Corrective Action Plans

EOHHS has met expectations on aligning the FSR and FDCR reports, has updated files to Milliman, and continues to monitor compliance. EOHHS is currently in a maintenance phase and will continue monthly oversight going forward. Anticipated Completion Date: Current and Ongoing Contact Person: Steven Corvese, Plan Analyst, Executive Office of Health and Human Services steven.corvese@ohhs.ri.gov

The findings can be grouped into several areas as shown below. The responses are included below each grouping. Each response is included in each category. 1. Licensing a. “Licensing for providers of behavioral healthcare services and home and community-based services to members with developmental disabilities are, by statute, the responsibility of the Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH). BHDDH, in conjunction with evaluations of provider health and safety standards, relicenses providers biennially. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from BHDDH resulting in a weakness in control for this segment of providers.” b. “Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from DCYF resulting in a weakness in control for this segment of providers. c. 4 out of 60 providers sampled noted instances where providers remained active during fiscal 2024 after provider licenses had expired, evidencing a deficiency in internal control relating to timely provider deactivation if provider licensure is not evidenced. No claims were paid to these providers thus noncompliance was not noted.” EOHHS’ Division of Medicaid Compliance is actively working with BHDDH, DCYF, and RIDOH to address the licensing concerns by strengthening the communication of end dates between each agency’s licensing division and Medicaid’s Division of Medicaid Compliance. Anticipated Completion Date: Ongoing. Anticipated June 2025. Contact Persons: Emily Tumber, Implementation Director of Policy and Programs, Executive Office of Health and Human Services emily.tumber@ohhs.ri.gov Nicholas James, Implementation Director of Policy and Programs, Executive Office of Health and Human Services nicholas.james@ohhs.ri.gov 2. Systems a. “Encounter data submitted by managed care organizations is not currently validated for provider enrollment upon acceptance. This deficiency in internal controls over provider eligibility prevents the detection of claiming submitted by unenrolled providers. Our testing noted 4 managed care providers that were not enrolled in the Medicaid Program as required by federal regulations resulting in noncompliance with provider eligibility requirements (questioned costs - $3,371). All 4 providers were out-of-state providers required to be enrolled under federal regulations based on the volume of services billed to RI Medicaid. Implementing this additional edit when processing encounter data would improve controls over compliance. b. For claims representing care furnished to a beneficiary by an out-of-state furnishing provider, the SMA may pay a claim, in limited circumstances, to a furnishing provider that is not enrolled in the reimbursing state’s Medicaid plan. In these circumstances, the State is required to meet several requirements including verification that the provider is enrolled in good standing in Medicare or another state’s Medicaid program. The State is not currently performing such validation for out-of-state providers with limited claiming. c. The State did not have documentation supporting review of the SSA Death Master file for 19 out of the 60 providers we tested. a. EOHHS conducted research on these cases and completed a system upgrade to remedy the issue on 5/1/2024. b. EOHHS conducted research on these cases and completed a system upgrade to remedy the issue on 5/1/2024. c. EOHHS implemented new Provider Screening Tool in February 2025 which will provide dated documentation following the automated search for various screening requirements, including Death Master File. This documentation will be uploaded to the provider file. This will eliminate the manual process of searching for providers individually through the Death Master File and relying on an individual recording the date. Anticipated Completion Date: Ongoing Contact Person: Kimberly Tebow, Senior Medical Care Specialist, Executive Office of Health and Human Services kimberly.tebow@ohhs.ri.gov 3. Provider Surveys a. Federal regulations require the Medicaid agency to execute provider agreements with nursing facility providers and intermediate care facilities for individuals with intellectual disabilities (ICF/IID) upon receiving notification from the State survey and certification unit that the provider has been certified in substantial compliance with federal health and safety regulations. The State Medicaid agency lacked documentation of a finalized provider agreements and approval letters to providers in 6 out of 18 providers reviewed. In respect to the State’s only ICF/IID facility, the State Medicaid agency was not monitoring the RI Department of Health’s (RIDOH) certification process and had no documentation from RIDOH regarding the facility’s health and safety certification. All providers were recertified by RIDOH and compliant with program health and safety requirements. EOHHS/Medicaid implemented tracking protocol for all surveys received by the RIDOH to ensure completeness and timely response. Revisions to the internal standard operating procedure for the review and approval of these surveys are under review. This was completed on February 1, 2024. Regarding the monitoring of RIDOH’s certification process, EOHHS will collaboratively work with RIDOH to implement a monitoring program. Anticipated Completion Date: June 2026 for the monitoring program. Contact Person: Patricia Arruda, Chief of Strategic Planning, Monitoring & Evaluation, Executive Office of Health and Human Services patricia.arruda@ohhs.ri.gov

2024-056a: During SFY 2024, several system fixes were deployed to address the findings noted in 2024-056. Specifically, in September 2024, a system fix was put in place to ensure children with verified SSNs were appropriately evaluated for Medicaid/CHIP coverage and excluded from Cover All Kids. RI Bridges appropriately determines eligibility for CHIP when TPL data is not present. Once TPL information is known to the system, existing eligibility rules will only evaluate for Medicaid, not CHIP. The TPL exceptions noted by the OAG show a discrepancy between TPL data in the MMIS and the information sent to RI Bridges via the TPL loopback file. EOHHS will work with their vendor to determine the root cause of the discrepancy and establish a corrective action plan if appropriate. Rhode Island did not participate in the February 2024 PARIS interstate match due to a file issue that has since been addressed in April 2024. The May and August 2024 PARIS matches were suspended at the Federal level for all States due to an outstanding computer matching agreement between the DoD and HHS/ACF. Enhancements to existing PARIS Interstate match logic are scheduled to run as planned for fall/winter 2025. Income/Wage Validation: EOHHS completed implementation of an interface on 3/5/24 between The Work Number (TWN) and RI Bridges. Contract and budget actions for TWN services were not completed until fall 2024. The system requirements that Equifax initially communicated to the State and our Integrated Eligibility System implementation partner were incomplete and the original integration configured in fall 2024 did not successfully pass testing. A system modification to correct the original specifications was originally scheduled for February 2025 but was delayed due to the 12/13/24 RI Bridges cyber event. Target date for TWN implementation is July 2025. Anticipated Completion Date: July 1, 2025 for income/wage validation. Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-056b: The Center for Staff Development and Learning (CSDL) the lead for training at the Rhode Island Department of Human Services (RIDHS) will work towards correction by using a blended approach to learning using formal (classroom or virtual learning sessions) and on the job learning activities. will conduct the following: a. The CSDL Team will continue to include in its Ex Parte Learning Series review of where the system performs an Ex Parte review to determine Medicaid eligibility for age outs ages 19, 26, and 65. In addition, included in the Medicaid Refresher, currently in development, a review will be done of updating income and verification procedures that includes end date and employment segments when household members lost employment. b. The Operations staff supervisors will schedule processing labs that will require the participants to process live cases with guidance from a supervisor. Anticipated Completion Date: The trainings and refresher learnings are ongoing. Processing labs are scheduled as need for this specific topic, we anticipate that processing labs will be scheduled and completed between July – September of 2025. The Medicaid Refresher Learning Series will be released in July. This training will also be ongoing. Contact Person: Zulma Valenzuela, Assistant Director of Administrative Services, Center for Staff Development and Learning, Department of Human Services zulma.valenzuela@dhs.ri.gov 2024-056c: As noted in prior year responses, CMS will not pursue recoveries associated with questioned costs given that recoveries based on eligibility errors can only be pursued when identified by programs operating under CMS’ Payment Error Rate Measurement program per section 1903(u) of the Social Security Act and regulations at 42 CFR Part 431, Subpart Q. This limits CMS’s ability to recover on most of the SSA eligibility findings. While CMS will pursue the internal control deficiencies noted by the SSA, CMS will not pursue recoveries associated with the questioned costs. Anticipated Completion Date: Not Applicable Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov

Management agrees with the finding regarding inaccurate calculations. Management disagrees with the finding regarding information about DCYF children in the system. The Office of Child Care (OCC) is continually reviewing available training materials related to CCAP eligibility and case processing and has identified certain gaps where additional training/clarification, and more frequent communication to processing staff is needed – specifically in income calculation/input of paystubs, confirming asset declarations, and confirming need hours. OCC is working with the DHS training department to create a CCAP-specific training to provide in-depth coverage of program requirements. OCC continues to present at quarterly meetings to highlight error findings and the critical importance of accurate documentation. In addition, the CCAP administrator works continuously with field staff and Deloitte through weekly theme meetings to identify areas where system changes can improve accuracy of eligibility determinations. OCC is currently reviewing the grace period/short-term approval policy, how it is applied to specific cases, and how it is implemented in RIBridges. The finding has been escalated from the CCAP administrator to the assistant director of the Office of Child Care to ensure continued collaboration from all facets of the eligibility work to continue to improve errors in determination. Anticipated Completion Date: Ongoing – will continue to see a decline in errors in eligibility approval. Contact Person: Nicole Chiello, Assistant Director, Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov

2024-053a: The State (EOHHS) receives quarterly user access reports from the MMIS fiscal agent. Anyone identified on the reports that have not logged in for a period of 60 days will have their access terminated. Terminating the users access locks them out and prevents access the system without first requesting a password reset, which is reviewed and approved/denied by EOHHS systems group. In addition, when a user leaves state service or moves to another agency, their access is terminated immediately. An SOP will be implemented with offboarding procedures to assist in timely removal of access. Access is maintained and controlled within the GainwellNow system. Email notifications of pending requests for access are sent to Hector Rivera and Kim Tebow (both EOHHS), who must then review the request and attached form and either grant or deny access. An FTE will be added to the EOHHS/Medicaid Systems team to standardize all user access policies and procedures. Oversight of all IT security activities performed by the MMIS contractor is the responsibility of the EOHHS/Medicaid Project/Contract Manager assigned to the vendor. This individual is supported by the ETSS AIM assigned to support EOHHS/Medicaid. A SOC audit is completed yearly and provides documentation for penetration and vulnerability testing. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov Kimberly Tebow, Senior Medical Care Specialist, Executive Office of Health and Human Services kimberly.tebow@ohhs.ri.gov 2024-053b: The 2025 MARS-E Assessment is underway and will be completed by 4/30/2025. The results will be reviewed to assure the items in the previous MARS-E assessment have been addressed as expected by the state. Documentation lacking to evaluate security controls; Complete pending MARS-E Assessment Continued use of unsupported applications in need of update or patching; major upgrade of the end of life frameworks is planned for SFY2026 start. This expensive upgrade structurally supports most of the modernization platforms that the state is considering. Start SFY 2026; Completion SFY 2027 Lack of contractor tracking of exceptions and risk assessments; Exceptions for vulnerabilities are tracked in JIRA. Risk assessments are performed in all security tests and periodically on security controls. CISO approves all vulnerability exceptions. Complete pending MARS-E Assessment Contractor only sharing partial vulnerability scanning results; Raw report results are provided in Sharepoint in support of the risk assessment process. Complete pending MARS-E Assessment Lack of a robust triage process for security vulnerabilities; Complete pending MARS-E Assessment Inadequate consideration of IT security vulnerabilities with industry best practices. Security vulnerability assessments are performed using the CMS method of impact X probability. The method has been reviewed by state and MARS-E assessor. Complete pending MARS-E Assessment Anticipated Completion Dates: See above Contact Person: Deb Merrill, Security Officer, Enterprise Technology System Services, Department of Administration deb.merrill@doit.ri.gov 2024-053c: The State (EOHHS) collaborates with system vendors (MMIS/Gainwell and Deloitte/RI Bridges) Maintenance & Operations (M&O) and Security teams to ensure annual risk assessment/vulnerability best practices and lessons learned are integrated into annual planning and scope of work for future FYs. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov 2024-053d: Our controls for User Access are in place. Depending on the access requested by the type of user and the program being administered, access are provided accordingly. Anticipated Completion Date: Current and Ongoing Contact Persons: Saurabh Gosai, Director – Technology, Strategy and Innovation, Department Human Services saurabh.u.gosai@dhs.ri.gov Sherri Kennedy, Chief - Human Services Policy and Systems Specialist, Department of Human Services sherri.kennedy@dhs.ri.gov

DHS management has implemented new procedures in SFY25 and anticipates this will not be a finding for the next Single Audit. Preparers of reports have been instructed to do a lookback for any additional entries from prior quarters not previously reported. Each report is now saved with the supporting documentation on a shared drive. Additionally, DHS will document the process of quarterly federal financial reporting. Regarding Federal Funding Accountability and Transparency Act (FFATA) reporting, DHS has started to track reporting by capturing contract execution dates to ensure timeliness. Anticipated Completion Date: June 30, 2025 Contact Person: Ben Quattrucci, Associate Director Financial Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov

System changes to modify the time schedule that RIBridges interfaces with SWICA for processing tasks has already been submitted (RIB-141767). Currently, the interface occurs twice yearly. This will increase the frequency to quarterly. Anticipated Completion Date: October 31, 2025 Contact Person: Donna Rook, Administrator, Family and Adult Services, Department of Human Services donna.m.rook@dhs.ri.gov

DHS continues its prior actions of training addressing eligibility, standing agenda on meetings, and quarterly meetings. At this time, DHS has completed the solicitation to hire a contractor to identify problematic processes, through the Business Processing Excellence Reengineering project. (BPER). The scope of work includes evaluating the eligibility to determine the deficiencies and to propose solutions. Anticipated Completion Date: Ongoing Contact Person: Donna Rook, Administrator, Family and Adult Services, Department of Human Servicesdonna.m.rook@dhs.ri.gov

Finding: 1 of 60 individuals had a return-to-work date submitted by the employer, however, the claimant received three payments after that date. DLT did not investigate any potential overpayment. (Questioned costs - $2,139) We do not concur with this finding. Per ETA guidance, specifically UIPL 01-16, because this claim was in payment status, we have to continue to make timely weekly payments (after proper certification), and an overpayment cannot be deemed recoverable until an official ineligibility determination is rendered. Unemployment Insurance Program Letter 01-16 states “in order to be eligible to receive administrative grants, a state must do the following in context of identifying and establishing improper payments…continue to make timely UC payments (if due) and wait to commence recovery of overpayments until an official determination of ineligibility is made…” In addition to the above requirement, data that State Workforce Agencies gather from crossmatch sources such as IB4, wage record /benefit, SDNH and NDNH wage/benefit have to be verified prior to initiating a decision disqualifying benefits. The actual cross match itself simply produces possible cases to investigate. The investigation is then initiated when the department sends out a request for wages form (720). When the form is returned by the employer the department can then use the verified information to render a disqualifying decision. A crossmatch itself is not enough to render a working and collecting determination based on wage record data as the claimant may have had actual earning within the quarter. The date identified on a NDNH crossmatch also is not enough to render a disqualification. This information needs to be verified. From: Unemployment Insurance 401 Handbook ETA 227 – OVERPAYMENT DETECTION AND RECOVERY ACTIVITIES E. Definitions 4. Cases Investigated. The number of cases emanating from a state-initiated overpayment detection process for which an investigation regarding a potential overpayment has been concluded. Example: during a wage/benefit crossmatch process, a state agency produces a printout identifying all benefit payments matched against wages in the same quarter. After the printout is screened, requests are sent to employers to identify which weeks in the quarter were worked. When an employer reply indicates overlap with weeks for which benefits were paid, claims are investigated to determine if they were overpaid. This was a continued claim that was effective 8/13/23 and the claimant certified weekly through 2/17/24. The RTW date listen on the ledger was autogenerated on 2/27/24. At this time the claimant had exhausted their balance of credits, all benefits had been paid. The date listed as the return-to-work date from the NDNH crossmatch stated 1/30/24. Since this date had the potential to affect benefits the department initiated it’s investigation and did send a 720 form to the employer to obtain the proper wage information. Since the requested information was not returned by the employer, the department lacked the proper information necessary to render a disqualification based on ETA guidelines. Finding: 1 of 60 was not registered within EmployRI and staff were unable to locate any records of the claimant. (Questioned costs - $10,829) The agency concurs with the above finding that includes state UC questioned costs of $10,829. This exception was caused by a programming (IT system) error. A nightly job is run that is sent to Workforce Development (Geosol) which then registers claimant’s with EmployRI. An issue was discovered on claims where the effective date of the claim was 56 days prior to the first payment being issued. These claimants were not populated on the nightly transfer to Workforce. ETSS has confirmed that this programming error has been fixed. We acknowledge the Auditor’s recommendations and offer the following response. We feel the findings, while relevant, are de minimis in scope, when compared to the workload volumes processed. Our current unemployment systems (Tax and Benefits) are aged and distressed. Due to their age and technology constraints, any changes or modifications needed, cannot be easily or quickly implemented. As such a larger burden is placed on staff to handle manually. DLT ‘s limited technology resources combined with having limited staffing resources also hinder our efficiency. We have limited staff resources to manually address our workload volumes, as well as the sheer number of forms involved in making proper determinations. In addition to this, the law requires benefit payments to be made timely based on available information until verifiable evidence is found that justifies a disqualification. Therefore, until we can implement a more modernized tax and benefits system, we acknowledge that similar findings such as these may persist. We will continue to utilize the resources we currently have and strive to be more efficient. We hope that by providing additional staff training and by strengthening our relationship with Workforce Development, this improved efficiency will be realized. We are in the process of evaluating whether or not an amendment to our work search requirement, is needed. In doing so, we will evaluate whether any changes are necessary to either; our internal policy, the guidance provided on the claimant’s benefit rights, the guidance displayed on DLT’s website and to regulation 1.18 Filing of Claims for Unemployment Insurance Benefits. Any necessary modifications will be made. Anticipated Completion Date: December 31, 2025 Contact Person: Philip D’Ambra, Director of Income Support, Department of Labor and Training philip.l.dambra@dlt.ri.gov

RIDE is currently evaluating third-party consultants in order to have the following services performed: • A cybersecurity assessment performed of the overall agency using the NIST Framework • A cybersecurity assessment of our internal applications including CNP Connect & Accelegrants • An updated business continuity plan • A Vendor Risk Assessment Program Development Through the above deliverables from the selected consultant, RIDE will be able to have a better understanding of gaps in IT/ Cybersecurity throughout the agency, as well as the applications cited by the Auditor General. Anticipated Completion Date: December 31, 2025 Contact Person: Brandon Bohl, Finance Director, Department of Elementary and Secondary Educationbrandon.bohl@ride.ri.gov

The District will ensure that Additional or Compensatory Special Education or Related Services (ACSERS) funds are not used to fund Substitute Services due to the teacher shortage.

2024-002: Health Centers Cluster – ALN# 93.224 Health Center Program (Community Health Centers, Migrant Health Centers, Health Care for the Homeless, and Public Housing Primary Care), ALN# 93.527 Grants for New and Expanded Services under the Health Center Program, June 30, 2024 - Special Tests and Provisions Condition: The Organization did not retain documentation or other evidence that patients were eligible for adjustment (discount) that was received. Corrective Action Plan: Patient Service Representatives are responsible for ensuring sliding fee schedule docuemtns are current. We have implemented another layer of oversight to ensure moving forward, we will be able to identify any patients with expired documentation for the sliding fee scale application. The PSR Lead will run a monthly report in the EMR to capture any information that may have been inadvertently missed and will help us ensure updates are completed accurately and in a timely manner. A report was run initially for the current fiscal year and will be run monthly going forward to identify expired applications so we can update accordingly. Responsible Person for Corrective Action Plan: Director of Operations and PSR Leads Implmentation Date of Corrective Action Plan: April 16, 2025

Finding 2024-004: U.S. Department of Housing and Urban Development – CFDA #14.871 Housing Choice Vouchers Applicable Federal Award Number and Year- HCV2024 HQS Enforcement Name of contact Person: Jenette Jemison, Director of Housing Operations Anticipated completion date: In Progress Planned Corrective Action: • SMHO will provide additional staff training and testing of understanding through a thirdparty training platform for inspections and re-inspections procedures. Management will quarterly review each file that requires re-inspection to ensure all documents are present in the file.

Finding 2024-003: U.S. Department of Housing and Urban Development – CFDA #14.871 Housing Choice Vouchers Applicable Federal Award Number and Year- HCV2024 Eligibility Name of contact Person: Jenette Jemison, Director of Housing Operations Anticipated completion date: Completed Planned Corrective Action: • SMHO will require managerial file review/approval for income used at new move-ins, port-ins and annual re-exams and the manager/lead will initial the new income line item added to the check sheet for each file to indicate the review/approval has been completed.

Finding 2024-002: U.S. Department of Housing and Urban Development – CFDA #14.871 Housing Choice Vouchers Applicable Federal Award Number and Year- HCV2024 Eligibility Name of contact Person: Jenette Jemison, Director of Housing Operations Anticipated completion date: Completed Planned Corrective Action: • SMHO will require managerial file review/approval for all new move-ins, port-ins and annual re-exams and the manager/lead will sign the check sheet for each file to indicate the review/approval has been completed.

Contact Person – Krista Martin, Director of Finance and Administration, and Ryan Riesinger, Executive Director Corrective Action Plan – Review and update procedures to ensure accurate reporting. Completion Date –December 31, 2025

Ensure full compliance with HUD regulations and internal policies related to eligibility documentation, income verification, utility allowances, and rent reasonableness determinations in the Housing Choice Voucher (HCV) program. 1. Correct the Deficiencies in the Identified Files Issue Missing 214 Declaration Form Utility Allowance Calculation (2 files) Missing Third-Party Income Verification Missing Rent Reasonableness Determination Action Contact tenant to obtain and file the signed 214 declaration. Recalculate and document the utility allowance using the current approved utility schedule. Request and obtain third-party verification; if unavailable, follow up with tenant and document efforts per HUD guidelines. Conduct and document rent reasonableness review for the current unit. Responsible Party Housing Specialist Housing Specialist Housing Specialist HQS/Rent Reasonableness Officer Timeline Within 10 business days Within 10 business days Within 10 business days Within 10 business days 2. Expand Review to Broader File Population Action Details Responsible Party Timeline Risk-based Review of Additional Files Identify Systemic Issues Report Findings Identify a representative sample of 100-200 files from the broader tenant population to assess the prevalence of the noted deficiencies. Track and categorize findings to identify patterns of noncompliance. Present findings to leadership and recommend procedural changes if systemic issues are found. Quality Assurance (QA) Team QA Manager QA Manager Within 45 days Within 60 days Within 75 days 3. Strengthen Policies, Procedures, and Staff Training Update Procedures Revise Standard Operating Procedures (SOPs) for file documentation, utility allowances, and rent reasonableness. Include clear checklists. Program Manager Within 90 days Staff Training Conduct mandatory refresher training on eligibility documentation,income verification protocols, rent reasonableness, and utility allowance schedules. File Audit Checklist Implement a standardized checklist for file reviews before final approval. 4. Ongoing Monitoring and Compliance Quarterly File Audits Continue random quarterly audits of tenant files to ensure ongoing compliance. Compliance Reporting Include compliance metrics in monthly management reports. Corrective Action Tracking Maintain a tracking system for noted deficiencies and corrective actions taken.

DCH will review MO 598348 within the Gateway system to ensure the established interface process is functioning properly. DCH will draft additional guidance through a policy memo to revise DHS policy 2750 as it relates to the processing of Ex-Parte members. The DCH policy memo will clarify that upon the completion of the determination by DHS, Gateway will notify GAMMIS of A/R's approval or denial thorough daily interface files sent from Gateway to GAMMIS. The non-confirmation report will be reviewed to determine SOP and validate that the file has been received. Additionally, the DCH policy memo will require Gateway to complete the DMA-962 and submit to Gainwell for manual processing if the file has not been received. DCH is also reviewing current policy to determine if the infinity date established for Ex-Parte members can be revised to a time-limited date.

DCH will develop a reconciliation process between members denied within Georgia Gateway and members removed within GAMMIS. DHS will provide training as outlined within the current contract to address changes and updates to Medicaid policy and the Georgia Gateway system.

The student in question had a lengthy break in enrollment (2015-2024). When the student returned, CGTC’s Banner rules differed from his previous enrollment and his status was not accurately updated within the correct term. To correct the issue, CGTC has worked with colleagues at the Technical College System of Georgia to identify and correct any discrepancies in the Banner rules for the Satisfactory Academic Progress (SAP) process to prevent future occurrences of this issue. The College’s Financial Aid office has identified the “cutoff” year for changes in SAP rules and has developed a procedure to manually review any students with long breaks in enrollment whose last enrollment occurred prior to the identified cutoff. This review process will help to ensure that students’ SAP status is accurately updated in the correct term.

Georgia State University (GSU) will ensure all team members are appropriately trained related to the process for locking student financial aid records and completing verifications after the term ends. Additionally, GSU has enhanced monitoring procedures to identify changes to institutional student information records after term ends with a verification indicator to ensure these accounts are resolved in a timely manner.

Effective November 16, 2024, GDOL restructured the Benefit Accuracy Measurement (BAM) unit to strengthen internal controls by incorporating a secondary review process prior to the final review by the supervisor. This process allows the reconciliation of discrepancies and validates the accuracy of the case findings prior to the supervisory review. If the reviewer identifies questionable items during the review, the case is returned to the auditor for corrections and updates. Once completed, it is returned back to the reviewer for an additional review, sign-off, and then submission to the supervisor for review and closure. Beginning April 2025, an initiative will be implemented to train staff to perform quality checks. Staff will review a sample of cases completed by other auditors in the previous quarter and provide feedback. This plan is being established to posture staff to supplement gaps in resources if the need arises and address challenges, such as, attrition. This allows staff to effectively fulfill the responsibility of reviewing cases and preparing them for official signoff in a timely manner. Summary: GDOL greatly appreciates the feedback and recommendations and has and will continue to take appropriate measures to ensure the established BAM procedures are followed.

GDOL Response: GDOL acknowledges this is a repeated finding from previous years and is partially resolved, therefore the Department concurs with this finding and offers the following response. GDOL’s limited technology resources and funding will hinder our ability to update our current system to satisfy the state audit’s recommendation. Therefore, we acknowledge that this finding will persist until a system-wide resolution is implemented in the new modernized UI system. GDOL will include a self-certification and dual certification process for employer-filed claims in the new solution. GDOL will also secure data analytic tools to aid GDOL staff with the identification of potential improper or fraudulent Payments, which will include payments linked to employer filed claims.

GDOL Response: GDOL acknowledges this is a repeated finding from previous years and is partially resolved, therefore the Department concurs with this finding and offers the following response. GDOL’s current UI Information Technology (IT) system was developed in 1982 using mainframe “legacy’ technology. Due to the system’s age and other limitations, many automated processes and corrections cannot be fixed and/or easily implemented. As such, many processes must be handled manually by staff. This includes reviewing all the Pandemic Unemployment Assistance (PUA) proof documents submitted to determine the validity and eligibility for each PUA claim. Based on the volume of workload and staff limitations, GDOL has been unable to quickly complete this manual review to correct the finding. It is anticipated this manual review will continue throughout the FY25 audit review period. The modernized UI system will include controls over eligibility determination for current and future unemployment programs. Employer-Filed Claims (EFC) are submitted by employers on behalf of the claimant. The employer is responsible for attesting to the employment status and weekly earnings of the claimant for the EFC submitted. An affidavit certifying that the employer has obtained earnings from other employment as well as other requirements must be completed before EFCs can be entered or uploaded. Claimants for which EFCs submitted are considered to be still attached to the employer and are exempt from the requirement to register for employment services per Georgia Employment Security Law Rule 300-2-4-.02. Such individuals are not required to be nor certify on a weekly basis to be able, available and actively seeking work. We recognize the state auditor's recommendations to add the self-certification. However, the current unemployment system is aged and distressed. GDOL’s limited technology resources will hinder our ability to update our current system to satisfy the state audit’s recommendation. Therefore, we acknowledge that this finding will persist until a system-wide resolution is implemented in the new modernized UI system. GDOL will include a self-certification process for employer-filed claims in the new solution. GDOL has procured a vendor to build and implement a modernized UI system. We are also pursuing data analytics tools to expedite the identification and detection of fraudulent activities. These tools will also be incorporated into the modernized solution. Summary: GDOL greatly appreciates the feedback and recommendations and will ensure they are incorporated into the new UI modernized system which is planned to be implemented in Spring 2026.

Recommendation: We recommend that management implement a control to ensure complete documentation is maintained for all cases that require retainer agreement. Explanation of disagreement with audit finding: There is no disagreement with this finding. Action taken in response to finding: Our Deputy Director/General Counsel contacted the person who had failed to sign the retainer that was missing the staff signature to remind them of that requirement. She also held a training on LSC requirements in Q1 2025 in which she reminded staff of the retainer requirement. Name of the contact person responsible for corrective action: Teresa Sullivan, Deputy Director / General Counsel Planned completion date for corrective action plan: Already implemented