Corrective Action Plans

Management agrees with the findings, with some concerns noted in the corrective actions below. These corrective action steps are separated by specific health and safety finding. Background Checks: DHS will prioritize an emergency reopening of the regulations for both family and child care center regulations to require all providers and staff who work with children to enroll in the workforce registry no later than one month after promulgation. This will allow DHS staff to access employee files in real time to ensure that all staff have appropriate and current comprehensive background checks in their digital files. Until this regulation goes into effect, DHS will implement an immediate policy that all staff who work with children have their staff files audited as part of on-site monitoring visits. Previously, DHS looked only at those staff who were new since this last visit. However, this led to expired background checks being found during the audit. These expired checks also counted as not being able to demonstrate completion of the background check. DHS does want to acknowledge that during this audit, all staff were required to show evidence of a comprehensive background check. This included staff who did not have access to children and/or were not in the building when children were present. This does not align with regulation 218-RICR-70-00-1.12.A.1 which states, “All individuals working or engaging directly with children who are employed or act as a volunteer in the program, must complete all requirements of a comprehensive background check as outlined here: https://dhs.ri.gov/programs-and-services/child-care/child-care-providers/background-checks.” While the auditing team was informed of this, those staff not working with children who were on a payroll sheet were included as a finding against the Department. DHS will send out communication to the field alerting them that the lack of background checks is not tolerated. Staff who do not have these checks on file will be sent home until a background check is received (a practice that already exists, but typically the licensor is not looking at all files for every visit). For center providers, any staff or provider who is found to not have this information will be told to leave the program until this evidence is found. This may result in programs needing to temporarily close due to staff ratio issues. For family child care providers, this will involve a file audit of all received background checks, as well as a visit to ensure that there are no additional or new household members who have not completed this check. Any provider who has not submitted or completed an updated background check will be required to close until received. Any provider who is found to have household members who have not been listed and/or completed appropriate background checks will be closed due to failure to adhere to regulations. Immunizations: DHS recognizes and supports the importance of ensuring children are receiving timely vaccinations. However, DHS also recognizes that providers are only able to gather this data directly from families. Families who do not provide updated immunizations may be excluded from care if they do not provide these records. DHS will communicate with providers that no child should be enrolled without this documentation and that failure to provide updates to this documentation can result in dismissal from the program. DHS does not know if any of the children identified in this finding had medical or religious exemptions for their immunizations but would challenge that this finding could be skewed if this additional information was not ascertained by the auditing team. DHS will continue to partner with the Rhode Island Department of Health to ensure that programs are actively monitored and surveyed regarding immunization documentation. Emergency Preparedness Plan: DHS has been working with providers to ensure they have documented the required components of an emergency preparedness plan as required by federal funding agencies. DHS is requiring providers to include the DHS emergency plan form as part of renewal (for already existing providers) or as part of initial licensure. Absence of this form does not mean that the criteria is not being met. DHS did not train the auditors on what these required areas were and cannot speak to how this was monitored. However, DHS will continue to work with our providers to ensure that these criteria are met as part of the requirements in RISES. DHS has also created a training with The Center for Early Learning Professionals that reviews how to complete this plan and implement through practice. Unallowable Items In Cribs: This audit found that 30% of providers were found to have unallowable items in cribs. For the purposes of this audit, this finding included cribs that did not have children sleeping in them. Per the regulations for both Family and Child Care Centers, “No items are placed in the crib with an Infant except for a pacifier.” (218-RICR-70-00-2.3.3.C.1.k and 218-RICR-70-00-1.10.C.i respectively) DHS requests that only those providers who were found to have children in cribs with items be included in the finding. DHS has worked with The Center for Early Learning Professionals to develop individual trainings related to safe sleep. Providers who are found to be noncompliant regarding safe sleep practices are referred to those trainings with additional monitoring visits occurring to ensure changes have been made. As a result of this audit, DHS will inform providers that any safe sleep violations may result in a probationary status with additional licensing action possible if the continued noncompliance with safe sleep is observed. Toxic Substances unlabeled and accessible: DHS continues to monitor for this in both Family Child Care and Center-based programs. Typically, these are addressed and corrected onsite. Repeated noncompliance in this area can lead to probationary status. DHS will be reviewing the probationary process and use Technical Assistance with our federal funders to evaluate how other states address probation and other licensing actions. The goal is to solidify the current processes to ensure that there is an appropriate escalation review for repeated noncompliance that starts with probation and possibly lead to suspension of license. This will be communicated regularly to all providers. Developmental history: Per regulations, developmental histories are required only for programs serving infants and toddlers. Per Family Child Care regulation (218-RICR-70-00-2.3.6.F.7.a) and Child Care Center regulation (218-RICR-70-00-1.13.F.8.a), only files for infants and toddlers must contain developmental histories. DHS is unable to confirm whether or not this finding is related to this age group or if this finding occurred because age groups beyond that were assessed for compliance. Without this clarification, DHS would contest that this finding is accurate. DHS continues to support the provider community - both Family Child Care and Center providers - ensuring that they have gathered as much information as possible on the children they are enrolling in care. DHS will continue to audit files while on site to ensure that infants and toddlers have these documents completed. In the new RISES system, new providers who identify the desire to be licensed for either age group are required to submit examples of these forms as part of the initial application. For current providers, those serving these age groups will not be able to submit their first renewal in the system without uploading examples of these completed forms. Anticipated Completion Date: Background Checks: DHS will meet with policy staff immediately to discuss the emergency promulgation of new regulations. DHS will also immediately send out an email to the provider community regarding the outcomes of this audit and the responses that DHS intends to implement. Monitoring of programs, including for compliance of this regulation, will be ongoing. All other findings will be addressed in an ongoing fashion. Contact Person: Nicole Chiello, Assistant Director, Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov

DHS has a policy for subrecipient monitoring, which includes documentation required to be submitted by a subrecipient. The documentation is based on assessing the risk of each subrecipient. There is no requirement in the Uniform Grant Guidance in regard to supporting documentation requirements. The invoice needs to be certified by an authorized agent and the expense needs to have been reasonably incurred. DHS ensures compliance in numerous ways, including monthly programmatic meetings, site visits, review of single audits and past performance. Additionally, DHS contracts include a budget narrative and allows for DHS to require additional documentation for audit purposes. If requested, DHS would have been able to produce more documentation to satisfy the allowability of costs. Anticipated Completion Date: Not Applicable Contact Person: Ben Quattrucci, Associate Director Financial Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov

RIDOH agrees with the finding and recommendation. Corrective action plan: • In gathering time sheets for the requested audit samples, RIDOH found that some Master Time Sheet Coordinators (staff responsible for receiving signed time sheets, populating the Master Time Sheet spreadsheets sent weekly from/to HR/Payroll, and saving time sheets to the Time Sheet Repository in Teams) were saving documents locally instead of in the central Teams site. RIDOH is providing training and increased oversight of the non-compliant Time Sheet Coordinators and is conducting ongoing checks of the time sheets uploaded to Teams weekly to assure the time sheets are saved properly. • Instructions have been provided and will be reiterated Department-wide that all time sheets must be signed and dated by both the employee and supervisors, and signatures without dates are not acceptable. • RIDOH will adjust the questioned costs for ELC and DWSRF to appropriate non-federal funds. • RIDOH has been working to move staff that use the general category codes (i.e., EH Management & Leadership) to non-federal funding sources as much as possible and will begin requiring staff on federal funds to record their hours for each federal grant separately. This is a complicated process and will be fully implemented once Time and Effort reporting is transferred to Workday (the ERP). Anticipated Completion Date: The first three bullets above will be completed by June 30, 2025. Transition of Time and Effort reporting to Workday has been delayed, and the new target implementation date has not been announced. Contact Persons: Alisha Colella, Chief Financial Officer, Department of Health alisha.colella@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Department of Health carla.lundquist@health.ri.gov

RIDOH agrees with the finding and recommendations and will develop and implement enhanced internal controls over Uniform Grant Spreadsheets (UGSs) to assure that all indirect cost billings and drawdowns of federal funds are appropriate and accurate. The UGS internal controls will include (but are not limited to): • Mandatory refresher training for all staff that complete and/or review UGSs, with focus on areas of potential errors and correct entry of UGS data in the Monthly Federal Grants Tracking spreadsheet used for drawdowns and indirect billing. • Providing a crosswalk of expenditure categories and natural accounts to grants management staff to assure appropriate and consistent assignment of transactions to categories subject to/not subject to indirect costs. • A rotating schedule of monthly in-depth reviews of UGSs to assure that data entry aligns with RIFANS transaction reports, transactions are recorded so natural accounts align with correct expenditure categories, the appropriate indirect cost rate is entered, and formulas for computation of indirect costs are not corrupted. Reviews will be conducted by supervisors of staff completing UGSs, and results will be reported to the Deputy CFO/Federal Grants Manager. • Review of the Monthly Federal Grants Tracking spreadsheets each month before indirect cost billing and federal drawdowns are completed, to assure that expenditures reported align with RIFANS reports and indirect billings and drawdown requests are appropriate. RIDOH credited the ELC Enhancing Detection federal award for the unallowable indirect costs on 3/14/2025 (J25075GMC530). The credit was calculated using RIFANS transaction data from 7/1/2020 through 3/13/2025, not from the UGSs. The UGSs for this award and others are being re-built from the start of the award using RIFANS data in new, less complicated templates to assure correct charging and reporting going forward. Anticipated Completion Date: July 31, 2025 Contact Persons: Alisha Colella, Chief Financial Officer, Department of Health alisha.colella@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Department of Health carla.lundquist@health.ri.gov

2024-044a: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044b: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044c: Management agrees with this finding and will communicate the requirements for subrecipient monitoring; specifically, the documentation of expenses, and meeting notes. Anticipated Completion Date: Completed April 23, 2025 Contact Persons: Paul L. Dion, Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov Brianna Ruggiero, Chief of Staff, Pandemic Recovery Office, Department of Administration brianna.ruggiero@doa.ri.gov

Quonset Development Corporation (QDC) disputes the finding, asserting that since the MARAD grant funding was provided on a reimbursement basis, QDC did not have custody of Federal funds at any point. QDC was required to meet rigorous documentation standards for reimbursement prior to the release of any funds. QDC has created written policies and procedures specifically referencing Uniform Guidance in the case we receive Federal funding in the future. These policies will be implemented after the Board of Directors approves such policies at the April 2025 meeting. Anticipated Completion Date: Ongoing Contact Person: Patricia Testa, Chief Financial Officer, Quonset Development Corporation ptesta@quonset.com

Pursuant to federal SNAP regulations at 7 CFR 272.4(g) and corresponding state regulations, the Department is required to establish and operate a fraud detection unit, which is responsible for the detection and investigation of SNAP fraud. The Office of Internal Audit (OIA) at the Department of Administration, Office of Management and Budget, through a Memorandum of Understanding (MOU), provides DHS with fraud detection, investigation and prevention services across DHS’s public assistance programs, including SNAP. DHS staff refer to OIA SNAP cases in which staff suspect fraud. OIA, in turn, investigates the allegation. If OIA determines that the household has committed an intentional program violation of SNAP, they pursue disqualification of the individual(s) from the program, either through an administrative disqualification hearing (ADH), a waiver of ADH, or refer the case to the state police for criminal prosecution. If the individual is found to have committed the IPV, and received SNAP benefits they were not entitled to, DHS establishes an overpayment claim against the household’s liable individuals. The liable individuals are required to make payment agreements to return to DHS, the benefits they received, but were not entitled to. If the fraud is referred for criminal prosecution, the amount of overpaid benefits is determined by the Court through an Order for Restitution. DHS followed the established and required protocols in the case cited in this finding. DHS referred a case to OIA in which identity fraud was suspected. OIA, with DHS assistance, and collaboration from the USDA Office of Inspector General (OIG), conducted the investigation, which revealed, not only fraudulent actions, but also criminal behavior and a significant estimate of overpaid SNAP benefits. The case was referred to the U.S. Attorney’s Office for prosecution. The criminal case is currently pending. Once a disposition is issued, DHS will take the appropriate sanction actions(s), including any disqualification from the SNAP, as well establishing an overpayment claim for any restitution ordered. Pursuant to federal regulations, any collection by DHS of any overpaid SNAP benefits will be returned to the Food and Nutrition Service (FNS), with DHS retaining 30% as provided for in the regulations. Should the liable individual not pay the ordered restitution in a timely manner and the claim becomes delinquent, DHS will pursue all other available collection actions to recoup the overpaid benefits. OIA and DHS also engage in fraud prevention activities, mainly by utilizing data analytics and identifying case issues that are indicative of fraudulent activities. Once an issue is identified, OIA, in conjunction with DHS, review the impacted case population and determine actions that should be taken to mitigate the issue as well as educate customers on actions they can take to safeguard their benefits, including changing EBT card PINs, freezing cards or limiting access to out-of-state or internet transactions. Other prevention actions that may be taken include changes to the card security through vendor options, as well as widespread communication to customers and the public on new fraud trends, etc. OIA and DHS also provide training to DHS staff to spot fraud in cases, including identifying fraudulent/altered documents, use of invalid identification cards, and identity fraud trends, etc. Approximately 60% of DHS staff have completed or are in the process of completing the fraud training. Anticipated Completion Date: The criminal case is ongoing. Contact Person: Iwona Ramian, Deputy Chief Legal Counsel, Department of Human Services iwona.ramian@dhs.ri.gov

Management will submit the cost allocation methodology for grants management services allocated to federal programs as part of the billed costs going forward. Anticipated Completion Date: Completed Contact Person: Kayla Marques, Supervisor Financial Management and Reporting, Department of Administration, Office of Accounts & Control kayla.marques@doa.ri.gov

The District will ensure that Additional or Compensatory Special Education or Related Services (ACSERS) funds are not used to fund Substitute Services due to the teacher shortage.

This finding is related to activities on our VOCA grants. This exception was related to a process in place prior to May 2023 for allocating our outside contracted IT services Again, in May 2023 FRLS added an electronic transaction approval process via Teams, that documents approvals for all our AP, AR and other transactions initiated by our accounting staff. These are reviewed and approved by the CFO before being posted into the GL. FRLS failed to update its allocation for this prior allocation method for this legacy vendor. The CFO will undertake a review of this process to ensure that we are in compliance with allowable cost documentation requirements. We will also review and update our documentation of allocations and ensure that each month’s allocation is properly approved. This change will be made within the next 60 days.

This finding is related to activities on our VOCA grants. This finding is related to Finding 2024-001. 4 invoices were not approved by management. FRLS’s AP policy that was adopted in September 2024 allowed us to skip separate management approval in cases of recurring invoices such as utilities and in cases where we have approved contracts such as rent payments, software subscriptions etc. This was our policy before September 2024, but it was not formalized before that date. As in the case of 2024-001. FRLS will modify its AP Policy and Procedures to remove this recurring payment exception and will now require all invoices be approved by management by routing invoices to management for approvals through the Teams automated system. Invoices over $5,000 will also be required to be approved by the Executive Director or their temporary designee. Such designation must be made in writing. This change will be made within the next 60 days.

This finding relates to activities on our Legal Services Field Grant. As part of FRLS’ post 2023 audit review, we implemented an update to our payroll accounting system that streamlined the process for uploading and properly coding employee time, salaries and benefits to the proper grant codes based upon a biweekly time reporting system. The exception created here came from a one-time payout for paid time off and as a result was not properly recorded to the correct grant codes. FRLS will be implementing within the next 60 days an update to its cost allocation policies to ensure any future “nonstandard” payroll payments are properly allocated.

Finding 2024-005: U.S. Department of Housing and Urban Development – CFDA #14.155 Mortgage Insurance for the Purchase or Refinance of Existing Multifamily Housing Projects Applicable Federal Award Number and Year – HUD loan under section 207/223(f), HUD Project No. 101-11316 Allowable Costs/ Allowable Activities Name of contact Person: Renee Gallegos, Finance Manager Anticipated completion date: Completed Planned Corrective Action: • Management has updated internal controls to include that all costs charged to the project are for allowable costs.

Contact Person – Krista Martin, Director of Finance and Administration, and Ryan Riesinger, Executive Director Corrective Action Plan – Review and update procedures over payment requests to ensure allowability accuracy. Completion Date –December 31, 2025

U.S. Department of Treasury No. 21.027 – Coronavirus State and Local Fiscal Recovery Funds Grant Period Year Ended December 31, 2024 Corrective Action Plan: In order to ensure future submissions are containing segregation of duties, the organization will ensure there are two people a part of the reporting and submission process. One person will fill out the reporting information and another person will sign off and submit the information to ensure two people are part of the process. Responsible for this plan: Ariel Rodriguez, Executive Director Implementation Timeline: Immediately as of April 22nd, 2025

FINDING NUMBER: 2024-002 Condition: The CMHSP included all contract costs, including amounts over $25,000, in the modified total direct costs. Recommendation: We recommend that the CMHSP review/update policies and procedures to ensure that amounts used to calculate indirect costs charged to the grant properly exclude contract amounts over the allowed limit. Planned Corrective Action: Going forward the Authority will calculate the indirect costs based on up to $25,000 per contract employee. Contact Person: Anthony Shaver, Chief Financial Officer Anticipated Completion Date: 9/30/2025

View of Responsible Officials: The Project agrees and will replenish the replacement reserve account. Responsible Party: Sherri Friedrich Estimated Completion: Funds will be replenished by April 30, 2025

Federal Fund Source liquidation is monitored monthly via the Fund Source Reconciliation Report and the Provider Utilization Report. Requests to close purchase orders associated with expiring federal fund sources are submitted to OPC accordingly. The Federal Financial Reporting Group will now have the right to close purchase orders with federal fund sources to expedite this process. Also, the Provider Utilization Report has been updated with Key Performance Indicators (KPIs), Contract End Date Exceeds Period of Performance and Payments Exceed Period of Performance, that specifically address the period of performance as of December 2024.

Formal internal control processes have been established for the Federal Funding Accountability and Transparency Act (FFATA) reporting, FFATA Preparation and Submission, 17-102. Additionally, FFATA review and approval has been delineated appropriately between the Director of Finance, Grants Manager, and Federal Funds Accountant.

DCH will review MO 598348 within the Gateway system to ensure the established interface process is functioning properly. DCH will draft additional guidance through a policy memo to revise DHS policy 2750 as it relates to the processing of Ex-Parte members. The DCH policy memo will clarify that upon the completion of the determination by DHS, Gateway will notify GAMMIS of A/R's approval or denial thorough daily interface files sent from Gateway to GAMMIS. The non-confirmation report will be reviewed to determine SOP and validate that the file has been received. Additionally, the DCH policy memo will require Gateway to complete the DMA-962 and submit to Gainwell for manual processing if the file has not been received. DCH is also reviewing current policy to determine if the infinity date established for Ex-Parte members can be revised to a time-limited date.

The Department acknowledges that some of the capitation rates in Georgia Medicaid Management Information System (GAMMIS) were inaccurate. The Department has completed the review of all capitation rates in GAMMIS from July 1, 2021. The Department is holding the rates currently in GAMMIS until the Centers for Medicare and Medicaid Services (CMS) approves all the pending rate amendments.

DCH will develop a reconciliation process between members denied within Georgia Gateway and members removed within GAMMIS. DHS will provide training as outlined within the current contract to address changes and updates to Medicaid policy and the Georgia Gateway system.

At the end of the Low Income Home Energy Assistance Program (LIHEAP) season, the State Program Office and other applicable areas such as Grant Administration, Office of Information Technology, etc. (Team) will attend the annual training completed by the Office of Community Services (OCS). The OCS Household Report training is typically scheduled in November of each year. After the training session, the team will discuss any changes to the new Household Report. The State Program Office will contact the Georgia Environmental Finance Authority (GEFA) to request information about their annual household report. The Household Report will be printed from the Online Data Collection (OLDC) system for review, discussion, and completion by the team, usually around the middle of December to finalize the draft report. Upon completion of the review and approval by the necessary areas, the State Program Office will submit the Household Report to OLDC for approval and acceptance.

The Office of Procurement Services (OPS) has dedicated staff that have attended Federal Funding Accountability and Transparency Act (FFATA) training and webinars. In addition, the same dedicated staff will verify that all federal grants with sub-recipients are properly reported. Beginning in FY 2025 (September 2024), the OPS has required programs that receive federal funding to email a PDF copy of the monthly FFATA report submitted in the FFATA Subaward Reporting System (FSRS) to the designated staff no later than the fifth of each month. Currently, the FY25 FFATA Reporting is up to date and the Office of Procurement Services will continue to review and adjust the process through FY 2025 (June 30, 2025).

The monthly student reconciliations for the Direct Loan programs, including the SAS files, have resumed starting with the October 2024 SAS file. These reconciliations will continue on a monthly basis by the financial aid office, as required, and will be conducted without interruption. The reconciliation process will be closely monitored, reviewed, and approved monthly by management to ensure ongoing compliance. The loan processing team has been trained on the SAS file import process and direct loan reconciliation. They have also been provided with the necessary system resources to identify variances between Common Origination and Disbursement (COD) and Banner at the student level. Additionally, the direct loan reconciliation process documentation will undergo continuous review and monitoring by the loan processing team, with oversight from the Director of Student Financial Aid and Scholarships, to ensure accuracy and adherence to established policies with each new academic year. The loan processing team will have annual refresher training at the beginning of each academic year. Confirmation of employees, date of training, and current training process will be documented.