually report TEACH Grant awards on COD’s website; the incorrect disbursement dates reported were a result of manual entry errors made during that process. • For one student, the University reported an incorrect disbursement date for one Federal Pell Grant disbursement made to the student during the award year. The University asserted that error occurred because the student’s record had to be manually updated after being rejected by the COD system for a missing value. The incorrect disbursement dates ranged from 78 days prior to 74 days after the actual funds were disbursed to the students. The University did not have a sufficient process to review the manual data entries for accuracy. Not accurately reporting information to the COD system could result in the institution overawarding federal funds. Recommendation: The University should strengthen its controls to ensure that disbursement dates are reported to the COD system accurately. Views of Responsible Officials: The University acknowledges and agrees with the findings regarding the accuracy of reporting disbursements in the Common Origination and Disbursement (COD) system. The University recognizes the importance of accurately reporting disbursements in the COD system and will work accordingly to ensure manual entries are entered with accurate information.

Special Tests and Provisions – Disbursements To or On Behalf of Students Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222293; and Federal Direct Student Loans, P268K232293 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Allowable Charges and Credit Balance Authorizations: An institution may credit a student’s ledger account with Title IV, Higher Education Act of 1965 (HEA) program funds to pay for allowable charges associated with the current payment period. Allowable charges are: (1) the amount of tuition, fees, and institutionally provided room and board assessed the student for the payment period or the prorated amount of those charges if the institution debits the student’s ledger account for more than the charges associated with the payment period; and (2) the amount incurred by the student for the payment period for purchasing books, supplies, and other educationally related goods and services provided by the institution for which the institution obtains the student’s or parent’s authorization under Section 668.165(b) (Title 34, Code of Federal Regulations (CFR), Section 668.164(c)(1)). A Title IV, HEA credit balance occurs whenever the amount of Title IV, HEA program funds credited to a student’s ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period. A Title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than (1) fourteen days after the balance occurred if the credit balance occurred after the first day of class within a payment period; or (2) fourteen days after the first day of class within a payment period if the credit balance occurred on or before the first day of class within that payment period (Title 34, CFR, Section 668.164(h)). If an institution obtains written authorization from a student or parent, as applicable, the institution may: (1) use the student’s or parent’s Title IV, HEA program funds to pay for charges that are included in that authorization, and (2) hold on behalf of the student or parent any Title IV, HEA program funds that would otherwise be paid directly to the student or parent as a credit balance, unless the Secretary provides funds to the institution under the reimbursement payment method or the heightened cash monitoring payment method (Title 34, CFR, Section 668.165(b)(1)). For 5 (8 percent) of 62 students tested, the University of North Texas (University) used Title IV funds to pay unallowable charges. Specifically, the University credited student ledger accounts during the payment period for charges other than tuition, fees, or institutionally provided room and board without obtaining the authorization of the student or parent. The unallowable charges paid with Title IV funds included various fees (late registration, replacement identification card, and parking), as well as the balance of institutional loans. Those errors occurred because a statement designed to obtain the student’s authorization to apply the Title IV funds to those types of charges was not included in the student self-service portal in the student information system as intended. For 1 (3 percent) of 36 students tested, the University did not obtain written authorization from the student or parent to hold Title IV funds as a credit balance. Specifically, the University held $1,861 of Direct Loans in excess of the student’s institutional charges, which should have been paid directly to the student or parent. Not receiving all Title IV funds a student is entitled to impairs students’ and parents’ ability to budget for the cost of attending. Recommendation: The University should strengthen its controls to ensure that it obtains written authorization from students or parents prior to crediting student ledger accounts for certain charges, or holding credit balances. Views of Responsible Officials: The University acknowledges and agrees with the findings regarding the payment of unallowable charges using Title IV funds for 5 students and the lack of written authorization to hold a Title IV fund as a credit balance for 1 student. The University recognizes the importance of ensuring Title IV funds are used only toward allowable charges and are not held as a credit balance without written authorization from the student or parent.

Special Tests and Provisions – Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007; 84.063; 84.268; and 84.379 Pass-Through Agency: N/A Award Number: Federal Supplemental Educational Opportunity Grants (FSEOG), P007A224085; Federal Pell Grant Program, P063P222293; Federal Direct Student Loans, P268K232293; and Teacher Education Assistance for College and Higher Education Grants (TEACH), P379T232293 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Return of Title IV Calculations: When a student who received Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the student began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (Title 34, Code of Federal Regulations (CFR), Section 668.22(a)(1)). If the total amount of Title IV grant or loan assistance earned by the student is less than the amount that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs and no additional disbursements may be made to the student for the payment period or period of enrollment (Title 34, CFR, Section 668.22(a)(4)). The amount of earned Title IV grant or loan assistance is calculated by (1) determining the percentage of Title IV grant or loan assistance that the student has earned and (2) applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student or on the student’s behalf for the payment period or period of enrollment as of the student’s withdrawal date. Students earn 100 percent of their Title IV grant or loan assistance if their withdrawal date is after the completion of 60 percent of the payment period or period of enrollment. The unearned amount of Title IV grant or loan assistance to be returned is calculated by subtracting the amount of Title IV assistance a student earned from the amount of Title IV assistance that was disbursed to the student or on the student’s behalf as of the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(e)). The total number of calendar days in a payment period or period of enrollment includes all days within the payment period or period of enrollment that the student was scheduled to complete, excluding scheduled breaks of at least five consecutive days. Scheduled breaks of at least five consecutive days are also excluded from the number of calendar days the student completed in that period (Title 34, CFR, Section 668.22(f)(2)(i)). The University of North Texas (University) made errors in Title IV return calculations for 32 (52 percent) of 61 students tested. Those errors occurred because the University did not exclude any break days from its Title IV return calculations for the Fall 2022 term as required; therefore, that issue would have affected all students who withdrew from the Fall 2022 term and had an automated return calculation performed. Although the amount of unearned Title IV assistance calculated for those students was incorrect, there were no questioned costs as a result of those errors because the University returned more funds than required. • For 1 of those 32 students, the University also did not accurately determine the withdrawal date for the student who was enrolled in modules. After auditors brought the issue to the University’s attention, the University re-performed the return calculation and returned the additional Title IV funds as required; therefore, there were no questioned costs. • In addition, for 1 of those 32 students, the University incorrectly returned Title IV funds for a student who completed more than 60 percent of the term and did not require a return. Distance Education: For distance education, documenting that a student has logged into an online class is not sufficient to demonstrate academic attendance by the student. An institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity. Only active participation by a student in an instructional activity related to the student’s course of study that meets the definition of “academic engagement” in Title 34, CFR, Section 600.2, and takes place during a payment period or period of enrollment qualifies as attendance in an academically related activity (U.S. Department of Education, 2022-2023 Federal Student Aid Handbook, Volume 5, Chapter 2). For 1 (14 percent) of 7 students tested, the University did not have evidence of academic engagement for the student who attended all distance education courses. The University relies on the last dates of attendance (LDA) provided by instructors to determine the withdrawal date for Return of Title IV purposes for students who unofficially withdraw. If no LDAs are provided by the instructors, the University uses the midpoint of the term as the withdrawal date. The student was enrolled in all distance education courses, and the University used the midpoint as the withdrawal for the student. However, the University could not provide evidence that the student participated or otherwise engaged in an academically related activity in any of the distance education courses. After auditors brought the issue to the University’s attention, the University performed a return calculation and returned Title IV funds as required; therefore, there were no questioned costs. Timeliness of Returns: An institution must return the amount of Title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution’s determination that the student withdrew (Title 34, CFR, Section 668.22(j)). For 12 (20 percent) of 61 students tested who withdrew and required a return of Title IV funds, the University did not return the funds within the required time frame. Specifically, the University returned the Title IV funds to the U.S. Department of Education between 47 to 183 days after the University determined that the students withdrew. The University asserted those errors occurred due to staffing issues and problems with the transmission of the adjustments to the U.S. Department of Education’s Common Origination and Disbursement (COD) system. The University did not have an adequate monitoring process to identify those errors or document the review process. Having a process that does not consistently calculate and return the correct amount of Title IV funds increases the risk that the University could return incorrect amounts of Title IV funds. In addition, not making returns within the required time frames reduces the funds available to the U.S. Department of Education for its program management. Recommendations: The University should: • Accurately determine the number of days in the payment period and exclude any scheduled breaks as required. • Ensure that evidence of academic engagement is consistently documented for students in distance education courses. • Strengthen its monitoring controls to ensure that it detects and corrects errors in Title IV return calculations and returns Title IV funds in a timely manner. Views of Responsible Officials: The University acknowledges and agrees with the findings regarding the Return of Title IV funds in cases where a student officially or unofficial withdraws from the institution after the student begins attendance in a given payment period or period of enrollment. The University acknowledges the importance of accurately calculating the Title IV funds to be returned and the timely return of those funds.

Special Tests and Provisions – Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063; and 84.268 Pass-Through Agency: N/A Award Number: Federal Pell Grant Program, P063P222293; and Federal Direct Student Loans, P268K232293 Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: 2020-136 Federal regulations and related guidance governing Title IV student aid programs require schools to report the enrollment of students who receive federal student aid (U.S. Department of Education, National Student Loan Data System (NSLDS) Enrollment Reporting Guide, November 2022, Chapter 2). Unless an institution expects to submit its next enrollment reporting roster file to the Secretary of the U.S. Department of Education within the next 60 days, it must notify the Secretary within 30 days if it discovers that a Federal Direct Student Loan (Direct Loan) has been made to or on behalf of a student who (1) enrolled at that institution but has ceased to be enrolled on at least a half-time basis; (2) has been accepted for enrollment at that institution but failed to enroll on at least a half_x0002_time basis for the period for which the loan was intended; or (3) has changed his or her permanent address (Title 34, Code of Federal Regulations (CFR), Section 685.309(b)). Enrollment reporting roster files also must include Federal Pell Grant-only recipients (Title 34, CFR, Section 690.83(b)(2); and Dear Colleague Letter, March 30, 2012 (GEN-12-06)). Institutions are required to report the program(s) of attendance for the student, including classification of instructional programs (CIP) code, program credential level, program length, program enrollment status, and other data about the program. The program enrollment effective date is the date that the current enrollment status reported for a student was first effective, and the program begin date is the date the student began attending the program being reported (NSLDS Enrollment Reporting Guide, November 2022, Chapters 1 and 4). For instances in which a student completes one academic program and then enrolls in another academic program at the same institution, the institution must report two separate enrollment transactions: one showing the completion of the first program and its effective date and credential level, and the other showing the enrollment in the second program and its effective date (Dear Colleague Letter, March 30, 2012 (GEN-12-06)). The University of North Texas (University) uses the services of the National Student Clearinghouse (NSC) to report status changes to NSLDS. Under this arrangement, the University reports all students enrolled and their status to NSC. NSC then identifies any changes in status and reports those changes when required to NSLDS. Although the University uses the services of NSC, the University still has the primary responsibility to report any changes in student enrollment status accurately and in a timely manner (NSLDS Enrollment Reporting Guide, November 2022, Chapter 3). For 9 (36 percent) of 25 students tested, the University did not accurately report the program begin date to NSLDS. Specifically, the University reported the program begin date as the first day of the term after the students declared their major or were otherwise approved to enroll in the program, instead of the first day of the term in which the students actually began attendance in the program. The University asserted that the errors were caused by issues related to the configuration of the enrollment reporting processes in the University’s student information system. Not reporting student program information accurately could affect determinations that guarantors, lenders, and servicers of student loans make related to in-school status, deferments, grace periods, and repayments schedules. Recommendation: The University should strengthen its controls to ensure that program begin dates are reported to NSLDS accurately. Views of Responsible Officials: The University acknowledges and agrees with the findings regarding the accuracy of the program begin dates reported for some students identified in the testing. The University acknowledges the importance of accurately reporting program information for students receiving Title IV aid to ensure that guarantors, lenders, and servicers of student loans are able to make accurate determinations related to in-school status, deferments, grace periods, and repayment schedules.

Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.038 Pass-Through Agency: N/A Award Number: Federal Perkins Loan Program, award number N/A Award Period: July 1, 2022, to June 30, 2023 Statistically Valid Sample: No and not intended to be a statistically valid sample Type of Finding: Significant Deficiency and Noncompliance Questioned Costs: None Repeat Finding: No Institutions must retain promissory and master promissory notes (MPNs) and repayment records for each Perkins Loan program loan made. Institutions are required to keep original paper promissory notes or original paper MPNs and repayment schedules in a locked, fireproof container. The original promissory notes and repayment schedules must be kept until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. After the loan obligation is satisfied, the institution shall return the original or a true and exact copy of the note marked “paid in full” to the borrower, or otherwise notify the borrower in writing that the loan is paid in full and retain a copy for the prescribed period (Title 34, Code of Federal Regulations (CFR), Section 674.19(e)(4)). For 4 (100 percent) of 4 retired loans tested, the University of North Texas (University) did not send paid in-full notifications to those borrowers, as required. As a result, the University did not maintain the required documentation of the paid-in-full notifications to those borrowers after their loan obligations were satisfied. The University asserted that the notifications were not sent due to staff turnover and the assumption that the University’s third-party Perkins Loan servicer was responsible for sending the notifications. Not maintaining adequate documentation results in noncompliance with the Federal Perkins loan program record retention requirements. Additionally, not notifying borrowers of their loans’ paid-in-full status increases the risk of borrowers making overpayments on their loans. Recommendation: The University should ensure that paid-in-full notifications are sent to all borrowers who satisfy their Perkins Loan obligations, and retain a copy of each notification for the prescribed period. Views of Responsible Officials: The University acknowledges and agrees with the finding related to sending paid-in-full notifications to all borrowers who satisfy their Perkins Loan obligations.