Corrective Action Plans

Name of Contact Person: Vickie K. Smith, DSS Director Income Maintenance Medicaid Supervisors will complete monthly second party reviews for application approvals/recertifications/denials/withdrawals for applications and ongoing cases. Based on findings from the monthly second party review of applications/recertifications individual meetings will be held with the responsible Income Maintenance Caseworker to discuss the errors found and ways to improve the work performance. The individual counseling will assist in assuring that the worker understands the error and what they need to do for improvements. Monthly a spreadsheet is created from each individual score, from each Income Maintenance Caseworkers audit. The spreadsheet is reviewed monthly and presented quarterly at the Bladen County Health and Human Service Advisory Committee meeting. In addition to the above ongoing process a meeting was held with the Medicaid staff on February 20, 2024 and the following manual sections were addressed (handouts given): DMA Admin Letter 02-19 The Work Number Procedures, Job Aid: The Work Number, Job Aid: Online Verifications; Manual calculations of Income MA 2250; Resources and verifications MA 2230; Job Aid: Evidence Dashboard Relationships; Approved Uses of Forced Eligibility last update 03/01/2023. Bladen County has shown significant improvement with the use of the Work Number for the purpose of application and ongoing case work. DMA Administrative Letter No. 02-19 (The Work Number Procedures). Proposed Completion Date: July 1, 2024 (Improvements from 06/01/2022 – 07/ 01/2023)

Name of Contact Person: Vickie K. Smith, DSS Director Income Maintenance Medicaid Supervisors will complete monthly second party reviews for application approvals/recertifications/denials/withdrawals for applications and ongoing cases. Based on findings from the monthly second party review of applications/recertifications individual meetings will be held with the responsible Income Maintenance Caseworker to discuss the errors found and ways to improve the work performance. The individual counseling will assist in assuring that the worker understands the error and what they need to do for improvements. Monthly a spreadsheet is created from each individual score, from each Income Maintenance Caseworkers audit. The spreadsheet is reviewed monthly and presented quarterly at the Bladen County Health and Human Service Advisory Committee meeting. In addition to the above ongoing process a meeting was held with the Medicaid staff on February 20, 2024 and the following manual sections were addressed (handouts given): DMA Admin Letter 02-19 The Work Number Procedures, Job Aid: The Work Number, Job Aid: Online Verifications; Manual calculations of Income MA 2250; Resources and verifications MA 2230; Job Aid: Evidence Dashboard Relationships; Approved Uses of Forced Eligibility last update 03/01/2023. Bladen County has shown significant improvement with the use of the Work Number for the purpose of application and ongoing case work. DMA Administrative Letter No. 02-19 (The Work Number Procedures). Proposed Completion Date: July 1, 2024 (Improvements from 06/01/2022 – 07/ 01/2023)

Views of Responsible Officials and Planned Corrective Actions: Staffing turnover limited ability for portfolio property managers to effectively manage tenant files at each building location. Historically, the management and auditing of tenant files was entirely under the process flows for property management team. Going forward the Inglis Compliance department will sufficiently sample and review tenant files throughout year to assure tenant files are accurate and audit ready at any given time. Inglis Housing Corporation hired new a new property management Executive Director in August 2023. Under her leadership the team has made extensive progress updating and bringing all PRACs, tenant recertifications, and tenant files into compliance. There has been in depth training for the property management team on the usage of a newly implemented property management system. All staff have or will attend external training classes for tax credit and HUD property management functions. The property management team is working on reviewing and updating all tenant files with a goal of being in compliance for the June 30, 2024 audit.

Views of Responsible Officials and Planned Corrective Actions: Staffing turnover limited ability for portfolio property managers to effectively manage tenant files at each building location. Historically, the management and auditing of tenant files was entirely under the process flows for property management team. Going forward the Inglis Compliance department will sufficiently sample and review tenant files throughout year to assure tenant files are accurate and audit ready at any given time. Inglis Housing Corporation hired new a new property management Executive Director in August 2023. Under her leadership the team has made extensive progress updating and bringing all PRACs, tenant recertifications, and tenant files into compliance. There has been in depth training for the property management team on the usage of a newly implemented property management system. All staff have or will attend external training classes for tax credit and HUD property management functions. The property management team is working on reviewing and updating all tenant files with a goal of being in compliance for the June 30, 2024 audit.

Views of Responsible Officials and Planned Corrective Actions: Staffing turnover limited ability for portfolio property managers to effectively manage tenant files at each building location. Historically, the management and auditing of tenant files was entirely under the process flows for property management team. Going forward the Inglis Compliance department will sufficiently sample and review tenant files throughout year to assure tenant files are accurate and audit ready at any given time. Inglis Housing Corporation hired new a new property management Executive Director in August 2023. Under her leadership the team has made extensive progress updating and bringing all PRACs, tenant recertifications, and tenant files into compliance. There has been in depth training for the property management team on the usage of a newly implemented property management system. All staff have or will attend external training classes for tax credit and HUD property management functions. The property management team is working on reviewing and updating all tenant files with a goal of being in compliance for the June 30, 2024 audit.

Views of Responsible Officials and Planned Corrective Actions: Staffing turnover limited ability for portfolio property managers to effectively manage tenant files at each building location. Historically, the management and auditing of tenant files was entirely under the process flows for property management team. Going forward the Inglis Compliance department will sufficiently sample and review tenant files throughout year to assure tenant files are accurate and audit ready at any given time. Inglis Housing Corporation hired new a new property management Executive Director in August 2023. Under her leadership the team has made extensive progress updating and bringing all PRACs, tenant recertifications, and tenant files into compliance. There has been in depth training for the property management team on the usage of a newly implemented property management system. All staff have or will attend external training classes for tax credit and HUD property management functions. The property management team is working on reviewing and updating all tenant files with a goal of being in compliance for the June 30, 2024 audit.

Staffing turnover limited ability for portfolio property managers to effectively manage tenant files at each building location. Historically, the management and auditing of tenant files was entirely under the process flows for property management team. Going forward the Inglis Compliance department will sufficiently sample and review tenant files throughout year to assure tenant files are accurate and audit ready at any given time. Inglis Housing Corporation hired new a new property management Executive Director in August 2023. Under her leadership the team has made extensive progress updating and bringing all PRACs, tenant recertifications, and tenant files into compliance. There has been in depth training for the property management team on the usage of a newly implemented property management system. All staff have or will attend external training classes for tax credit and HUD property management functions. The property management team is working on reviewing and updating all tenant files with a goal of being in compliance for the June 30, 2024 audit.

The County will implement additional review procedures.

Federal Award Findings Finding 2023-002 Late Reporting and Noncompliance with Reporting Requirements Name of Contact Person: Fony Imawan Corrective Action Plan: - Management will carefully review report deadlines and ensure that submission of reports is made before they are due. Management will also carefully review reporting requirements and ensure that requirements are adhered to. Proposed Completion Date: - Fiscal Year 2024

Finding 2023-001 Lack of Internal Controls over Eligibility Name of Contact Person: Fony Imawan Corrective Action Plan: -We will introduce supplementary policies and procedures -Staff/ the program manager will undergo training to review signed applications from the client -Managers will document their findings, noting whether clients are deemed eligible or not. -If clients are eligible, we will include supporting documentation with their application to validate their eligibility determination Proposed Completion Date: The end of the month

The Alamo Colleges District Student Financial Aid Office has collaborated with Internal Audit to put into place controls that ensure Alamo Colleges District Board policies are followed and that all Financial Aid staff are trained on the execution of those policies. Additional control reporting has been established to monitor compliance. The Board Policy F.2.4 has also been revised to clarify those expectations. Implementation Date: June 2024 Responsible Persons: Dr. Harold Whitis, District Director of Student Financial Aid

Findings – Federal Award Programs Audit Department of Agriculture 2023-001 Child Nutrition Cluster Program Deficiencies: See Finding 2023-001 Recommendation: Machne Rav Tov will ensure that meal counters are present at the start of each meal service. All required records will be maintained and posted as necessary. The Organization will have proper site supervision during meal services to ensure that meals are served at the approved time, consist of all required components, and are consumed on site. Action Taken: Since the date of the exit conference, we have implemented the above-mentioned comprehensive plan of corrective action. Mrs. Rotenberg, the site supervisor, is designated as being responsible to ensure timely and efficient meal service, and consumption of meals on site. Meal servers will receive relevant training for proper service of meals, including required meal components. An additional site supervisor, Mr. Isaac Ferentz, was hired and trained and will be present on site before the start of each meal time. The supervisors will ensure that meal pattern requirements are met and proper meal counts and food safety procedures are followed. Mrs. M. Stasel is designated as overseeing proper meal counting. Click counters will be used for accurate counting and documenting. Additional training was given to all SFSP staff. We have designated Mr. Hershey Rosenberg as being responsible to oversee the implementation of our plan of corrective action for these findings. Completion Date: May 21, 2024

Corrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Section III - Federal Award Findings and Questioned Costs (continued) Corrective Actions for findings 2023-005, 2023-006, 2023-007, 2023-008, annd 2023-009 also apply to the State Award findings. Finding: 2023-008 Section IV- State Award Findings and Questioned Costs Finding: 2023-009 The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Household composition (MA-3306), MAGI Budgeting (MA-3306), and Income Calculations (MA-3300). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Inaccurate Resources Entry Nia Broadway, Medicaid Manager The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Financial Resources (MA-2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Untimely Review of SSI Terminations Nia Broadway, Medicaid Manager The County County Met with all MAGI and Adult Medicaid Staff to discuss and review untimely review of SSI terminations finding, including policies for SSI Ex Parte Reviews (MA2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews

Corrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Section III - Federal Award Findings and Questioned Costs (continued) Corrective Actions for findings 2023-005, 2023-006, 2023-007, 2023-008, annd 2023-009 also apply to the State Award findings. Finding: 2023-008 Section IV- State Award Findings and Questioned Costs Finding: 2023-009 The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Household composition (MA-3306), MAGI Budgeting (MA-3306), and Income Calculations (MA-3300). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Inaccurate Resources Entry Nia Broadway, Medicaid Manager The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Financial Resources (MA-2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Untimely Review of SSI Terminations Nia Broadway, Medicaid Manager The County County Met with all MAGI and Adult Medicaid Staff to discuss and review untimely review of SSI terminations finding, including policies for SSI Ex Parte Reviews (MA2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews

Corrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Section III - Federal Award Findings and Questioned Costs (continued) Corrective Actions for findings 2023-005, 2023-006, 2023-007, 2023-008, annd 2023-009 also apply to the State Award findings. Finding: 2023-008 Section IV- State Award Findings and Questioned Costs Finding: 2023-009 The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Household composition (MA-3306), MAGI Budgeting (MA-3306), and Income Calculations (MA-3300). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Inaccurate Resources Entry Nia Broadway, Medicaid Manager The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Financial Resources (MA-2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Untimely Review of SSI Terminations Nia Broadway, Medicaid Manager The County County Met with all MAGI and Adult Medicaid Staff to discuss and review untimely review of SSI terminations finding, including policies for SSI Ex Parte Reviews (MA2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews

Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Corrective Action: Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Corrective Action: Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Inadequate Request for Information The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for 12 and 30 day documentation (MA-2230), Financial Resources (MA- 3306). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Finding: 2023-005 Finding: 2023-006 IV-D Non-Cooperation Training completed 5/1/2024. County will continue Second Party Reviews. Finding: 2023-007 Finding: 2023-004 The County experienced a ransomware attack in May 2021 which significantly impacted all systems maintained and supported by the County. Electronic supporting documentation and work sheets were lost which impacted the ability to report information to ensure the audit was completed on time. In review of our current status, the administration estimates to complete the FY 24 audit on time by 10/31/24. October 31, 2024 Section III - Federal Award Findings and Questioned Costs The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Medicaid Unwinding Instructions on Case Handling. The County will continue Second Party Reviews and conduct trainings based on findings. Inaccurate Information EntryCorrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Name of Contact Person: Corrective Action: Proposed Completion Date: Section III - Federal Award Findings and Questioned Costs (continued) Corrective Actions for findings 2023-005, 2023-006, 2023-007, 2023-008, annd 2023-009 also apply to the State Award findings. Finding: 2023-008 Section IV- State Award Findings and Questioned Costs Finding: 2023-009 The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Household composition (MA-3306), MAGI Budgeting (MA-3306), and Income Calculations (MA-3300). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Inaccurate Resources Entry Nia Broadway, Medicaid Manager The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Financial Resources (MA-2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Untimely Review of SSI Terminations Nia Broadway, Medicaid Manager The County County Met with all MAGI and Adult Medicaid Staff to discuss and review untimely review of SSI terminations finding, including policies for SSI Ex Parte Reviews (MA2230). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews

Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Corrective Action: Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Corrective Action: Proposed Completion Date: Name of Contact Person: Nia Broadway, Medicaid Manager Inadequate Request for Information The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for 12 and 30 day documentation (MA-2230), Financial Resources (MA- 3306). The County will continue Second Party Reviews and conduct trainings based on findings. Training completed 5/1/2024. County will continue Second Party Reviews. Finding: 2023-005 Finding: 2023-006 IV-D Non-Cooperation Training completed 5/1/2024. County will continue Second Party Reviews. Finding: 2023-007 Finding: 2023-004 The County experienced a ransomware attack in May 2021 which significantly impacted all systems maintained and supported by the County. Electronic supporting documentation and work sheets were lost which impacted the ability to report information to ensure the audit was completed on time. In review of our current status, the administration estimates to complete the FY 24 audit on time by 10/31/24. October 31, 2024 Section III - Federal Award Findings and Questioned Costs The County met with all MAGI and Adult Medicaid Staff to discuss and review inadequate request for inforamtion findings, including polices for Medicaid Unwinding Instructions on Case Handling. The County will continue Second Party Reviews and conduct trainings based on findings. Inaccurate Information Entry

Name of Responsible Individual: Dylan Nowakowski, Assistant Director of Financial Aid Corrective Action: There is no documentation available to indicate that a professional judgement was completed at the time of the incident cited. Wheeling did not have access to any documentation such as log notes, documents, or contact records of any kind. The DPT program budgets differ in amount for first- and second-year attendance. It is known that at this time, the first-year budget was not available, and some student budgets were not separated and entered correctly for first- and second-year cost of attendance. A Financial Aid Office policy has been established to ensure that proper documentation and records maintenance is achieved. Staff enter detailed log notes regarding student contact and results of those contacts. A Budget Adjustment form has been created for students to present to the office if they request a cost of attendance and budget increase. These forms are scanned into the individual student file and is easily obtained for future use when and if necessary. Each DPT budget year has been incorporated into a spread sheet format. Any change to a budget item is input into the sheet and the system will auto calculate a new or different budget amount. These new numbers and the updated COA (cost of attendance) are inserted into the colleague system and is a permanent, easily retrievable record. Anticipated Completion Date: July 2023.

Procurement Recommendation: We recommend that the Organization follow the current policies and procedures over covered transactions and to maintain supporting documentation of the process. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Society has reviewed the procurement policy with staff, emphasized the importance of following, and will ensure that adequate documentation is retained. Name(s) of the contact person(s) responsible for corrective action: Kelly Moritz, Vice President of Finance and Contracts Planned completion date for corrective action plan: December 31, 2024

In order to address this audit finding, CMN financial aid staff plans to seek continual improvement in the areas relating to Pell calculations. Through both Federal Student Aid and National Association of Financial Aid Administrators (NASFAA), staff will complete trainings to understand all aspects of calculating awards, as well as staying up to date on regulatory changes through our student information system. In addition to more training in this area, priority will be placed on rechecking and auditing Pell awards so that they are reviewed during the award year. Staff has already begun reviewing fall 2023 Pell awards for accuracy and will continue to review awards as terms move forward.

Internal Control over Compliance (Repeat Finding 2022-001, 2021-003, 2020-001, 2019-002, 2018-003, 2017-002, 2015-002, 2014-008) Name of contact person responsible for corrective action plan: Rhett R. Vertrees, Assistant Chief Financial Officer 2601 Enterprise Road, Reno NV 89512-1666 Phone: (775)784-3409, Fax: (775)784-1127 Email: rvertrees@nshe.nevada.edu Responses UNR agrees with the findings • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; The technical staff can only have the PeopleSoft Administrator (PSA) role in either development or production, but not both. There is an approval process in place to ensure that access is removed from either development or production when a PSA needs to be moved across to the other environment. This process became effective March 1, 2023. There is a quarterly security review of the PeopleSoft Administrator role in PeopleSoft. The first quarterly review was performed in FY16 Q1 and has been performed each quarter since. The reviews are documented and approved. There is a quarterly security review of the PeopleSoft Administrator activities in PeopleSoft. The first quarterly review was performed in FY22 Q4 and has been performed each quarter since. The reviews are documented and approved. There is a quarterly security review of the PeopleSoft Oracle database and user access. The first quarterly review was performed in FY20 Q2 and has been performed each quarter since. The reviews are documented and approved. • How compliance and performance will be measured and documented for future audit, management and performance review. Compliance and performance can be measured by the documented quarterly reviews. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The PeopleSoft Manager will be responsible for ensuring the corrective actions plans are implemented and followed. The Vice President of Information Technology will be accountable for the department’s compliance. UNLV agrees with the finding. • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; UNLV understands the importance of adequate segregation of duties within the PeopleSoft environments and applications. The PeopleSoft Administrator (PSA) position that is the subject of the finding is responsible for the installation, configuration, upgrades, and troubleshooting of all the application environments. The PeopleSoft Administrators are not programmers/developers, and their access to the production environments is periodically required to perform the needed activities required to provide timely support of the application within the scope of their job duties. UNLV has implemented the following controls to mitigate the risks associated with the elevated access required for the administrators to perform their required support activities. 1. UNLV has removed all persistent assignment of the PeopleSoft Administrator role from all PSAs in all environments. 2. The PeopleSoft Administrator role is temporarily assigned only when elevated actions are required. All assignments are of a limited duration and include a justification detailing the need and actions to be performed. All assignments trigger the follow actions: a. An immediate notification to the Director of Business Continuity & Resiliency and the Interim Senior Associate Vice Provost for Digital Strategy and Transformation. b. Removal is automatic but can be initiated by PSA if work is completed sooner than expected. c. All details around the assignment are captured in a tracking table. d. A review of all assignments and activities is performed monthly. 3. UNLV will continue to review access, activities, and assigned privileges monthly for the PeopleSoft Administrators. 4. UNLV will continue researching and implementing other control methods that may strengthen the segregation of duties or the monitoring capabilities that are available. • How compliance and performance will be measured and documented for future audit, management and performance review. The PeopleSoft Administrator role is no longer persistently assigned to the PSA position. It is only assigned upon request with the knowledge and approval of approving authorities. UNLV performs monthly reviews of the access and activities to determine if the PeopleSoft Administrators' activities align with the necessary support. Additionally, UNLV will continue to research other control methods that will address the segregation of duties while providing appropriate service and support. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The Director of Business Continuity & Resiliency will be responsible for performing the activity reviews and access needs of the PeopleSoft Administrators. The Director will complete the reviews and is also accountable if repeat or similar observations are noted. The Chief Information Security Officer will verify that reviews are conducted on a monthly basis per audit practices. SCS agrees with the findings • Detailed corrective action taken, including what will be done to avoid the identified issues in the future, and when these measures will be in place; In addition to the compensating controls (a) to (d), that have been operating since prior to FY23 the segregation of PeopleSoft Administrators (PSA) is enforced through a “locked account” process. Only two employees have PSA access in both the Production and Development environment. Each employee can only have access to the Production or Development environment at any one time, i.e., the PSA account in the other environment remains locked. A JIRA ticket must be opened for an account to be unlocked. The request is approved by management and the account is unlocked by a member of the IT Security Team. The controls listed below should also mitigate the segregation of duties risk and support a review of “user activities” in the absence of an appropriate user activities audit log function. (a) STAT for PeopleSoft – Code control and internal modification tracking provides visibility over PSA activities that are processed via this tool. These object changes are reviewed and approved by the Director of Information and Application Services. (b) JIRA ‐ Change control management and project tracking software. Change requests and projects related to the PeopleSoft shared instance are tracked and approved. This would include user access modifications and system updates for example. (c) Security e‐mail alerts – The SCS security team are alerted via automated e‐mails when key events are triggered. For example, an elevated role is assigned to a user. (d) User Access Reviews – On an annual basis an independent user access review is performed incorporating SCS/SA privileged users and all shared instance security coordinators. • How compliance and performance will be measured and documented for future audit, management and performance review. The PeopleSoft Administrators will have persistent unlocked access to either the Production or Development environments only. Their corresponding account in the other environment will remain locked. In the event that access is needed to the locked environment, a ticket will be created requesting access which will document the rationale and approvals. In addition, PSA activities are monitored via the change control process through STAT for PeopleSoft. Object changes within the Production environment for example, are approved along with the associated workflows. • Who will be responsible and may be held accountable in the future if repeat or similar observations are noted. The SCS Director of Information and Application Services, and SCS Security Group are responsible for locking/unlocking PSA accounts. The SCS Security Group monitor PeopleSoft e-mail alerts. The IT Audit Manager is performing annual SCS/SA privileged user access reviews.

Finding Number: 2023-004 Condition: We were not able to verify that the U.S. citizenship for six of the 14 participants tested for the Talent Search program as management did not retain support for eligibility determination. Planned Corrective Action: Management concurs with the recommendation and will implement the proper internal controls to ensure all applications are complete and accurate. This is being accomplished by building out the internal accounting department, which includes adding a grants director to the team. Contact person responsible for corrective action: Brian Fredericks, Interim CFO Anticipated Completion Date: July 1, 2024

4. Finding 2023-003 – Major Federal Award Programs Audit c. Comments on the Finding and Recommendation We concur with the auditors finding as follows: In connection with our lease files review we noted the following deficiencies: • 1 out of 1 move-outs tested did not have the inspection signed by the tenant or an employee at the property. • 1 out of 1 move-outs tested did not have the inspection dated by an employee at the property. • 1 out of 1 move-ins tests did not have the tenant’s Enterprise Verification Form (“EIV”) performed timely within the 90 days HUD requires. d. Action(s) Taken or Planned on the Finding Management Agent Management has hired a new Compliance Manager and engaged a 3rd party compliance monitoring company to review all files and EIV processes effective 5/1/2024. Regards Kimalee Williams

Conduct physical review of each client application (and/or scanned and emailed applications). Increase training on procedural regulations to front-line and supervisory staff in counties outside Dickinson and Iron. Implement quality control verification checks regularly at counties outside of Dickinson and Iron. Person(s) Responsible: Christina Ureta, CSFP/TEFAP Director Timing for Implementation: Immediately

Management's Views and Corrective Action Plan Finding 2023-002 - Non-Compliance with Financial Need Requirements for Subsidized Direct Loans in Non-Standard Semesters Grantor: U.S. Department of Education Program: Student Financial Assistance Cluster Assistance Listing#: 84.268 Award Titles: Federal Direct Student Loan Program Program Award Years: 7/2022 - 6/2024 Management agrees with the finding and proposes the following corrective action plan: Corrective Action Plan: When a student attends a standard semester (Fall and Winter), PeopleSoft uses the Prorated Estimated Family Contribution (EFC) Methodology to determine the subsidized loan eligibility based on their EFC. When a student attends a non-standard term (Spring), PeopleSoft uses the Automatic Zero EFC Methodology and offers subsidized loans to all students rather than the subsidized loan eligibility based on their EFC. Tammie Fonoimoana, Financial Aid & Scholarships Senior Manager, will work to update the PeopleSoft system to use the Prorated EFC Methodology for calculating subsidized loan eligibility for both standard and non-standard terms. In addition, Tammie Fonoimoana, Financial Aid & Scholarships Senior Manager, who is responsible for packaging and awarding of Financial Aid at Brigham Young University- Hawaii will continue to provide training to the staff who administer Title IV aid to ensure they are aware of the changes in packaging and awarding subsidized loans for the non-standard term (Spring). Also, Tammie Fonoimoana will oversee the implementation of controls wherein the University will implement preventative mechanisms to verify financial aid packages are calculated correctly. Timing: Tammie Fonoimoana, Financial Aid & Scholarships Senior Manager, will be responsible for overseeing that the items as noted in the corrective action plan section above will be implemented by July 1, 2024. Signed and Acknowledged, Tammie Fonoimoana, Senior Manager BYU-Hawaii Financial Aid & Scholarships Tammie.fonoimoana@byuh.edu 808-675-4737