Maryland Department of Labor - Division of Unemployment Insurance - Part 2 - Unemployment Benefits - 01-06-26

Document type: Report
Date: 2026-01-06

Summary

A fiscal compliance audit report of the Maryland Office of Legislative Audits on the Maryland Department of Labor, Division of Unemployment Insurance, Part 2 (Unemployment Benefits), dated January 6, 2026 and signed by Legislative Auditor Brian S. Tanen. The audit covers the period beginning November 16, 2020 and ending January 15, 2025. It reports that DUI did not timely pursue recovery of claimant overpayments totaling $807.4 million, with up to $760.7 million no longer collectable as of May 2025, and did not adjust BEACON account balances for $493.9 million in potentially fraudulent funds removed from debit cards. Other findings concern the lack of supervisory reviews of claims and incomplete procedures for wage data matches, and Findings 5 and 6 are redacted as cybersecurity-related. The department's response and auditor's comments are appended.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Audit Report

Maryland Department of Labor
Division of Unemployment Insurance

Part 2
Unemployment Benefits

January 2026

Public Notice

In compliance with the requirements of the State Government Article Section
2-1224(i), of the Annotated Code of Maryland, the Office of Legislative
Audits has redacted cybersecurity findings and related auditee responses
from this public report.

OFFICE OF LEGISLATIVE AUDITS
DEPARTMENT OF LEGISLATIVE SERVICES
MARYLAND GENERAL ASSEMBLY
Joint Audit and Evaluation Committee
Senator Shelly L. Hettleman (Senate Chair) Delegate Jared Solomon (House Chair)
Senator Joanne C. Benson Delegate Steven J. Arentz
Senator Benjamin T. Brooks, Sr. Delegate Andrea Fletcher Harrison
Senator Paul D. Corderman Delegate Steven C. Johnson
Senator Katie Fry Hester Delegate Mary A. Lehman
Senator Cheryl C. Kagan Delegate David H. Moon
Senator Clarence K. Lam, M.D. Delegate Julie Palakovich Carr
Senator Cory V. McCray Delegate Emily K. Shetty
Senator Justin D. Ready Delegate Stephanie M. Smith
Senator Bryan W. Simonaire Delegate M. Courtney Watson

To Obtain Further Information
Office of Legislative Audits
The Warehouse at Camden Yards
351 West Camden Street, Suite 400
Baltimore, Maryland 21201
Phone: 410-946-5900
Maryland Relay: 711
TTY: 410-946-5401 · 301-970-5401
E-mail: webmaster@ola.maryland.gov
Website: ola.maryland.gov

To Report Fraud
The Office of Legislative Audits operates a Fraud Hotline to report fraud, waste, or abuse involving State
of Maryland government resources. Reports of fraud, waste, or abuse may be communicated anonymously
by a toll-free call to 1-877-FRAUD-11, by mail to the Fraud Hotline, c/o Office of Legislative Audits, or
through the Office’s website.

Nondiscrimination Statement
The Department of Legislative Services does not discriminate on the basis of age, ancestry, color, creed,
marital status, national origin, race, religion, gender, gender identity, sexual orientation, or disability in the
admission or access to its programs, services, or activities. The Department’s Information Officer has been
designated to coordinate compliance with the nondiscrimination requirements contained in Section 35.107
of the United States Department of Justice Regulations. Requests for assistance should be directed to the
Information Officer at 410-946-5400 or 410-970-5400.
January 6, 2026

Senator Shelly L. Hettleman, Senate Chair, Joint Audit and Evaluation Committee
Delegate Jared Solomon, House Chair, Joint Audit and Evaluation Committee
Members of Joint Audit and Evaluation Committee
Annapolis, Maryland

Ladies and Gentlemen:

We have conducted a fiscal compliance audit of the Maryland Department of
Labor (MDL) – Division of Unemployment Insurance (DUI) for the period
beginning November 16, 2020 and ending January 15, 2025. DUI administers the
State’s Unemployment Insurance Program and is responsible for collecting
unemployment insurance tax contributions from employers and processing
applications for, and disbursing unemployment benefits. The focus of this report
was unemployment insurance benefits which addresses the second part of our
audit. A report on the collection of tax contributions was issued April 8, 2025.

Our audit disclosed that DUI did not timely pursue recovery of claimant
overpayments totaling $807.4 million resulting in up to $760.7 million that is no
longer collectable as of May 2025. The delay in sending the notifications was due
in part to a lawsuit filed against MDL that caused it to suspend collection efforts
beginning in January 2022 which did not resume until September 2023 (22
months after the lawsuit). Furthermore, collection efforts where not sufficiently
comprehensive after the suspension ended resulting in an additional $33.6 million
in overpayments not being adequately pursued.

In addition, our audit disclosed that DUI did not require supervisory reviews of
claims and adjudications processed by DUI and staffing vendor employees. This
condition was commented upon in our two preceding audit reports dating back to
February 2019 but not corrected. In June and July 2024, two staffing vendor
employees pled guilty to aggravated identity theft for their roles in manipulating
claims in the unemployment insurance information system (BEACON) to defraud
DUI of more than $3.5 million over an approximately two-year period. The lack
of comprehensive supervisory reviews may have contributed to the untimely
detection of this activity.
Our audit further disclosed that DUI did not adjust claimant account balances in
BEACON for $493.9 million in potentially fraudulent funds removed from
claimants’ debit cards and could not document the disposition of $3 million of
these funds. This condition was commented upon in our preceding audit report
but not corrected. Moreover, DUI did not have comprehensive procedures to
timely investigate the results of BEACON data matches of individuals receiving
unemployment benefits against individuals with reported wage income.

Furthermore, our audit disclosed cybersecurity-related findings. However, in
accordance with the State Government Article, Section 2-1224(i) of the
Annotated Code of Maryland, we have redacted the findings from this audit
report. Specifically, State law requires the Office of Legislative Audits to redact
cybersecurity findings in a manner consistent with auditing best practices before
the report is made available to the public. The term “cybersecurity” is defined in
the State Finance and Procurement Article, Section 3.5-301(c), and using our
professional judgment we have determined that the redacted findings fall under
the referenced definition. The specifics of the cybersecurity findings were
previously communicated to those parties responsible for acting on our
recommendations.

MDL’s response to this audit, on behalf of DUI, is included as an appendix to this
report. Consistent with State law, we have redacted the elements of MDL’s
response related to the cybersecurity audit findings. In accordance with State law,
we have reviewed the response and, while MDL generally agrees with the
recommendations in this report, we identified certain instances in which
statements in the response disagree or appear to be inconsistent with a report
finding and recommendation. In each instance, we reviewed and reassessed our
audit documentation, and reaffirmed the validity of our finding. In accordance
with generally accepted government auditing standards, we have included
“auditor’s comments” within MDL’s response to explain our position. We will
advise the Joint Audit and Evaluation Committee of any outstanding issues that
we cannot resolve with MDL. We wish to acknowledge the cooperation extended
to us during the audit by MDL and DUI, and the agreement to implement the
audit recommendations.

Respectfully submitted,

Brian S. Tanen
Brian S. Tanen, CPA, CFE
Legislative Auditor

2
Table of Contents

Background Information 5

Agency Responsibilities 5
BEACON – Unemployment Insurance Information System 6
Status of Findings From Preceding Audit Report 7

Findings and Recommendations 9

Overpayment Recovery
Finding 1 – The Maryland Department of Labor (MDL) – Division of 9
Unemployment Insurance (DUI) did not timely pursue recovery of
claimant overpayments totaling $807.4 million resulting in up to
$760.7 that is no longer collectable.

Claims Processing
* Finding 2 – DUI did not have procedures to require supervisory reviews 10
of claims and adjudications processed by DUI and staffing vendor
employees, which may have contributed to certain fraudulent activity
not being detected timely.

* Finding 3 – DUI did not adjust claimant account balances in BEACON 12
for $493.9 million in potentially fraudulent debit card funds removed
from claimants’ debit cards and could not document the disposition of
$3 million of these funds.

Benefit Payments
Finding 4 – DUI did not have comprehensive procedures to timely 13
investigate the results of data matches that identified individuals
receiving unemployment benefits who also received wages.

Information Systems Security and Control
Finding 5 – Redacted cybersecurity-related finding. 14

Finding 6 – Redacted cybersecurity-related finding. 14

* Denotes item repeated in full or part from preceding audit report

3
Exhibit 1 – Listing of Most Recent Office of Legislative Audits Fiscal 15
Compliance Audits of Maryland Department of Labor Units as of
November 2025

Audit Scope, Objectives, and Methodology 16

Agency Response Appendix

4
Background Information

Agency Responsibilities

The Division of Unemployment Insurance (DUI) is a separate budgetary unit
within the Maryland Department of Labor (MDL). DUI administers the State’s
Unemployment Insurance Program that includes the following primary
responsibilities.

• Collecting unemployment insurance tax contributions from employers
• Processing applications for, and disbursing unemployment benefits

We have divided our audit of DUI into the following two parts to address the
aforementioned DUI responsibilities. This report addresses Part 2 of our audit.

Part 1 – Unemployment Insurance Tax Contributions
Includes employer unemployment contributions, reimbursements from
government agencies and certain non-profit organizations, associated accounts
receivable activity, and system functionality.

Part 2 – Unemployment Benefits
Includes methods individuals can use to file for unemployment insurance
benefits, eligibility and monetary benefit determinations (for State
unemployment insurance), payment monitoring, prevention of fraudulent
claims, and system functionality.

According to the State’s records, DUI’s fiscal year 2024 operating expenditures
(excluding unemployment benefit disbursements) totaled approximately $109.1
million (see Figure 1 on the following page). Also during the same period, DUI
paid approximately $387.5 million in unemployment insurance benefits to more
than 78,000 claimants.

During the period June 30, 2021 through June 30, 2024, DUI had vacancy rates
that ranged from 6.1 percent to 14.9 percent. As of June 30, 2024, approximately
12.5 percent of the total 377 positions were vacant. We were advised that
vacancies were primarily for staff that conducted claim related functions which
were augmented by contractual service staffing; these vacancies may have
contributed, at least in part, to the findings in this report.

5
Figure 1
MDL – DUI Positions, Expenditures, and Funding Sources
Full-Time Equivalent Positions as of June 30, 2024
Positions
Filled 330
Vacant 47
Total 377

Fiscal Year 2024 Expenditures
Expenditures
Salaries, Wages, and Fringe Benefits $ 38,576,235
Technical and Special Fees 2,306,825
Operating Expenses 68,254,548
Total $109,137,608

Fiscal Year 2024 Funding Sources
Funding
Special Fund $ 3,387,908
Federal Fund 105,749,700
Total $109,137,608

Source: State financial and personnel records

BEACON - Unemployment Insurance Information System

BEACON is DUI’s unemployment insurance information system that was
implemented in September 2020. On August 23, 2022, an indictment was filed in
the U.S. District Court of West Virginia against two principals of the primary
BEACON contractor. The indictment included several criminal charges such as,
conspiracy to steal trade secrets related to BEACON. On March 23, 2023, a civil
lawsuit was filed against the primary BEACON contractor by a company (the
plaintiff) alleging that former employees of the plaintiff worked for the primary
BEACON contractor and used source code and trade secrets to develop the
BEACON software. We were advised by MDL’s counsel that they believe the
outcome of these cases may seriously impact the contractor’s ability to abide by
the terms and conditions of its contract with the State.

Our previous audit reports of MDL contained findings regarding BEACON.
MDL addressed many of these findings, but a certain finding remained unresolved
as further described in finding 3.

6
Status of Findings From Preceding Audit Report

Our audit included a review to determine the status of 12 of the 13 findings
contained in our preceding audit report dated November 15, 2022. See Figure 2
for the results of our review.

Figure 2
Status of Preceding Findings
Preceding Implementation
Finding Description
Finding Status
The Division of Unemployment Insurance (DUI) did
not conduct certain critical matches used to identify
potentially fraudulent or improper claims. We
Finding 1 Not repeated
conducted three matches to replicate four of the
discontinued DUI matches and identified at least $32.3
million in potentially improper payments.
DUI did not have comprehensive procedures to ensure
that individuals filing claims using a foreign Internet
Finding 2 Protocol address were eligible to receive benefits, Not repeated
including 3,724 claimants that received benefit
payments totaling $3.6 million.
DUI did not ensure claimants who were full-time
students were eligible for benefits, and that all
Finding 3 Not repeated
claimants were enrolled in the Maryland Workforce
Exchange System, as required.
DUI did not have procedures to help prevent and detect
duplicate benefit payments. Our analysis disclosed
Finding 4 $43.3 million in potentially duplicate payments made Not repeated
to 12,500 claimants between April 2020 and December
2021 that were not identified or investigated by DUI.

7
Figure 2
Status of Preceding Findings
Preceding Implementation
Finding Description
Findings Status
DUI did not conduct timely verifications of income
reported by applicants for Pandemic Unemployment
Not repeated (Not
Finding 5 Assistance benefits and did not ensure manual
followed up on)
adjustments processed by DUI and contract employees
were proper.
DUI did not adequately review regular claims and
adjudications processed by claims center DUI
Repeated
Finding 6 employees and temporary staff, and output reports of
(Current Finding 2)
manual wage entries could not be generated from
BEACON for verification purposes.
DUI did not establish sufficient controls over reissued
Finding 7 debit cards, and did not ensure the proper disposition of Not repeated
funds remaining on expired debit cards.
DUI did not properly account for potentially fraudulent
Repeated
Finding 8 benefits totaling $493.9 million that were removed
(Current Finding 3)
from claimants’ debit cards.
DUI did not ensure amounts disbursed from the
Unemployment Insurance Trust Fund were properly
Finding 9 Not repeated
transferred to the bank account used to make benefit
payments.
Finding 10 Redacted cybersecurity-related finding.1 Status Redacted1
Finding 11 Redacted cybersecurity-related finding.1 Status Redacted1
Finding 12 Redacted cybersecurity-related finding.1 Status Redacted1
Finding 13 Redacted cybersecurity-related finding.1 Status Redacted1

1
The finding description as well as the implementation status of this cybersecurity–related finding
have been redacted for the publicly available report in accordance with State Government
Article, Section 2-1224(i) of the Annotated Code of Maryland.

8
Findings and Recommendations

Overpayment Recovery

Finding 1
The Maryland Department of Labor (MDL) - Division of Unemployment
Insurance (DUI) did not timely pursue recovery of claimant overpayments
totaling $807.4 million resulting in up to $760.7 million that is no longer
collectable.

Analysis
DUI did not timely pursue recovery of claimant overpayments totaling $807.4
million resulting in up to $760.7 million that is no longer collectable. State law
provides that overpayments can only be collected if the claimant is notified within
three years from when the overpayment was issued. In November 2021, a lawsuit
was filed against MDL asserting that DUI’s overpayment notifications violated
claimant constitutional rights because they did not include the reason for the
overpayment or an opportunity to appeal. As a result, in January 2022 MDL
suspended its collection efforts until the regulations for the overpayment process
and related BEACON notifications were updated.

Our review disclosed that the regulations and BEACON were not updated timely
resulting in numerous overpayments that are no longer eligible for recovery.
Specifically, DUI did not update the regulations until March 2023 (16 months
after the lawsuit) and did not update the BEACON notifications for the changes or
restart the collections until September 2023 (22 months after the lawsuit).
According to DUI’s records, during the period when collections were suspended
DUI identified overpayments totaling $773.8 million of which $760.7 million are
no longer collectable as of May 2025 because the notifications were not sent
within three years of the payment, as required. Furthermore, each day these
overpayment notifications are not issued, the statute of limitations is eliminating
DUI’s ability to pursue collection of additional overpayments.

In addition, our review disclosed that DUI did not adequately pursue collection of
overpayments identified after the suspension period ended in September 2023.
Specifically, although DUI sent notifications for $33.6 million in overpayments,
as of May 2025, it had not initiated any follow-up collection efforts including
sending dunning letters and referring delinquent overpayments to the Central
Collection Unit for collection. For example, an overpayment totaling $3,010 for
payments made during October 2024 and November 2024 was identified in
December 2024; however, as of May 2025, DUI had only sent one notice of

9
overpayment and no dunning letters. DUI could not readily provide the source of
the outstanding overpayments to identify which would have been repaid to the
Maryland Unemployment Trust Fund2 (UI Trust Fund) for regular unemployment
insurance payments or the federal government for federal pandemic
unemployment insurance payments.

Recommendation 1
We recommend that DUI
a. timely pursue claimant overpayments including those noted above. Such
actions should include sending overpayment notifications and referrals of
delinquent overpayments to CCU; and
b. determine the total amount that was uncollectable resulting from the
aforementioned delays and report this information to the Maryland
General Assembly.

Claims Processing

Background
BEACON has automated validation rules to help determine eligibility and
benefits. For example, wages reported by the applicant are automatically verified
to wages reported by an applicable employer. If inconsistencies or other
discrepancies are detected, applications and claims may be flagged for manual
review and adjustment by a claim processor. A claim can also be designated for
adjudication when it requires a claims worker to further investigate certain issues
and determine the impact on the claimant’s eligibility. For example, a claim may
be adjudicated to determine whether the claimant was terminated or voluntarily
resigned.

Finding 2
DUI did not have procedures to require supervisory reviews of claims and
adjudications processed by DUI and staffing vendor employees, which may
have contributed to certain fraudulent activity not being detected timely.

Analysis
DUI did not have procedures to require supervisory reviews of claims and
adjudications processed by DUI and staffing vendor employees, which may have
contributed to certain fraudulent activity not being detected timely. The reviews

2
DUI maintains the UT Trust Fund for the deposit of unemployment taxes collected from
employers and for benefit payments to claimants. The balance as of June 30, 2024 was $2.1
billion.

10
are critical to ensure the propriety of the claims and adjudications processed by
DUI and vendor employees. DUI could not readily provide the total number of
claims processed by the claims center and staffing vendor but according to DUI
records, during calendar year 2024, there were 92,862 adjudications.

• DUI policy effective December 2023 only required supervisors to strive to
review 5 claims and/or adjudications of each employee per week but did not
require the reviews. In addition, DUI did not have a process to track and
monitor the reviews to ensure they were being conducted. As a result, DUI
did not take corrective action when the reviews were not conducted.

Our test of reviews conducted during the weeks ending June 7, 2024 through
June 21, 2024 at each of the four claims centers disclosed that one claim
center had not conducted any of the reviews and the other three claim centers’
reviews did not include claims processed by certain team members. Our test
of 22 claims and adjudications processed by the claims centers from
November 2022 through November 2024 concluded that they were proper.3

• DUI had no procedures to perform, and the related contract did not require,
supervisory reviews of claims processed by staffing vendor employees. DUI
could not provide documentation that any claims processed by the staffing
vendor were reviewed.

These reviews are important because in June and July 2024, two staffing
vendor employees pled guilty to aggravated identity theft for their roles in
manipulating claims in BEACON to defraud DUI of more than $3.5 million
over an approximately two-year period. The lack of comprehensive
supervisory reviews may have contributed to the untimely detection of this
activity.

Similar conditions regarding the lack of supervisory reviews over claims were
commented upon in our two preceding audit reports dating back to February 5,
2019 and the lack of supervisory reviews over adjudications and procedures for
reviewing staffing vendor employee claims was commented upon in our
preceding audit report. In response to our prior report, DUI indicated that by
December 31, 2022, these supervisory reviews would be reinstated. During our
current audit, we were advised that DUI had not implemented the
recommendations because staff was working on more urgent matters.

3
The claims were selected based on assessed risk and the adjudications were arbitrarily selected.

11
Recommendation 2
We recommend that DUI
a. establish procedures to require supervisory reviews of claims and
adjudications,
b. ensure that supervisors at claim centers perform the required reviews of
claims processed and adjudications completed (repeat), and
c. establish a formal process to provide for supervisory review of claims
processed by staffing vendor employees (repeat).

Finding 3
DUI did not adjust claimant account balances in BEACON for $493.9 million
in potentially fraudulent debit card funds removed from claimants’ debit
cards and could not document the disposition of $3 million of these funds.

Analysis
DUI did not adjust claimant account balances in BEACON for $493.9 million in
potentially fraudulent debit card funds removed from claimants’ debit cards and
could not document the disposition of $3 million of these funds. As noted in our
prior report, in July 2020, DUI canceled debit cards for 46,986 claimants with
benefits totaling $493.9 million that were potentially fraudulent because they
originated from out of State. However, DUI did not update BEACON resulting in
claimants receiving overpayment notices even though they never received the
related funds.

During our current audit we tested ten of these claimants with canceled debit
cards containing $265,300 and noted that as of July 2025 DUI had not updated the
related BEACON accounts to reflect the amount cancelled.4 Furthermore, while
DUI transferred $490.9 million of the cancelled funds to the UI Trust Fund in
March 2022; it could not document the disposition of the remaining $3 million.

In response to our preceding audit report, DUI agreed to update the accounts in
BEACON by July 1, 2023. We were advised during our current audit that DUI
has not updated the accounts because many of these accounts needed adjustments
for unrelated issues and is currently working on a plan to make all of the
adjustments together.

4
We selected these canceled debit cards for testing based on materiality.

12
Recommendation 3
We recommend that DUI
a. ensure that all transactions impacting claimant accounts are properly
recorded in BEACON, including those noted above (repeat); and
b. determine the disposition of the aforementioned $3 million and take
appropriate action.

Benefit Payments

Finding 4
DUI did not have comprehensive procedures to timely investigate the results
of data matches that identified individuals receiving unemployment benefits
who also received wages.

Analysis
DUI did not have comprehensive procedures to timely investigate the results of
data matches between BEACON records of individuals receiving unemployment
benefits and records of individuals with wage income. DUI obtains data of
individuals with wage income including quarterly reports of individuals receiving
wages in another state and individuals with new employment in Maryland. Our
review disclosed that DUI did not have written policies and procedures dictating
how the matched items were to be investigated and the process for documenting
the related results and any corrective actions.

We arbitrarily selected 10 of the 2,522 individuals identified in the fourth quarter
of calendar year 2024 as receiving unemployment benefits while also having
wage income in another state. Our test disclosed that as of July 2025, DUI had
not documented an investigation for any of these 10 individuals who had received
unemployment benefits totaling $23,000 during the quarter. This is significant
because recipients continue to receive benefits until the match result
investigations are completed. We could not readily determine the total amount of
benefits paid to these individuals while they also had wage income.

Recommendation 4
We recommend that DUI conduct timely investigations of data matches
which identified individuals that had received unemployment benefits and
also had reported wage income.

13
Information Systems Security and Control

We determined that the Information Systems Security and Control section,
including Findings 5 and 6 related to “cybersecurity,” as defined by the State
Finance and Procurement Article, Section 3.5-301(c) of the Annotated Code of
Maryland, and therefore are subject to redaction from the publicly available audit
report in accordance with the State Government Article 2-1224(i). Consequently,
the specifics of the following findings, including the analysis, related
recommendations, along with MDL’s responses, have been redacted from this
report copy.

Finding 5
Redacted cybersecurity-related finding.

Finding 6
Redacted cybersecurity-related finding.

14
Exhibit 1
Listing of Most Recent Office of Legislative Audits
Fiscal Compliance Audits of Maryland Department of Labor (MDL)
Units as of November 2025

Most Recent
Name of Audit Areas Covered
Report Date
Division of
• DOPL cash receipts
Occupational and
1 • Licensing 07/21/25
Professional Licensing
• Guaranty funds
(DOPL)
• Information system security
• Grants
Office of the Secretary, • Payroll
Division of • Federal Funds
Administration, Division • Procurement and disbursements activities
2 04/16/25
of Workforce (including support service for all divisions)
Development & Adult • Support services to other divisions of MDL
Learning, (such as payroll, data processing,
maintenance of accounting records, and
related fiscal functions)
• Employer unemployment contributions
Division of
• Reimbursements from government agencies
Unemployment
3 and certain non-profit organizations 04/08/25
Insurance (DUI) Part I
• Accounts receivable
Tax Contributions
• Information systems security and control
• Consumer credit and oversight of financial
Division of Financial
4 institutions 09/20/24
Regulation
• Examinations and licensing
• DLI accounts receivable
• Monitoring of compliance with certain laws
Division of Labor and
5 pertaining to prevailing wages 01/06/23
Industry (DLI)
• Safety inspections for boilers, pressure
vessels, and elevators
• DOR Cash receipts
• Racing funds
Division of Racing • Distribution of video lottery terminal funds
6 01/26/22
(DOR) • Certain licensee (racetrack) requirements
regarding the reporting and distribution of
pari-mutuel wagering revenue

15
Audit Scope, Objectives, and Methodology
We have conducted a fiscal compliance audit of the Maryland Department of
Labor (MDL) – Division of Unemployment Insurance (DUI), for the period
beginning November 16, 2020 and ending January 15, 2025. The audit was
conducted in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence obtained
provides a reasonable basis for our findings and conclusions based on our audit
objectives.

As prescribed by the State Government Article, Section 2-1221 of the Annotated
Code of Maryland, the objectives of this audit were to examine DUI’s financial
transactions, records, and internal control, and to evaluate its compliance with
applicable State laws, rules, and regulations.

In planning and conducting our audit, we focused on the major financial-related
areas of operations based on assessments of significance and risk. The areas
addressed by the audit included benefit payments, claims, third-party processing,
and information systems security and control. We also determined the status of
the findings contained in our preceding audit report.

Our audit did not include certain support services provided to DUI by MDL –
Office of the Secretary. These support services (such as payroll, human
resources, purchasing, maintenance of certain accounting records, and related
fiscal functions) are included within the scope of our audit of MDL - Office of the
Secretary. In addition, our audit did not include an evaluation of internal controls
over compliance with federal laws and regulations for federal financial assistance
programs and an assessment of DUI’s compliance with those laws and regulations
because the State of Maryland engages an independent accounting firm to
annually audit such programs administered by State agencies, including DUI.

Our assessment of internal controls was based on agency procedures and controls
in place at the time of our fieldwork. Our tests of transactions and other auditing
procedures were generally focused on the transactions occurring during our audit
period of November 16, 2020 to January 15, 2025, but may include transactions
before or after this period as we considered necessary to achieve our audit
objectives.

To accomplish our audit objectives, our audit procedures included inquiries of
appropriate personnel, inspections of documents and records, tests of transactions,

16
and to the extent practicable, observations of DUI’s operations. Generally,
transactions were selected for testing based on auditor judgment, which primarily
considers risk, the timing or dollar amount of the transaction, or the significance
of the transaction to the area of operation reviewed. As a matter of course, we do
not normally use sampling in our tests, so unless otherwise specifically indicated,
neither statistical nor non-statistical audit sampling was used to select the
transactions tested. Therefore, unless sampling is specifically indicated in a
finding, the results from any tests conducted or disclosed by us cannot be used to
project those results to the entire population from which the test items were
selected.

We also performed various data extracts of pertinent information from the State’s
Financial Management Information System (such as revenue and expenditure
data). The extracts are performed as part of ongoing internal processes
established by the Office of Legislative Audits and were subject to various tests to
determine data reliability. We determined that the data extracted from this source
were sufficiently reliable for the purposes the data were used during this audit.

We also extracted data from BEACON, as well as from certain other State
records, such as those maintained by the Maryland Department of Labor, for the
purpose of testing unemployment tax payments. We performed various tests of
the relevant data and determined the data were sufficiently reliable for the
purposes the data were used during the audit. Finally, we performed other
auditing procedures that we considered necessary to achieve our audit objectives.
The reliability of data used in this report for background or informational
purposes was not assessed.

DUI’s management is responsible for establishing and maintaining effective
internal control. Internal control is a process designed to provide reasonable
assurance that objectives pertaining to the reliability of financial records,
effectiveness and efficiency of operations including safeguarding of assets, and
compliance with applicable laws, rules, and regulations are achieved. As
provided in Government Auditing Standards, there are five components of
internal control: control environment, risk assessment, control activities,
information and communication, and monitoring. Each of the five components,
when significant to the audit objectives, and as applicable to DUI, were
considered by us during the course of this audit.

Because of inherent limitations in internal control, errors or fraud may
nevertheless occur and not be detected. Also, projections of any evaluation of
internal control to future periods are subject to the risk that conditions may
change or compliance with policies and procedures may deteriorate.

17
Our reports are designed to assist the Maryland General Assembly in exercising
its legislative oversight function and to provide constructive recommendations for
improving State operations. As a result, our reports generally do not address
activities we reviewed that are functioning properly.

This report includes findings relating to conditions that we consider to be
significant deficiencies in the design or operation of internal control that could
adversely affect DUI’s ability to maintain reliable financial records, operate
effectively and efficiently, and/or comply with applicable laws, rules, and
regulations. Our report also includes findings regarding significant instances of
noncompliance with applicable laws, rules, or regulations. Other less significant
findings were communicated to DUI that did not warrant inclusion in this report.

State Government Article Section 2-1224(i) requires that we redact in a manner
consistent with auditing best practices any cybersecurity findings before a report
is made available to the public. This results in the issuance of two different
versions of an audit report that contains cybersecurity findings – a redacted
version for the public and an unredacted version for government officials
responsible for acting on our audit recommendations.

The State Finance and Procurement Article, Section 3.5-301(c), states that
cybersecurity is defined as “processes or capabilities wherein systems,
communications, and information are protected and defended against damage,
unauthorized use or modification, and exploitation.” Based on that definition, and
in our professional judgment, we concluded that certain findings in this report fall
under that definition. Consequently, for the publicly available audit report all
specifics as to the nature of these cybersecurity findings and required corrective
actions have been redacted. We have determined that such aforementioned
practices, and government auditing standards, support the redaction of this
information from the public audit report. The specifics of these cybersecurity
findings have been communicated to DUI and those parties responsible for acting
on our recommendations in an unredacted audit report.

In our preceding audit report, we reported that DUI’s accountability and
compliance level was unsatisfactory, in accordance with the rating system we
established in conformity with State law. Our current audit disclosed that DUI
has improved its fiscal and compliance operations, and accordingly, DUI’s
accountability and compliance level is no longer unsatisfactory. Our rating
conclusion has been made solely pursuant to the aforementioned law and rating
guidelines approved by the Joint Audit and Evaluation Committee. The rating
process is not a practice prescribed by professional auditing standards.

18
The response from MDL, on behalf of DUI, to our findings and recommendations
is included as an appendix to this report. Depending on the version of the audit
report, responses to any cybersecurity findings may be redacted in accordance
with State law. As prescribed in the State Government Article, Section 2-1224 of
the Annotated Code of Maryland, we will advise MDL regarding the results of
our review of its response.

19
APPENDIX
Maryland Department of Labor
Division of Unemployment Insurance
Part 2
Unemployment Benefits
Agency Response Form

Overpayment Recovery

Finding 1
The Maryland Department of Labor (MDL) Division of Unemployment
Insurance (DUI) did not timely pursue recovery of claimant overpayments
totaling $807.4 million resulting in up to $760.7 million that is no longer
collectable.

We recommend that DUI
a. timely pursue claimant overpayments including those noted above. Such
actions should include sending overpayment notifications and referrals of
delinquent overpayments to CCU; and
b. determine the total amount that was uncollectable resulting from the
aforementioned delays and report this information to the Maryland
General Assembly.

Agency Response
Analysis
Please provide
additional comments as
deemed necessary.

Recommendation 1a Agree Estimated Completion Date: 03/31/2026
Please provide details of
corrective action or Based on the prior Administration’s decisions, there were several pauses in
explain disagreement. DUI overpayment collections during the pandemic, and the issuance of
overpayment notices and collections was paused entirely in January 2022 due
to a lawsuit alleging a due process violation. As part of the settlement
agreement in Gorres, et al. v. Robinson (1:21-cv-03029), the Maryland
Department of Labor (MD Labor) was required to establish processes to notify
claimants of their right to appeal agency determinations of overpayment and to
seek a waiver if they were not at fault for the overpayment and are
experiencing financial hardship. Prior to this settlement, overpayment notices
did not adequately inform claimants of their appeal rights.

Page 1 of 9
Maryland Department of Labor
Division of Unemployment Insurance
Part 2
Unemployment Benefits
Agency Response Form

Since that time, DUI has taken meaningful, concrete steps to reform its
overpayment process. Following public rulemaking, MD Labor adopted new
regulations to ensure claimants have the right to appeal overpayment
determinations and to seek waivers where appropriate. These new procedures
became final regulations under Maryland law on March 6, 2023.

However, implementing these procedures required significant updates to the
BEACON system, which MD Labor’s vendor did not complete until September
25, 2023. Only after these safeguards were in place could DUI resume issuing
appealable overpayment determinations for new cases. System changes were
also necessary to address the previous claimants who were entitled to, but not
afforded, full appeal rights.

Under the present leadership, MD Labor has worked expeditiously to complete
the necessary back-end work to resume collection activities and issue
appealable overpayment determinations for pre-moratorium overpayments with
a focus on two areas: due process and system/policy alignment.

With the implementation of these changes, DUI began issuing retroactive
overpayment notices to affected individuals on December 5, 2025, and will
resume collection activities on all overpayments in January 2026.

DUI’s timeline of activities includes:

● September, 2023: DUI began issuing Overpayment Determinations to
claimants whose overpayments accrued on or after this date.

● August 1, 2025: DUI resumed billing activities on overpayments.

● September 2025: DUI resumed overpayment waiver processing.

● October 13, 2025: DUI sent files to the State Comptroller for Tax
Refund Intercept Program (TRIP) debt collection.

● November 1, 2025: DUI issued the first of two rounds of billing
statements for debts that will be referred to the U.S. Treasury for tax
interception through the Treasury Offset Program (TOP).

Page 2 of 9
Maryland Department of Labor
Division of Unemployment Insurance
Part 2
Unemployment Benefits
Agency Response Form

● December 5, 2025: DUI began issuing “retroactive” Overpayment
Determinations to claimants whose overpayments accrued during
moratorium periods. As of 12/19/2025, 171,126 notices have been
issued. We expect that 53,000 notices will be issued on or before
December 31, 2025.

● February, 2026 : DUI will send collection files to the U.S. Treasury for
TOP activities by this date.

● January 2026: Benefit offsets will be activated in BEACON, and tax
interception will begin through TRIP and TOP.
Recommendation 1b Agree Estimated Completion Date: 9/15/2025
Please provide details of
corrective action or Pursuant to § 8-809(f)(3) of the Labor & Employment Article of the Maryland
explain disagreement. Code, the Secretary of Labor has deemed uncollectible any overpayment that
has not been recovered within 5 years of the date of the decision to recover the
amount. Claimants who owed the outstanding debt were not afforded full due
process with respect to the notices issued for the overpayment determinations.

Lab. & Empl. § 8-809 precludes DUI from establishing any overpayment later
than 3 years after the date that benefits were paid to a claimant. Furthermore,
there are statutory restrictions on any overpayment that was not established
within the last three years.

DUI has determined that there are $610,483,429 in uncollectible funds
involving 108,592 claimants, for overpayments established without notice more
than three years ago, or with faulty notice more than five years ago. The
process of identifying certain overpayments as uncollectible can be divided into
three steps; the first has been completed.

As discussed in our response to recommendation 1a, DUI has begun issuing
overpayment determinations for payments made less than five years ago, where
a claimant previously received an overpayment notice, but without full due
process rights. The notices are now being reissued with all appeal and waiver
request rights. As of December 31, 2025, approximately 221,223 such cases
totaling almost $1.29 billion will be issued overpayment determinations..

Page 3 of 9
Maryland Department of Labor
Division of Unemployment Insurance
Part 2
Unemployment Benefits
Agency Response Form

Furthermore, for overpayments made less than three years ago and for which
no determination notice was sent due to the moratorium, DUI is now issuing
overpayment notices. This involves over 43,000 cases and approximately $250
million.

The portion of the disposition of funds previously recovered, totaling
approximately $211.5 million, is under review. These amounts may reflect
reversals of banking transactions rather than overpayments. DUI is continuing
reconciliation efforts and consulting with appropriate legal counsel to
determine the status of these funds and to identify the appropriate path forward
for resolution.

Auditor’s Comment: Although MDL/DUI agreed with recommendation 1b,
MDL/DUI noted that the amount uncollectable was $610,483,429 rather than the
$760.7 million noted in our analysis. The difference is based on an MDL/DUI
analysis completed subsequent to our audit fieldwork and accordingly was not
subject to any audit verification. In this regard, we provided MDL/DUI with our
determination of the amount uncollectable and the underlying methodology and
MDL/DUI conceptually agreed to our determination and methodology.
We did note that MDL/DUI used a different timeframe in their calculation which
may have contributed to the difference. Therefore, we continue to believe our
finding and related recommendation is accurate based on the facts presented at the
time of our review.

Claims Processing

We recommend that DUI
a. establish procedures to require supervisory reviews of claims and
adjudications,

Page 4 of 9
Maryland Department of Labor
Division of Unemployment Insurance
Part 2
Unemployment Benefits
Agency Response Form

b. ensure that supervisors at claim centers perform the required reviews of
claims processed and adjudications completed (repeat), and
c. establish a formal process to provide for supervisory review of claims
processed by staffing vendor employees (repeat).

Agency Response
Analysis
Please provide
additional comments as Under MDUI’s current policy, which was reviewed by OLA, Section 1.b.
deemed necessary. provides that adjudication and claims review activities may be suspended
during periods when workload demands require all staff to focus on processing
UI claims.

During the period in question, the Division of Unemployment Insurance
experienced a significant increase in workload and a substantial backlog of
adjudication issues. Given limited staffing and resources, it was necessary for
all personnel to be dedicated to claims processing. Accordingly, supervisory
review was suspended in alignment with established policy.

Recommendation 2a Agree Estimated Completion Date: 4/1/2026
Please provide details of
corrective action or DUI is in the process of updating its policy and procedures regarding
explain disagreement. supervisory reviews of claims and adjudications, including required procedures
during periods of increased workload, to ensure adequate supervisory reviews
occur.
Recommendation 2b Agree Estimated Completion Date: 4/1/2026
Please provide details of
corrective action or After the policy is updated, DUI will train supervisors and ensure that
explain disagreement. supervisors at claim centers perform the required reviews of claims and
adjudications processed by all staff members. These reviews will be
documented, discussed with staff, and maintained appropriately.
Recommendation 2c Agree Estimated Completion Date: 05/10/2022
Please provide details of
corrective action or This is no longer applicable, as claims are no longer processed by vendor
explain disagreement. staff. The vendor contract concluded on May 10, 2022.

Page 5 of 9
Maryland Department of Labor
Division of Unemployment Insurance
Part 2
Unemployment Benefits
Agency Response Form

We recommend that DUI
a. ensure that all transactions impacting claimant accounts are properly
recorded in BEACON, including those noted in this finding (repeat); and,
b. determine the disposition of the aforementioned $3 million and take
appropriate action.

Agency Response
Analysis
Please provide
additional comments as
deemed necessary.

Recommendation 3a Agree Estimated Completion Date: 6/30/2026
Please provide details of
corrective action or DUI initially faced significant delays in adjusting account balances due to an
explain disagreement. incomplete data file from the financial institution, which hindered
reconciliation efforts.

However, a complete data file was received in August 2025. Since then, our
team has successfully reconciled and applied correct balances to approximately
85% of the accounts.

The remaining accounts present complex issues requiring careful consideration
of relevant laws and regulations. DUI policy and the Attorney General’s Office
are currently evaluating the optimal course of action to ensure compliance.

Once DUI reaches a definitive resolution, we will promptly post the correct
balances to these outstanding accounts.

Page 6 of 9
Maryland Department of Labor
Division of Unemployment Insurance
Part 2
Unemployment Benefits
Agency Response Form

Recommendation 3b Agree Estimated Completion Date: 3/31/2026
Please provide details of
corrective action or The approximately $3 million discrepancy appears to be associated with
explain disagreement. accounts for which debit cards may have been cancelled due to potential UI or
identity fraud concerns. At this time, DUI does not have sufficient information
to fully reconstruct the decisions made during that period or to determine why
the amount returned by the financial institution differs from expectations,
without additional review of the March 2022 transactions.

Given significant staff turnover over the past several years and limitations in
historical documentation, further review is required to understand the
circumstances surrounding the return of funds, the identified discrepancy, and
the related financial records and decisions.

Benefit Payments

Finding 4
DUI did not have comprehensive procedures to timely investigate the results
of data matches that identified individuals receiving unemployment benefits
who also received wages.

We recommend that DUI conduct timely investigations of data matches
which identified individuals that had received unemployment benefits and
also had reported wage income.

Agency Response
Analysis
Please provide DUI is responding to this finding by assuming the OLA audit team is referring
additional comments as to crossmatch data related to out-of-state employers.
deemed necessary.

Recommendation 4 Agree Estimated Completion Date: 6/30/26
Please provide details of
corrective action or
explain disagreement. DUI acknowledges that crossmatches were not completed due to staffing
shortages and the need to modernize technology. The issue primarily arose

Page 7 of 9
Maryland Department of Labor
Division of Unemployment Insurance
Part 2
Unemployment Benefits
Agency Response Form

following the implementation of BEACON, after which the crossmatch process
encountered technical challenges that have not yet been fully resolved.

DUI will continue to process the earnings verifications for any periods that
were not processed in a timely manner. Retroactive corrective actions are
underway, including the development of technology-based solutions within
BEACON to resolve the issue.

DUI will implement the following corrective actions:

1: All overpayments (approximately 300) that are beyond the statute of
limitations will be excluded.

2: DUI is reviewing federal guidance and exploring additional measures to be
taken upon detection of a crossmatch hit to stop payment more promptly. This
will include a review of current processes and the feasibility of implementing
potential modifications to existing programming. Options to be explored
include possible stop payment, issuance of notification to claimants with
required follow-up, and denials for failures to respond.

Information Systems Security and Control

The Office of Legislative Audits (OLA) has determined that the Information
Systems Security and Control section, including Findings 5 and 6 related to
“cybersecurity,” as defined by the State Finance and Procurement Article, Section
3.5-301(c) of the Annotated Code of Maryland, and therefore are subject to
redaction from the publicly available audit report in accordance with the State
Government Article 2-1224(i). Although the specifics of the following findings,
including the analysis, related recommendations, along with MDL’s responses,
have been redacted from this report copy, MDL’s responses indicated agreement
with the findings and related recommendations.

Finding 5
Redacted cybersecurity-related finding.

Agency Response has been redacted by OLA.

Page 8 of 9
Maryland Department of Labor
Division of Unemployment Insurance
Part 2
Unemployment Benefits
Agency Response Form

Finding 6
Redacted cybersecurity-related finding.

Agency Response has been redacted by OLA.

Page 9 of 9
AUDIT TEAM
James M. Fowler, CFE
Principal Auditor

Edwin L. Paul, CPA, CISA
Information Systems Audit Manager

Edward O. Kendall, CISA
Information Systems Senior Auditor

Charles H. Hinds IV, CPA
Data Analytics Senior Auditor

Kevin M. Billard
Jonathan D. Souders
Staff Auditors

Christopher C. Pitre
Matthew K. Gonglewski
Information Systems Staff Auditors

File and source

File: REPORT_MD-Office-of-Legislative-Audits_DUI-overpayment-pandemic_2026-01-09.pdf
Size: 1,168,931 bytes
SHA-256: e0e73136d043617602f228b4510f6c331bc3becee59e90b28ad7de18b21a9997
Our copy: REPORT_MD-Office-of-Legislative-Audits_DUI-overpayment-pandemic_2026-01-09.pdf
Original: marylandmatters.org

Maryland Department of Labor - Division of Unemployment Insurance - Part 2 - Unemployment Benefits - 01-06-26

Summary

Full text

File and source

Related records