Corrective Action Plans

Finding Number 2024-050 U.S. Department of Health and Human Services Children’s Health Insurance Program (CHIP), 93.767 Medicaid Cluster: State Medicaid Fraud Control Units, 93.775 State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, 93.777 Medical Assistance Program (Medicaid; Title XIX), 93.778 Summary of Finding for 2024 Audit: PARIS data was not utilized by the Nevada Health Authority (NVHA) or the Nevada Division of Social Services (DSS) to monitor residency changes to determine when managed care benefits needed to be terminated because the beneficiary was a resident of another state for Medicaid purposes. NVHA and DSS did not have internal controls in place to effectively communicate the PARIS data between the two agencies to ensure managed care benefits were terminated when appropriate. Individuals are enrolled in Medicaid (and CHIP) plans in multiple states and benefits are not being terminated timely. Therefore, the State of Nevada is paying capitation payments to managed care organizations, when the benefits should have been terminated. We recommend NVHA and DSS implement internal controls to effectively communicate the PARIS data between each other and to ensure managed care benefits are terminated when appropriate. NVHA Response: The Nevada Health Authority agrees with this finding. Contact Person(s): Russ Steele, Audit Manager Corrective Action Planned: The Division of Social Services (DSS), which conducts eligibility and enrollment on behalf of Nevada Medicaid, automated the PARIS process as of September 30, 2025. The automation is designed to streamline the quarterly PARIS process. Upon receipt of the file, the system generates initial requests for information to customers identified, requiring them to confirm Nevada residency. Customers are allowed 30 days to respond. Approximately five days after the initial request, reminder notices are issued by text message and email to customers who have not responded. Customers who fail to respond within the 30-day timeframe, or who confirm an out-of-state address, will be terminated in accordance with policy, while those confirming Nevada residency will retain eligibility. NVHA continues to implement processes to ensure that MMIS will receive closure information related to PARIS matches and report it to T-MSIS. Once DSS has determined that termination is needed within the timeframes outlined above, DSS will send a “Y” indicator to MMIS and proceed with the termination which will also terminate the member from managed care benefits. This enhancement was implemented in November 2025. In addition, another project which will update the PARIS indicator to include Concurrent Enrollment Matches (CEM) and Death Master File (DMF). Any terminations that fall under these will be reported with respective termination codes when this is implemented, which is currently estimated to be October 2026 but is subject to change. Anticipated Completion Date of Corrective Action Plan: This corrective action plan was implemented on September 30, 2025.

As noted, one vendor was identified which required the Town to perform the verification procedure. The Town was unaware that this was required for a federal grant award. To correct this, the TA performed the required verification procedure and the vendor was not under suspension or debarred. The Town will adhere to this requirement on any federal award.

Corrective Action Plan Provided by Management: Philadelphia Legal Assistance Center, Inc. (PLA) agrees with the finding. In November 2024, PLA hired a Legal Compliance Specialist whose full-time job is to review open and closed cases for compliance mistakes. The Legal Compliance Specialist did not have time to review every case closed in 2024. However, the Legal Compliance Specialist has been reviewing cases all year in 2025 and catching issues with missing citizenship attestations, which should reduce the chances of a case being reported to LSC without the documentation required by 45 C.F.R. 1626. In the summer of 2025, we required all case handlers to watch compliance training videos and answer multiple-choice questions to test their knowledge. The videos and questions included content related to 45 C.F.R. 1626. We plan to require staff to complete a similar training process in 2026, which will include additional content related to 45 C.F.R. 1626 compliance.

Re: Corrective Action Plan - 2024 Audit To: United States Department of Housing and Urban Development From: Housing Authority of City of Pittsburgh, (HACP) Action: Respectfully submits the following Corrective Action Plan for the year-end December 31,2024. Name and address of independent public accounting firm: Maher Duessel, CPA’s 503 Martindale Street, Suite 600 Pittsburgh, PA 15212 Audit period: January 1, 2024 - December 31, 2024 The findings from the December 31, 2024, Schedule of Findings and Questioned Costs are discussed below. The findings are numbered consistently with the number assigned in the schedule. Finding 2024-001 U.S. Department of Housing and Urban Development Moving to Work Demonstration Program - ALN 14.881 Eligibility and Reporting Repeat Finding from 2021(2021-001), 2022(2022-001), and 2023 (2023-001) Maher Duessel Finding Condition: During our review of 40 tenant files prepared by the Housing Authority of the City of Pittsburgh (Authority) as part of the biennial reexamination process, we noted a lack of functioning internal controls which led to the below exceptions in our testing. We noted four instances where a tenant recertification using the HUD-50058, Family Report (Form) (which provides eligibility and reporting information) was not completed, on a timely basis. We also noted one instance where other documentation to support the reporting and eligibility assessment as part of completion of the HUD-50058 was not provided. This includes items such as support for income calculation and medical deductions. These exceptions indicate a lack of functioning internal controls and oversight to ensure compliance with HUD requirements related to timely and accurate tenant recertifications. HACP Management Response/Action Taken: Action Taken: The HACP will continue to monitor and train staff regarding processes and procedures, to include and not limited to the Housing and Urban Development’s (HUD) hierarchy of income verification. As noted in previous responses, the HACP continues to experience challenges in hiring and retaining staff as a result of the complexity of the Housing Choice Voucher (HCV) Program. In fiscal year (FY) 2024, the HCV Department had a significant turnover in both line and managerial staff. The HACP promoted an aggressive hiring plan to attract new talent to fill vacant positions due to the great resignation that the HACP, along with other national Agencies, continue to experience. In addition, the HACP has adopted the policy of hiring more staff than needed in the event of turnover. The HACP will continue to utilize the Internal Compliance (IC) Department to review recertifications and compile audit report cards based on the accuracy of recertifications reviewed. The audit report cards are used as an additional management tool to determine whether additional training is needed for staff and the department in general. The HACP continues to: • Send notices regarding re-certifications 120 days in advance of the due date, o Send 10-day notices for missing AR documents o Send 30-day notices when there is no or insufficient response to the 10 day notice sent • Require Managers to review reports to assure timely submission of re-certifications, • Utilize the IC Department to review and sample files from the Occupancy and the HCV portfolio, • Offer periodic staff training on re-certification, • Offer participants the use of technology to complete paperwork In addition to the above noted internal controls, the HACP will institute Bob.ai in FY 2026 as an additional tool to notify both the participant and the HACP staff when the recertifications are due and provide notification of missing documents. The One Stop Shop (OSS) is staffed with three (3) full-time staff members to receive information from participants and landlords to provide timely customer service. In July of 2024, the OSS was equipped with computers for the public to access HACP staff virtually. The use of the computers allows staff to interact with participants regarding minor issues without having the staff physically come to the OSS, thus saving time and money for both the external customer and the Authority. The opening of the One Stop Shop has been successful in receiving the public and responding to concerns.

1. Person Responsible: County Auditor-Controller 2. Corrective Action Plan: The County agrees with the finding and recommendation. The County Auditor’s office will work with department heads to update policies and procedures to ensure record retention is in compliance for all individuals receiving adoption assistance payments. 3. Anticipated Implementation date: June 30, 2027

1. Person Responsible: County Auditor-Controller 2. Corrective Action Plan: The County agrees with the finding and recommendation. The County Auditor’s office will work with department heads to revise policies and procedures to ensure continued operations of controls and completeness of records during times of staff vacancies. 3. Anticipated Implementation date: June 30, 2027

The City will implement a new policy to verify vendors are not suspended or debarred.

Finding No. 2024-008: Inadequate Documentation and Records for Application of Sliding Fee Discounts We have incorporated a policy that establishes the basis for the sliding fee policy to assure affordable access to care for uninsured and underinsured patients of the organization. The policy will recognize a “full discount” for individuals and families with annual incomes at or below 100% FPL with only nominal fees charged, three levels of discount between 100% and 200%, and no discounts for copays for individuals and families earning over 200% FPL. This policy will be in accordance with Section 330(k)(3)(G) of the PHS Act and 42 CFR Part 51c.303(f) and 42 CFR Part 51c.303(u) which are incorporated herewith. We will charge a nominal fee to individuals and families with annual incomes at or below 100% of the Federal poverty level (FPL). Patients whose incomes are above 100% and at or below 200% of the FPL will be charged according to our sliding fee scale based on income and family size. Discounts will be provided to patients with incomes up to 200% of the FPL for medical visits. Discounts will be provided to patients with incomes up to 250% of the FPL for family planning visits. Staff will assess patients’ incomes based upon a sliding fee scale and no patient will be denied care based upon their inability to pay. The organization also has a policy of non-discrimination in the delivery of health care as stated in its Patient Bill of Rights. Also, the Board of Directors define the income and family size, and has defined the family size to be all parents, minors or guardians that are financially responsible for the household. The tracking and documentation of sliding fees is now maintained with the deposit record of each fee received in the shared file for immediate availability and reference.

Contact Person – Matt Bakke, Executive Director Corrective Action Plan – The Project will review its policies and procedures over documentation of periodic review of tenant files. Completion Date – 12/31/26

2024 – 007 – Satisfactory Academic Progress The Institution concurs with this finding. Arkansas Baptist College will review and adhere to its practices, policies, and procedures along with federal guidelines as it relates to students meeting satisfactory academic progress. Arkansas Baptist College has an SAP appeal committee in place to enforce and abide by Arkansas Baptist College's policy. Responsible Administrators: Director of Financial Aid Effective: Immediately and ongoing

2024 – 005 – Verification The Institution, Arkansas Baptist College, accepts the recommendation and will continue to work and strengthen its internal controls over the verification process by implementing procedures to ensure that all required verification documentation is obtained, reviewed, and retained prior to disbursing Title IV financial assistance. Management will use Jenzabar to monitor students selected for verification, maintain complete verification files supporting all required verification procedures, and require an additional level of review to verify that the required documentation has been received and eligibility has been established before aid is awarded or disbursed. Responsible Administrators: Director of Financial Aid & Chief Financial Officer Effective: Immediately and ongoing

2024 – 013 – Annual Loan Limit / PLUS Denial The Institution concurs with this finding. Under new leadership, Arkansas Baptist College accepts the recommendation to strengthen its internal controls over the Federal Direct Loan awarding process by implementing procedures to ensure dependent students are awarded additional Federal Direct Unsubsidized Loan funds only when they meet the eligibility requirements prescribed by federal regulations. Leadership will continue to utilize Jenzabar to identify students receiving additional unsubsidized loan funds, verify and retain documentation of Direct PLUS Loan denials or other qualifying exceptions before disbursement, establish system edits or manual review procedures to prevent awards from exceeding applicable annual loan limits, and require supervisory review of all additional unsubsidized loan awards prior to disbursement. Responsible Administrators: Director of Financial Aid Effective: Immediately and ongoing

2024 – 011 – Aggregate Loan Limits The Institution concurs with this finding and accepts the recommendation for leadership to implement immediate steps to ensure that students receive their loan funds as required by Title IV regulations. Responsible Administrators: Director of Financial Aid & Chief Financial Officer Effective: Immediately and ongoing

2024 – 009 – Pell Grant Calculations The Institution concurs with this finding. Arkansas Baptist College will adhere to its policies, procedures, processes, and federal guidelines as it relates to calculating and awarding Pell. Arkansas Baptist College will return any ineligible Management funds accordingly. Responsible Administrators: Director of Financial Aid & Chief Financial Officer Effective: Immediately and ongoing

Contact Person – Matt Bakke, Executive Director Corrective Action Plan – The Project will implement formal procedures requiring documentation evidencing the completion of periodic reviews. Completion Date – 12/31/26

2024-007 Tenant Eligibility Material Weakness Recommendation: In general, we continue to recommend a review of the re-certification process to determine areas of weakness. Specifically, we recommend the use of a standard checklist in the re-certification process. We further recommend that each re-certification clerk’s work be routinely audited. We also recommend more standardization in resident files organization of information, and procedures established to make sure all files are maintained adequately in order to be compliant. Action Taken: The Housing Authority agrees with this finding and will implement this recommendation within 120 days of this audit report.

Reference Numbers: 2024-001, 2023-001, and 2022-001 Federal Program: Direct - USDA Rural Utilities Service award; ALN 10.760, 'Water and Waste Disposal Systems for Rural Communities' (Single Audit / Uniform Guidance).Condition: The Great Northwest Wholesale Water Commission did not complete and submit its reporting package, including the SEFA and the single audit report, to the Federal Audit Clearinghouse within nine months of the fiscal year end. Criteria: Under 2 CFR §200.512, the audit must be completed, and the data collection form and reporting package must be submitted within 30 calendar days after receipt of the auditor's report, or nine months after the fiscal year end, whichever is earlier. Corrective Action Plan: Management acknowledges the finding and has implemented procedures to improve the timely completion and submission of the data collection form to the Federal Audit Clearinghouse. Management has engaged an audit firm to complete the December 31, 2022, 2023, and 2024 audits and will submit the reporting package to the Federal Audit Clearinghouse upon completion. Management will coordinate with the auditors throughout the audit process, monitor applicable reporting deadlines, and establish internal timelines to ensure the audit report and data collection form are submitted within the required time frame prescribed by 2 CFR 200.512(a). Personnel responsible for Corrective Action: Jerri Dearmont, Executive Director Anticipated Completion Date: August 18, 2026

Management has updated the policies and procedures manual to address this finding. For each housing unit, we are using the Department of Housing and Urban Development (HUB) rent reasonableness form at lease signing. This form will be updated annually for each unit. We will also be following the HUD fair market rent determinations.

Finding Number 2024-084 Subject Heading (Financial) or AL no. and program name (Federal) 93.778 Medicaid Cluster Planned Corrective Action OKDHS agrees with the finding and recommendation. The agency recognizes that the volume of GI DX discrepancy messages, combined with limited automated triage capabilities, contributed to delays in resolving exceptions within the required 45-calendar-day timeframe. As noted by the auditors, the existing process relied heavily on manual review and did not provide sufficient management oversight tools to effectively monitor aging discrepancies and ensure timely resolution. Corrective Action Planned: OKDHS has initiated a multi-faceted corrective action plan designed to improve the timeliness, consistency, and accountability of GI DX exception resolution. As part of this effort, OKDHS is developing an automated prescreening process for National New Hire (NNH), State New Hire (SNH), and Oklahoma Wage (OWG) discrepancy messages. The automated process is intended to evaluate discrepancies against established policy criteria and reduce the number of non-actionable matches requiring manual review. Discrepancies identified as requiring staff review will be routed to eligibility staff with standardized documentation and processing guida nee. Additionally, OKDHS is developing formal procedures governing the review, monitoring, and resolution of GIDX discrepancies. These procedures will def me staff responsibilities, supervisory oversight expectations, escalation requirements, and management use of exception monitoring reports to support timely resolution of discrepancies. Management reporting and monitoring controls are also being enhanced to improve visibility into outstanding discrepancies and aging trends. Supervisors and program management will utilize exception reporting to monitor workloads, identify training opportunities, and promote accountability for timely processing. OKDHS will also provide training and implementation guidance to staff and supervisors regarding revised workflows, discrepancy resolution requirements, documentation standards, and management monitoring expectations. The agency anticipates implementation of the planned enhancements beginning in October 2026, with continued monitoring and refinement following deployment to ensure the corrective actions effectively address the underlying control deficiencies identified in the finding. OHCA MEMBER AUDIT Auditor Response: Member Audit began receiving Medicaid files monthly in September of 2023. Files are continuing to be received from DHS each month. Audits are completed monthly and will continue indefinitely. Any discrepancies are discussed with OKDHS to determine the cause and remedy put in place to ensure any failed jobs were resolved. Anticipated Completion Date October 2026 Responsible Contact Person OKDHS Contact: Kayla Urtz, Director of Internal Audit OHCA Contact: Tana Parrott, Director of Member Audits

Finding Number 2024-084 Subject Heading (Financial) or AL no. and program name (Federal) 93.778 - Medicaid Planned Corrective Action OKDHS agrees with the finding and recommendation. The agency recognizes that the volume of GI DX discrepancy messages, combined with limited automated triage capabilities, contributed to delays in resolving exceptions within the required 45-calendar-day timeframe. As noted by the auditors, the existing process relied heavily on manual review and did not provide sufficient management oversight tools to effectively monitor aging discrepancies and ensure timely resolution. OKDHS has initiated a muti-faceted corrective action plan designed to improve the timeliness, consistency, and accountability of G1DX exception resolution. As part of this effort, OKDHS is developing an automated pre-screening process for National New Hire (NNH), State New Hire (SNH), and Oklahoma Wage (OWG) discrepancy messages. The automated process is intended to evaluate discrepancies against established policy criteria and reduce the number of non-actionable matches requiring manual review. Discrepancies identified as requiring staff review will be routed to eligibility staff with standardized documentation and processing guidance. Additionally, OKDHS is developing formal procedures governing the review, monitoring, and resolution of GIDX discrepancies. These procedures will define staff responsibilities, supervisory oversight expectations, escalation requirements, and management use of exception monitoring reports to support the timely resolution of discrepancies. Management reporting and monitoring controls are also being enhanced to improve visibility into outstanding discrepancies and aging trends. Supervisors and program management will utilize exception reporting to monitor workloads, identify training opportunities, and promote accountability for timely processing. OKDHS will also provide training and implementation guidance to staff and supervisors regarding revised workflows, discrepancy resolution requirements, documentation standards, and management monitoring expectations. The agency anticipates implementation of the planned enhancements beginning in October 2026, with continued monitoring and refinement following deployment to ensure the corrective actions effectively address the underlying control deficiencies identified in the finding. Anticipated Completion Date 10/5/26 and OHCA will continue monitoring through SFY2025 Responsible Contact Person Kayla Urtz and Tana Parrott, OHCA

Finding Number 2024-005 Subject Heading (Financial) or AL no. and program name (Federal) 93.767 Children’s Health Insurance Program 93.778 Medicaid Cluster Planned Corrective Action OKDHS Response: We are using Azure DevOps to track the work related to the findings for the mentioned issues. The work is being completed under User Story 455612 - PS2 | AFS | Notices | Update Medical Notices Language for CMS Audit Finding Corrective Action (2024-005). To ensure all required notice language updates are implemented accurately and consistently, OKDHS is currently utilizing an Azure DevOps tracking tool to conduct a thorough discovery and analysis of all aspects of this issue. Our primary focus is identifying every notice and process that may be impacted by this change. OHCA Response: Additional post-CAP audits will be conducted by Member Audits upon notification from OHS all corrective measures have been implemented, should occur after August 1, 2026. Anticipated Completion Date August 1, 2026 Responsible Contact Person Chris Dees, Eligibility and Coverage Services Technical Director; April Anonsen, Deputy State Medicaid Director; Aubrey McDonald, OKDHS Medicaid Program Administrator; Tana Parrott, OHCA Director of Member Audits; Kristin Edwards OHCA Senior Director of Program & Accountability

Finding Number 2024-081 Subject Heading (Financial) or AL no. and program name (Federal) 93.575 – CCDF Cluster Planned Corrective Action OKDHS agrees with the finding and recommendation. The agency recognizes that the volume of GI DX discrepancy messages, combined with limited automated triage capabilities, contributed to delays in resolving exceptions within the required 45-calendar-day timeframe. As noted by the auditors, the existing process relied heavily on manual review and did not provide sufficient management oversight tools to effectively monitor aging discrepancies and ensure timely resolution. OKDHS has initiated a muti-faceted corrective action plan designed to improve the timeliness, consistency, and accountability of G1DX exception resolution. As part of this effort, OKDHS is developing an automated pre-screening process for National New Hire (NNH), State New Hire (SNH), and Oklahoma Wage (OWG) discrepancy messages. The automated process is intended to evaluate discrepancies against established policy criteria and reduce the number of non-actionable matches requiring manual review. Discrepancies identified as requiring staff review will be routed to eligibility staff with standardized documentation and processing guidance. Additionally, OKDHS is developing formal procedures governing the review, monitoring, and resolution of GIDX discrepancies. These procedures will define staff responsibilities, supervisory oversight expectations, escalation requirements, and management use of exception monitoring reports to support the timely resolution of discrepancies. Management reporting and monitoring controls are also being enhanced to improve visibility into outstanding discrepancies and aging trends. Supervisors and program management will utilize exception reporting to monitor workloads, identify training opportunities, and promote accountability for timely processing. OKDHS will also provide training and implementation guidance to staff and supervisors regarding revised workflows, discrepancy resolution requirements, documentation standards, and management monitoring expectations. The agency anticipates implementation of the planned enhancements beginning in October 2026, with continued monitoring and refinement following deployment to ensure the corrective actions effectively address the underlying control deficiencies identified in the finding. Anticipated Completion Date 10/5/26 Responsible Contact Person Kayla Urtz

Finding Number 2024-067 Subject Heading (Financial) or AL no. and program name (Federal) 93.575 – CCDF Cluster Planned Corrective Action OKDHS agrees that additional review procedures would have strengthened controls over the Workforce Support Grant payment approval process and may have prevented the issuance of payments to individuals who did not meet all eligibility requirements at the time of application. The agency concurs that two Workforce Support Grant payments were issued to individuals whose employment termination dates preceded the application date. As a result, the individuals did not meet the program eligibility requirements for receipt of the workforce bonus payment. Upon identification of the issue, OKDHS reviewed the circumstances surrounding the payments and initiated appropriate corrective actions. The agency has evaluated the affected payments and will pursue recovery of funds as appropriate. OKDHS has reviewed the eligibility verification process associated with Workforce Support Grant payments and has implemented additional procedures designed to strengthen verification of employment status prior to payment approval. These procedures include enhanced review of available employment records and validation of eligibility information submitted as part of the application process. Additionally, OKDHS will continue recovery efforts related to identified ineligible payments and will monitor compliance with updated review procedures to reduce the likelihood of similar errors occurring in future provider assistance initiatives. Anticipated Completion Date N/A Responsible Contact Person Kayla Urtz

Finding Number 2024-082 Subject Heading (Financial) or AL no. and program name (Federal) 93.568 – LIHEAP Planned Corrective Action OKDHS agrees with the finding and recommendation. The agency recognizes that the volume of GI DX discrepancy messages, combined with limited automated triage capabilities, contributed to delays in resolving exceptions within the required 45-calendar-day timeframe. As noted by the auditors, the existing process relied heavily on manual review and did not provide sufficient management oversight tools to effectively monitor aging discrepancies and ensure timely resolution. OKDHS has initiated a muti-faceted corrective action plan designed to improve the timeliness, consistency, and accountability of G1DX exception resolution. As part of this effort, OKDHS is developing an automated pre-screening process for National New Hire (NNH), State New Hire (SNH), and Oklahoma Wage (OWG) discrepancy messages. The automated process is intended to evaluate discrepancies against established policy criteria and reduce the number of non-actionable matches requiring manual review. Discrepancies identified as requiring staff review will be routed to eligibility staff with standardized documentation and processing guidance. Additionally, OKDHS is developing formal procedures governing the review, monitoring, and resolution of GIDX discrepancies. These procedures will define staff responsibilities, supervisory oversight expectations, escalation requirements, and management use of exception monitoring reports to support the timely resolution of discrepancies. Management reporting and monitoring controls are also being enhanced to improve visibility into outstanding discrepancies and aging trends. Supervisors and program management will utilize exception reporting to monitor workloads, identify training opportunities, and promote accountability for timely processing. OKDHS will also provide training and implementation guidance to staff and supervisors regarding revised workflows, discrepancy resolution requirements, documentation standards, and management monitoring expectations. The agency anticipates implementation of the planned enhancements beginning in October 2026, with continued monitoring and refinement following deployment to ensure the corrective actions effectively address the underlying control deficiencies identified in the finding. Anticipated Completion Date 10/5/26 Responsible Contact Person Kayla Urtz

Finding Number 2024-060 Subject Heading (Financial) or AL no. and program name (Federal) 93.658 - LIHEAP Planned Corrective Action OKDHS concurs that the control environment in place during the period reviewed did not provide adequate segregation of duties and allowed incompatible responsibilities to be concentrated within the program area. OKDHS takes the identified fraudulent activity and associated control weaknesses seriously. The fraudulent activity involved intentional actions by a former employee who was able to exploit excessive access and insufficient segregation between program administration, vendor maintenance, and payment-related processes. Upon identification of the suspected activity, OKDHS took action to remove the employee's access, terminate employment, and refer the matter for investigation and appropriate legal action. OKDHS continues to cooperate with investigative authorities regarding the full scope of the activity. In response, OKDHS is not limiting corrective action to additional review within the existing LIHEAP process. The Agency is redesigning the underlying business processes to separate program administration from vendor registration, vendor maintenance, contracting, financial reporting, and payment processing. The corrective actions described below are intended to establish independent controls across multiple organizational functions and reduce reliance on information prepared and controlled solely within the program area. Enhanced Financial Reporting and Oversight OKDHS Finance is working to obtain more detailed, transaction-level LIHEAP information to support independent financial oversight and reconciliation. Historically, Finance relied substantially on summarized information provided by the program area. The enhanced reporting structure is intended to provide Finance with greater visibility into underlying LIHEAP transactions and improve its ability to independently reconcile, review, and analyze program expenditures. This increased access to detailed information will also support the development of exception reporting and other analytical procedures designed to identify unusual payment activity, vendor activity, or other anomalies requiring additional review. Transition of LIHEAP Payments to PeopleSoft OKDHS is working with its technical teams to transition LIHEAP payment processing to PeopleSoft. This change will integrate LIHEAP payments into the Agency's established financial system and associated financial controls rather than maintaining a separate program controlled vendor and payment process. Under the redesigned process, LIHEAP providers will be required to complete the applicable statewide vendor registration process before receiving payment. Vendor establishment and maintenance, including changes to vendor information, will therefore be subject to controls outside of the LIHEAP program area. The transition will eliminate the program area's ability to independently maintain the vendor information used to facilitate LIHEAP payments and will provide greater segregation between program eligibility and benefit authorization responsibilities and the vendor establishment and payment functions. Centralized Vendor Registration and Maintenance As part of the transition to PeopleSoft, the existing AFS vendor-maintenance process will be replaced by the statewide vendor registration and maintenance process. LIHEAP program staff will no longer independently control the establishment or maintenance of the vendor records used for payment. This change is intended to ensure that vendor creation and modification are performed through an independent process and are appropriately separated from program functions responsible for determining eligibility and authorizing benefits. Formal Provider Contracting OKDHS Procurement is working to establish contracts with LIHEAP providers. Formalizing provider relationships through the procurement and contracting process will establish additional independent review and documentation before providers participate in the program and receive payments. The contracting process will also provide a defined mechanism for establishing provider responsibilities, maintaining provider information, and addressing compliance or performance concerns. Strengthened Segregation of Duties Collectively, these changes are designed to establish segregation across the major components of the LIHEAP process: • AFS/LIHEAP program staff will remain responsible for program administration and applicable eligibility and benefit determinations; • Statewide vendor registration and financial system processes will control vendor establishment and maintenance; • Procurement will oversee the formal contracting process with participating providers; and • Finance will have increased access to detailed transaction information to support independent financial oversight, reconciliation, and analysis. This structure is intended to prevent a single employee or organizational unit from controlling the program, vendor, and payment functions necessary to initiate and conceal improper transactions. System Controls and Monitoring As the redesigned processes are implemented, OKDHS will continue to evaluate system controls, access permissions, exception reporting, and data analytics to identify unusual vendor or payment activity. The transition to centralized vendor registration, PeopleSoft payment processing, formal provider contracting, and enhanced financial reporting will provide additional opportunities for independent review and monitoring. OKDHS will also continue to cooperate with OIG and other appropriate investigative and legal authorities regarding the identified fraudulent activity and will pursue appropriate recovery and corrective actions based on the results of those proceedings. These actions represent a significant redesign of the LIHEAP control environment and are intended to address the underlying conditions that allowed the fraudulent activity to occur and remain undetected. By distributing responsibility for program administration, vendor registration and maintenance, contracting, financial oversight, and payment processing across independent functions, OKDHS is establishing a more sustainable control structure designed to reduce the risk of similar fraudulent activity in the future. Anticipated Completion Date In Progress Responsible Contact Person Kayla Urtz