The Legislative Audit Bureau makes 48 recommendations to State of Wisconsin Agencies.

Department of Administration (p. 80)

We recommend the Wisconsin Department of Administration:  

1. 1. update existing access review procedures by December 30, 2025, to include all active user access and all types of accounts, including vendor accounts and agency staff accounts that have privileged access through user accounts managed by DOA (p. 83);
   2. update existing access review procedures to clearly define documentation requirements to ensure all accounts are reviewed and to ensure sufficient and appropriate documentation of each review is created and maintained (p. 83);
   3. provide guidance to individuals completing access reviews on the requirements for developing, performing, and documenting the completion of an access review (p. 83);
   4. monitor the access review process by obtaining and reviewing documentation of access reviews to ensure compliance with access review procedures (p. 83);

We recommend the Wisconsin Department of Administration:

1. 5. update its IT Security Control Exception Plan by February 27, 2026, to include a strategy and timeline for identifying and evaluating the risks related to all controls that were determined to be not implemented (p. 86);
   6. comply with the IT Security Policy Handbook and track controls that are not implemented, including the status of all exception requests (p. 86);

We recommend the Wisconsin Department of Administration comply with its statutory responsibilities to provide oversight and monitoring of executive branch agency adherence to the State’s IT policies by:

1. 7. updating its Information Security Continuous Monitoring plan to include a strategy and timeline to examine and assess agency-reported information for controls that pose a moderate or low risk if not implemented (p. 90); 
   8. documenting by June 30 2026, its assessment of the accuracy of agency-reported information for those IT security controls that pose the highest risk if not implemented (p. 90);
   9. documenting by February 27, 2026, its evaluation of risks related to vulnerability assessments and penetration tests (p. 90);

We recommend the Wisconsin Department of Administration:

1. 10. review its existing procedures for financial reporting to ensure unearned revenue is appropriately reported and amounts are appropriately classified within the General Fund fund balance (p. 95);
   11. correct the presentation of General Fund fund balance as of June 30, 2025, to reflect the $177.5 million of CSLFRF interest earnings as Fund Balance—Unassigned (p. 95);

Department of Health Services (p. 27)

1. 12. We recommend the Wisconsin Department of Health Services continue its efforts to monitor for Children’s Health Insurance Program participants who exceed the age requirement to ensure they are identified and removed in a timely manner (p. 31);

We recommend the Wisconsin Department of Health Services:  

1. 13. identify and implement procedures to monitor the timeliness with which data match discrepancies are resolved and perform follow-up with local agencies as needed (p. 33);
   14. continue efforts to assess solutions for resolving state wage information collection agency data match discrepancies in a timely manner to determine if system or policy changes are needed  (p. 33);

We recommend the Wisconsin Department of Health Services:  

1. 15. enforce with the fiscal agent that directives require appropriate approval and that the fiscal agent should confirm any directive where the approver may not be authorized (p. 36);
   16. ensure that the listings of authorized directive approvers provided to the fiscal agent are updated at least quarterly (p. 36); 
   17. review policies related to directives, update these polices to identify those directives that require an approver other than the creator, and document justifications for any directives for which the creator and approver may be the same employee (p. 36);
   18. assess the feasibility of changes to the PRISM system that would enforce an approval from a user other than the creator of a directive (p. 36);

We recommend the Wisconsin Department of Health Services:  

1. 19. develop and document procedures to complete an annual assessment of the controls in place by each contractor that provides support and security for an IT system used in administering the WIC Special Supplemental Nutrition Program for Women, Infants, and Children program, including the support provider, the cloud provider, and the EBT provider  (p. 40);
   20. obtain annually available service organization controls audit reports and perform an annual review that includes an assessment of the identified internal control deficiencies and a determination of whether the relevant complementary user entity controls are implemented (p. 40);
   21. prepare and maintain documentation of its annual review and assessment (p. 40);

We recommend the Wisconsin Department of Health Services ensure the accuracy of the medical status code by:

1. 22. implementing and testing the needed updates to CARES to correct the errors in the assigned medical status code (p. 42);
   23. completing an assessment of the effect of the identified errors in the medical status code on accounting entries, required federal reporting, and making any necessary corrections (p. 42);
   24. implementing procedures to test the accuracy of the medical status code when making future changes in CARES (p. 42);
   25. We recommend the Wisconsin Department of Health Services develop and implement procedures to ensure the results of the periodic audits of managed care organizations are posted to the State’s website in a timely manner (p. 44);
   26. We recommend the Wisconsin Department of Health Services comply with federal regulations and ensure it performs annual reconciliations to calculate any differences between the estimated cost and the actual cost of vaccines for SCHIP participants and then adjusts the estimate for vaccine purchases funded from the Children’s Health Insurance Program (CHIP) (p. 46);

Department of Public Instruction (p. 47) 

1. 27. We recommend the Wisconsin Department of Public Instruction follow its established policies and procedures to complete timely monthly Federal Funding Accountability and Transparency Act reporting for the Child Nutrition Cluster programs (p. 51);

Department of Transportation (p. 51)

We recommend the Wisconsin Department of Transportation:

1. 28. document and implement procedures to prepare the SF-270 form and the SF-425 report (p. 53);
   29. submit the SF-270 form and the SF-425 report for the Motor Carrier Safety Assistance Program, as required by the federal government under the program terms and conditions (p. 53);

We recommend the Wisconsin Department of Transportation:  

1. 30. improve its documentation of its internal secondary review for the annual SF-271 form and SF-270 form and update its procedures for the internal secondary review to ensure that corrections made in response to the secondary review are reviewed for accuracy before submission to the federal government (p. 55);
   31. develop and implement written procedures for an internal secondary review of the final SF-271 form, the final SF-270 form, and the annual and final SF-425 reports, including procedures for maintaining sufficient documentation of the review (p. 55);
   32. obtain and maintain documentation of the project completion information used to complete the SF-271 form (p. 55);

We recommend the Wisconsin Department of Transportation:

1. 33. develop written procedures to ensure all subawards are appropriately assessed for Federal Funding Accountability and Transparency Act reporting and reported accurately and in a timely manner (p. 58);
   34. complete Federal Funding Accountability and Transparency Act reporting for subawards that were provided with funding received as a result of the public health emergency, unless it obtains written documentation from the Federal Aviation Administration to exempt such subawards (p. 58);

We recommend the Wisconsin Department of Transportation improve its procedures to ensure compliance with wage rate requirements by:

1. 35. improving the effectiveness of the review completed by the Bureau of Aeronautics’ Labor Compliance Team, including by identifying additional available sources of information to assist it in determining if certified payrolls are required and increasing the frequency of such reviews (p. 61);
   36. updating its procedures to require weekly progress reports for all weeks that work is performed on a project (p. 61);
   37. updating its procedures to require that work performed by second- or lower-tier subcontractors is included on weekly progress reports (p. 61);

We recommend the Wisconsin Department of Transportation:  

1. 38. identify and document within its accounting procedures the relevant historical basis of the established infrastructure capital assets estimation methodology (p. 92);
   39. document how each proposed alteration to the established infrastructure capital assets estimation methodology will comply with accounting standards (p. 92);
   40. ensure it adequately reviews applicable financial reporting standards before preparing financial information in order to correctly determine how any proposed alteration to its established infrastructure capital assets estimation methodology should be shown for financial reporting purposes (p. 92);

University of Wisconsin System (p. 63)

We recommend the University of Wisconsin-Madison:

1. 41. stop issuing any additional advanced payments to the Dairy Business Innovation Initiatives subrecipient until all federal cash management requirements are met (p. 66);
   42. fully implement the December 2025 procedures and provide training on them (p. 66);

We recommend that the University of Wisconsin-Madison ensure that it conducts a complete physical inventory of all federal equipment within a two year period by:

1. 43. conducting a physical inventory by September 30, 2026, of all federal equipment last inventoried before June 2023 (p. 68);
   44. updating its procedures to require inventories be conducted at a sufficient number of departments to complete a review of at least one half of federal equipment annually (p. 68);
   45. developing written procedures to require an annual review of the federal equipment listing to identify any federal equipment that did not have a physical inventory within the last two years, documenting the annual review, and completing any required physical inventories by the end of each fiscal year (p. 68);

We recommend the University of Wisconsin (UW) System Administration:

1. 46. provide training to UW institutions on its new procedures and on its data requirements for preparing the Schedule of Expenditures of Federal Awards (SEFA) to ensure that UW institutions accurately record, identify, and classify Research and Development Cluster expenditures within the new accounting system (p. 71);
   47. implement procedures to review whether federal expenditures related to agreements with other state agencies that specify the relevant assistance listing number are properly classified in the SEFA (p. 71); and
   48. revise and document its procedures by June 30, 2026, to specify how federal grants activities will be compiled accurately and in a timely manner for the FY 2025 26 SEFA using the new accounting system (p. 71).