Corrective Action Plans

2022-015 Improve Controls over Medicaid Capitation Payments for Medicare Members Federal Agency: U.S. Department of Health and Human Services State Entity: Department of Community Health (DCH) Corrective Action Plans: This correction was put into production on 7/1/2022. The recoupments began April 1, 2023, to coincide with the termination of the continuous coverage requirement of the Public Health Emergency (PHE). Estimated Completion Date: April 1, 2023 Contact Person: Lynnette Rhodes, MAP Executive Director Telephone: 404-656-7513; E-mail: lrhodes@dch.ga.gov

2022-014 Improve Controls over Payments for Home and Community Based Services Federal Agency: U.S. Department of Health and Human Services State Entity: Department of Community Health Corrective Action Plans: Centers for Medicare & Medicaid Services? (CMS) approval of Appendix K: Emergency Preparedness and Waiver form allowed for some payments to go through to ensure continuity of services during the Public Health Emergency (PHE). The Medical Assistance Plan program continues to evaluate these payments to determine if the appropriate documents were filed under this exemption. This evaluation should be completed by June 30, 2023. Estimated Completion Date: June 30, 2023 Contact Person: Lynnette Rhodes, MAP Executive Director Telephone: 404-656-7513; E-mail: lrhodes@dch.ga.gov

2022-013 Improve Controls over Medicaid Payments after Date of Death Federal Agency: U.S. Department of Health and Human Services State Entity: Department of Community Health (DCH) Corrective Action Plans: Modifications to the date of death process in Georgia Medicaid Management Information System (GAMMIS) have been completed. Mass adjustments # 700, 702, and 720 are pending to correct the claims that require a recoupment. The mass adjustments should be completed by June 30, 2023. Estimated Completion Date: June 30, 2023 Contact Person: Lynnette Rhodes, MAP Executive Director Telephone: 404-656-7513; E-mail: lrhodes@dch.ga.gov

2022-012 Improve Controls over Managed Care Organization Financial Audits Federal Agency: U.S. Department of Health and Human Services State Entity: Department of Community Health (DCH) Corrective Action Plans: DCH has already included a statement in the Managed Care Organization (MCO) contracts regarding submitting financial statements in accordance with Generally Accepted Accounting Principles (GAAP) and Generally Accepted Auditing Standards (GAAS); however, MCOs submitted reports on a different basis. Going forward, DCH will review financial statements submitted to ensure the proper basis is used for the financial statements and then post to our website within the timeframes contained in the regulations. Estimated Completion Date: June 30, 2023 Contact Person: Lynnette Rhodes, MAP Executive Director Telephone: 404-656-7513; E-mail: lrhodes@dch.ga.gov

2022-024 Improve Controls over Period of Performance Federal Agency: U.S. Department of Health and Human Services State Entity: Department of Behavioral Health and Developmental Disabilities (DBHDD) Corrective Action Plans: The Department will continue to improve the internal controls to ensure that expenditures are liquidated within 90 days of the end of the period of performance as required. The Department will update processes and procedures associated with period of performance requirements and provide training that outlines close-out processes associated with the specific grant awards. DBHDD will update the internal controls related to period of performance no later than June 30, 2023. Estimated Completion Date: June 30, 2023 Contact Person: Kenneth Ward, Director of Internal Audit Telephone: 404-884-5486; E-mail: kenneth.ward@dbhdd.ga.gov

2022-023 Strengthen Controls over Eligibility Records Federal Agency: U.S. Department of Health and Human Services State Entity: Department of Human Services (DHS) Corrective Action Plans: ? The Program will work with the Community Action Agencies (CAAs) and the third party to modify the data system and establish a Community Services Block Grant (CSBG) Eligibility Date and Federal Poverty Level percentage or categorical eligibility status within the data system with each application. ? This modification will clearly identify the date that the household was eligible for CSBG services and ensure compliance with 42 U.S.C. ? 9902 (defining "low-income" and "poverty line"). The Household will be eligible for CSBG services for 90 days. At the 90-day marker, the Agency must re-determine eligibility to continue CSBG services. The services will end at the end of the current Federal Fiscal Year Contract and must be reestablished annually. ? For community events or indirect services aimed at assisting low-income communities, in accordance with 42 U.S.C. ? 9901 (objectives and purposes of the CSBG program), the CAAs will flag these events in the data system as "Community Event" and document the event's purpose, attendance, and any relevant eligibility information for participants. This approach will help demonstrate the services? validity and ensure compliance with the CSBG program's objectives. ? DHS will provide the reconciliation parameters and methodology to the CAAs for their quarterly reconciliation. ? The Program will update the CSBG Policy Manual and distribute to the network. The Program will provide training and guidance to the network to ensure that policies and procedures are consistently enforced and operating effectively. Estimated Completion Date: August 1, 2024 Contact Person: Cynthia Bryant, Unit Director Telephone: 470-259-8188; E-mail: cynthia.bryant@dhs.ga.gov

2022-022 Improve Controls over Transparency Act Reporting Federal Agency: U.S. Department of Health and Human Services State Entity: Department of Human Services (DHS) Corrective Action Plans: The agency will: ? The Office of Financial Services will work with the DHS Chief Financial Officer to determine the direct accountability and submission of the FFATA report ? Provide written procedures and training for the FFATA reporting requirement and process; ? The Office of Financial Services will provide oversight to ensure timely and complete FFATA reporting; ? The Office of Financial Services will provide quarterly FFATA status reporting to the DHS Chief Financial Officer. Estimated Completion Date: January 31, 2024 Contact Person: Bill Zisek, Director, Office of Financial Services Telephone: 404-273-9427; E-mail: Bill.Zisek@dhs.ga.gov

2022-021 Improve Controls over Expenditures Federal Agency: U.S. Department of Health and Human Services State Entity: Department of Human Services (DHS) Corrective Action Plans: ? The Low-Income Household Water Assistance Program (LIHWAP) State Office Unit implemented a $5,000 maximum amount on the total benefit per household. ? Any benefit over $3,500 requires review and approval from the LIHWAP State Office with a LIHWAP Waiver Request Form and provide a copy of the form to the Community Action Agency (CAA). ? The State Office will require that each LIHWAP Waiver Request Form approval be submitted with the Agency?s Monthly Expenditure Report packet and retained in the file. ? The Community Action Agency will be required to submit a monthly checklist and supporting documents for all applications in which the household had a leak and/or benefit amount over $3,500. ? The State Program Office will update and distribute the LIHWAP State Policy to the CAAs. The Program will provide training and guidance to the network to ensure that policies and procedures are consistently enforced and operating effectively. Estimated Completion Date: August 1, 2023 Contact Person: Cynthia Bryant, Unit Director Telephone: 470-259-8188; E-mail: cynthia.bryant@dhs.ga.gov

2022-011 Improve Controls over Transparency Act Reporting Federal Agency: U.S. Department of Education State Entity: Department of Education Corrective Action Plans: The Department of Education concurs with this audit finding. We hired additional staff during June 2022 to complete Federal Funding Accountability and Transparency Act (FFATA) reporting to ensure the reports are submitted timely and accurately moving forward. Estimated Completion Date: June 30, 2023 Contact Person: Metsehet Ketsela, Assistant Director Telephone: 678-472-7898; E-mail: metsehet.ketsela@doe.k12.ga.us

2022-010 Improve Controls over Subrecipient Monitoring Federal Agency: U.S. Department of Education State Entity: Department of Education (GaDOE) Corrective Action Plans: We have transitioned the subrecipient audit monitoring process to the Financial Review team within GaDOE which currently performs local educational agency (LEA) audit monitoring. The controls already in place for the Financial Review team?s LEA audit monitoring will be duplicated for nonprofit audit monitoring to ensure all required procedures are complete and timely. Additionally, we will review the Division of Federal Programs Handbook, the 21st Century Community Learning Centers (CCLC) Subgrantee Manual, and the 21st CCLC Internal Operations manual to ensure compliance to the Uniform Grants Guidance for subrecipient monitoring. Where needed, language will be added to each manual to clarify and emphasize that subrecipient monitoring includes application review, budget review, drawdown approval, completion report review in addition to virtual or onsite monitoring of specific program indicators. The 21st CCLC documents will be updated to ensure a clear subrecipient monitoring process is established for the final year of a cohort. This process will clarify that subrecipient monitoring during the last funded year will include application review, budget review, drawdown approval, and completion report review. Additionally, LEAs identified as ?high-risk? will have an onsite or virtual monitoring on specific 21st CCLC indicators. Estimated Completion Date: June 30, 2023 Contact Person: Metsehet Ketsela, Assistant Director Telephone: 678-472-7898; E-mail: metsehet.ketsela@doe.k12.ga.us

2022-031 Continue to Improve Internal Controls over Federal Financial Reporting Federal Agency: U.S. Department of the Treasury State Entity: Office of the Governor Corrective Action Plans: The Office of Planning and Budget shall maintain written documentation showing independent review and approval of data entered for reporting prior to submission of all federal reports. Estimated Completion Date: March 31, 2022 Contact Person: Stephanie Beck, Deputy Director Telephone: 678-245-0675; E-mail: stephanie.beck@opb.georgia.gov

2022-032 Improve Controls over Employer-Filed Claims Federal Agency: Various Federal Agencies: U.S. Department of Homeland Security U.S. Department of Labor State Entity: Department of Labor (GDOL) Corrective Action Plans: The Georgia Department of Labor disagrees with this finding. The Employer Filed (Partial) Claims (EFC) program originated in the late 1960?s and was designed to allow employers with short term, temporary periods of lack of work for their employees to retain their workforce when work resumes. This is a program that many large manufacturers in Georgia rely on when they have temporary plant shutdowns and have for decades. When GDOL has attempted in the past to limit this program, we have met strong resistance from Georgia?s manufacturers. This program optimizes our ability to process and pay mass numbers of claims more quickly, such as what occurred at the beginning of the pandemic. EFCs may be filed by an employer with respect to any complete pay-period week during which an otherwise full-time employee works less than full-time, due to lack of work only, and earns an amount not exceeding his/her unemployment insurance weekly benefit amount. Such claims shall not be submitted or allowed for vacation days regardless of whether such vacation days were requested by the employee or established by the employer. Effective March 19, 2020, a temporary, Emergency Rule 300-2-4-05(1), containing Rule 300-2-4-.09(1) was signed which required employers to electronically submit EFCs on behalf of their employees whenever it is necessary to temporarily reduce work hours or there was no work available for a short period of time. Employers were allowed to file such claims for full and part time employees whose earnings had been reduced. In July 2020, the Rule was sunset and employers were no longer required to file EFCs. EFCs may be filed online by single entry or upload or paper. An employer may submit EFCs for regular state unemployment insurance programs including available extended benefits programs with the same eligibility requirements as regular UI, such as Pandemic Emergency Unemployment Compensation (PEUC) and State Extended Benefits (SEB), given all regular UI entitlement is exhausted. By electing to submit EFCs on behalf of the individuals, the employer is responsible for attesting to the employment status and weekly earnings of the individual for the EFC submitted. An affidavit certifying that the employer has obtained earnings from other employment as well as other requirements must be completed before EFCs can be entered or uploaded. Individuals for which EFCs are submitted are considered to be still attached to the employer and are exempt from the requirement to register for employment services per Georgia Employment Security Law Rules 300-2-4-.02. Such individuals are not required to be nor certify on a weekly basis to be able, available and actively seeking work. The GDOL disagrees that we would not provide the requested information to the auditors. The data requested relates to an ongoing federal criminal investigation. GDOL did not provide the data with concerns that dissemination of the data to a third party could jeopardize the ongoing criminal investigation and create legal risk for GDOL. GDOL stated that the auditors should obtain permission from the United States Department of Justice as a condition to dissemination of the data. GDOL did not receive any confirmation that the auditors had discussed the matter or coordinated with the US Department of Justice. Even though there have been some publicized indictments, the US Department of Justice has confirmed to GDOL that the investigation is ongoing and future indictments are anticipated. Notwithstanding, GDOL reiterates it would be happy to share the relevant data in its possession with assurances that the auditors will not publicize or disseminate any of the audit data without first consulting with the US Department of Justice. GDOL is also happy to cooperate with the auditors and provide information relating to how GDOL discovered the methods and schemes used by the fraudsters; however, GDOL has serious concerns about any publication of such information or of any other specific vulnerabilities in GDOL?s systems that would serve to encourage or perpetuate additional unemployment insurance fraud. Summary When we identified employer fraud schemes, we followed the guidance issued by United States Department of Labor (USDOL) and collaborated with the United States Department of Labor Office of Inspector General (OIG) to investigate these cases. Effective December 6, 2021, the EFC process was revised to require individuals (employees) to complete an EFC profile to include a real-time identity verification before payments can be made. Employers are responsible for submitting the request for the payment to certify to the individual?s employment status, but the individuals must certify their identity and personal information for the claim to be processed. Employees are notified when a claim is filed on their behalf and provided instructions for their portion of completing the EFC process. The MyUI Customer Portal dashboard provides all the EFC correspondence sent to the individual as well as a status of the profile set up and identify verification. Prior to the implementation of the EFC profile requirement, GDOL utilized the Social Security Administration (SSA) crossmatch and Systematic Alien Verification for Entitlement (SAVE) verification processes to verify the identity of claimants where employers submit claims on their behalf. GDOL has no plans to stop utilizing the EFC program as it is an effective and popular program among employers with a successful 60-year track record. GDOL greatly appreciates the feedback and recommendations and will consider this information in future endeavors to modernize and update system and business processes. Estimated Completion Date: December 6, 2021 Contact Person: Crystal Singleton, Policy and Procedure Manager Telephone: 404-232-3183; E-mail: Crystal.Singleton@gdol.ga.gov

2022-030 Strengthen Controls over the Summary Schedule of Prior Audit Findings Federal Agency: U.S. Department of Labor State Entity: Department of Labor (GDOL) Corrective Action Plans: As Georgia progressed towards addressing and pursuing efforts to resolve outstanding Coronavirus Aid, Relief, and Economic Security Act (CARES Act) matters, impediments such as limited workforce and system restrictions hindered progress. Such factors, imposed upon the intents to make system changes, corrections and enhancements. We have taken the following corrective actions in an ongoing effort to bring these findings to full resolution: 2020- 036 Improve Controls Over Eligibility Determinations In addition to steadily reviewing and determining eligibility of responses providing proof of Pandemic Unemployment Assistance (PUA) employment and wages, a task force has been established to assist with this effort. An ongoing campaign is in progress to onboard additional resources to increase the cadence of addressing these items. Claimants who fail to provide adequate proof are manually reconsidered and overpayments established appropriately. Since this process is manually reviewed by staff rather than by system automation, we anticipate this effort will take approximately 60 weeks to complete. When there are indications of potential fraud, additional investigation is pursued to determine if fraud penalties should be imposed. 2021-036 ? Improve Controls over Employer-Filed Claims Effective December 6, 2021, the Employer-Filed Claims (EFC) process was revised to require individuals (employees) to complete an EFC profile to include a real-time identity verification before payments can be made. Employers are responsible for submitting the request for the payment to certify to the individual?s employment status but the individuals must certify their identity and personal information for the claim to be processed. Employees are notified when a claim is filed on their behalf and provided instructions for their portion of completing the EFC process. The MyUI dashboard provides all the EFC correspondence sent to the individual as well as a status of the profile set up and identify verification. Summary We are currently seeking funding to modernize our UI benefits system which will incorporate and improve the controls cited. GDOL will develop and implement procedures to ensure the status of each prior audit finding is reported in an accurate manner. GDOL will ensure staff responsible for submitting the status of prior period audit findings are trained and understand their responsibilities associated with the Summary Schedule of Prior Audit Findings under the Uniform Guidance. Estimated Completion Date: December 6, 2021 Contact Person: Racquel Robinson, Unemployment Policy and Procedures Chief Telephone: 404-232-3190; E-mail: Racquel.Robinson@gdol.ga.gov

2022-029 Improve Controls over the Identification, Recording, and Reporting of Overpayments Federal Agency: U.S. Department of Labor State Entity: Department of Labor (GDOL) Corrective Action Plans: The Georgia Department of Labor did not maintain adequate controls over the identification, recording, and reporting of benefit overpayments associated with the Unemployment Insurance programs. GDOL Response: The Georgia Department of Labor disagrees with this finding. USDOL provides guidance and recommended procedures for crossmatches but does not dictate a frequency or cadence for performing them. The crossmatch process is conducted using third party software which runs a systematic check against weeks in a quarter for which benefits are paid and wages are reported during the same quarter. Although the program may detect weeks paid and wages reported, this alone is not indicative of an overpayment. Therefore, the process involves verification correspondence being sent to both the claimant and the employer, as applicable, to verify the status of employment, the wages earned as well as the weeks in which an individual worked and earned the wages. Based on responses, an assessment is made to determine if an overpayment exists and subsequent actions are taken accordingly. We are prohibited from assuming a match is an overpayment. It is not an overpayment until we have completed a full investigation and provided due process to all parties. The audit report indicates misinterpretation of the data reflected on the federal reports, specifically the ETA 227. The ETA 227 is for reporting of overpayment detection and recovery activities that the Agency performed in a quarter. It is not for reporting the amount of benefits overpaid for specific weeks during that quarter. A federal reporting team was created to accurately identify and track overpayments. The Department is taking necessary actions to complete the overpayment reconciliation for the ETA 227 and 902 reports. Federal regulations require an actual person to review and establish fraudulent overpayments. Due to the volume of claims and the number of cross matches to be performed on all state and federal pandemic programs, it would require multiple GDOL staffing levels to review all cross matches, requiring increased levels of state and federal funding. Summary GDOL has developed an aggressive plan to complete all remaining state and pandemic program cross matches. We have filled all of our budgeted positions for the Overpayment Unit and are utilizing non-overpayment staff to assist with identification and overpayment investigations. Additionally, we are utilizing temp agency staff to perform some clerical duties; however, federal regulations prohibit non-merit staff from adjudicating and releasing overpayment decisions. In early 2022, we started to freeze the overpayment data at the end of every month so that we can conduct periodic reconciliation of the overpayment records. GDOL is coordinating with USDOL to ensure the timely and accurate identification, tracking and reporting of overpayments. GDOL greatly appreciates the feedback and recommendations and will consider this information in future endeavors to modernize and update system and business processes. Estimated Completion Date: January 1, 2022 Contact Person: Crystal Singleton, Policy and Procedure Manager Telephone: 404-232-3183; E-mail: Crystal.Singleton@gdol.ga.gov

2022-028 Improve Controls over Eligibility Determinations Federal Agency: U.S. Department of Labor State Entity: Department of Labor (GDOL) Corrective Action Plans: (1) Identity verification was not performed appropriately in eight instances. GDOL Response: The Georgia Department of Labor disagrees with these findings as it relates to identity verification. The auditors did not identify the type of identity verification procedures not performed or any identity verification procedures that GDOL was required to perform. There was not a mandatory requirement to complete identity verification at the time most of these applications were submitted as the majority of these claims were employer-filed claims (EFC). Identity requirements for EFCs were implemented at a later date. At the start of the pandemic, the identity proofing processes available were Social Security Administration (SSA) verification, Department of Driver Services (DDS) crossmatch and for non-citizens, Department of Homeland Security Systematic Alien Verification for Entitlement (SAVE). As applicable, these processes were performed on all initial regular and EFCs, which includes the eight instances. (2) Non-monetary determination was not performed in two instances. GDOL Response: Instance 1: A disqualifying non-monetary determination was released and disqualification was entered into the system. The system erroneously released a payment for the week in question. An overpayment was established in January 2023. Instance 2: Claim was processed but issue did not get added to the claim to address separation reasons. A non-monetary determination was released in November 2022 to allow benefits. All payable weeks have been processed. There was no detriment to the claimant as they were determined eligible nor was there any monetary loss to the State. (3) Proof of employment or self-employment or a valid offer to begin employment and proof of wages was not submitted by two Pandemic Unemployment Assistance (PUA) claimants. GDOL Response: The GDOL disagrees with the findings related to proof of employment or self-employment or a valid offer to begin employment and proof of wages was not submitted by two PUA claimants. Under the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), claimants did not have to provide proof of employment or self-employment. It was not until Continued Assistance Act (CAA) was enacted December 27, 2020 that such proof was required. The disqualification could not be applied retroactively, as outlined in Unemployment Insurance Program Letter (UIPL) No. 16-20, Change 4. Instance 1: Claimants who established PUA entitlement at the minimum weekly benefit amount were instructed to submit their proof of wages by email. Under the CARES Act, if claimants did not submit proof, federal requirements only allowed for payment of the minimum weekly benefit amount and no disqualification of benefits. The claim cited was originally established and remains established for the minimum weekly benefit amount. In accordance with CAA rules, the claimant was notified to provide proof of employment and wages for weeks paid on or after 12/27/20. To date, no proof has been provided by the claimant. The claimant has been disqualified effective 12/27/20 and an overpayment was established in January 2023. Instance 2: Claimants who established PUA entitlement with a weekly benefit amount greater than the minimum was based on wages entered by the claimant and/or wages reported by the employer. CARES Act only required proof of wages to be submitted. If claimants did not submit proof, federal requirements only allowed for payment of the minimum weekly benefit amount and no disqualification of benefits. Claims established at a higher weekly benefit amount had to be reduced to the minimum amount if no proof was provided. To date, no proof has been provided by the claimant cited. The claim was established above the minimum amount; therefore, benefits were reduced to the minimum amount. In accordance with CAA rules, claimants were notified to provide proof of employment and wages for weeks paid on or after 12/27/20. The claimant has been disqualified effective 12/27/20 and an overpayment was established in November 2022 for weeks paid over the minimum amount under CARES and weeks paid after 12/27/20 under CAA/American Rescue Plan Act (ARPA). (4) Claimants did not self-certify for benefits in 18 instances. GDOL Response: The GDOL disagrees with the findings Claimants did not self-certify for benefits in 18 instances. Employer-Filed Claims (EFC) are submitted by employers on behalf of the claimant. The employer is responsible for attesting to the employment status and weekly earnings of the claimant for the EFC submitted. An affidavit certifying that the employer has obtained earnings from other employment as well as other requirements must be completed before EFCs can be entered or uploaded. Claimants for which EFCs are submitted are considered to be still attached to the employer and are exempt from the requirement to register for employment services per Georgia Employment Security Law Rule 300-2-4-.02. Such individuals are not required to be nor certify on a weekly basis to be able, available and actively seeking work. Additionally, USDOL encouraged states to waive work search requirements for all claimants during the pandemic. (5) Claimant and payment information did not exist in the system of record in one instance. GDOL Response: The identifying information the auditors provided for this claim does not match any claims in our system. Therefore, we are unable to validate the auditor?s finding. Summary The information above is provided for your consideration in dispelling some of the audit findings. GDOL took immediate action to establish the federal UI programs and comply with federal guidance and regulations. There was not a mandatory requirement to complete identity verification at the time most of these applications were submitted. At the start of the pandemic, the identity proofing processes available were Social Security Administration (SSA) verification, Department of Driver Services (DDS) crossmatch and for non-citizens, Department of Homeland Security Systematic Alien Verification for Entitlement (SAVE). As applicable, these processes were performed on all initial regular and employer-filed claims (EFC). Beginning January 2021, PUA applicants were required to complete additional identity verification processes. Beginning in December 2021, all applicants were required to complete identity verification prior to filing a claim for UI benefits. Effective December 6, 2021, the EFC process was revised to require individuals (employees) to complete an EFC profile to include a real-time identity verification before payments can be made. Employers are responsible for submitting the request for the payment to certify to the individual?s employment status, but the individuals must certify their identity and personal information for the claim to be processed. Employees are notified when a claim is filed on their behalf and provided instructions for their portion of completing the EFC process. Additionally, as system deficiencies were identified, changes were made as quickly as possible to mitigate risks of improper payments. Automation of PUA claims was suspended and reviews were handled manually by staff before a determination was released. GDOL established task forces to develop and implement strategies to address the ramped fraud attempts to bypass system and procedural safeguards. We regularly attended fraud meetings with various federal agencies and unemployment agencies from other states to share best practices for combatting fraud. As resources permitted, we did our best to implement these best practices and strategies. Prioritizing system changes was challenging with the time constraints, necessity to build a program based on an established program that operated manually in our state and the demands of all other federal UI programs; but GDOL made every attempt to maximize our system capacity to accommodate the guidelines of each program requirements. Georgia greatly appreciates your time and consideration of our response to the findings and welcome you to contact us if you have any questions. Estimated Completion Date: December 16, 2021 Contact Person: Crystal Singleton, Policy and Procedure Manager Telephone: 404-232-3183; E-mail: Crystal.Singleton@gdol.ga.gov

2022-027 Improve Controls over Administrative Expenditures Federal Agency: U.S. Department of Labor State Entity: Department of Labor (GDOL) Corrective Action Plans: The seven transactions related to utility bills for some local career centers did not have an approval signature from Regional Operations. Each was processed by line staff after being reviewed by a lead worker/manager in Accounts Payable to assure that the account numbers belonged to GDOL. The accounts were confirmed as longstanding accounts and the invoice amounts were reviewed to assure that they were in line with prior billings. These invoices are reviewed again at the end of the day the payment was processed to assure they were processed as appropriate. As stated, we had several regular billers redirect invoices directly to Financial Services in an attempt to avoid misdirected mail during the vestiges of the pandemic. We wanted to avoid the risk of creating adverse relations with any biller or have to use precious time dealing with penalties and fees being added to account balances or service terminations as a result of going beyond the standard payment window. These were standard billings for critically needed utility services that needed to continue uninterrupted. Currently, approval signatures are required on all invoices as was customary prior to the pandemic. Estimated Completion Date: March 15, 2023 Contact Person: John Williams, Accounting Director II Telephone: 404-232-3577; E-mail: john.williams@gdol.ga.gov

2022-026 Improve Controls over Transparency Act Reporting Federal Agency: U.S. Department of Housing and Urban Development State Entity: Department of Community Affairs (DCA) Corrective Action Plans: Since the State audit, DCA has revised its processes and procedures related to the submission of the Federal Funding Accountability and Transparency Act (FFATA) for all federal programs, including CDBG-DR and CDBG-MIT. These processes include a formal review and approval of the report by the Office Director and the Division Director prior to submission. Estimated Completion Date: February 3, 2023 Contact Person: Nina Gyasi, Financial Ops and Reporting Manager Telephone: 404-679-5820; E-mail: nina.gyasi@dca.ga.gov

Corrective action plan: For the annual UI access review, TWC will monitor the annual CAPPS Systems Access Privileges Certification in CAPPS to ensure timely completion. For the code developer/promoter system roles, IT will implement a new quarterly review of developer roles to ensure no staff member has both roles assigned to ensure separation of duties in the system roles. We are also looking at potential technical solutions that would automate and prevent staff being assigned certain roles based on separation of duties. Implementation date(s): February 28,2023 Responsible Persons: Heather Hall, CIO

Corrective action plan: The formula error was identified, corrected and reallocations are now correct. Also, the outdated reallocation journal tool is no longer used. The new journal reallocation tool includes edits to identify discrepancies before a reallocation journal is posted. As an additional verification step, which began with March 2022 reallocations, a new verification report (Fund Source Allocation Compare Report) is run that compares the date the factor was updated to the date the reallocation journal was entered to ensure no changes have been made to the factor. HHSC Accounting will work with Chief Financial Officer (CFO) Operation Support to establish an automated process to strengthen existing verifications. Implementation date(s): August, 31, 2023 Responsible persons: Director, Funds Management

Corrective action plan: Texas Integrated Eligibility Redesign System (TIERS) - In order to bring password settings into compliance with the HHSC Information Security (IS) Security Policy, the TIERS Operations team released tool/method (113.0) successfully into production without any adverse impact. This release was completed on 09/24/2022 and contained the security requirements to restrict minimum allowed password changes from zero (unlimited) to one meaning users are allowed "only" one password change a day. This was verified by CliftonLarsonAllen LLP (CLA) auditors on 12/21/22. Screenshots were also provided to CLA auditors. Implementation date(s): September 24, 2022 Responsible Persons: Director, Information Technology (IT) Infrastructure Services

Responsible Individual: Matthew Zern, Financial Officer Corrective Action Plan: Due to the retirement of Greater Johnstown Area Vocational Technical School?s long time business manager and the sudden resignation of the replacement, the audit was unable to be completed timely. Greater Johnstown Area Vocational Technical School currently has a business manager in place and is expected to file its audit timely beginning with the June 30, 2023, fiscal year ending. Anticipated Completion Date: November 30, 2023.

2022-003 Improve Recordkeeping of Expense Allocations (Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing #93.9592) Recommendation: We recommend that Comprehend maintains supporting documentation of all expense allocations and have it on file and readily available for the audit. Action Taken: Management agrees that supporting documentation is to be maintained to comply with Grant Requirements. Comprehend is currently working with Payroll Provider; ADP, to comply with the complexity of the payroll requirement as its to reconciling allocations of payroll at the program level. This process will be in place by May 2023 under the new provider. Donna Hicks, CFO, and Melanie Hill, Accounting Assistant, are the contact persons responsible for the corrective action.

Finding: 2022-001 Considered a significant deficiency in internal control/immaterial non-compliance. Program: ALN 93.959 Block Grants for Prevention and Treatment of Substance Abuse (Treatment) Criteria: As detailed by 2 CFR 200.402, the total cost of a Federal award is the sum of the allowable direct and allocable indirect costs less any applicable credits. Condition: During testing of amounts charged to the grants it was noted that provider stabilization payments were charged to the Treatment grant but were not authorized by the grants. Cause/Effect: This condition appears to be the result of a misunderstanding of costs allowed under this grant. These costs were not in compliance with 2 CFR 200.402. Questioned Cost: $199,598 Recommendation: We recommend that the Entity review all grant agreements to gain a thorough understanding of allowable costs and then establish/modify internal controls to assure that only allowable costs are charged to the grant View of Responsible Official: Management is in agreement with this recommendation. Corrective Action Plan: SWMBH's provider stability committee will review SWMBH's COVlD-19 Provider Stability plan. Along with the review of the plan, SWMBH will fully understand and execute request in accordance with the SWMBH COVlD-19 Provider Stability plan. Payments of an approved provider stability request will only be funded by Medicaid and Healthy Michigan. Responsible Party: Garyl L. Guidry Jr., MBA Chief Financial Officer Date of completion: August 1, 2023

Kettle Falls School District has already taken action to correct the finding. We utilized a project management firm to oversee the elementary roof project that this finding was based on. We informed them that we were using Federal funds to support the project and asked them to make sure that all rules regarding Federal funds were being followed. However, we learned during this audit that they were not followed. As soon as we learned about a potential issue with our current audit, we made an immediate change to our practice. We no longer rely on the firm to ensure that Federal requirements are being met. We now oversee those requirements, and the district will be certifying the payroll for any project that is being funded through Federal dollars.

2022-002 ALLOWABLE COSTS AND ALLOWABLE ACTIVITIES ? COVID-19 CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS Recommendation: We recommend that the County include consideration of any expenditures that may be part of other federal programs as part of their review. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will review their procedures to ensure expenditures coded to federal grants are not already claimed by other grant programs. Name of the contact person responsible for corrective action plan: Deborah Erickson, Administrative Services Director Planned completion date for corrective action plan: December 31, 2023