Corrective Action Plans

Corrective Action Plan: Through analysis of the exceptions identified in the audit, the University has developed a standard operating procedure to assign employee access based on the principle of least privilege as determined by individual roles. The university is engaged with a third-party vendor to procure and implement an automated role-based access assignment process, to ensure that the University complies with this audit findings requirements. Implementation Date: June 2024 Responsible Person: Mr. Matthew Steimel, Director of Enterprise Applications

Corrective Action Plan: Once the discrepancy was identified in July of 2023, corrections were made for the next satisfactory academic progress review in August of 2023 and going forward. The new procedures put into place in August are as follows: the SAP table used for calculating maximum time frame will be reviewed by the Associate Director and Director over Advising in conjunction with the Registrar’s office to ensure there are no discrepancies in degree program hour requirements. The policy manual has been revised to include procedures. Implementation Date: August 2023 Responsible Person: Delisa Falks, Assistant Vice President

Corrective Action Plan: In a typical academic year, we package prior to the new aid year COA being finalized. This means that we roll the prior year's components when initially packaging students. Once the new aid year's COA is finalized, we re-run COA to update these components on all students prior to disbursement each term. This involves updating the budget component screen in our student information system. In 2022-2023, we rolled the 2021-2022 budget components and did not accurately update the components in Banner, which led to lower COA for students enrolled in Fall 2022 and Spring 2023. This was not identified until the Summer of 2023 when entering the weekly summer budget components. The Office of Financial Aid will implement a new aid year checklist specific to the review of Cost of Attendance that has a sign-off for each step of the process. The Executive Director and Director have responsibility in creation of the annual Cost of Attendance. The COA is shared with the Vice President of Enrollment Management prior to any awarding occurs. After the creation of the COA chart, the Director and Assistant Director will ensure accuracy of the chart in comparison to the COA methodology. The Director of Financial Aid will enter these components into Banner with secondary review by the Assistant Director. We will provide screenshots with the checklist that the COA chart matches Banner. When our IT staff runs COA prior to disbursement, we will test a sample of students to ensure budgets match the COA chart and RORALGS. The policy and procedure will be revised to include these updated procedures. The 2024-2025 aid year cycle is an atypical cycle with the delayed release of the FAFSA. We will not receive ISIR records until at least February 2024. We will not package students until after the 2024-2025 COA is finalized. This means that we will not roll the 2023-2024 COA. We will follow our new updated procedures and checklist to ensure accurate calculations and reporting. Implementation Date: March 2024 Responsible Persons: Kathy Wright, Executive Director of Student Financial Assistance Services Amanda Petrosian, Director of Financial Aid Josiah Mendoza, Assistant Director of Operations

Corrective Action Plan: The user access has been limited to their specific job function. The university will verify user access was appropriately updated/removed. Access review procedures will be reviewed to ensure access is appropriately assigned in the future. To streamline and assure a consistent outcome regarding the approvals for security patches to be introduced to the production environment, the University will convert these normal changes to standard changes. A standard change is “A pre-authorized change that is low risk, relatively common and follows a procedure or work instruction. (ITIL v4 definition.)” Software patching and updates are standard change candidates. Not applying security patches in a timely manner introduces a greater risk to the University than processing these requests as a normal change. A standard change is pre-authorized and will address how IT is testing and/or validating whether the OS patches were successful in an available test environment prior to deployment to production. Test procedures will be documented as a requirement of the Standard Change Model. IT will document that outcome of the testing and/or validating of the OS patch as a Journal entry on the Standard Change prior to implementation. The Change Advisory Board (CAB) will review these changes/procedures on a regular basis to ensure we are in compliance. Policies, Standards and Procedures will be updated to meet any required changes. Implementation Date: January, 2025 Responsible Persons: Michael Dewey, Chief Technology Officer Amy Wilson, Director of Financial Aid and Scholarships

Corrective Action Plan: A process with the Student Aid office exists for aid clean up that is run after Census Day for each part of term identifying students that had a variation in payouts versus packaged budget. In reviewing the 2022-2023 aid year, it appears that these reports and processes were not being worked due to staff turnover. Working the students identified on this report is part of scheduled processes. Student Aid is working with IT to have these reports automated and scheduled out for delivery to ensure that it is received and worked in a timely manner. Implementation Date: February 2024 Responsible Person: Megan Begnaud, Director of Student Aid

Corrective action plan: Program is enhancing processes to reconcile current expenses and ensure only eligible expenses are reported on the applicable funding sources. These actions will result in accurate amounts reported on the schedule of federal award expenditures. To strengthen requirements related to unique disaster funding, DSHS will reevaluate all invoices on this grant to ensure they are on the proper funding source. The State Medical Operations Center Finance staff will coordinate with DSHS Financial Division to communicate FEMA updates impacting expense reimbursement. Implementation date: August 31, 2024 Responsible persons: Wayne Zwart, Disaster Finance Manager, Center for Health Emergency Preparedness and Response’; Amanda Hudson, Budget Director, Financial Division

Corrective action plan: In December 2021, the Texas Health and Human Services Commission (HHSC) implemented the Texas Medicaid & Healthcare Partnership (TMHP) Provider Enrollment Management System (PEMS), an automated system that is the single tool for provider enrollment, re-enrollment, revalidation, and maintenance requests (maintaining and updating provider enrollment record information). Children’s Health Insurance Program (CHIP) provider enrollment, revalidation, and re-enrollment documentation, including risk-based screenings, are tracked in PEMS. Additionally, the relevant federal databases are checked at least monthly for all providers currently enrolled in CHIP. Of the CHIP providers requested during the fiscal year 2023 Statewide Single Audit, 59 of 60 samples had been enrolled or revalidated through PEMS and the auditor received all requested documentation. The listed exceptions only apply to one CHIP provider. The provider enrolled with CHIP before the implementation of PEMS. HHSC operated under the public health emergency (PHE) between March 30, 2020, and May 11, 2023. In response to the public health emergency (PHE), the Centers for Medicare and Medicaid Services waived exclusion check requirements for provider reenrollments and revalidations. HHSC is in the process of revalidating providers through PEMS; however, as a result of the PHE end date and provider revalidation requirements, the projected completion date for the required revalidation of all CHIP providers is January 2027. HHSC continues efforts to enroll CHIP providers through PEMS and expects to eliminate errors related to these documents once all CHIP providers have revalidated. Implementation dates: December 2021, PEMS implementation January 2027, provider enrollment and revalidation completed Responsible persons: Jordan Nichols, Deputy Associate Commissioner, Medicaid and CHIP Services Operations Management

Corrective action plan: The applicant's file date is the date HHSC or an HHSC agent receives an application that contains, at a minimum, the person's name, address and signature. A faxed or electronic signature, if using the online application available through YourTexasBenefits.com, is acceptable. Access and Eligibility Services (AES) must determine eligibility and provide Form TF0001, Notice of Case Action, by the 45th day after the file date for an application requesting health care for children. Federal regulations at 42 CFR 435.912(c)(3) require that HHSC complete an eligibility determination within 90 days for individuals who are applying for Medicaid based on disability and within 45 days for all other applicants. HHSC has made significant investments in its eligibility workforce to address required application processing timeframes. In the last fiscal year, HHSC onboarded more than 2,100 eligibility staff, implemented workforce recruitment and retention initiatives, and augmented its training capacity by leveraging technology, strengthening the quality of the virtual learning products and scheduling, and standardizing On-the-Job Trainings. HHSC is working on cross-training eligibility advisor staff across all programs (SNAP, TANF, Medicaid, CHIP, MEPD). HHSC is actively reviewing existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Implementation date: December 31, 2024 Responsible person: Gracie Perez – Interim Associate Commissioner, AES Operations

Corrective action plan: HHSC has made significant investments in its eligibility workforce to meet workload demands. In the last fiscal year, HHSC has onboarded more than 2,100 eligibility staff, implemented workforce recruitment and retention initiatives, and augmented its training capacity by leveraging technology, strengthening the quality of the virtual learning products and scheduling, and standardizing On-the-Job Trainings. HHSC will also continue to create and share guidance and tips with staff to reinforce proper data entry in the eligibility determination system, including entries related to TANF. Implementation date: December 31, 2024 Responsible person: Gracie Perez – Interim Associate Commissioner, Access and Eligibility Services (AES) Operations

Corrective action plan: To rectify the discrepancies in the EA Eligibility Application/Determination section of the IMPACT system, DFPS is implementing the following measures: 1. Research and Analysis: DFPS IT initiated research on 12/12/2023 to investigate the root cause of why the child became eligible upon recertification. This research will be ongoing to comprehensively understand the underlying factors. 2. Database Audit: A database audit table was added in early October 2023 to expedite the identification of similar issues in the future. This enhancement aims to facilitate a quicker determination of the root cause for any inaccuracies related to EA eligibility. 3. Batch Analysis: The EA eligibility batch process will undergo a thorough analysis to ensure it accurately identifies children who should or should not be deemed EA eligible. Insights from this analysis will help optimize the batch process and prevent similar occurrences. 4. Project Review: A review of Project 65700, completed in August 2021, will be conducted to assess if any gaps in the re-certification batch allowed a child to be incorrectly considered EA eligible. The data fix performed during this project will also be scrutinized to ensure it adhered to accurate eligibility criteria. 5. Communication and Training: DFPS commits to ongoing communication and training for INV/AR staff regarding EA and the correct method of answering questions within the IMPACT system. This aims to enhance staff awareness and compliance with federal guidelines and internal policies. 6. Internal Quality Assurance: DFPS will strengthen its internal quality assurance reviews of cases eligible for EA. This proactive approach ensures ongoing compliance with federal guidelines and internal policies, thereby minimizing the likelihood of eligibility-related errors. 7. In Fiscal Year 2023, DFPS Investigations/Alternative Response personnel underwent supplementary training sessions and received revised policy and resource guides pertaining to Emergency Assistance (EA). These initiatives were implemented to address the concerns identified, specifically related to inaccuracies in responding to questions within the EA Eligibility Application/Determination. DFPS remains committed to these corrective actions to address the identified issues and continually improve the accuracy and reliability of the EA eligibility determination process. The effectiveness of these measures will be regularly assessed to uphold the integrity of the system and prevent improper payments. Citizenship: To rectify this situation and to ensure that a child that is not a U.S. citizen, qualified alien, or permanent resident does not receive EA benefits, DFPS is implementing the following measures: 1. DFPS Finance will work with program and IT to determine the best practices when answering citizenship and the Emergency Assistance (EA) eligibility questions and ensure the IMPACT system is reading the responses and applying the logic properly resulting in EA eligibility determination that is in compliance with United States Codes, Chapter 8 Aliens and Nationality, Chapter 14 – Restricting Welfare and Public Benefits of Aliens, §1611. 2. DFPS will review the list of non-citizens and update their eligibility if they are incorrectly deemed EA eligible. 3. DFPS will review the payments issued to non-citizens and process adjustments to ensure EA funds are used only for eligible activities. Implementation dates: IMPACT IT research begun on 12/12/2023 and will be ongoing to determine the root cause of the issue. Ongoing communication to staff. Citizenship: The first item will require a coordination with IT and programs and it’s completion date will be dependent on the efforts required to make the agreed upon changes. Item 2 and 3 is anticipated to be completed by May 31, 2024. Responsible persons: Jerome Green, CPI Deputy Director of Field; Citizenship: Scott Greer, Budget Director

Corrective action plan: The Provider Finance Department (PFD) will take proactive measures to establish and enforce guidelines that guarantee documentation is retained for a minimum of three years from the date of submission of the final expenditure report for each grant. This approach aligns with our dedication to transparency, accountability, and responsible grant management. We will ensure that all the documentation is saved within our documentation repository for a minimum of three years from the date of submission. Implementation date: June 1, 2024 Responsible person: Stacy Kerns – Director, Business Operations and Support Services

Corrective action plan: Yardi and AmeriNat Case auditors and supervisors have been reminded that the original loan amount and origination date must be verified before approving a case. The CDF portal should have these columns completed. If the CDF does not include the original loan amount and origination date, case auditors will ask the loan servicer for a corrected record which includes the original loan amount and origination date in order to confirm conforming loan limits. For non-traditional loan servicers, a deed of trust or settlement statement will continue to be requested from the homeowner. As it relates to the specific case in question, the Reinstatement (R program) plus Monthly Payment Assistance (U Program) case was originally a HAF Contribution to Modification case (P Program.) The case was transferred from the P Program to the R Program on 8/23/2022 and due to a technical issue, the Yardi portal did not add the U Program to the existing R Program. On 1/17/2024, the U Program was manually added to the R Program and payment was made to the homeowner’s loan servicer for the three additional monthly payments. Implementation date: January 17, 2024 Responsible persons: Lizet Hinojosa, Director of HAF and Grace Timmons, Assistant Director of HAF

Corrective action plan: The program is no longer issuing new payments and is in the process of final reconciliation and closure. TRR management shared these findings with the external application review vendor on February 9, 2024, reiterating the processes for reviewing and approving rental assistance according to all program policies and procedures and ensuring that appropriate documentation related to review of applications is maintained in the files. Implementation date: February 9, 2024 Responsible person: Danny Shea, TRR Senior Program Manager

The District has implemented a procedure to validate the calculation of sample applications, including coordinating with the Riverside County Office of Education.

Finding 2023-001 – Eligibility for Subsidized Direct Loans ALN Number: 84.268 Federal Award Identification Number: P268K230616 Recommendation: It is recommended that the College ensure that all EFC information from the ISIR is entered in to the student aid packaging system before the student aid award is calculated. Action Taken: In review of the student records, the student aid packaging system at the time of aid determination indicated an EFC of $0 and months and weeks in academic year being zero. However, the FASFA was completed and the ISIR EFC amount was known at the time of the packaging and loan issued due to the cost of attendance not calculating correctly at time of packaging. The student aid packaging system parameters ensure that if need amount is $0 the system will stop a subsidized direct loan from being awarded. The weeks and months in academic year information was corrected in their next term and a subsidized loan was not awarded. Error appears related to only their first loan issued. The allowance of subsidized loans was due to user error because the months and weeks enrolled in academic year were showing as zero. The College has re-trained its staff on the sequence of processing and ensure that inputs for months and weeks in academic year are correct. The College also worked with their student information system to ensure the set up for academic year definitions for cost of attendance calculations are set to be automatic for proper calculations. The College made an internal report in order to review all student financial need for the 2022-2023 academic year in February 2024 and determined there were no additional students awarded need based aid in excess of their financial need. The College will continue to use this report every term to review need. For the 2 students that received subsidized loans in error, their loans were refunded in March 2024.

Finding #2023-002 – Material Weakness and Other Noncompliance. Recommendation: Provide additional staff training to ensure internal control procedures over client eligibility and required documentation are followed. Planned corrective action: Client eligibility and documentation requirements do not pertain to cost reimbursement grants; these regulations exclusively apply to fee-for-service grants. The fee-for-service grant programs concluded on September 30, 2023. Consequently, starting from October 1, 2023, the business model shifted to cost reimbursement only. As a result, no corrective actions are needed for fee-for-service grants. Responsible officer: Drew Dutton, President and CEO. Estimated completion date: Completed October 1, 2023

Name of Contact Person: Kimberly Irvine, DSS Director Corrective Action: The County created a 2nd Party Review Error Summary Log to record all 2nd Party Reviews that require corrections to a case. 2nd Party Review forms are completed and handed out to caseworkers as previously with the exception that the Reviewer will log the ones that need corrections. This process was implemented and used from January through August 2023. After that, there was a management change which caused the log not to be followed up on. The use of the log has been reinstated as of March 13, 2024. A meeting will be held on March 21, 2024 with the Reviewers to ensure they are using this procedure. The program manager will check the log monthly to ensure that it is up to date and being used correctly. Proposed Completion Date: March 21, 2024.

Name of Contact Person: Kimberly Irvine, DSS Director Corrective Action: The County will develop a 2nd Party Review form that will be used to check completed applications for accuracy in applying policy and to assure all verifications have been uploaded to the NCFAST system. Proposed Completion Date: October 31, 2023.

The Authority has performed a review of all patients who have had indications of additional health insurance on an account with a HRSA payment, and made appropriate refunds.

1. Finding 2023-001 a. Comments on the Finding and Each Recommendation We accept finding and recommendations made b. Action(s) Taken or Planned on the Finding A review of policies and documentation will be undertaken, and training with an emphasis of appropriate documentation handling will be applied to those who handle the leasing information.

FINDING 2023-001 Finding Subject: Child Nutrition Cluster – Eligibility Summary of Finding: The Food Service Director was responsible for running the direct certification match report monthly from the Indiana Department of Education and uploading it to the school lunch point-of-sale system. The School Corporation did not have a proper system of oversight or review to ensure that all students on the direct certification match report were entered accurately into the point-of-sale system. We recommended that the School Corporation's management establish a system of internal control to ensure compliance and comply with the Eligibility compliance requirement Contact Person Responsible for Corrective Action: Nick Alessandri Contact Phone Number and Email Address: 219-962-7551 Views of Responsible Officials: We concur with the finding. Description of Corrective Action Plan: River Forest Community School Corporation is now part of the Community Eligibility Provision (CEP) and therefore the direct certification process will no longer take place. In the event that we are no longer CEP and begin the direct certification process, we will implement a process of internal controls that ensure proper oversight and review to ensure all students are entered accurately into our point-of-sale system. Anticipated Completion Date: July 1, 2023

Audit Period: June 30, 2023 The finding from the June 30, 2023 schedule of findings and questioned costs is discussed below. The finding is numbered consistently with the number in the schedule. FINDING – FEDERAL AWARDS PROGRAM AUDIT U.S. Department of Health and Human Services, Health Center Cluster Programs (Assistance Listing Number 93.224/93.527/COVID-19 93.224) SIGNIFICANT DEFICIENCY Item 2023-001 –Special Tests and Provisions Recommendation: We recommend that proper training be given to employees and that sliding fee discounts be reviewed by a supervisor on a periodic basis to ensure compliance with the sliding fee scale. Action Taken Management will be training all registration personnel in teams meetings or one on one training sessions. The staff will be trained on how to appropriately monitor and use the sliding fee discounts. Staff will be shown how to maintain the applicable documentation to support the maintenance of the sliding fee discounts. In addition, a team of management and billing staff will be assigned to periodically review the process to ensure the Center always complies with the sliding fee regulations. Completion Date: July 1, 2024 If the Health Resources and Services Administration has questions regarding this plan, please call Tamisha McPherson, Executive Director of URAM at 212-803-2850.

2023-001: Incorrect Pell Disbursement - Student Financial Aid Cluster Assistance Listing Number 84.007, 84.033, 84.063, 84.268, Grant Period - Year Ended August 31, 2023 Condition Found During our student file testing we noted one student out of forty was not disbursed the correct Pell Grant. The student was enrolled as three-quarters time but was awarded as being a full-time student resulting in an over award of $574. We consider this error to be an instance of noncompliance relating to the Eligibility Compliance Requirement. This finding was repeated from last year, see Prior Year finding 2022-002. Corrective Action Plan Financial Aid Office will make sure to disburse the accurate Pell Grant amoutn according to the students' enrollment status. EWU will return the over awarded Pell to reflect the correct amount for the student. We have never had a finding for awarding full time Pell to a three-quarters attending student. This was an isolated incident. Responsible Person for Corrective Action Plan Director of Financial Aid Cesar Campos Implementation Date of Corrective Action Plan February 15, 2024

2023-002 Incorrect Direct Loans Disbursement Amount - Student Financial Aid Cluster Assistance Listing Number 84.007, 84.033, 84.063, 84.268, Grant Period - Year Ended August 31, 2023 Condition Found During our student file testing we noted two students out of forty were disbursed the incorrect Direct Loan amount. Based on the student’s enrollment status and need the students were over awarded $4,500 in Subsidized Loans and under awarded $4,500 in Unsubsidized Loans. We consider this error in awarding to be an instance of noncompliance of the Eligibility Compliance Requirement. Corrective Action Plan Financial Aid office will make sure the correct amount is awarded based on the student enrollment status and need of the student. EWU will make the proper adjustments to the Direct Subsidized Loan and Direct Unsubsidized Loan to reflect the correct amount foer the two students. Responsible Person for Corrective Action Plan Director of Financial Aid Cesar Campos Implementation Date of Corrective Action Plan February 15, 2024

Major Program: 10.558 - Child and Adult Care Food Program (Grantor - Department of Agriculture) Condition: We tested 18 provider files and identified two billing errors within the May 2022 claim submissions. For each instance of error, the number of meals served was incorrectly determined and submitted for reimbursement. Corrective Action Plan: Catholic Charities Program Manager, Joanne Varnes, conducted a training on December 19, 2023 with all staff involved in the CACFP that included income eligibility/enrollment categorization and meal count accuracy. Catholic Charities staff will review each income form/enrollment and double check that children’s reimbursement rate is properly categorized based on their family’s income. Staff members will review each claim before it is entered for reimbursement to ensure the claim is accurate. Program Manager, Joanne Varnes, will oversee this process and conduct case record reviews quarterly for all providers under Catholic Charities Sponsorship. Contact Person Responsible for Corrective Action: Samantha Wallace, Interim Executive Director Anticipated Completion Date of Corrective Action: Immediately