Corrective Action Plans

Program: AL 21.023 ? COVID-19 Emergency Rental Assistance ? Allowability & Eligibility Corrective Action Plan: N/A Contact: Lee Will Anticipated Completion Date: N/A

Program: AL 17.225 ? Unemployment Insurance ? Admin ? Special Tests & Provisions Corrective Action Plan: The corrective action plan has been completed and approved by USDOL. Contact: Andi Bridgmon, UI Director Anticipated Completion Date: N/A

Program: AL 17.225 ? COVID-19 ? Unemployment Insurance ? Federal; AL 17.225 ? Unemployment Insurance ? State ? Allowability & Eligibility Corrective Action Plan: NDOL will work to ensure that investigations are appropriately set and timely resolved. Contact: Andi Bridgmon, UI Director Anticipated Completion Date: June 30, 2023

Program: AL 93.778 ? Medical Assistance Program; AL 93.778 ? COVID-19 Medical Assistance Program ? Allowability and Eligibility Corrective Action Plan: The agency will review training materials and tip sheets regarding these topics. The agency will review the errors with the staff who made them and provide any additional training needed. Contact: Catherine Gekas Steeby Anticipated Completion Date: 10/31/2023

Program: AL 93.778 ? Medical Assistance Program; AL 93.778 ? COVID-19 Medical Assistance Program ? Allowability Corrective Action Plan: Training materials will continue to be updated and made available to assist providers with EVV and for submitting accurate billing. Training will be at least annually for direct staff involved with assisting providers. EVV website to be kept updated with program guidelines and regulations. DHHS will engage the vendor to explore technical options to resolve any technical related issues identified in the report, and develop any additional quality assurance measures necessary when a technical solution is not achievable in the short term. Contact: Kathy Scheele Anticipated Completion Date: 06/30/2023

Program: AL 93.575 and 93.596 ? CCDF Cluster ? Allowability & Eligibility Corrective Action Plan: The CCDF program team will continue to work with the training team and the program accuracy team to create `quick tips? and tools addressing these eligibility issues for field staff. CCDF program staff are reviewing monthly reviews with high billed hours. Resource Developer (RD) staff will increase initial and annual billing trainings with subsidy providers. A new provider handbook is being created and slated to be completed and launched summer 2023. DHHS is also changing the current billing structure from hours and days to half-days and full-days. This should simplify billing and calculation errors. This is scheduled to be completed by May 2023. Contact: Nicole Vint Anticipated Completion Date: 06/30/2023

Program: AL 93.568 ? COVID-19 ? Low-Income Home Energy Assistance (LIHEAP); AL 93.568 ? Low-Income Home Energy Assistance ? Eligibility Corrective Action Plan: The LIHEAP Desk Aid will be revised to a Standard Operating Procedure to assist in providing clear guidance to Eligibility Staff. Contact: Matt Thomsen Anticipated Completion Date: 06/30/2023

Program: AL 93.558 ? Temporary Assistance for Needy Families (TANF) ? Allowability & Eligibility Corrective Action Plan: The specific error that occurred does not appear to be widespread since only 1 out of 25 cases were identified to have this error. In addition, the TANF program has information on regulations and the policy log that provides guidance on this issue. The Program will follow up with the worker that made the error to ensure it does not happen again. Contact: Will Varicak Anticipated Completion Date: 1/29/2023

Program: AL 93.558 ? Temporary Assistance for Needy Families (TANF) ? Allowability & Eligibility Corrective Action Plan: DHHS will review the underlying coding that pulls this report and make any changes based on findings. Contact: Andrew Keck Anticipated Completion Date: 6/30/2023

Program: AL 12.400 ? Military Construction, National Guard ? Suspension and Debarment Corrective Action Plan: Contracting Officers are logging into SAM website, looking up the Contractor or A&E to ensure that they are not barred. We are taking a screen shot of the web site printing it off and attaching it to our digital/hard copy files. Contact: MAJ Justin Portenier Anticipated Completion Date: The Corrective Action Plan has already been implemented and will be updated in the Standard Operating Procedure Manual (SOP) no later than 30-May-2023.

2022-001 ? Eligibility - Tenant File Documentation Finding Type. Immaterial noncompliance, Significant deficiency in internal controls over compliance (Eligibility) Federal programs U.S. Department of Housing and Urban Development ? Supportive Housing for the Elderly (ALN# 14.157) Condition. Out of a sample of 6 tenant files, it was noted: 1. Two out of six instances where the resident's cash balance was verified using the ending balance; however, the 6-month average balance should have been used; 2. One out of six instances where the resident's medical expenses were improperly calculated; 3. One out of six instances where the tenant's security deposit and/or prorated rent were not disbursed to them in the required 30 days; 4. One out of six instances where there was no verification of pension income performed on the most recent recertification. Effect. As a result of this condition, certain tenant files did not contain all required supporting documentation. In addition, employees did not follow HUD guideline procedures, and/or did not properly calculate the tenant subsidy in HUD Form 50059. While there were no significant differences in the amount of subsidies allowed compared to subsidies received, the lack of effective internal controls could lead to future significant noncompliance. Plan. Management agrees with finding 2022-001. All files are to be inspected in the current fiscal year to ensure compliance with HUD regulations. File maintenance will be competed following each move in and annual recertification. In addition to one-on-one training, the housing administrator has signed up for additional training including a WebEx on annual recertification and a basic EIV course. Additional training sessions are forthcoming. Contact Person Responsible for This Corrective Action: Laura Maisevich, Senior Housing Manager Anticipated completion date: December 31, 2022

Finding 2022-001: Gramm-Leach Bliley Act (GLBA) Recommendation: The University should perform and document an annual risk assessment to determine the University's specific risks relevant to protecting consumer nonpublic personal information. At a minimum, the University should have at least one risk statement aligned or referenced to each of the three required areas noted in the GLBA law at 16 CFR 314.4 (b). Finally, the University should identify and document at least one safeguard (i.e., control) for each of the risks identified and document in the risk assessment. Each control should be aligned or referenced to the risk(s) to which the safeguard applies. Action Taken: The University has taken the following steps to address the risks identified during the audit: 1. Employee Training and Management a. The University deployed the Knowbe4 Security Awareness Program to all full time staff. The program provides training for managing user data and email messages. To date the University has distributed two campaigns to combat email phishing attempts. 2. Information systems, including network and software design, as well as information processing, storage, transmission and disposal a. The University has formulated a digital transformation strategy to reduce on premises systems and applications. All the critical business systems are hosted at a colocation or are SaaS solutions. b. The University performs backups of all on premises systems using technology that creates immutable storage. c. The University leverages the cybersecurity experience of resellers and manufacturers to ensure all core network technology is installed and configured to minimize any attack surface. 3. Detecting, preventing, and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks as required by the Gramm-Leach Bliley Act (GLBA). a. The University has deployed a redundant pair of Fortinet Advanced Firewalls to monitor and block traffic with suspicious payloads. b. The University has updated to the latest version of Microsoft Advanced Threat Defender to serve as optimal end point protection for managing email traffic. c. The University contracted with the Cybersecurity and Infrastructure Security Agency (CISA) to perform vulnerability scans and penetration testing. The IT department evaluates the weekly reports and remediates highlighted deficiencies. d. The University has removed all admin rights from school managed computers, eliminating the ability to install local software. e. The University has deployed an updated VPN client to all school managed computers providing a secure tunnel for access network services. f. The University manages web browsers of all school managed computers. The University will take the results of the security assessment that was completed and draft the GLBA policy in conformity with the DOE requirements by June 2023. Responsible Individual for Corrective Action: Chief Information Officer ? Gregg Chottiner Anticipated Completion Date: June 30, 2023

The following action items are currently being put into place by the People, Culture & Learning Department: -Reviewing and updating policies, procedures, and language in the Employee Handbook that meets the requirements of the Colorado Healthy Families Workplace Act -Communicate and train supervisors and managers on the updated policies, procedures, and language including the requirement for supervisors to be aware of the employee?s use of the specific leave codes and ensuring the leave code is being used appropriately before approving timecards -Implementing a new HRIS/Payroll system that will require justification/documentation from the employee for specific paid leave codes such as use of Extended Leave Bank or COVID. CLIENT RESPONSIBLE PARTY: Jaime Engle, Director of Total Rewards and HR Operations COMPLETION DATE: August 1, 2023 with implementation of ADP payroll system

Finding: 2022-005 Name of contact person: LaGuana Holder, QA/PI Income Maintenance Supervisor Corrective Action: Universal template mandated by Agency Director. In-house audits to verify templates are being used. Proposed Completion Date: Templates will be distributed and used by staff starting immediately.

Finding: 2022-004 Name of contact person: LaGuana Holder, QA/PI Income Maintenance Supervisor Corrective Action: A required Power Point training for manual section 2230, 2300, 2250 for all Medicaid staff. A universal template mandated by Agency Director. Proposed Completion Date: PowerPoint training will be completed by January 31, 2023. Templates will be distributed and used by staff starting immediately.

Finding: 2022-003 Name of contact person: LaGuana Holder, QA/PI Income Maintenance Supervisor Corrective Action: Universal template mandated by Agency Director. In-house audits to verify templates are being used. Proposed Completion Date: Templates will be distributed and used by staff starting immediately.

Finding: 2022-002 Name of contact person: LaGuana Holder, QA/PI Income Maintenance Supervisor Corrective Action: A required Power Point training for manual section 3365 for all Medicaid staff. A universal template mandated by Agency Director. In-house audits to verify that templates are being used. Proposed Completion Date: PowerPoint training will be completed by January 31, 2023. Templates will be distributed and used by staff starting immediately.

Finding: 2022-002 ? Material Weakness, Internal Control Over Compliance, Eligibility and Special Tests ? ALN 93.778 Medicaid Cluster Personnel Responsible for Corrective Action: Pam Noonan, Mesa County Finance Director Anticipated Completion Date: 09/29/2023 Cause: Internal controls over the eligibility determinations are the responsibility of management. Mesa County did not follow its formal process in place for reviews of eligibility determinations. View of Responsible Officials and Planned Corrective Action: Mesa County agrees with the finding and has put together a corrective action plan for the finding. Corrective Action Plan: Mesa County was aware that they were not meeting their internal or Health Care Policy and Financing (HCPF) and Colorado Department of Human Services (CDHS) review requirements for 2022. Mesa County created a new quality control case reviews policy and procedure effective June 2023. The new policy included internal, HCPF and CDHS review requirement for all programs. In addition, MCDHS quality assurance team will be providing oversight using a tool they create to ensure review requirements are being met for each program.

Recommendation: We recommend the District implement procedures to ensure that someone knowledgeable of the grant requirements reviews the prepared eligibility reports prior to submission. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action planned/taken in response to finding: A procedure will be implemented to require a separate preparer and reviewer of the reports. Responsible official: Keith Lucius, Assistant Superintendent Anticipated completion date: June 30, 2023

1. Comments on Findings and Recommendation Management acknowledges failure to comply with timely EIV Master File Reports required to be completed as part of tenant move in certification process and EIV Master File process. 2. Actions Taken or Planned The Corporation will regularly monitor and reconcile the creation and retention of background checks and Income reports as part of the move in process. Additional training was provided and corrective action was taken. Management is reviewing and revising the EIV policy. 3. Status of Corrective Actions on Prior Findings The Corporation did not remediate the prior year finding for failure to comply with timely EIV Income Reports.

2022-001 - Student Financial Aid Cluster - (a) Federal Supplemental Educational Opportunity Grants (b) Federal Work Study Program (c) Federal Perkins Loan Program - Federal Capital Contributions (d) Federal Pell Grant Program (e) Federal Direct Student Loans (f) Teacher Education Assistance for College and Higher Education (TEACH), Assistance Listing No. (a) 84.007 (b) 84.033 (c) 84.038 (d) 84.063 (e) 84.268 (f) 84.379 - Year Ended June 30, 2022. Condition: We tested 40 files, 18 of which were Pell Grant recipients, and 2 students did not receive the full amount of their allowed Pell grants. The students were eligible for $65,480, but received $64,930. For one student, this condition was caused by using the 20-21 Pell Award Chart for a 21-22 Pell Award. For the other student, this condition was caused by using the College's institutional EFC instead of the student's EFC noted on their FAFSA. Management Response: We accept this finding and immediately filed a correction with the Federal Pell Grant Program when the discrepancy was discovered during fieldwork. The affected students had no adverse impact with this issue as the incorrect Pell award was initially offset by increased Knox College aid. Corrective Action Plan: The college will devote additional attention to awarding the Federal Pell Grants. Prior to disbursement, a report of all Title IV recipients will be reviewed with the amount of Federal Pell grant the recipient receiving. A manual review will occur to ensure that the accurate Federal Pell Grant amount is correct based on the Expected Family Contribution and Cost of Attendance. Responsible Person: Alexander Guroff, CFO Implementation Date: January 23, 2023

Finding Number 2022-003 SPECIAL TESTS AND PROVISIONS- ELIGIBILITY - COMPLIANCE DEFICIENCY Agency Name FEDERAL AGENCY: PUBLIC AND INDIAN HOUSING, DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT Program ALN 14.850 ? PUBLIC AND INDIAN HOUSING Contract # N/A Criteria Eligibility for Individuals - Most PHAs devise their own application forms that are filled out by the PHA staff during an interview with the tenant. The head of household signs (a) a certification that the information provided to the PHA is correct; (b) one or more release forms to allow the PHA to get information from third parties; (c) a federally prescribed general release form for employment information; and (d) a privacy notice. Under some circumstances, other members of the family may be required to sign these forms (24 CFR sections 5.212, 5.230, and 5.601 through 5.615). Condition/Context The Authority received funding from the Public and Indian Housing Operating Fund. The Public and Indian Housing program is to provide and operate cost effective, decent, safe, and affordable dwellings for lower income families through an authorized local PHA. Of the sixty (60) case files selected for testing in which 540 pieces of audit evidence (eligibility forms as noted in the Criteria section above) were requested to be provided: ? Five eligibility forms were not provided (3 missing application forms and 2 missing release forms). These forms are required documentation to be maintained in the case files to support eligibility for Public and Indian Housing. Therefore, we were not able to determine if the eligible participants met all the eligibility criteria. Recommendation We recommend the Authority strengthen its controls over the Public and Indian Housing ? Operating Fund case files to ensure that all eligibility forms are received, reviewed, and maintained in the case files to support the determination of eligibility Corrective Action Plan Step 1 A follow-up search by the property Housing Managers and Management Services Department was unable to locate the three missing Original Application forms. One of the three missing Original Application forms was due to the resident?s folder that had been damaged during Superstorm Sandy. In January 2011, NYCHA implemented the Siebel Customer Relationship Management (CRM) system, which included digital file storage and an online application process, which replaced our previous paper application process. Any applications in process from that date onward were subject to document scanning and documentation was stored digitally. Any applications processed prior to this date were kept in a paper format and stored at the development, where the applicant was certified or where the tenant resides. If a tenant family transferred to another development, the physical tenant folder and documents were sent to their new location. In June 2020, NYCHA sought to digitize all tenant folders; however, the cost of the project was determined to be prohibitive so the goal of digitizing the tenant folders was not realized. Any documents damaged or lost prior to 2011 cannot be recovered, including those impacted by Hurricane Sandy. Corrective Action Plan- Step 2 ? A follow-up search by the property Housing Managers was unable to locate the two missing Consent to share your personal information NYCHA 042.785. On September 20, 2023, the Management Services Department requested that the property Housing Managers contact the residents to sign the consent form, and upload to Siebel. As a result, it was discovered that in one of the cases the Head of Household had died, and the development began the legal process to regain possession of the apartment through the holdover proceeding in Landlord Tenant Court. Action Date September 20, 2023 Final Implementation October 13, 2023 Name And Phone Number Of Person Responsible For Implementation Sylvia Aude Office of the Senior Vice President for Public Housing Operations, Tenancy Administration Senior Vice President 212-306-3921

Federal Agency: US Department of Homeland Security Federal Program Name: FEMA Public Assistance Grant Program Assistance Listing Number: 97.036 Award Period: Year ended December 31, 2022 Type of Finding: ? Significant Deficiency in Internal Controls over Compliance ? Other Matters Criteria: The Foundation?s internal controls related to the FEMA Public Assistance Grant Program state that authorization form are required to be obtained by the appropriate level of management for all capital purchases. Condition: The compliance requirements state that FEMA evaluates the eligibility of all costs claimed by the applicant. Not all costs incurred as a result of the incident are eligible. Costs must be authorized and not prohibited under federal, state, territorial, tribal, or local government laws or regulations as well as consistent with applicant?s internal policies, regulations, and procedures that apply uniformly to both federal awards and other activities of the applicant. Questioned Costs: $-0- Context: It was noted that as a part of Aultman Health Foundation's internal controls related to FEMA funding, as well as other capital projects, that one signed authorization form was required to be obtained by the appropriate level of management to approve capital purchases. Per discussions with client, they were unable to locate the signed authorization form for a set of disbursements totaling $44,631 associated with one of the FEMA projects. Per further discussion with client, the signed authorization form was obtained and retained by an employee who is no longer employed with the Foundation and therefore, access to this signed copy was no longer available. Effect: There is potential that capital purchases could be made without authorization from the proper level of management. Recommendation: We recommend that for all capital purchases, especially for projects that utilize federal funding, formal authorization is obtained from the appropriate level of management. Additionally, it is recommended that the signed authorization forms be retained in a location that is easily accessible when requested.Views of Responsible Officials and Planned Corrective Actions: Aultman Health Foundation created a central shared location for all signed capital authorization forms to be kept electronically for reference.

Finding 2022-001 U.S. Department of Housing and Urban Development Moving to Work Demonstration Program - ALN 14.881 Eligibility and Reporting Repeat Finding from 2021 Maher Duessel Finding Condition: During our review of 60 tenant files prepared by the Housing Authority of the City of Pittsburgh (Authority) as part of the biennial reexamination process, we noted a lack of functioning internal controls which led to the below exceptions in our testing. We noted two (2) tenant files (which provide eligibility and reporting information) were unable to be provided. Additionally, we noted four (4) tenants for which the most recent recertification was not completed on a timely basis. Also noted was one (1) tenant file that did not contain the required income verification support. In all cases previously described the HUD-50058 Family Report (OMB No. 2577-0083) (HUD-50058) forms prepared by the HACP were not completed and/or did not contain support for the calculations. All instances related to the MTW ? Housing Choice Voucher (HCV) Program. In addition, we noted the following exceptions related to the tenant recertification process: We noted two (2) instances where the application was missing or not signed, three (3) instances where the tenant files was missing a social security card or driver's license, two (2) instances where a signed lease agreement was missing and two (2) instances where a signed HAP contract was missing. HACP Management Response/Action Taken: Action Taken: The HACP will continue to monitor and train staff regarding processes and procedures, to include and not limited to the HUD's hierarchy of income verification. In fiscal year (FY) 2022 the HCV Department had a significant turnover in line and managerial staff. The HACP promoted an aggressive hiring plan to attract new talent to fill vacant positions due to the great resignation that the HACP along with other national Agencies continue to experience. In addition, the HACP retained the services of CVR and Associates to train newly hired staff on all aspects of the HCV Program, to include and not limited to recertifications, contracts, interims, and rent increases. The HACP will continue managerial and internal audits by the HACP Internal Compliance Department to reduce the necessity of corrections subsequent to the initial submission. The HACP continues to: ? Send notices regarding re-certifications 120 days in advance of the due date, ? Require Managers to review reports to assure timely submission of re-certifications, ? Utilize the Internal Compliance (IC) Department to review and sample files from the Occupancy and the HCV portfolio, ? Make corrections when discovered, ? Make payment adjustments to participant accounts when errors are discovered and corrected. ? The HACP will offer periodic staff training on re-certification, ? The HACP offers participants the use of technology to complete paperwork. During FY 2022, the HACP was closed to the public. In July of 2023, the HACP opened a "One Stop Shop" that is open to the public from 8 a.m. to - 4:30 p.m. daily. The One Stop Shop has is staffed with four (4) full-time staff members to receive information from participants and landlords to provide timely customer service. The opening of the One Stop Shop has been successful in receiving the public and responding to concerns.

2022-001 Income Certifications Name of contact person ? Angela Riley, CFO Corrective action ? The Corporation agrees with the finding, and has continued to implement strategies to address these issues throughout 2021 and 2022, including: assembled and deployed a team of external consultants and temporary workers to assist site staff in completing tenant recertifications, hired a team of 6 additional roving property management/compliance teams to cover open property management positions and to support site staff in completing tenant recertifications, developed a new training program to onboard site staff, and developed a monitoring program to set expectations and hold employees accountable to those expectations. Proposed completion date ? Management has begun the corrective action and is expected to have additional internal controls and training done by December 31, 2023.