Our audit of the Department of Taxation (Taxation) for the year ended June 30, 2025, found:

• proper recording and reporting of all transactions, in all material respects, in the Commonwealth’s accounting and reporting system, Taxation’s internal accounting and reporting system, and supplemental information and attachments submitted to the Department of Accounts (Accounts);

• one matter involving internal control and its operation necessary to bring to management’s attention; however, we do not consider it to be a material weakness;

• four additional matters involving internal control and its operation requiring management’s attention that also represent instances of noncompliance with applicable laws and regulations that are required to be reported under Government Auditing Standards; and

• corrective action has not been completed with respect to the prior audit findings identified as ongoing in the Findings Summary included in the Appendix.

Our report includes a risk alert that requires the action and cooperation of Taxation’s management and the Virginia Information Technologies Agency (VITA) regarding risks related to unpatched software.

In the section titled “Internal Control and Compliance Findings and Recommendations," we have included our assessment of the conditions and causes resulting in the internal control and compliance findings identified through our audit as well as recommendations for addressing those findings. Our assessment does not remove management’s responsibility to perform a thorough assessment of the conditions and causes of the findings and develop and appropriately implement adequate corrective actions to resolve the findings as required by Accounts in Topic 10205 – Agency Response to APA Audit of the Commonwealth Accounting Policies and Procedures Manual. Those corrective actions may include additional items beyond our recommendation.