Corrective Action Plans

Corrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Section III - Federal Award Findings and Questioned Costs (continued) Corrective Actions for findings 2023-005, 2023-006, 2023-007, 2023-008, annd 2023-009 also apply to the State Award findings. Finding: 2023-008 Section IV- State Award Findings and Questioned Costs Finding: 2023-009 The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Household composition (MA-3306), MAGI Budgeting (MA-3306), and Income Calculations (MA-3300). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Inaccurate Resources Entry Nia Broadway, Medicaid Manager The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Financial Resources (MA-2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Untimely Review of SSI Terminations Nia Broadway, Medicaid Manager The County County Met with all MAGI and Adult Medicaid Staff to discuss and review untimely review of SSI terminations finding, including policies for SSI Ex Parte Reviews (MA2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews

Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Corrective Action: Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Corrective Action: Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Inadequate Request for Information The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for 12 and 30 day documentation (MA-2230), Financial Resources (MA- 3306). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Finding: 2023-005 Finding: 2023-006 IV-D Non-Cooperation Training completed 5/1/2024. County will continue Second Party Reviews. Finding: 2023-007 Finding: 2023-004 The County experienced a ransomware attack in May 2021 which significantly impacted all systems maintained and supported by the County. Electronic supporting documentation and work sheets were lost which impacted the ability to report information to ensure the audit was completed on time. In review of our current status, the administration estimates to complete the FY 24 audit on time by 10/31/24. October 31, 2024 Section III - Federal Award Findings and Questioned Costs The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Medicaid Unwinding Instructions on Case Handling. The County will continue Second Party Reviews and conduct trainings based on findings. Inaccurate Information EntryCorrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Section III - Federal Award Findings and Questioned Costs (continued) Corrective Actions for findings 2023-005, 2023-006, 2023-007, 2023-008, annd 2023-009 also apply to the State Award findings. Finding: 2023-008 Section IV- State Award Findings and Questioned Costs Finding: 2023-009 The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Household composition (MA-3306), MAGI Budgeting (MA-3306), and Income Calculations (MA-3300). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Inaccurate Resources Entry Nia Broadway, Medicaid Manager The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Financial Resources (MA-2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Untimely Review of SSI Terminations Nia Broadway, Medicaid Manager The County County Met with all MAGI and Adult Medicaid Staff to discuss and review untimely review of SSI terminations finding, including policies for SSI Ex Parte Reviews (MA2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews

Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Corrective Action: Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Corrective Action: Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Inadequate Request for Information The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for 12 and 30 day documentation (MA-2230), Financial Resources (MA- 3306). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Finding: 2023-005 Finding: 2023-006 IV-D Non-Cooperation Training completed 5/1/2024. County will continue Second Party Reviews. Finding: 2023-007 Finding: 2023-004 The County experienced a ransomware attack in May 2021 which significantly impacted all systems maintained and supported by the County. Electronic supporting documentation and work sheets were lost which impacted the ability to report information to ensure the audit was completed on time. In review of our current status, the administration estimates to complete the FY 24 audit on time by 10/31/24. October 31, 2024 Section III - Federal Award Findings and Questioned Costs The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Medicaid Unwinding Instructions on Case Handling. The County will continue Second Party Reviews and conduct trainings based on findings. Inaccurate Information Entry

Name of Responsible Individual: Dylan Nowakowski, Assistant Director of Financial Aid Corrective Action: There is no documentation available to indicate that a professional judgement was completed at the time of the incident cited. Wheeling did not have access to any documentation such as log notes, documents, or contact records of any kind. The DPT program budgets differ in amount for first- and second-year attendance. It is known that at this time, the first-year budget was not available, and some student budgets were not separated and entered correctly for first- and second-year cost of attendance. A Financial Aid Office policy has been established to ensure that proper documentation and records maintenance is achieved. Staff enter detailed log notes regarding student contact and results of those contacts. A Budget Adjustment form has been created for students to present to the office if they request a cost of attendance and budget increase. These forms are scanned into the individual student file and is easily obtained for future use when and if necessary. Each DPT budget year has been incorporated into a spread sheet format. Any change to a budget item is input into the sheet and the system will auto calculate a new or different budget amount. These new numbers and the updated COA (cost of attendance) are inserted into the colleague system and is a permanent, easily retrievable record. Anticipated Completion Date: July 2023.

Procurement Recommendation: We recommend that the Organization follow the current policies and procedures over covered transactions and to maintain supporting documentation of the process. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Society has reviewed the procurement policy with staff, emphasized the importance of following, and will ensure that adequate documentation is retained. Name(s) of the contact person(s) responsible for corrective action: Kelly Moritz, Vice President of Finance and Contracts Planned completion date for corrective action plan: December 31, 2024

In order to address this audit finding, CMN financial aid staff plans to seek continual improvement in the areas relating to Pell calculations. Through both Federal Student Aid and National Association of Financial Aid Administrators (NASFAA), staff will complete trainings to understand all aspects of calculating awards, as well as staying up to date on regulatory changes through our student information system. In addition to more training in this area, priority will be placed on rechecking and auditing Pell awards so that they are reviewed during the award year. Staff has already begun reviewing fall 2023 Pell awards for accuracy and will continue to review awards as terms move forward.

Internal Control over Compliance (Repeat Finding 2022-001, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu Responses UNR agrees with the findings • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; The technical staff can only have the PeopleSoft Administrator (PSA) role in either development or production, but not both. There is an approval process in place to ensure that access is removed from either development or production when a PSA needs to be moved across to the other environment. This process became effective March 1, 2023. There is a quarterly security review of the PeopleSoft Administrator role in PeopleSoft. The first quarterly review was performed in FY16 Q1 and has been performed each quarter since. The reviews are documented and approved. There is a quarterly security review of the PeopleSoft Administrator activities in PeopleSoft. The first quarterly review was performed in FY22 Q4 and has been performed each quarter since. The reviews are documented and approved. There is a quarterly security review of the PeopleSoft Oracle database and user access. The first quarterly review was performed in FY20 Q2 and has been performed each quarter since. The reviews are documented and approved. • How compliance and performance will be measured and documented for future audit, management and performance review. Compliance and performance can be measured by the documented quarterly reviews. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The PeopleSoft Manager will be responsible for ensuring the corrective actions plans are implemented and followed. The Vice President of Information Technology will be accountable for the department’s compliance. UNLV agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; UNLV understands the importance of adequate segregation of duties within the PeopleSoft environments and applications. The PeopleSoft Administrator (PSA) position that is the subject of the finding is responsible for the installation, configuration, upgrades, and troubleshooting of all the application environments. The PeopleSoft Administrators are not programmers/developers, and their access to the production environments is periodically required to perform the needed activities required to provide timely support of the application within the scope of their job duties. UNLV has implemented the following controls to mitigate the risks associated with the elevated access required for the administrators to perform their required support activities. 1. UNLV has removed all persistent assignment of the PeopleSoft Administrator role from all PSAs in all environments. 2. The PeopleSoft Administrator role is temporarily assigned only when elevated actions are required. All assignments are of a limited duration and include a justification detailing the need and actions to be performed. All assignments trigger the follow actions: a. An immediate notification to the Director of Business Continuity & Resiliency and the Interim Senior Associate Vice Provost for Digital Strategy and Transformation. b. Removal is automatic but can be initiated by PSA if work is completed sooner than expected. c. All details around the assignment are captured in a tracking table. d. A review of all assignments and activities is performed monthly. 3. UNLV will continue to review access, activities, and assigned privileges monthly for the PeopleSoft Administrators. 4. UNLV will continue researching and implementing other control methods that may strengthen the segregation of duties or the monitoring capabilities that are available. • How compliance and performance will be measured and documented for future audit, management and performance review. The PeopleSoft Administrator role is no longer persistently assigned to the PSA position. It is only assigned upon request with the knowledge and approval of approving authorities. UNLV performs monthly reviews of the access and activities to determine if the PeopleSoft Administrators' activities align with the necessary support. Additionally, UNLV will continue to research other control methods that will address the segregation of duties while providing appropriate service and support. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The Director of Business Continuity & Resiliency will be responsible for performing the activity reviews and access needs of the PeopleSoft Administrators. The Director will complete the reviews and is also accountable if repeat or similar observations are noted. The Chief Information Security Officer will verify that reviews are conducted on a monthly basis per audit practices. SCS agrees with the findings • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; In addition to the compensating controls (a) to (d), that have been operating since prior to FY23 the segregation of PeopleSoft Administrators (PSA) is enforced through a “locked account” process. Only two employees have PSA access in both the Production and Development environment. Each employee can only have access to the Production or Development environment at any one time, i.e., the PSA account in the other environment remains locked. A JIRA ticket must be opened for an account to be unlocked. The request is approved by management and the account is unlocked by a member of the IT Security Team. The controls listed below should also mitigate the segregation of duties risk and support a review of “user activities” in the absence of an appropriate user activities audit log function. (a) STAT for PeopleSoft – Code control and internal modification tracking provides visibility over PSA activities that are processed via this tool. These object changes are reviewed and approved by the Director of Information and Application Services. (b) JIRA ‐ Change control management and project tracking software. Change requests and projects related to the PeopleSoft shared instance are tracked and approved. This would include user access modifications and system updates for example. (c) Security e‐mail alerts – The SCS security team are alerted via automated e‐mails when key events are triggered. For example, an elevated role is assigned to a user. (d) User Access Reviews – On an annual basis an independent user access review is performed incorporating SCS/SA privileged users and all shared instance security coordinators. • How compliance and performance will be measured and documented for future audit, management and performance review. The PeopleSoft Administrators will have persistent unlocked access to either the Production or Development environments only. Their corresponding account in the other environment will remain locked. In the event that access is needed to the locked environment, a ticket will be created requesting access which will document the rationale and approvals. In addition, PSA activities are monitored via the change control process through STAT for PeopleSoft. Object changes within the Production environment for example, are approved along with the associated workflows. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The SCS Director of Information and Application Services, and SCS Security Group are responsible for locking/unlocking PSA accounts. The SCS Security Group monitor PeopleSoft e-mail alerts. The IT Audit Manager is performing annual SCS/SA privileged user access reviews.

Finding Number: 2023-004 Condition: We were not able to verify that the U.S. citizenship for six of the 14 participants tested for the Talent Search program as management did not retain support for eligibility determination. Planned Corrective Action: Management concurs with the recommendation and will implement the proper internal controls to ensure all applications are complete and accurate. This is being accomplished by building out the internal accounting department, which includes adding a grants director to the team. Contact person responsible for corrective action: Brian Fredericks, Interim CFO Anticipated Completion Date: July 1, 2024

4. Finding 2023-003 – Major Federal Award Programs Audit c. Comments on the Finding and Recommendation We concur with the auditors finding as follows: In connection with our lease files review we noted the following deficiencies: • 1 out of 1 move-outs tested did not have the inspection signed by the tenant or an employee at the property. • 1 out of 1 move-outs tested did not have the inspection dated by an employee at the property. • 1 out of 1 move-ins tests did not have the tenant’s Enterprise Verification Form (“EIV”) performed timely within the 90 days HUD requires. d. Action(s) Taken or Planned on the Finding Management Agent Management has hired a new Compliance Manager and engaged a 3rd party compliance monitoring company to review all files and EIV processes effective 5/1/2024. Regards Kimalee Williams

Conduct physical review of each client application (and/or scanned and emailed applications). Increase training on procedural regulations to front-line and supervisory staff in counties outside Dickinson and Iron. Implement quality control verification checks regularly at counties outside of Dickinson and Iron. Person(s) Responsible: Christina Ureta, CSFP/TEFAP Director Timing for Implementation: Immediately

Management's Views and Corrective Action Plan Finding 2023-002 - Non-Compliance with Financial Need Requirements for Subsidized Direct Loans in Non-Standard Semesters Grantor: U.S. Department of Education Program: Student Financial Assistance Cluster Assistance Listing#: 84.268 Award Titles: Federal Direct Student Loan Program Program Award Years: 7/2022 - 6/2024 Management agrees with the finding and proposes the following corrective action plan: Corrective Action Plan: When a student attends a standard semester (Fall and Winter), PeopleSoft uses the Prorated Estimated Family Contribution (EFC) Methodology to determine the subsidized loan eligibility based on their EFC. When a student attends a non-standard term (Spring), PeopleSoft uses the Automatic Zero EFC Methodology and offers subsidized loans to all students rather than the subsidized loan eligibility based on their EFC. Tammie Fonoimoana, Financial Aid & Scholarships Senior Manager, will work to update the PeopleSoft system to use the Prorated EFC Methodology for calculating subsidized loan eligibility for both standard and non-standard terms. In addition, Tammie Fonoimoana, Financial Aid & Scholarships Senior Manager, who is responsible for packaging and awarding of Financial Aid at Brigham Young University- Hawaii will continue to provide training to the staff who administer Title IV aid to ensure they are aware of the changes in packaging and awarding subsidized loans for the non-standard term (Spring). Also, Tammie Fonoimoana will oversee the implementation of controls wherein the University will implement preventative mechanisms to verify financial aid packages are calculated correctly. Timing: Tammie Fonoimoana, Financial Aid & Scholarships Senior Manager, will be responsible for overseeing that the items as noted in the corrective action plan section above will be implemented by July 1, 2024. Signed and Acknowledged, Tammie Fonoimoana, Senior Manager BYU-Hawaii Financial Aid & Scholarships Tammie.fonoimoana@byuh.edu 808-675-4737

Management's Views and Corrective Action Plan Finding 2023-001 - Non-Compliance with Timely and Accurate Student Enrollment Change Submissions to the National Student Loan Data System (Significant Deficiency) Grantor: U.S. Department of Education Program: Student Financial Assistance Cluster Assistance Listing#: 84.268, 84.063 Award Titles: Federal Direct Student Loan Program, Federal Pell Grant Program A ward Years: 7 /2022 - 6/2024 Management agrees with the finding and proposes the following corrective action plan: Corrective Action Plan: The prior year's corrective action plan was successful in addressing two of three issues identified in previous audits in enrollment reporting. These additional steps will be taken to address the remaining issue noted during the 2023 audit, which resulted in a repeat finding of 2022-001. When a student returns from a leave of absence, PeopleSoft updates the students' program begin date for the student's return date rather than the original program begin date. Daryl Whitford, Registrar, will continue reviewing program begin dates for students returning from a leave of absence to ensure the proper program begin date is reported to NSLDS. In addition, we will review if any PeopleSoft enhancements can be made to provide additional comfort that the program begin elates are accurate in these circumstances. Daryl Whitdord, Registrar, who is responsible for enrollment reporting at Brigham Young University Hawaii will continue to provide training to staff who participate in enrollment reporting to ensure that they are aware of the campus and program enrollment changes to be reported, the details to be reported for each change, and the importance of submitting changes timely. Also, Daryl Whitford, Registrar, will oversee the implementation of a control wherein the University will review program begin dates for students returning from leave of absence to ensure the proper program begin date is reported to NSLDS. Timing: Daryl Whitford, Registrar, will be responsible for overseeing that the items as noted in the corrective action plan section above will be implemented by September 1, 2024. Signed and Acknowledged, Daryl Whitford, Registrar BYU-Hawaii daryl.whitford@byuh.edu 808-675-3730

The following corrective actions have been put into place in order to address these findings:

•       The district will follow all guidelines outlined by the USDA during the verification process.

•       A change in personnel was made.

•       Child nutrition specialists from the Department of Education, Child Nutrition Unit have provided technical assistance to district employees on the verification process. This technical assistance included assistance in reviewing the correct number of applications, the process in which the confirming official confirms the applications, the correct documents that may be submitted for income documentation, the correct use of tracker forms, and the procedure for reclassifying applications after the verification process. This technical assistance was given in the spring semester this school year and will be repeated next year to ensure that the guidelines are followed.

•       District personnel will properly review the supporting documentation provided during the verification process which will include ensuring the correct number of applications are verified, that the confirming official confirms the applications, that the correct documentation of income is received, that the tracker forms are used correctly, and that the applications are reclassified after the verification process is completed, if necessary. This will be a multi layered review that will include the cafeteria managers, child nutrition director, director of federal programs, and superintendent.

There corrections had gone into effect Jan. 2024.

Response and Corrective Action Plan The Authority has attempted to segregate accounting duties by having a person who does not initiate, prepare or post disbursements review the bank statements and co-sign all checks. The Authority will continue to monitor its policies and procedures in an effort to improve control efficiencies, however, at this time, the Authority has determined that the cost of eliminating the deficiency would exceed its benefit.

FINDINGS - MAJOR FEDERAL AWARD PROGRAM AUDIT Department of Housing and Urban Development Finding, 2023-002: Major Program: Supportive Housing for the Elderly (Section 202 Capital Advance - Accumulated Balance), Federal Assistance Listing Number 14.157 RECOMMENDATION The auditor recommends ensuring all current and new staff are trained on tenants’ 90-day EIV reports and ensuring they are generated within the required time period to verify tenant information promptly and help reduce errors in subsidy payments. ACTION TAKEN The Project will be monitoring use of the EIV system for move ins and recertifications.

FINDINGS - MAJOR FEDERAL AWARD PROGRAM AUDIT Department of Housing and Urban Development Finding, 2023-001: Major Program: Supportive Housing for the Elderly (Section 202 Capital Advance - Accumulated Balance), Federal Assistance Listing Number 14.157 RECOMMENDATION The auditor recommends ensuring all tenants’ paperwork is thoroughly reviewed and accurately used in the calculation of the tenant’s required monthly rent and HUD’s tenant assistance payments. ACTION TAKEN The Project will be billing the tenant for the $264 and reimbursing HUD for additional tenant assistance payments of $264 due to the Project.

Finding 2023-006: Material Weakness in Internal Control over Compliance - Special Tests and Provisions Corrective Action Plan: I. The DLR RA Management Analyst will prepare and submit all ETA Reports (Preparer). a. The Management Analyst will initially enter all data into the report and ensure its initial accuracy. b. The Management Analyst will also be responsible for addressing any warning message(s) or error message(s) that are generated by the reporting system. c. Once the data has been entered and all warning and error messages have been addressed, the Management Analyst will notify the DLR RA Senior Internal Auditor that the ETA Report is complete and ready for their review. 2. The DLR RA Senior Internal Auditor will Review and Sign Off on all ETA reports (Reviewer) a. The Senior Auditor will review the completed report to ensure its accuracy. b. If an issue is found during the review, it will be researched and corrected. c. Once the Senior Internal Auditor has verified all data elements within the report are correct, they will email the Management Analyst signing off on the data presented and give approval for the Management Analyst to submit the final report. 3. The Management Analyst submits the final report. 4. Once submitted, the Management Analyst will print the submitted copy of the final report to PDF. 5. Once in PDF form, the Management Analyst will add the following notes: a. Prepared By: [Name] b. Date and Time c. Reviewed By: [Name] d. Date and Time 6. With the "Prepared/Reviewed Note" added, it is now considered the "Finalized Report." 7. The Management Analyst will save an electronic copy of the Finalized Report along with copies of any supporting documentation and any email communications between the "Preparer" and the "Reviewer" to the QA records to be retained according to DLR Record Retention policies. 8. All RA Staff can access all finalized reports through the RA MS SharePoint site. Contact Person: Pauline Heier, Director, Reemployment Assistance Anticipated Completion Date: No anticipated completion date was listed in the separately issued audit report.

Project Legal Name: The Harry and Jeanette Weinberg Terrace, INC HUD Project No.: 502-EE015 Audit Firm: CohnReznick Period covered by the audit: Year end June 2023 Corrective Action Plan prepared by: Name: Shantay Hall Position: HUD Compliance Specialist Telephone Number: 571-307-6571 The following is a recommended format to be followed by the auditee for preparing a corrective action plan: A. Current Findings on the Schedule of Findings, Questioned Costs and Recommendations 1. Finding # 2023‐001; Section 202 Supportive Housing for the Elderly, Assistance Listing 14.157 a. Recommendation: Management should establish procedures and monitor compliance with those procedures to ensure that tenant security deposits are correctly recorded, tenant eligibility is correctly determined and that tenant lease files are properly maintained in accordance with the requirements of HUD Handbook 4350.3, Occupancy Requirements of Subsidized Multifamily Housing Programs b. Action(s) Taken or Planned on the Finding The inspection was conducted under previous management. The Franklin Johnston Group took over July 1st, 2023. The Franklin Johnston EIV policies and procedures require site staff to Run Existing tenant searches within 90 days prior to the move in date which is required to be uploaded to the assigned Compliance specialist for review prior to move in approvals. Although HUD requires quarterly reports, we require monthly. Site teams are only permitted to pull the “By Head of Household Report” at the time of recertification. 90- day EIV’s are to be ran within 90days of the anticipated voucher submission date. Site staff are required to go through our approval process, staff are not required to perform a move with without Compliance Approval. The Franklin Johnston performs quarterly audits to ensure that these processes are being followed along with ensuring that the files are being properly maintained. All site teams members have been trained as it relates to these policies. In addition to this training all site teams are required to attend monthly EIV training/Policies and procedures trainings according to HUD guidelines.

Compliance and Controls over Compliance – Eligibility Home Investment Partnership Program, AL# 14.239 Material Weakness Accord did not have controls in place to ensure that eligibility criteria and rent calculations were being reviewed and/or approved by someone other than the individual performing the initial determination or annual reexamination. Actions Taken or Planned: Management agrees with this finding. As of December 31, 2023, the Organization has sold all properties financed by HOME funds. Contact Persons: Robert Pickering, Chief Financial Officer

Finding: The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with financial reporting requirements for the Child Care and Development Fund Cluster. Questioned Costs: Assistance Listing # 93.575 93.575 COVID-19 93.596 Status: Corrective action in progress Corrective Action: The Child Care and Development Fund (CCDF) program was previously managed by the Department of Social and Health Services and the Department of Early Learning. Since the program transitioned in 2019, the Department has been making efforts to strengthen internal controls over payments to child care providers and other CCDF grant requirements. The Department implemented grant-level management of all federal funds, including the CCDF grant. The Department allocated the CCDF grant to eligible clients and allowable activities in compliance with 45 CFR 98.67. As part of the audit resolution process, the Department of Health and Human Services (HHS), Administration for Children & Families (ACF), which oversees the CCDF program at the federal level, reviews all State Auditor’s Office (SAO) findings and issues management decision letters. The Department received a management decision letter dated October 3, 2023, from HHS for finding 2021-033 (2020-038) which states: “The ACF noted that the auditor raised concern about the Department’s accounting procedures and efforts made to trace expenditures at the transaction-level. As the basis for the finding, the auditor used CFRs (200.53, 200.303, 200.403, 200.410) that do not apply to CCDF. Federal regulations allow Lead Agencies to expend and account for CCDF funds in accordance with their own procedures.” In addition, ACF did not sustain the disallowance of questioned costs and stated: “Although the Department’s internal controls were lacking, the ACF has not identified any funds that were expended on ineligible activities.” The ACF recommended: “…that the Department work with the auditors to determine an appropriate methodology that can be tested to ensure child care payments comply with Federal regulations.” The Department met with ACF and SAO on November 8, 2023, to discuss the ACF decision at which time ACF upheld the above statements that the activities allowed finding was not substantiated. The Department is committed to collaborating with SAO to determine an appropriate methodology that identifies a sampling unit that can be used to accurately test compliance. The SAO maintained that the program is not auditable without child-level data. The Department does not currently have the staff and resources to develop and maintain the business process redesign, as well as the information technology initiatives necessary to meet the level of assurance recommended by SAO. In response to the auditor’s recommendations, the Department submitted a budget request for the 2024 supplemental budget. Funding was provided to develop and maintain the business process that would allow adjustments to include child-level data beginning July 2024. The conditions noted in this finding were previously reported in findings 2022-044 and 2021-038. Completion Date: Estimated December 2025 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov