Corrective Action Plans

Management agrees with the finding and is in process of developing and implementing the appropriate policies and procedures. Management expects to present the policies to the board for approval at the May 2025 board meeting.

Southeastern Indiana REMC is aware there were two invoices submitted in error totaling $55,705. The result of this error was an overstatement of the amount eligible for reimbursement. Southeastern Indiana REMC has invoices eligible for reimbursement that were not submitted which offsets these errors. Southeastern Indiana REMC, given these circumstances, does not believe they have requested total funds in excess of eligible costs.

Management concurs with the finding and has agreed to implement the recommended procedures. Management has also: 1) hired a Director of Finance to oversee financial reporting; 2) implemented a monthly grant reconciliation process; 3) implemented segregation of duties so that no single individual will be responsible for preparing reimbursement requests and subsequently submitting them; 4) provided extensive training to staff involved in the grant reimbursement procedures; 5) implemented a centralized grant tracking sheet to monitor billed amounts by category and date that is verified by two staff members; 6) implemented a quarterly internal audit review by a Board of Directors member with any findings reported to the Board of Directors for oversight.

Recommendations: We recommend the Organization implement additional procedures during year-end close out procedures to ensure residual receipt deposits due at year-end are deposited in a timely manner. Management agrees with the recommendations and to adhere to current internal control processes that are in place to ensure the Organization is in compliance with all requirements as it relates to their federal awards.

Add a new staff member to the Federal Funds Office to strengthen segregation of duties. Update and document internal procedures to ensure proper role separation in the drawdown process. Leverage the upcoming implementation of a new ERP system to support workflow automation and enforce segregation. Conduct training to clarify and reinforce individual roles and responsibilities. Introduce periodic internal reviews to verify compliance with segregation protocols.

Transfers and Disbursement process will be reviewed to minimize the time between drawdown and disbursement and comply with Federal regulations. Funds are regularly monitored to ensure that only needed funds for immediate use are drawdown. Drawdowns are initiated when accounting department send the Grant monthly reconciliation to Federal and State Funds Administration Office, Compliance officer reviews the reconciliation and Director of Federal Funds Administration determine needed funds to be requested. A new Enterprise Resource Planning (ERP) software it’s under implementation and will address this issue as part of the implementation process.

Update internal financial aid disbursement policies to require annual and mid-year reviews of Pell Grant schedules. Implement a compliance checklist for verifying disbursement amounts.

Management concurs with the finding. The specific occurrences will be reviewed to determine the cause. In addition, the procedure to facilitate drawdowns after funds have been disbursed will be reemphasized to ensure compliance with the three-business day disbursement rule from the time of drawdown. The Student Financial Aid Office (SFA) will authorize Title IV awards and notify the Bursar and the Grants Account. The Bursar will facilitate disbursement of the funds to the students’ accounts and notify the Grants Accountant once the disbursement has been processed. The Grants accountant will facilitate the drawdown of funds after the funds have been disbursed. This will mitigate the potential recurrence of funds being drawn down prior to being disbursed to students’ accounts resulting in the potential for noncompliance with the three-day window.

Finding: The Department of Children, Youth, and Families did not have adequate internal controls to ensure monthly foster care maintenance payments to children’s caregivers were adequate and accurate for the Foster Care program. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Status: Corrective action complete Corrective Action: The Department is committed to strengthening internal controls and complying with grant requirements. As stated in the finding’s Cause of Condition, the Department did not fully implement the prior year’s corrective action plan during the audit period and did not have the reporting capabilities to track rate setting reviews for the entire audit period. To strengthen internal controls and documentation, and as part of the implementation of the new rate assessment process, the Department took the following corrective actions: • Published a new report in FamLink to assist rate assessors in identifying: o Six-month reviews that have not been performed timely. o Cases with upcoming rate assessments and due dates for reviews. • Implemented monthly tracking by supervisors to assist with internal controls and compliance. The Department continues to use the Plan, Do, Check, Act (continuous quality improvement process) to improve the accuracy of the new reports and provide additional training to staff as needed to ensure compliance with the requirement of performing six-month reviews of the reimbursement rates. The conditions noted in this finding were previously reported in finding 2023-067. Completion Date: June 2024 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Children, Youth, and Families did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Status: Corrective action in progress Corrective Action: The Department is committed to strengthening internal controls and complying with grant requirements. In response to the prior year audit finding, the Department has taken the following actions: • Between April and December 2023: o Filled two vacant contract staff positions dedicated to reviewing child welfare contracts to include family time visit payments. o Developed compliance audit plans for child welfare contracts and began fiscal monitoring of family time visit payments. o Implemented a new process for creating Sprout invoices from family time activity data to include the following:  Utilizing algorithms to identify reimbursements outside of reasonable amounts.  Requiring providers to submit additional documentation or explanation for flagged invoices.  Identifying duplicate billings using a re-run process.  Performing additional review and approval of invoices of the Network Administrator in Eastern Washington prior to release of payment. • Between January and March 2024: o Identified and implemented regional program approvals for Western Washington providers. o Implemented fiscal monitoring controls to ensure payments to providers for travel and family visits are allowable and adequately supported. o Utilized the Plan, Do, Check, Act (continuous quality improvement process) to add additional steps to the process to ensure payments were accurate. In response to the State Auditor’s Office (SAO) recommendations, the Department will: • Reconcile the identified payment exceptions and take appropriate action. • Review the implemented invoice and payment process and update training resources as needed. • Refine the compliance audit plans and update documentation for the contract monitoring process to ensure that SAO can review documentation for monitoring tasks completed. The conditions noted in this finding were previously reported in findings 2023-066, 2022-048, and 2021-040. Completion Date: Estimated July 2025 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Health did not have adequate internal controls over cash management and allowable cost requirements for the Epidemiology and Laboratory Capacity for Infectious Diseases program. Questioned Costs: Assistance Listing # 93.323 93.323 COVID-19 Status: Corrective action in progress Corrective Action: The Department partially agrees with the finding. The Department agrees with the auditors’ assessment of inadequate internal controls to ensure automated draw calculations in the Grant Management System are accurate. The Department is working diligently with the Information Technology (IT) division to identify and correct cash draw report calculation errors until they are resolved. The Department has taken steps to ensure adequate internal controls over cash management and allowable cost requirements for the program, but disagrees with the auditors’ assessment of internal control weaknesses in the following areas: • Daily manual reconciliation - During the audit period, the Department identified a concern with the AFRS Data Distribution Services database reporting criteria. With the IT division’s assistance, the Department was able to identify the cause of the report errors and made corrections within the audit period. • Chart of account updates - The Department initially set up the coding structure based on the Office of Financial Management’s 23-25 biennium Expenditure Authority (EA) schedule. In October 2023, an updated EA schedule was released to correct one EA code. The Department addressed the coding error timely and processed a journal voucher to move recorded expenditures to the correct coding. • Cash Management Improvement Act (CMIA) - The Department spends on a first in, first out method and uses the previous year’s coding for all expenditures that occurred in the allowable period. The Department has controls in place to ensure cash draws are performed in line with the CMIA funding techniques and the payroll cycle. The Department will consult with the grantor to determine whether the questioned costs identified in the finding should be repaid. Completion Date: Estimated July 2025 Agency Contact: Jeff Arbuckle External Audit Manager PO Box 47890 Olympia, WA 98504-7890 (360) 701-0798 Jeff.Arbuckle@doh.wa.gov

Finding: The Department of Health did not have adequate internal controls over cash management and reporting requirements for the Immunization Cooperative Agreements program. Questioned Costs: Assistance Listing # 93.268 93.268 COVID-19 Amount $0 Status: Corrective action in progress Corrective Action: The Department partially agrees with the finding. The Department agrees with the auditors’ assessment of inadequate internal controls to ensure automated draw calculations in the Grant Management System are accurate. The Department is working diligently with the Information Technology (IT) division to identify and correct cash draw report calculation errors until they are resolved. The Department has taken steps to ensure adequate internal controls over cash management and allowable cost requirements for the program, but disagrees with the auditors’ assessment of internal control weaknesses in the following areas: · Daily manual reconciliation - During the audit period, the Department identified a concern with the AFRS Data Distribution Services database reporting criteria. With the IT division’s assistance, the Department was able to identify the cause of the report errors and made corrections within the audit period. · Chart of account updates - The Department initially set up the coding structure based on the Office of Financial Management’s 23-25 biennium Expenditure Authority (EA) schedule. In October 2023, an updated EA schedule was released to correct one EA code. The Department addressed the coding error timely and processed a journal voucher to move recorded expenditures to the correct coding. Completion Date: Estimated July 2025 Agency Contact: Jeff Arbuckle External Audit Manager PO Box 47890 Olympia, WA 98504-7890 (360) 701-0798 Jeff.Arbuckle@doh.wa.gov

Finding: The Department of Commerce did not have adequate internal controls to ensure payments to subrecipients were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Questioned Costs: Assistance Listing # 21.027 COVID-19 Amount $0 Status: Corrective action in progress Corrective Action: The Department maintains that there are effective internal controls over programs that are funded by the Coronavirus State and Local Fiscal Recovery Funds. Due to delayed audit planning and scoping, the auditors were unable to perform procedures to ascertain whether the Department established and followed internal controls to ensure compliance with program requirements. The Department plans to ensure sufficient time and resources are available for all future audits by performing the following steps: • Performing outreach to all federal programs to document internal controls for all applicable compliance requirements before the start of the next single audit cycle. • Working with the State Auditor’s Office earlier in the audit cycle to identify the audit scope for selected programs. • Providing support and guidance to programs selected for audit to ensure compliance with all internal controls and compliance requirements. The conditions noted in this finding were previously reported in findings 2023-027, 2023-028, and 2022-019. Completion Date: Estimated August 2025 Agency Contact: Gena Allen, CFE Internal Control Officer PO Box 42525 Olympia, WA 98504-2525 (360) 480-5149 Gena.Allen@Commerce.wa.gov

Finding: The Housing Finance Commission did not have adequate internal controls over earmarking requirements for the Homeowner Assistance Fund program. Questioned Costs: Assistance Listing # 21.026 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Commission has taken the following corrective actions to strengthen controls over earmarking requirements for the Homeowner Assistance Fund (HAF) program: • Developed a system to track and monitor expenditures in relation to overall program expenditures to ensure earmarking requirements are within allowable parameters. • Selected an increased percentage of approved, denied, and withdrawn HAF applications that have previously been reviewed by the contractor, as part of the Quality Control process, for a secondary review by program staff. • Reviewed a selection of HAF applications independent of the Quality Control process performed by the contractor. • Reviewed a selection of approved HAF applications prior to disbursing funds to confirm eligibility determinations are proper. The conditions noted in this finding were previously reported in finding 2023-023. Completion Date: October 2024 Agency Contact: Lucas Loranger Senior Finance Director 1000 Second Ave, Suite 2700 Seattle, WA 98104-3601 (206) 464-7139 Lucas.Loranger@wshfc.org

Effect and recommendation The Hospital implemented a new accounting and electronic health record (EHR) system in May of 2023 and experienced significant delays in being able to bill and process claims. In addition, there was a cyberattack on the Hospital’s claims processing clearinghouse in February 2024 that took the hospital offline from processing claims. These two events had a negative and material impact on overall operating results as additional accounts receivable allowances for both contractual adjustments and bad debts were necessary at June 30, 2024. The negative impact on overall operations resulted in the Hospital not meeting the required 1.5 debt service coverage ratio and having less than 90 days of cash on hand at June 30, 2024. The Hospital did receive a waiver for from the USDA regarding not meeting these loan covenants for fiscal year 2024. Views of responsible officials and planned corrective actions The implementation of the new electronic health records created a delay in operational workflow processes which required vendor modifications and corrections to the system. This delayed submitting insurance claims for reimbursement continued throughout fiscal year 2024. Operations have now stabilized and the debt service coverage ratio is expected to be in compliance in fiscal year 2025. Hospital management notified its USDA representatives and received a waiver from the required 1.5 debt service coverage ratio and required 90 days of cash on hand for the period ended June 30, 2024. Anticipated completion date Ongoing

2024-003 – 10.558 – Child and Adult Care Food Program –Eligibility Condition Two providers received an improper amount for their meal reimbursement for the month tested. Recommendation Controls should be reviewed and updated to ensure that complete and accurate meal counts are submitted to the State for reimbursement. Comments on the Finding Given the Organization’s limited size, it is not always feasible to fully segregate the duties surrounding the meal claims processes. However, in order to mitigate errors, steps have been taken to implement checks within those processes. Action Taken Whenever possible, an employee other than the Director will prepare the claims. The Director of the Organization will later review the claims for accuracy and compare the claim numbers in both the excel spreadsheet and the Little Organizer program to ensure their correctness.

The RIEMA Recovery staff will conduct an additional review of all projects prior to obligation including both small and large projects. This review will include not only that the state required documentation is included but will also review the FEMA final validation report submitted with the project. We acknowledge the errors which were reported by the State audit review of project number 694201 for federal disaster declaration DR-4505-RI. The agency will contact the Office of Housing and Community Development of the finding and they will be required to reimburse FEMA the unallowable costs. Anticipated Completion Date: RIEMA is implementing this immediately for all project reviews. Contact Person: Lawrence Macedo, Recovery Branch Chief, Rhode Island Emergency Management Agency lawrence.macedo@ema.ri.gov

This audit finding refers to retroactive Medicaid billing from BHDDH for dates of service in 2022 and 2023 once the IMD status was removed from ESH. That provider type currently does not require the Medicare information to be submitted to EOHHS for processing. They bill with a type of bill and if there is eligibility on file for Eleanor Slater, the claim is paid. EOHHS will pursue a project to correct this finding. Project PH0630 - OI Edit for ESH was created and is being worked on by Gainwell and the State. The Project Charter states that the state must have controls in place to ensure that claims from the State Hospital, including Eleanor Slater Hospital (ESH) are reimbursed by Medicaid as the payer of last resort. Meetings, requirements gathering, and business designs are ongoing. The Business Design is anticipated to be completed by end of April 2025. Anticipated Completion Date: To Be Determined Contact Person: Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov

2024-065a: Rhode Island did not participate in the February 2024 PARIS interstate match due to a file issue that has since been addressed in April 2024. The May and August 2024 PARIS matches were suspended at the Federal level for all States due to an outstanding computer matching agreement between the DoD and HHS/ACF. Enhancements to existing PARIS Interstate match logic are scheduled to run as planned for fall/winter 2025. EOHHS completed implementation of an interface on 3/5/24 between The Work Number (TWN) and RI Bridges. Contract and budget actions for TWN services were not completed until fall 2024. The system requirements that Equifax initially communicated to the State and our Integrated Eligibility System implementation partner were incomplete and the original integration configured in fall 2024 did not successfully pass testing. A system modification to correct the original specifications was originally scheduled for February 2025 but was delayed due to the 12/13/24 RI Bridges cyber event. Target date for TWN implementation is July 2025. The Death Match process resumed in Spring 2025. Long-term modifications are scheduled for December 2025. These modifications include connecting RI Bridges to the SSA Death Master File (DMF) and utilizing the data from DMF as the primary source for monthly death verifications. During SFY 2024, several system fixes were deployed to address the findings noted in 2024-065. Specifically, in September 2024, a system fix was put in place to ensure children with verified SSNs were appropriately evaluated for Medicaid/CHIP coverage and excluded from Cover All Kids. The system automatically identifies individuals aging out of Medicaid Expansion prior to their 65th birth month and redetermines eligibility. EOHHS will improve controls of this process and ensure that if the system is unable to accurately remove the member from the Medicaid expansion category, a manual workaround will be implemented. Anticipated Completion Date: January 1, 2026 Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-065b: EOHHS will proactively work with the system vendor and other State agencies to implement controls over eligibility system and process deficiencies. Corrective actions will include, but are not limited to, manual processes, code fixes, and new system enhancements. Anticipated Completion Date: Ongoing Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-065c: EOHHS will identify and return any potential ineligible costs by end of the current Federal Fiscal Year (FFY). Anticipated Completion Date: September 30, 2025 Contact Person: Allison Shartrand, Assistant Director, Financial & Contract Management, Executive Office of Health and Human Services allison.shartrand@ohhs.ri.gov

EOHHS amended and updated its guidelines and standard operating procedures leveraging the CMS ‘Delivering Service in School-Based Settings: A Comprehensive Guide to Medicaid Services and Administrative Claiming’ as a source document. In addition to ensuring alignment with CMS requirements, the updated guidelines include a uniform schedule of quarterly submission dates and details the billing responsibilities of participating LEAs. These responsibilities include meeting all Medicaid documentation requirements; submitting the Certification of Local Funds on a quarterly basis; and signing provider agreements and maintaining all other records used to support claims submitted for Medicaid reimbursement. Upon receipt of these submissions a new audit tool will be utilized to ensure each submissions contains the required documentation. Beginning June 2025, EOHHS will initiate on-site reviews of twenty (20) LEAs using a tiered, randomized sample of claims from State Fiscal Year 2023 (SFY23). The sample will include claims with at least 20 claims per LEA, selected to ensure wide geographic representation. If documentation is missing, incomplete, or found to be in error, the LEA and their billing contractor will be notified and corrective action will be implemented. Lastly, EOHHS is also working in partnership with the CMS School-Based Services Technical Assistance Center to ensure continued alignment with federal expectations and the implementation of national best practices in school-based Medicaid claiming and update guidance. Anticipated Completion Date: Administrative Claiming Materials – June 1, 2024; On-site Audit – June 30, 2025 Contact Persons: Tyler McFeeters, Health Program Administrator, Executive Office of Health and Human Services tyler.mcfeeters@ohhs.ri.gov Mark Kraics, Deputy Medicaid Director, Executive Office of Health and Human Services mark.kraics@ohhs.ri.gov

EOHHS has met expectations on aligning the FSR and FDCR reports, has updated files to Milliman, and continues to monitor compliance. EOHHS is currently in a maintenance phase and will continue monthly oversight going forward. Anticipated Completion Date: Current and Ongoing Contact Person: Steven Corvese, Plan Analyst, Executive Office of Health and Human Services steven.corvese@ohhs.ri.gov

2024-056a: During SFY 2024, several system fixes were deployed to address the findings noted in 2024-056. Specifically, in September 2024, a system fix was put in place to ensure children with verified SSNs were appropriately evaluated for Medicaid/CHIP coverage and excluded from Cover All Kids. RI Bridges appropriately determines eligibility for CHIP when TPL data is not present. Once TPL information is known to the system, existing eligibility rules will only evaluate for Medicaid, not CHIP. The TPL exceptions noted by the OAG show a discrepancy between TPL data in the MMIS and the information sent to RI Bridges via the TPL loopback file. EOHHS will work with their vendor to determine the root cause of the discrepancy and establish a corrective action plan if appropriate. Rhode Island did not participate in the February 2024 PARIS interstate match due to a file issue that has since been addressed in April 2024. The May and August 2024 PARIS matches were suspended at the Federal level for all States due to an outstanding computer matching agreement between the DoD and HHS/ACF. Enhancements to existing PARIS Interstate match logic are scheduled to run as planned for fall/winter 2025. Income/Wage Validation: EOHHS completed implementation of an interface on 3/5/24 between The Work Number (TWN) and RI Bridges. Contract and budget actions for TWN services were not completed until fall 2024. The system requirements that Equifax initially communicated to the State and our Integrated Eligibility System implementation partner were incomplete and the original integration configured in fall 2024 did not successfully pass testing. A system modification to correct the original specifications was originally scheduled for February 2025 but was delayed due to the 12/13/24 RI Bridges cyber event. Target date for TWN implementation is July 2025. Anticipated Completion Date: July 1, 2025 for income/wage validation. Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-056b: The Center for Staff Development and Learning (CSDL) the lead for training at the Rhode Island Department of Human Services (RIDHS) will work towards correction by using a blended approach to learning using formal (classroom or virtual learning sessions) and on the job learning activities. will conduct the following: a. The CSDL Team will continue to include in its Ex Parte Learning Series review of where the system performs an Ex Parte review to determine Medicaid eligibility for age outs ages 19, 26, and 65. In addition, included in the Medicaid Refresher, currently in development, a review will be done of updating income and verification procedures that includes end date and employment segments when household members lost employment. b. The Operations staff supervisors will schedule processing labs that will require the participants to process live cases with guidance from a supervisor. Anticipated Completion Date: The trainings and refresher learnings are ongoing. Processing labs are scheduled as need for this specific topic, we anticipate that processing labs will be scheduled and completed between July – September of 2025. The Medicaid Refresher Learning Series will be released in July. This training will also be ongoing. Contact Person: Zulma Valenzuela, Assistant Director of Administrative Services, Center for Staff Development and Learning, Department of Human Services zulma.valenzuela@dhs.ri.gov 2024-056c: As noted in prior year responses, CMS will not pursue recoveries associated with questioned costs given that recoveries based on eligibility errors can only be pursued when identified by programs operating under CMS’ Payment Error Rate Measurement program per section 1903(u) of the Social Security Act and regulations at 42 CFR Part 431, Subpart Q. This limits CMS’s ability to recover on most of the SSA eligibility findings. While CMS will pursue the internal control deficiencies noted by the SSA, CMS will not pursue recoveries associated with the questioned costs. Anticipated Completion Date: Not Applicable Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov

RIDE is currently evaluating third-party consultants in order to have the following services performed: • A cybersecurity assessment performed of the overall agency using the NIST Framework • A cybersecurity assessment of our internal applications including CNP Connect & Accelegrants • An updated business continuity plan • A Vendor Risk Assessment Program Development Through the above deliverables from the selected consultant, RIDE will be able to have a better understanding of gaps in IT/ Cybersecurity throughout the agency, as well as the applications cited by the Auditor General. Anticipated Completion Date: December 31, 2025 Contact Person: Brandon Bohl, Finance Director, Department of Elementary and Secondary Educationbrandon.bohl@ride.ri.gov

RIDE’s Office of School Health & Wellness will develop a guidance document for LEAs regarding Paid Lunch Equity calculations and send communication at least annually to ensure LEAs have complied with 7 CFR Sec. 210.14(e). Anticipated Completion Date: June 30, 2026 Contact Persons: Brandon Bohl, Finance Director, Department of Elementary and Secondary Education brandon.bohl@ride.ri.gov Rosemary Reilly-Chammat, Director – Office of School Health & Wellness, Department of Elementary and Secondary Education rosemary.reilly-chammat@ride.ri.gov Jennifer Goodwin, School Health Specialist, Department of Elementary and Secondary Education jennifer.goodwin@ride.ri.gov

Procedures are in process of being reviewed and will be completed prior to the issuance of this report. Underlying reports will be updated with the ERP implementation and corrected to capture all data for all programs in the TSA. Anticipated Completion Date: December 31, 2025 Contact Person: Xiomara Soto, Administrator Financial Management & Reporting, Department of Administration, Office of Accounts & Control xiomara.c.soto@doa.ri.gov