Corrective Action Plans

Finding Number 2024-051 Subject Heading (Financial) or AL no. and program name (Federal) 93.658 - LIHEAP Planned Corrective Action The Oklahoma Department of Human Services (OKDHS) concurs that improvements were needed to strengthen certain automated payment processing controls, system edits, and supervisory review procedures within the LIHEAP program. The Agency agrees with the specific payment processing errors identified during audit testing related to cooling overpayments, ECAP payment limits, duplicate payments, and preauthorization system logic. Corrective actions, including system modifications, policy clarification, staff coaching, enhanced supervisory oversight, and improvements to payment validation processes, have been implemented or are in progress to reduce the risk of recurrence. The Agency notes, however, that this finding combines several distinct issues—including isolated payment processing errors, temporary administration of LIHWAP and LIHEAP supplemental benefits, reporting limitations associated with legacy system functionality, and recommendations regarding future system design—into a single conclusion regarding the adequacy of internal controls. While each of these issues warrants evaluation and appropriate corrective action, they represent different types of control considerations and should not be viewed as resulting from a single underlying control deficiency. During implementation of LIHWAP and subsequent LIHEAP supplemental payments, OKDHS utilized its existing eligibility infrastructure to administer multiple federally authorized funding streams. This approach was consistent with congressional direction encouraging states, to the extent practicable, to utilize existing systems, processes, and procedures when implementing the temporary LIHWAP program. While this approach allowed the Agency to efficiently deliver emergency assistance, the Agency acknowledges that utilizing common payment coding across multiple temporary funding streams reduced reporting clarity and complicated downstream financial reporting and audit analytics. The Agency further notes that the majority of the questioned costs identified in this finding resulted from payment processing logic, temporary system configuration changes, or automated system edits rather than deficiencies in the underlying eligibility determination process. Accordingly, corrective actions have appropriately focused on strengthening payment validation, automated system edits, duplicate payment prevention, and preauthorization controls while continuing to reinforce supervisory review of eligibility determinations. The Agency agrees that improvements to payment coding, reporting architecture, and reconciliation capabilities would strengthen the overall control environment and has already initiated broader modernization efforts in these areas. These efforts extend beyond the recommendations contained in this finding and are intended to improve financial reporting, reconciliation, program transparency, and overall governance while supporting long-term administration of LIHEAP and other assistance programs. The Agency respectfully disagrees that the reporting limitations identified by the auditors, standing alone, demonstrate an overall failure of eligibility or payment authorization controls. While the Agency acknowledges the payment processing errors identified elsewhere in this finding, the lack of distinct payment identifiers primarily affected reporting, reconciliation, and audit analytics rather than the Agency's ability to accurately determine eligibility for the vast majority of transactions reviewed. The finding itself demonstrates that both the Agency and the auditors were ultimately able to distinguish between LIHEAP, LIHWAP, and supplemental payments through available program documentation when evaluating the sampled transactions. Accordingly, the Agency believes the identified system limitation is more appropriately characterized as a reporting and system design issue than evidence that the underlying eligibility control framework was ineffective. The Agency also respectfully disagrees that creation of additional payment identifiers is the only means of achieving compliance with federal internal control requirements. Federal internal control standards require reasonable assurance that federal funds are properly administered, but they do not prescribe a specific system architecture or require a particular reporting structure. While distinct payment identifiers would improve reporting efficiency and facilitate financial reconciliation and audit analytics, the Agency does not believe the absence of those identifiers, by itself, constitutes a compliance deficiency. Since the audit period, the Agency has undertaken broader improvements extending beyond the specific recommendations contained in this finding. These efforts include strengthening automated payment processing controls, restoring and enhancing system edits, improving reporting architecture, expanding financial reconciliation capabilities, reinforcing supervisory oversight, and improving overall program governance. Collectively, these initiatives are intended to establish a stronger and more sustainable internal control framework while improving the Agency's ability to administer multiple funding streams and provide more transparent financial reporting. Accordingly, the Agency concurs that certain payment processing controls, automated system edits, and related supervisory controls required strengthening and has implemented corrective actions addressing those issues. However, the Agency respectfully disagrees that the reporting limitations identified in this finding, standing alone, demonstrate an overall failure of LIHEAP eligibility controls or establish that implementation of distinct payment identifiers is the only means of achieving reasonable assurance over program administration. Anticipated Completion Date In progress Responsible Contact Person Kayla Urtz

Finding Number 2024-027 Subject Heading (Financial) or AL no. and program name (Federal) 93.568 - LIHEAP Planned Corrective Action Due to the age and sophistication of updating our current systems, many of our LIHEAP processes and reporting have become outdated. AFS, Finance, and DTO have several projects in the pipeline to improve system and program reporting and to improve the reconciliation of eligibility and payment data. Anticipated Completion Date 10/31/2026 Responsible Contact Person Kayla Urtz

Finding Number 2024-066 Subject Heading (Financial) or AL no. and program name (Federal) 93.558 – TANF Planned Corrective Action OKDHS agrees that controls related to the timely completion and documentation of T ANF eligibility redeterminations can be strengthened. During the period reviewed, eligibility operations were impacted by the Public Health Emergency (PHE) and associated continuous coverage requirements. As the agency worked through the post-PHE unwinding process, efforts were focused on reviewing and updating affected cases. During this period, some staff incorrectly believed T ANF reviews were subject to the same review flexibilities that applied to medical programs, resulting in untimely completion of certain TANF eligibility redeterminations. To strengthen controls, OKDHS has implemented the Current system, which automatically assigns cases requiring review and provides enhanced workload management and monitoring capabilities. Current includes tracking and reporting functionality that identifies untimely reviews, places overdue items on management reports, and alerts staff and supervisors when action is needed. In addition, supervisory staff conduct monitoring activities, including spot checks and review of workload reports, to ensure eligibility reviews are completed and documented within required timeframes. OKDHS believes these system enhancements and monitoring activities strengthen oversight of T ANF eligibility redeterminations and provide greater assurance that reviews are completed timely and appropriately documented. Anticipated Completion Date In progress Responsible Contact Person Kayla Urtz

Finding Number 2024-064 Subject Heading (Financial) or AL no. and program name (Federal) 93.558 – TANF Planned Corrective Action OKDHS concurs and will ensure that staff are refreshed on the importance of including all verifications in the case file at certification. Anticipated Completion Date N/A Responsible Contact Person Kayla Urtz

Finding Number 2024-063 Subject Heading (Financial) or AL no. and program name (Federal) 93.558 – TANF Planned Corrective Action OKDHS agrees that controls related to the timely completion and documentation of TANF eligibility redeterminations can be strengthened. During the period reviewed, eligibility operations were impacted by the Public Health Emergency (PHE) and associated continuous coverage requirements. As the agency worked through the post-PHE unwinding process, efforts were focused on reviewing and updating affected cases. During this period, some staff incorrectly believed TANF reviews were subject to the same review flexibilities that applied to medical programs, resulting in untimely completion of certain TANF eligibility redeterminations. To strengthen controls, OKDHS has implemented the Current system, which automatically assigns cases requiring review and provides enhanced workload management and monitoring capabilities. Current includes tracking and reporting functionality that identifies untimely reviews, places overdue items on management reports, and alerts staff and supervisors when action is needed. In addition, supervisory staff conduct monitoring activities, including spot checks and review of workload reports, to ensure eligibility reviews are completed and documented within required timeframes. OKDHS believes these system enhancements and monitoring activities strengthen oversight of T ANF eligibility redeterminations and provide greater assurance that reviews are completed timely and appropriately documented. Anticipated Completion Date In progress Responsible Contact Person Kayla Urtz

Finding Number 2024-058 Subject Heading (Financial) or AL no. and program name (Federal) 93.558 – TANF Planned Corrective Action OKDHS agrees that controls supporting the compilation and validation of the Child Welfare Services (CWS) population used in the TANF allocation methodology can be strengthened. OKDHS will enhance procedures used to compile and validate the population included in the Child Welfare Services TANF allocation methodology. Management will implement additional review procedures to verify that participants included in the allocation methodology meet the applicable eligibility criteria established by the Oklahoma TANF State Plan and that supporting documentation is available to substantiate eligibility. The agency will also formalize review procedures for the preparation and approval of the allocation calculation, including validation of source data used to determine the applicable percentage applied to Child Welfare Services contract expenditures. These procedures will include management review of supporting documentation and reconciliation of the underlying population prior to completion of the allocation methodology. These enhancements are intended to strengthen internal controls over the allocation process, improve the reliability of the supporting data, and provide greater assurance that expenditures charged to the TANF program are based on an accurately supported eligible population. Anticipated Completion Date In Progress Responsible Contact Person Kayla Urtz

Finding Number 2024-041 Subject Heading (Financial) or AL no. and program name (Federal) 93.558 – TANF Planned Corrective Action OKDHS agrees with the finding and recommendation. The agency recognizes that the volume of GI DX discrepancy messages, combined with limited automated triage capabilities, contributed to delays in resolving exceptions within the required 45-calendar-day timeframe. As noted by the auditors, the existing process relied heavily on manual review and did not provide sufficient management oversight tools to effectively monitor aging discrepancies and ensure timely resolution. OKDHS has initiated a muti-faceted corrective action plan designed to improve the timeliness, consistency, and accountability of G1DX exception resolution. As part of this effort, OKDHS is developing an automated pre-screening process for National New Hire (NNH), State New Hire (SNH), and Oklahoma Wage (OWG) discrepancy messages. The automated process is intended to evaluate discrepancies against established policy criteria and reduce the number of non-actionable matches requiring manual review. Discrepancies identified as requiring staff review will be routed to eligibility staff with standardized documentation and processing guidance. Additionally, OKDHS is developing formal procedures governing the review, monitoring, and resolution of GIDX discrepancies. These procedures will define staff responsibilities, supervisory oversight expectations, escalation requirements, and management use of exception monitoring reports to support the timely resolution of discrepancies. Management reporting and monitoring controls are also being enhanced to improve visibility into outstanding discrepancies and aging trends. Supervisors and program management will utilize exception reporting to monitor workloads, identify training opportunities, and promote accountability for timely processing. OKDHS will also provide training and implementation guidance to staff and supervisors regarding revised workflows, discrepancy resolution requirements, documentation standards, and management monitoring expectations. The agency anticipates implementation of the planned enhancements beginning in October 2026, with continued monitoring and refinement following deployment to ensure the corrective actions effectively address the underlying control deficiencies identified in the finding. Anticipated Completion Date 10/5/26 Responsible Contact Person Kayla Urtz

Finding Number 2024-055 Subject Heading (Financial) or AL no. and program name (Federal) #64.015 Veterans State Nursing Home Care Planned Corrective Action ODVA concurs with the finding. During State Fiscal Year 2024, the absence of centralized, standardized tracking procedures resulted in 52 unsubmitted VA Form 10-5588As and a delay in receiving the eligible prevailing per diem rates. Corrective Action Plan (CAP): To strengthen internal controls and ensure compliance with 38 CFR Part 51, ODVA accounting leadership met on July 16, 2026, to overhaul the 10-5588A submission, tracking, and reimbursement process. The following actions have been taken and scheduled to resolve this finding:  Centralized Responsibility: Duties surrounding all 10-5588A recording, tracking, and USDVA liaising have been officially assigned to dedicated Central Office staff to eliminate decentralized, inconsistent procedures across the 7 State Veterans Homes.  Standardized Procedures & Tools: Leadership developed a detailed, step-by-step process outlining exactly how 10-5588As are filed, related VA payments are recorded, and retroactive payment/refunds are tracked. This is paired with a newly revised, comprehensive, and easy-to-read tracking worksheet.  Validation of Procedures: Leadership reviewed unfiled 10-5588As to ensure the updated procedures and tracking tools successfully cover most potential scenarios. Anticipated Completion Date August 31, 2026: Finalize revised tracking sheet and standard operating procedures; October 31, 2026: Complete comprehensive training. Responsible Contact Person Chris Busby, Chief Financial Officer; Caitlyn Thiele, Accounting Manager

Finding Number 2024-054 Subject Heading (Financial) or AL no. and program name (Federal) 20.205 - Highway Planning and Construction Planned Corrective Action The Agency went live in PeopleSoft Financials with online voucher entry to pay invoices for operating accounts and the 747 process (Load Vouchers from Remote) for invoices for capital accounts. Both these interfaces have built in edit capabilities to detect and deter duplicate invoices. During the PeopleSoft implementation, division staff were trained on keeping Invoice logs for all their payments. Also, reports have been built to be run by Financial Services Accounts Payable staff monthly to pull all possible duplicate payments for review. Anticipated Completion Date 07/02/2025 Responsible Contact Person Sam Ddamba

Finding Number 2024-085 Subject Heading (Financial) or AL no. and program name (Federal) #17.225 Unemployment Insurance Planned Corrective Action The agency concurs with the finding and acknowledges our responsibility for program integrity and proper controls for the RESEA program. As we referenced in our response last year, the agency has undertaken modernization efforts to provide better solutions for the RESEA program. EmployOklahoma (EO) is the first result of this effort in the workforce employment area and launched in January 2025 as the replacement for Oklahoma Job Match (OKJM). The recommendation as detailed above (to continue development of OKJM) is no longer applicable, due to the successful transition to the new EmployOklahoma system, which generates accurate, reliable data. Additionally, we instituted, and continue to provide ongoing training to RESEA staff to ensure proper implementation of new policies and procedures. We anticipate there will continue to be elevated risk for inaccuracies through early FY2025 (December 2024), as reporting data was still being provided through OKJM legacy data. Beginning January 2025 the agency’s EO modernization initiatives were initiated. OESC believes we’ve successfully implemented comprehensive solutions to address both the case management and data reporting requirements needed to fully resolve this finding. Anticipated Completion Date Completed in March 2026 Responsible Contact Person Tammy Wood, RESEA/TAA Program Manager

Finding Number 2024-079 Subject Heading (Financial) or AL no. and program name (Federal) 10.565 – Food Distribution Cluster Planned Corrective Action OKDHS agrees that documentation supporting the approval and eligibility of participating CSFP agencies should be consistently completed, reviewed, and retained. The condition identified by the auditors reflects a documentation and record-retention control weakness. The absence of documentation available for audit does not, by itself, establish that the participating agency was ineligible; however, OKDHS recognizes that sufficient documentation must be maintained to demonstrate compliance with applicable program requirements. To strengthen controls over the onboarding, approval, and ongoing oversight of participating agencies, the Food Distribution Unit is implementing a standardized onboarding process. The process will include a checklist identifying required eligibility and program documentation that must be submitted by the food bank and reviewed by OKDHS as part of the approval process. Required documentation will include, as applicable, the Civil Rights Questionnaire, nonprofit and identifying information, required agreements, and confirmation that appropriate program information and training have been provided. Following review of the required documentation, OKDHS will document its approval of eligible participating agencies and maintain final agreements and supporting documentation within the Food Distribution Unit's program files in accordance with applicable record-retention requirements. OKDHS will also review its agreements and related procedures with its food bank partners to improve consistency in the documentation, retention, and availability of records supporting participating agencies. As part of this effort, OKDHS will work with the food banks to strengthen centralized record-retention practices and clarify responsibilities for maintaining records required by federal and state program requirements. Ongoing monitoring activities will include review of applicable eligibility, agreement, and record-retention documentation. Identified instances of noncompliance will be addressed through corrective action and technical assistance, as appropriate. In addition, OKDHS will provide annual training to food bank partners addressing participating-agency eligibility, record retention, civil rights requirements, and other applicable CSFP and TEFAP program requirements. These actions are intended to strengthen the consistency of the eligibility approval process and provide reasonable assurance that required documentation is complete, appropriately reviewed, retained, and available for subsequent monitoring or audit. Anticipated Completion Date Standardized onboarding checklist: July 30, 2026 Annual training materials: August 30, 2026 Review of food bank greements and centralized recordretention processes: September 30, 2026 Responsible Contact Person Kayla Urtz

Finding Number 2024-076 Subject Heading (Financial) or AL no. and program name (Federal) 10.565 – Food Distribution Cluster Planned Corrective Action OKDHS agrees that documentation supporting participant eligibility should be consistently maintained and retained in accordance with program requirements. The condition identified by the auditors represents a documentation and record-retention weakness at one participating local pantry during a limited period. The absence of documentation available during the audit does not, by itself, establish that participant eligibility determinations were incorrect or that ineligible individuals received program benefits; rather, it limits the ability to independently verify those determinations after the fact. It should also be noted that OKDHS conducted an on-site review of this pantry in June 2023 and again in August 2025. During the 2025 review, current participant intake records were available and reviewed to verify that eligibility determinations were being performed in accordance with program requirements. Contrary to the finding's characterization, OKDHS reviews completed participant intake forms during monitoring activities, not merely blank application forms. In accordance with federal requirements, routine CSFP reviews are conducted every two years unless a participating agency is identified as higher risk, in which case more frequent monitoring is performed. To further strengthen oversight, OKDHS is implementing a standardized onboarding process for new participating pantries and new local management. This process will include standardized checklists, verification of required agreements and documentation, confirmation that required program training has been completed, and notification requirements when management changes occur at participating agencies. OKDHS will also work with its food bank partners to strengthen centralized record-retention practices, clarify documentation responsibilities, and reinforce record retention requirements through annual training and technical assistance. Ongoing monitoring activities will continue to include reviews of participant eligibility documentation, agreements, and record-retention practices, with corrective actions implemented whenever deficiencies are identified. These enhancements build upon existing monitoring activities and provide additional assurance that required documentation is consistently maintained and available for future monitoring and audit. Anticipated Completion Date In Progress Responsible Contact Person Kayla Urtz

Finding Number 2024-088 Subject Heading (Financial) or AL no. and program name (Federal) 10.565 – Food Distribution Cluster Planned Corrective Action OKDHS agrees that documentation supporting the receipt, distribution, and accountability of CSFP food packages should be consistently maintained in accordance with federal program requirements. The condition identified by the auditors represents a documentation and recordkeeping weakness at one participating local pantry and does not, by itself, establish that USDA commodities were lost, misused, or improperly distributed. With respect to the reported inventory discrepancy, the issue identified during the audit related to documentation supporting home deliveries. While the local pantry did not maintain documentation at the site to support the number of food packages assigned to a delivery route, OKDHS does not agree that the food packages should be characterized as unaccounted for. Home delivery distributions are finalized after the delivery route is completed to ensure inventory records accurately reflect the commodities actually delivered and any packages returned to the pantry if a delivery cannot be completed. Requiring documentation to be completed before deliveries are finalized could result in inaccurate inventory records when circumstances change during the delivery route. The documentation weakness identified was the lack of retained supporting documentation demonstrating the number of packages assigned for home delivery. OKDHS currently performs management reviews in accordance with 7 CFR 247.34, including on-site reviews of participating agencies at least once every two years, with more frequent monitoring of agencies identified as higher risk. Agencies with identified deficiencies are required to submit corrective action plans, and follow-up reviews are conducted until corrective actions have been satisfactorily implemented. Accordingly, OKDHS believes its existing monitoring process is consistent with federal requirements while recognizing that documentation controls can be strengthened. To further enhance internal controls, OKDHS will work with its food bank partners to standardize documentation requirements for home deliveries, strengthen record retention practices, and clarify responsibilities for maintaining receiving, inventory, and distribution records. OKDHS will also require food banks to incorporate these documentation requirements into their oversight of local pantries and will provide annual training reinforcing federal inventory accountability, documentation, and record retention requirements. In addition, OKDHS will continue evaluating monitoring practices and available resources to determine the most effective methods for strengthening oversight of participating agencies while continuing to meet all applicable federal monitoring requirements. These enhancements build upon the existing management review process and are intended to provide additional assurance that inventory records are complete, accurate, and available for future monitoring and audit activities. Anticipated Completion Date In Progress Responsible Contact Person Kayla Urtz

Finding Number 2024-083 Subject Heading (Financial) or AL no. and program name (Federal) 10.551 – SNAP Cluster Planned Corrective Action OKDHS agrees with the finding and recommendation. The agency recognizes that the volume of GI DX discrepancy messages, combined with limited automated triage capabilities, contributed to delays in resolving exceptions within the required 45-calendar-day timeframe. As noted by the auditors, the existing process relied heavily on manual review and did not provide sufficient management oversight tools to effectively monitor aging discrepancies and ensure timely resolution. OKDHS has initiated a muti-faceted corrective action plan designed to improve the timeliness, consistency, and accountability of G1DX exception resolution. As part of this effort, OKDHS is developing an automated pre-screening process for National New Hire (NNH), State New Hire (SNH), and Oklahoma Wage (OWG) discrepancy messages. The automated process is intended to evaluate discrepancies against established policy criteria and reduce the number of non-actionable matches requiring manual review. Discrepancies identified as requiring staff review will be routed to eligibility staff with standardized documentation and processing guidance. Additionally, OKDHS is developing formal procedures governing the review, monitoring, and resolution of GIDX discrepancies. These procedures will define staff responsibilities, supervisory oversight expectations, escalation requirements, and management use of exception monitoring reports to support the timely resolution of discrepancies. Management reporting and monitoring controls are also being enhanced to improve visibility into outstanding discrepancies and aging trends. Supervisors and program management will utilize exception reporting to monitor workloads, identify training opportunities, and promote accountability for timely processing. OKDHS will also provide training and implementation guidance to staff and supervisors regarding revised workflows, discrepancy resolution requirements, documentation standards, and management monitoring expectations. The agency anticipates implementation of the planned enhancements beginning in October 2026, with continued monitoring and refinement following deployment to ensure the corrective actions effectively address the underlying control deficiencies identified in the finding. Anticipated Completion Date 10/5/26 Responsible Contact Person Kayla Urtz

Management will improve internal processes and controls to include the following: Monthly staff training for documentation retention requirements and policies, Quarterly audits of program expenditure documentation, and Annual Uniform Guidance compliance training.

Finding Number 2024-010 Corrective Action Plan Cash Management — AL 15.875 (U.S. Department of the Interior) • Develop, approve and issue a dedicated written cash management procedure specifically addressing the time elapsing between the receipt of infrastructure project funds and their disbursement, setting out the disbursement process and target timeframes consistent with Article IV, Section 5(b)(ii) of the Fiscal Procedures Agreement. • Maintain documentation of the date of receipt and the date of disbursement for each drawdown, so that compliance with the procedure and the minimization of elapsed time can be evidenced and monitored. • Institute periodic monitoring and reporting of elapsed time between receipt and disbursement, with exceptions escalated for management action. • Train Treasury staff and the authorized signatories in the wire-out approval process on the new procedure and the applicable FPA requirement. • Pursue resolution of the questioned costs of $1,643,137 through the audit resolution process with DOI/OIA. Management’s position is that the condition is an internal control deficiency and that questioned costs of $0 are warranted under the definition in 2 CFR § 200.1, including paragraph (3)(i), as the FPA prescribes no day-count standard, all disbursements were made within the month of receipt through the required approval process, and the payments were eligible, fully supported and reasonable. Anticipated Completion Date 9/30/2027 Responsible Person (Contact Details) Ms. Julyn Lawrence Email: julyn.lawrence@gov.fm Ms. Senny Phillip Assistant Secretary, Investment Email: senny.phillip@gov.fm

Responsibility for Suspension and Debarment compliance has been formally assigned to the Legal Affairs Division. The Legal Affairs Division is responsible for performing and documenting reviews of contractor eligibility, including verification through SAM and other applicable federal sources, prior to contract execution and when otherwise required by federal regulations.

FINDING 2024-004 Finding Subject: Child Nutrition Cluster – Internal Controls Contact Person Responsible for Corrective Action: Superintendent and Food Service Director Contact Phone Number and Email Address: Kyle Neukam; 812-752-8921; kneukam@scsd2.k12.in.us Tammy Mosier; 812-752-8921; tmosier@scsd2.k12.in.us Views of Responsible Officials: We concur with the finding. Description of Corrective Action Plan: A new Food Service Director has been appointed and the District partnered with OPAA! Food Management to provide oversight and compliance support. Invoice review procedures ensure pricing accuracy and compliance with contracts. Risk assessment and monitoring procedures have been implemented to ensure ongoing compliance. Scott County School District 2 now participates in the Community Eligibility Provision (CEP) for its school nutrition programs. Under CEP, individual household applications for free and reduced-price meal eligibility are no longer collected or processed. As a result, the eligibility determination procedures that were the subject of finding are no longer applicable. Therefore, no further action is warranted regarding this compliance requirement. The School Corporation has implemented procedures designed to strengthen the control environment, improve risk assessment and information and communication processes, enhance control activities, and provide ongoing monitoring to ensure compliance with Child Nutrition Program requirements and timely identification and correction of deficiencies. Anticipated Completion Date: August 2026

Contact Person – Terry Hanson, Executive Director Corrective Action Plan – The Project will review its policies and procedures over documentation of periodic review of tenant files. Completion Date – 12/31/26

Finance policy and procedure manual was updated with recommendations. See attached.

Finding Number: 2024-007 Finding Title: Eligibility – MAXIS Program: 93.778 Grants to States for Medicaid Name of Contact Person Responsible for Corrective Action: Cindy Noetzelman Corrective Action Planned: Cases have been corrected and there was a discussion with staff on the process and the need for correct entries. We will continue to review at monthly staffing meetings to ensure correct procedures continue to be followed. Anticipated Completion Date: Cases have been corrected as of Dec 31, 2025

Management has implemented the following corrective actions to address the deficiencies noted in tenant file maintenance and eligibility determinations: A. Strengthening Recertification Compliance 1. Implementation of a Recertification Tracking System: a. A digital tracking log will be used to monitor upcoming recertifications with alerts at 90, 60, and 30 days before due dates. b. The Senior Housing Specialist will oversee timely completion and issue weekly progress reports to the Director of Asset Management. c. Non-compliant files will be flagged for immediate follow-up with tenants. d. PMCS, a third-party group, will assist with recertifications. 2. Enforcing Timely Recertifications: a. Recertifications must be completed no later than 30 days before expiration. b. Staff will receive monthly reminders, and escalation measures will be implemented for delays. 3. Quarterly Internal Audits: a. PMCS and internal staff will conduct random file audits every three months to ensure adherence. b. Deficiencies will be addressed in real-time, and corrective steps will be logged. B. Ensuring EIV System Compliance 1. Standardizing EIV Compliance Procedures: a. A formal checklist will be created for EIV report reviews, ensuring all required reports are generated before lease renewals. b. EIV data will be cross-referenced with tenant files every quarter to ensure completeness. 2. Internal Monthly EIV Reviews: a. The Senior Housing Specialist will generate and review EIV reports on the 1st of each month. b. The Director of Asset Management, Third-Party Compliance Officer (PMCS), and Senior Housing Specialist will verify compliance before reports are finalized. 3. Quarterly Compliance Reports: a. The Compliance Officer will submit a quarterly compliance report documenting completion rates and deficiencies. C. Enhancing Staff Training and Accountability 1. Mandatory Quarterly Training: a. Staff will undergo quarterly compliance training covering HUD Handbook 4350.3, recertifications, and EIV compliance. b. Training sessions will be documented, and staff performance assessed. 2. Clarification of Responsibilities: a. Staff roles will be clearly outlined in a Standard Operating Procedure (SOP) document. b. Staff will be required to acknowledge their roles in compliance processes. 3. PMCS Involvement for Training Support: a. PMCS will offer supplementary training sessions as needed. D. Documentation and Oversight Enhancements 1. Maintaining Complete and Auditable Files: a. All lease and EIV documentation will be stored both physically and digitally. b. A real-time compliance dashboard will track completion rates. 2. Routine Management Reviews: a. The Senior Housing Specialist and Director of Asset Management will conduct monthly spot checks to verify document accuracy and completion. b. Non-compliance will result in formal corrective actions.

To address these challenges and strengthen program integrity, DHS implemented the Provider Enrollment Application (PEA) Portal on March 2, 2026. The PEA Portal modernizes provider enrollment and revalidation by electronically collecting, storing, and maintaining required documentation in a centralized system. The portal supports retention of Medicaid Provider Agreements, screening documentation, ownership disclosures, licensure information, and other enrollment records within a single electronic repository. The PEA Portal improves document retention and accessibility, creates an electronic audit trail, and enables staff to retrieve enrollment and screening records more efficiently. It also strengthens oversight by standardizing enrollment workflows, reducing reliance on paper files, and improving documentation consistency. These enhancements better position DHS to demonstrate compliance during future audits and monitoring reviews. DHS recognizes the importance of maintaining complete, accurate, and accessible provider enrollment records. In addition to implementing the PEA Portal, DHS is strengthening policies and procedures related to provider file maintenance, document retention, and quality assurance reviews. Staff training and periodic monitoring will help ensure required enrollment documents and exclusion screening records are consistently maintained and available for inspection. DHS is committed to maintaining compliance with federal Medicaid and CHIP provider enrollment requirements and believes the corrective actions implemented, including deployment of the PEA Portal, will improve documentation controls, strengthen program integrity, and reduce the risk of similar findings in the future.

During the audit period, the Department did not complete the required ADP Risk Analysis and System Security Review for systems supporting the Medicaid Program, and certain monitoring controls were not operating at a sufficient level of precision to ensure compliance with federal requirements. To address this finding, the Department recently issued Requests for Qualifications (RFQs) to seven qualified vendors to perform comprehensive security risk assessments of the Medicaid Enterprise Systems (MES), including the VIBES Eligibility and Enrollment System, Provider Enrollment Application (PEA), Pharmacy Benefit Management (PBM) solution, and related supporting systems. Vendor responses are due within three weeks, after which the Department will evaluate submissions and proceed with the procurement process. The selected vendor will conduct the required risk assessments, identify control deficiencies and security vulnerabilities, and provide recommendations to strengthen the Department's security posture and compliance framework. The Department will work collaboratively with its technology partners, system vendors, and oversight entities to implement corrective actions identified through the assessments and enhance monitoring controls to ensure ongoing compliance with applicable federal requirements.

Conversion from VIMS to VIBES allowed system generated ex parte extensions beyond 12 months without requiring updated member contact or documentation. No process was in place to proactively require updated documentation when extensions exceeded one year, resulting in eligibility continuing without current proof in file. DHS will: 1. Implementation of Annual In Person/Active Renewal for Extended Cases 2. If members fail to provide required documentation or complete the renewal process, the case is closed for failure to verify eligibility. Appropriate adverse action notices are issued in accordance with policy and timelines. 3. Staff have been instructed that eligibility determinations must not be maintained solely on a system generated extension; supporting documentation must be present in the electronic case record and/or document management system. A brief standard note template is used in VIBES to reference what documents were received, and the date eligibility was rerun. 4. System Configuration Changes with Vendor (RedMane). Worked with RedMane to adjust system logic so that eligibility cannot be approved or extended if no completed application (or renewal) is on record. 5. Updated written procedure includes, staff must confirm that a completed application (paper, phone, online, or converted electronic record) is present and imaged/recorded before approving eligibility. If the individual fails to submit required information by the due date, staff must proceed with denial/closure and document the action in case notes. 6. Conducted targeted staff training on, requirement for a completed application before approval/extension; proper use of pending status and timeframes; correct closure/denial procedures. Provided written job aids illustrating compliant workflows. 7. Implementation of Review Tracking in SharePoint, as of July 2025, an Excel tracking file housed on SharePoint is used to document: case worker name; member name and address; case number; type of case (new application, renewal, newborn, etc.). Each case is entered when assigned to the worker. 8. The supervisor reviews the case directly in VIBES, confirms eligibility determinations, and applies any needed updates. VIBES records the supervisor’s actions with date, time stamp, and staff ID to show who reviewed and approved the case. The supervisor also applies changes and documents a brief note in the VIBES notes section (e.g., “Supervisor [Name/ID] reviewed and approved eligibility determination; OK to issue Notice of Decision.”). After review, the supervisor updates the SharePoint tracker to reflect that review is complete.