Corrective Action Plans

Finding 2024-002: Allocation of Payroll Costs - Significant Deficiency in Internal Control Over Compliance and Instance of Noncompliance – Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services – Medicaid Cluster Response and Corrective Action Plan: Management acknowledges that documentation supporting payroll allocations for PATH CITED-related activities did not fully align with Uniform Guidance expectations for federal awards. However, similar to Finding 2024-001, the Organization was not aware that PATH CITED funding constituted federal assistance during FY2024 due to the absence of federal identifiers in grant documentation and related communications from DHCS. As such, payroll costs were managed under the Organization’s standard operational practices rather than federal compliance-specific requirements. The Organization applied a reasonable and consistent allocation methodology based on supervisory oversight and expected levels of effort, which management believes appropriately reflected the work performed, given the nature of the program at that time. Upon confirmation of the federal nature of the funding, management will take the following corrective actions which includes enhancing a time attestation/time studies process for personnel working on federal awards and strengthening policies requiring periodic after-the-fact review of payroll allocations and documentation retention requirements for supervisory approvals. Anticipated Completion Date: by June 30, 2026 Responsible Person: Virginia Lui VP, Controller

Planned Corrective Action: The Division will implement their control of ensuring that they only charge allowable costs incurred during the approved budget period of a federal award’s period of performance or will obtain authorization from the grantor for any costs incurred before the grant's approved budget period. Anticipated Completion Date: 9/30/2026 Responsible Contact Person: Al Agpoon, Golden State Division Controller

Planned Corrective Action: The Division will design and implement a precise control to ensure that the amount of food distributed is properly reviewed and that the Division maintains such evidence. Anticipated Completion Date: 9/30/2026 Responsible Contact Person: Al Agpoon, Golden State Division Controller

VIDCOE will establish and document capitalization thresholds and procedures for identifying, recording, and depreciating capital assets, including maintaining a fixed asset register with periodic reconciliations. Procedures will also be implemented to ensure prepaid expenses are recorded appropriately and amortized over the periods benefited. In addition, grant accounting policies will be strengthened to ensure that funds received in advance are recorded as refundable advances and recognized as revenue only as allowable expenditures are incurred, in compliance with grant agreements and federal requirements. To further strengthen internal controls, VIDCOE will implement formal supervisory review and reconciliation procedures, including routine account reconciliations and financial statement reviews, to ensure transactions are properly classified, supported, and recorded. VIDCOEs’ Management expects to fully implement all corrective actions by July 30, 2026.

Finding No.: 2024-053 Special Test and Provisions – Project Accounting Responding Agency: Guam Homeland Security (GHS) Responsible Personnel: Esther Aguigui, Director GHS will create a Standard Operating Procedure (SOP) to establish internal policies and procedures in compliance with applicable special tests and provision requirements. GHS will also identify department personnel responsible.

Finding No.: 2024-051 Period of Performance Responding Agency: Guam Homeland Security (GHS) Responsible Personnel: Esther Aguigui, Director GHS will create a Standard Operating Procedure (SOP) to establish internal policies and procedures over compliance with applicable period of Performance requirements, as well as retention of all grant agreements. GHS will also identify department personnel responsible.

Finding No.: 2024-049 Activities Allowed or Unallowed: Allowable Costs/Cost Principles Responding Agency: Guam Homeland Security (GHS) Responsible Personnel: Esther Aguigui, Director Guam Homeland Security (GHS) will make sure that proper supporting documentation is available. GHS will also identify department personnel responsible.

Finding No.: 2024-046 Period of Performance Responding Agency: Department of Public Health and Social Services (DPHSS) Responsible Personnel: Theresa Arriola, Director DPHSS disagrees with this finding and provided documentation of grantor approval to use the FY 2024 award to pay prior year obligations. The enclosed communication from Linda Gee, CMS, dated July 1, 2021, provides more information. 45 CFR 95.7 (https://www.ecfr.gov/cgi-bin/text-idx?node=pt45.1.95&rgn=div5#se45.1.95_17) provides that a state Medicaid agency (i.e. Guam Medicaid Agency) has up to two years to file for a claim that it made. DPHSS welcomes the opportunity to discuss and collaboratively identify the relevant information and guidance during an entrance conference for each year’s audit.

Finding No.: 2024-040 Activities Allowed or Unallowed: Allowable Costs/Cost Principles Responding Agency: Department of Public Health and Social Services (DPHSS) Responsible Personnel: Theresa Arriola, Director The Bureau of Child Care Services (BCCS) disagrees with this finding. The questioned transactions relate to a major system migration from the AS400 to the D365 system, which temporarily impacted the traceability of certain records. During this transition, some data identifiers were reformatted to fit the new system's structure. However, this was a synchronization issue rather than a lack of oversight, and BCCS maintains that all costs are allowable, necessary, and reasonable under CCDF requirements. Supporting documents exist and were provided after a subsequent request on February 9, 2026, via One Drive link.

Finding No.: 2024-038 Period of Performance Responding Agency: Department of Public Health and Social Services (DPHSS) Responsible Personnel: Theresa Arriola, Director DPHSS ELC Program disagrees with the findings. Condition 1: The questioned labor costs of $16,668 align with payment of Core funded staff during that approved budget period for BP01. The PPE coincides with two draws for the ending and beginning of those fiscal years. Supporting documents were submitted twice, once on February 9, 2026, and February 20, 2026, including the Notice of Award (NOA) for this grant with issue date of July 9, 2024. Condition 2: The question of compliance with period of performance was justified through supporting documentations as reflected in the NOAs and extensions of NOAs which were provided twice February 9, 20206 and February 23, 2026. Program also noted that core funds have expanded authority to be utilized in subsequent budget periods throughout the 5-year cycle of the Cooperative Agreement. Upon auditor’s review, a correspondence email noted that the documents were received and findings were removed for all but on expense. Although all supporting NOAs were submitted for every expenditure amount, a follow up email with the last NOA for 6NU50CK000561-05-00 was provided again as an attachment.

Finding No.: 2024-035 Program Income Responding Agency: Guam Environmental Protection Agency (GEPA) Responsible Personnel: Michelle Lastimoza, Director Guam EPA has implemented processes relevant to the monitoring and reconciliation of program income. As part of our Correction Action for the FY2023 audit, which is a repeat finding in FY2024, Guam EPA is attaching a sample report of all program income collected through the Transaction Processing System (TPS) to include external payments received by DOA. Also, variances not captured by this report, consisting of payments/transactions submitted directly to DOA via electronic method of payments, are being reconciled by our staff and DOA.

Finding No.: 2024-034 Period of Performance Responding Agency: Guam Environmental Protection Agency (GEPA) Responsible Personnel: Michelle Lastimoza, Director Request to DOA will require immediate collaboration between Guam EPA and DOA to gather, reconcile, and provide all supporting documentation to support compliance with the period of performance in question.

Finding No.: 2024-032 Activities Allowed or Unallowed: Allowable Costs/Cost Principles Responding Agency: Guam Environmental Protection Agency (GEPA) Responsible Personnel: Michelle Lastimoza, Director Request to DOA will require immediate collaboration between Guam EPA and DOA to gather, reconcile, and provide all documentation supporting compliance of allowable costs incurred during the federal award period of performance as specified in the terms and conditions of the federal award or in the approved extension.

Finding No.: 2024-025 Activities Allowed or Unallowed: Allowable Costs/Cost Principles Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director The Agency disagrees with this finding. Please refer to a letter dated March 31, 2026, regarding Reports on Compliance September 30, 2024.

Finding No.: 2024-021 Activities Allowed or Unallowed: Allowable Costs/Cost Principles Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director The Agency disagrees with this finding. Please refer to a letter dated March 31, 2026, regarding Reports on Compliance September 30, 2024.

Finding No.: 2024-018 Eligibility Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director The Agency is reviewing the management of Federal Grants to ensure robust handover and succession plans are in place for future programs. The sudden passing of the ERA Program Coordinator directly impacted overall management of the program.

Finding No.: 2024-013 Allowable Costs/Cost Principles: Procurement, Suspension, and Debarment Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director Agency disagrees with 2 out of the 3 findings. • Condition 1 regarding the Authorization To Proceed (ATP), as per the Grant and Cooperative Agreement and the Grant Terms and Conditions, it did not state that an ATP is required to begin work on the grant for D20AP00048 and D21AP10145.The Government complies with ATP requirements for grants which mandate such compliance. If the grant is silent, no ATP is required.. • Condition 2 GSA will continue to verify vendor eligibility through SAM.gov prior to contract award. Documentation of the verification will be retained in the procurement file for each transaction. • Condition 3 The necessary controls will be strengthened when the updated Federal Grant module is fully implemented.

Finding No.: 2024-011 Period of Performance Responding Agency: Department of Public Health and Social Services (DPHSS) Responsible Personnel: Theresa Arriola, Director (DPHSS) The DPHSS WIC Program disagrees with the findings. All supporting documents related to the findings were provided promptly on March 3,2026 when request was received on February 26,2026. In accordance with WIC FY 2024 Closeout Guidance and the requirements under 2 CFR 200.344, the WIC Program is allowed 90 days after the end of the period of performance to submit all final financial reports, as well as 90 days to liquidate all obligations incurred during the period of performance. For FY 2024, the closeout timeline required that all obligations be liquidated no later than January 31, 2025. The program adhered to these federal requirements. All obligations were liquidated prior to the close of the fiscal year grant, and obligations were reported in the fiscal year in which they occurred, consistent with 7 CFR 246.17. Furthermore, the final closeout report was submitted within 120 days after the end of the fiscal year, fully complying with WIC closeout procedures. Based on the timely submission of all supporting documentation and adherence to federal closeout regulations, the DPHSS WIC Program maintains that the questioned costs were appropriately obligated, liquidated, and reported.

93.767 Children's Health Insurance Program (CHIP) 93.778 Medical Assistance Program (Medicaid; Title XIX) 2024-023 Strengthen Controls to Ensure Compliance with Provider Eligibility Requirements of CHIP and the Medical Assistance Program DOM Response: Two instances of no documentation that required fee were collected. DOM Partially Concurs. After a review of the 2 files, DOM has found in one instance an application fee was collected and sent to DOM for processing; however, the receipt of the application fee was not indicated by comments in the system. DOM will work with Gainwell to ensure remedial training is conducted to reduce errors in the future. One (1) instance correlates to an application received before DOM began requiring the fee on October I, 2022. Thirty-eight instances of no documentation that provider's medical license was current and free of limitations. DOM Partially Concurs. After a review of the 38 files, DOM has found in thirty-one (31) instances the license from the board was attached and the checklist completed after the license was not verified by LexisNexis . Two (2) instances were applications approved prior to the Gainwell implementation; however, the licenses remain valid in SFY 2024 and reflect correct effective dates in the system. One (1) instance is a group and does not require license. Four (4) instances the license from the board was manually verified and attached after the license was not verified by LexisNexis; however, there were typographical errors or omissions in the license fields in the system. DOM will ensure Gainwell conducts remedial training to mitigate these errors in the future. Thirty-one instances of no documentation of review prior to approval of provider's application. DOM Does Not Concur. After a review of the 31 files, DOM has verified all applications identified within this finding as being approved by DOM without review have documented comments in the system of record to show a review of each application was conducted prior to approval. This would include Fifteen (15) instances with review notes, requests for missing information (if applicable), etc. entered by reviewers since the Gainwell Go-Live. Sixteen (16) instances with review notes, requests for missing information (if applicable), etc. entered by reviewers prior to the Gainwell Go-Live. Ten instances of no documentation of verified identity and exclusion status of providers using required federal databases prior to application approval. DOM Partially Concurs. After a review of the 10 files, DOM has found in five (5) instances the LexisNexis report indicated the NPI was verified. One (I) instance of the NPI not verified by LexisNexis, but the Gainwell Analyst performed a manual search in NPPES and attached the verification results on 11/14/24. Four (4) instances before Gainwell began processing applications. The provider was sent to Digital Harbor for screening. DOM's contractual relationship with Digital Harbor ended in 2016 and the data is no longer available. Agency began revalidation in 2017 by stratifying all providers; however, due to PHE all revalidations were paused. As a result, not all revalidations have been completed. At this time, revalidation dates have been assigned in alignment with CMS guidance and will be completed within CMS required timelines, i.e. 44 months from end of the PHE. One (I) instance has a note indicating revalidation occurred in 2017, but no documentation can be located in the system, which potentially could be attributed to data conversion from the legacy system to the new system. Four instances of no documentation of OIG exclusion checks prior to application approval. DOM Concurs. After a review of the 4 files, DOM has found in three (3) instances contain a comment within EDMS that verifies the providers were sent to Digital Harbor for screening. DOM's contractual relationship with Digital Harbor ended in 2016 and the data is no longer available. Please note: Agency began revalidation in 2017 by stratifying all providers, however due to PHE all revalidations were paused. As a result, not all revalidations have been completed. At this time, revalidation dates have been assigned in alignment with CMS guidance and will be completed within CMS required timelines, i.e., 44 months from end of the PHE. One (1) instance has a note indicating revalidation occurred in 2017, but no documentation can be located in the system, which potentially could be attributed to data conversion from the legacy system to the new system. Two instances of no documentation of collection of the provider's NPI. DOM Concurs. After a review of the 2 files, DOM has found all instances contain a comment within the system which verifies the provider was sent to Digital Harbor for screening. DOM's contractual relationship with Digital Harbor ended in 2016 and the data is no longer available. Eight instances of missing or incomplete documentation of required disclosure details. DOM Partially Concurs. After a review of the 8 files, DOM has found in two (2) instances where the individual provider's date of birth is in the system. Two (2) instances where the individual provider's date of birth is not available as it was not a required element at the time of application. DOM will ensure the date of birth is obtained from the provider and added to the system. Three (3) instances where the organizational provider has all required elements. One (1) instance where the organizational provider's address is not available as it was not a required element at the time of application. The missing data is now required and will be collected at the next revalidation. Four instances of no documentation required screening procedures in accordance with provider's designated risk level. DOM Partially Concurs. After a review of the 4 files, DOM has found in three (3) instances where the individual provider's file contains a comment within EDMS verifies provider was sent to Digital Harbor for screening. DOM's contractual relationship with Digital Harbor ended in 2016 and the data is no longer available. Please note: Agency began revalidation in 2017 by stratifying all providers, however due to PHE all revalidations were paused. As a result, not all revalidations have been completed. At this time, revalidation dates have been assigned in alignment with CMS guidance and will be completed within CMS required timelines, i.e., 44 months from end of the PHE. One ( l) instance the individual provider was screened, and a site visit was conducted (as this provider type was deemed moderate risk at that time) and the documentation is available in the system. DOM Corrective Action Plan: a. In response to the audit findings, the Division of Medicaid (DOM) will collaborate with its Fiscal Agent, Gainwell Technologies, to review all identified issues and implement corrective measures. As part of this effort, mandatory refresher and remedial training will be conducted for Gainwell Provider Enrollment staff. This training will emphasize the requirement for comprehensive and accurate documentation within provider files, including clear, detailed, and supportive comments that fully reflect all actions taken during the enrollment and maintenance processes. Additionally, DOM will implement enhanced oversight and quality assurance monitoring to ensure sustained compliance with documentation standards. DOM notes that certain discrepancies identified in the audit may predate the implementation of the MESA system and the transition to Gainwell Technologies as the Fiscal Agent. Due to system conversion constraints, data limitations, and the absence of complete historical documentation within the current system, DOM's ability to retrospectively validate or remediate these pre-implementation discrepancies is limited. As such, corrective actions will be applied prospectively, with a focus on ensuring accuracy, completeness, and compliance within the current MESA environment moving forward. b. Bill Hardin c. March 31, 2026

Rndlng 2024-017: Spedal Tests and Provisions Significant Defldency In Internal Control over Compliance Crit eria: Per 45 CFR 1356.2l (ml(l ), in meeting the requirements of section 47l(a)(ll) of the Act, the tilie IV·E agency must review at reasonable, specifi c, tim e-limi tedperiods, to be established by the agency, the amount of the payments made for foster care maint enance to assure their continued appropriateness , and that the amount made to a licensed or approved relative or kinship foster famil y home is the same as th e amount that would have been made if the child was placed in a licensed or appr oved non-relative foster family home. Based on the Olicia Y. Lawsuit' s Mi ssissippi Sett.lem ent Agreement and Reform Plan, MOCPS is requ ired to review and publi sh u pdated! foster boardpayment rates every two years. Per 45 CFR 75.303(a), non-Federal entities expending HHS awards must establish and maintain effective internal contro ls over comp liance with Federal states, regulations, and the terms and conditions of the Federal award. Condit ion: Our audit procedures over foster care board payments disclosed that the approved payment board rates were unattai nable . The rates had not been updated from the rate approved in 2019 and no documentation could be provided for the required biannual review. Furt her, therate applied for children aged 0- 8 were not the most recent approved rates resulting in underpayments to foster families. Perspective: Below are the exceptions noted in our testing of foster care board payments for proper allocation of the rates and their approval. The samples were not statistically valid. • One of tenrate categories did not have the proper rateappliedbased on provided board rates resulting in twenty-six of forty sample payment Items being underpaid. • MDCPS did not maintain adequate documentation for the required rate review. Personnel Responsible for Corrective Action: Name: A/asha King Title: Grants Accounting Team Lead Email: Aiasha.King@mdcps.ms.gov Phone Number: 601-359-4016 Co rr ective Acti on Plan: Prior to lhe Single Audit, MDCPS im plemented the Foster Board Payment Review Standard Operating Proce dure (2.15.9.1) to ensure payment rates are verified and approved prior to issuan ce. Annual reviews of board payment rates will be conducted to ensure alignment with approved rates. Antldpatecl Completion Date: Completed as of March 19, 2026.

Finding 2024- 015: Allowable Costs/ Cost Principle Signifi cant Deficiency In Internal Contro l Over Compliance Criteria: Per 45 CFR 1355.57(d), a title N·E agency must allocate project costs in accordance with applicab le HHS regulations and other guidance. Per 45 CFR 75.303(a), non-Federal entities expending HHS awards must establish and maintain effective internal con trols over compliance with Federal sta tes, regu lations, and the terms and conditionsof the Federal award. Condition: Our audit procedures over administrative services disclosed that MDCPS lacked proper policies and procedures over data editing or modification of the cost allocation system. Perspe ctive: Per discussion with management, it was determined that no formal policies and procedures were established for data editing or modifications. Personnel Responsible for Corrective Action : Name: Christopher Roy Title : Deputy Director to the CFO Email: Christopher.Roy@mdcps.ms.gov Phone Number: 601-359-4043 Corrective Action Plan: MDCPS Is strengthening segregation of duties within the Cap Plus system by limiting administrative privileges and ensuring supervisory approval is documented for all cost allocation changes. AntJdpated Completion Date: Permissions were corrected and completed as of March 31, 2026. Documented process and policy anticipated completed May 30, 2026.

Finding 2024 - 014: Allowable Costs/ Cost Prlnclple Significant Defldency In Internal Control Over Compliance Criteria: Per 45 CFR 1355.57(d), a title IV-E agency must allocate project costs in accordance with applicable HHS regulati ons and other guidance. Per 45 CFR 75.303(a), non-Federal entities expending HHS awards must establish and maintain effective internal controls over compliance with Federal states, regulations, and the terms and conditions of the Federal award. Condition: Our audit procedures over administrative services disclosed that MDCPS lacked proper controls over employee training costs expended through a specific vendor. Perspective: Below are the exceptions noted in our testing of administrat ive services for appropriate review over cost allocation . The samples were not stat ist ically valid. One hundred percent of the costs charged for employeetraining using a specific vendor (four transactions) were te.ste d, and four out of four transactions lacked appro priate review. Personnel Responsible for Corrective Action: Name: Christopher Ray Title : Depuly to 1he Chief Financial Officer Email: christoher.Roy@mdcps.ms.gov Phone Number: 601-359-4043 Corrective Action Plan: MDCPS will enforce our policy requiring approval of the grant management's team's review of appropriate detailed documentation provided by vendor payments. Antldpated Completion Date: Completed as of March 31, 2026.

Finding 2024- 013: Terminated User Access Not Removed Timely Significant Deficiency In Internal Control Over Financial Reporting Criteria: Per 45 CFR 75.303(a), non-Federal entitles expendingHHS awards must establish and maintain effective internal controls over compliance with Federal states, regulati ons, and the terms and conditions of the Federal award. Management must mainta in effective user access controls over financia l reporting systems. This Includes promptly removing or disabling access for terminated users and periodically reviewing user access to confirm it aligns with current employment status and job responsibilities. Condition: Testing of IT general controls identifiedinstances where terminated employees' user accounts or financial application access remained active beyond the termination date. MDCPS did not disable terminated user access or remove related application rights in a timely manner. Perspective: During our review of general IT controls, the auditor received a list of terminated employees. Of the 11 employees presented, 6 maintainedaccess to MACWIS after termination.Further, during the performance of a process walkthrough,it was noted that the former chief financial officer was still active in CapPlus and SPHARS. Personnel Responsiblefor Corrective Action: Nome: Shannon Rushton (Employee Seporotlon SOP) Title : Deputy Commissionerof Human Capitol Email: Shannon.Rushton@mdcps.ms.gov Phone Number: 601-359-2696 Name: Christopher Ray (CapPlus User Termination) Title: Deputy Director to the CFO Email: Christopher.Roy@mdcps.ms.gov Phone Number: 601-359-4043 Corrective Action Plan: MDCPS has reinforcedthe EmployeeSeparation St andard Operating Procedure(2.19.2.2) to ensure all system access is removed promptly upon employee separation. Human Resources will notify system administrators immedai tely upon employeetermination, and system administrators will disable all associated application access no later than th e employee's final day of employment. Human Resources will conduct periodic user access reviews to ensure procedures are properly Imp lemented. The Finance Division will ensure the cap Plus software's access and penn1ss1ons are monitored and maintained by the agency with assistance from Interactive Voice Application (IVA). Upon a Cap Plus user's termination , they will be removed from the Cap Plu s software upon their last day of employment or the removal of th eir dutie.s by the agency. These permissions do not require IT or Human Resource control as Cap Plus i s independent of all accounting, payroll, and HR software. Antldpated Completion Date: Empl oyee Separation SOP effectiveas of July 22, 2025. CapP lus user's termination procedures effective as of March 31, 2026.

The Department should reevaluate its current process, implement proper controls, and perform additional training over time and effort reporting. The Department of Health should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Response: The Department concurs with the finding and the need for a proper method of time recording for accurate time and effort reporting. Prior to the conclusion of the audit, the agency created an internal review group to assess the need for an efficient time keeping system to be utilized throughout the agency to allow for uniformity and accuracy. Corrective Action: The Department will continue to move forward with the implementation of the new time keeping system which allows for proper time and leave collection for documentation and allocation of employee time. In the system, the employee time will be recorded and approved by supervisory personnel for accuracy prior to submission payroll processing. The system will allow documentation to be assessed when needed. Name of contact person responsible for the corrective action: Lucreta Tribune Anticipated date for completion of corrective action: July 1, 2026

The Department should reevaluate its current process, implement proper controls, and perform additional training over time and effort reporting. The Department of Health should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Response: The Department concurs with the finding and the need for a proper method of time recording for accurate time and effort reporting. Prior to the conclusion of the audit, the agency created an internal review group to assess the need for an efficient time keeping system to be utilized throughout the agency to allow for uniformity and accuracy. Corrective Action: The Department will continue to move forward with the implementation of the new acquired time keeping system which allows for proper time and leave collection for documentation and allocation of employee time. In the system, the employee time will be recorded and approved by supervisory personnel for accuracy prior to submission payroll processing. The system will allow documentation to be assessed when needed. Name of contact person for the corrective action: Lucreta Tribune Anticipated date for completion of corrective action: July 1, 2026.