Corrective Action Plans

Finding 1218801 (2025-002)

Material Weakness 2025

NE

Eligibility Internal Control / Segregation of Duties Procurement, Suspension & Debarment § 200.303

Persons responsible for corrective action: Keith Morrow, Health Services Chief Executive Officer Corrective action planned: Developed and implemented process by which Business Services staff in Health Services review documents provided by non-Ponca Native Americans upon initial request for services ...

Persons responsible for corrective action: Keith Morrow, Health Services Chief Executive Officer Corrective action planned: Developed and implemented process by which Business Services staff in Health Services review documents provided by non-Ponca Native Americans upon initial request for services and on an annual basis to follow to confirm and verify their capacity to receive health services from the Ponca Tribe. Steps have been taken to see the staff verifying are independent from those who initially collect such documents. Additionally, confirmed such process is consistent with existing verification review of Ponca members requesting services. Implementation date: December 1, 2025.

View Audit 404885

Finding 1218776 (2025-002)

Material Weakness 2025

City of Lowell

MA

Procurement, Suspension & Debarment Subrecipient Monitoring Allowable Costs / Cost Principles § 200.327

Audit Finding Reference: 2025-002 Improve Procurement Procedures Planned Corrective Action: The District will strengthen its procurement procedures for federally funded purchases to ensure compliance with Uniform Guidance requirements. Specifically, the District will: 1. Revise procurement procedure...

Audit Finding Reference: 2025-002 Improve Procurement Procedures Planned Corrective Action: The District will strengthen its procurement procedures for federally funded purchases to ensure compliance with Uniform Guidance requirements. Specifically, the District will: 1. Revise procurement procedures to clearly identify when federal procurement requirements apply in addition to state and local procurement regulations. 2. Develop and implement a federal procurement checklist that must be completed prior to the award of any contract funded in whole or in part with federal grant funds. 3. Work with the Law Department to establish standardized contract templates containing all required federal contract provisions, including the Byrd Anti-Lobbying Amendment when applicable. 4. Require a secondary review bythe Business Office or Grants Management personnel before contract execution to verify compliance with Uniform Guidance procurement standards and required contract clauses. 5. Provide annual training to Business Office staff, grant managers, and other personnel involved in procurement activities regarding federal procurement requirements and contract provisions. 6. Conduct periodic internal reviews of federally funded procurement transactions to ensure ongoing compliance. Planned Implementation Date of Corrective Action: The revised procedures, procurement checklist, and standardized contract templates will be implemented by7 /1/2026. Training will be completed for applicable staff during the current fiscal year and prior to the initiation of future federally funded procurements. Person Responsible for Corrective Action: Assistant Superintendent of Finance Derek Pinto, Assistant Superintendent of Finance

View Audit 404883

Finding 1218766 (2025-001)

Material Weakness 2025

Nevada School District

AR

Subrecipient Monitoring Internal Control / Segregation of Duties

District management will adopt sound accounting policies and establish and maintain internal control that will initiate, authorize, record, process, and report transactions consistent with management's assertions embodied in the financial statements and that will safeguard District assets.

View Audit 404881

Finding 1218757 (2025-002)

Material Weakness 2025

Pact, Inc.

DC

Subrecipient Monitoring Reporting Internal Control / Segregation of Duties

Corrective Action Plan: Effective January 2026, Pact management implemented a new process that strengthens the internal controls over the FFATA reporting to ensure the required reports are submitted within the required timeframe. The monthly report being run to capture those subaward actions that re...

Corrective Action Plan: Effective January 2026, Pact management implemented a new process that strengthens the internal controls over the FFATA reporting to ensure the required reports are submitted within the required timeframe. The monthly report being run to capture those subaward actions that require FFATA reporting has been changed to encompass 45 days to ensure that no late entries are missed when the reporting is done.

View Audit 404865

Finding 1218756 (2025-001)

Material Weakness 2025

Pact, Inc.

DC

Subrecipient Monitoring Internal Control / Segregation of Duties Procurement, Suspension & Debarment

Corrective Action Plan: Misuse of Funds – Vehicle: Pact updated its Global Vehicle Policy effective November 1, 2025. The updated Global Vehicle Policy reinforces Pact’s zero-tolerance policy. No new reports of vehicle misuse have been received since November 2025, and all the reported cases of misu...

Corrective Action Plan: Misuse of Funds – Vehicle: Pact updated its Global Vehicle Policy effective November 1, 2025. The updated Global Vehicle Policy reinforces Pact’s zero-tolerance policy. No new reports of vehicle misuse have been received since November 2025, and all the reported cases of misuse occurred prior to November 1. Pact’s updated policy complies with all applicable laws and regulations, including the organization’s internal Code of Conduct, while aligning with the objectives and scope of work for the project. Pact’s guidelines specify roles and responsibilities and role assignments; identify authorized places to obtain fuel; where to store vehicle keys; where to park vehicles; and require individuals to enter detailed records regarding the use of the vehicle into a log. Misuse of Funds – Payroll: In alignment with Pact’s core principle of continuous quality improvement, and following substantiation of the misuse in one country office, Pact developed and implemented a corrective action plan. This plan included a comprehensive quality review of existing controls to identify and address any procedural gaps in the timesheet systems to ensure the timesheet systems have a functional auditable approval trail. We have reinforced, including in Senior Management Team meetings with staff, and other trainings supervisors’ responsibility to review and verify hours worked for their staff.

View Audit 404865

Finding 1218735 (2025-002)

Material Weakness 2025

Crossett Housing Authority

AR

Subrecipient Monitoring Cash Management Period of Performance

Views of Responsible Officials and Planned Corrective Actions: The Crossett Housing Authority Director will immediately seek guidance from HUD officials and MRI/Lindsey to remedy this problem.

View Audit 404826

Finding 1218716 (2025-061)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties Subrecipient Monitoring Allowable Costs / Cost Principles § 200.303

Finding 2025-061 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), ALN 93.323 and Block Grants for Prevention and Treatment of Substance Abuse, ALN 93.959 Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS is actively pursuing the implementation of an A...

Finding 2025-061 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), ALN 93.323 and Block Grants for Prevention and Treatment of Substance Abuse, ALN 93.959 Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS is actively pursuing the implementation of an API for the submission of FFATA data to the federal system, SAM, to improve both timeliness and accuracy through automation. This API will connect EGrAMS with SAM, enabling backend communication between the systems and allowing SAM to automatically retrieve data directly from EGrAMS. To ensure accurate reporting until the API is established, MDHHS will continue reviewing validation errors when submitting web-based information to SAM and will work with the SAM federal helpline to report federal system issues and identify interim alternatives to submit the required data. Also, MDHHS implemented an enhancement in August 2025 that validates federal funding sources in EGrAMS against their effective dates, reducing coding errors and improving data reliability. In addition, the query used to obtain certain FFATA data elements was modified during fiscal year 2026 to improve accuracy of reporting. Anticipated Completion Date December 31, 2027 Responsible Individual(s) Matt Blackburn, MDHHS Jeanette Hensler, MDHHS Rebecca Jones, MDHHS

View Audit 404775

Finding 1218710 (2025-019)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties

Finding 2025-019 MARIS Change Management Process Management Views MDHHS agrees that the procedural step of formalizing post implementation validation documentation was not completed for this specific request for change. MDHHS emphasizes that active operational monitoring of the Medicaid Audit Recove...

Finding 2025-019 MARIS Change Management Process Management Views MDHHS agrees that the procedural step of formalizing post implementation validation documentation was not completed for this specific request for change. MDHHS emphasizes that active operational monitoring of the Medicaid Audit Recovery and Investigation System (MARIS) environment occurred post deployment, mitigating the risk of unauthorized or inappropriate changes impacting the system's secure operation. In addition, MDHHS notes that verbal approval for the deployment was provided during a meeting with DTMB, and both parties proceeded with the understanding that the change was authorized. The absence of required written documentation was an administrative oversight stemming from a breakdown in the established interagency communication workflow, where DTMB did not send the standard notification email prompting the business owner's formal sign-off. Planned Corrective Action The MDHHS Office of Inspector General (OIG) formalized a communication protocol with DTMB to ensure the change management documentation lifecycle is completed. During April 2026, DTMB and the OIG implemented the use of Azure DevOps for monitoring scheduled MARIS implementation dates and documenting approvals. Anticipated Completion Date Completed Responsible Individual(s) Casey Barton, MDHHS

View Audit 404775

Finding 1218709 (2025-018)

Material Weakness 2025

State of Michigan

MI

Subrecipient Monitoring Internal Control / Segregation of Duties

Finding 2025-018 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Medical Loss Ratio Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS updated and strengthened its medical loss ratio (MLR) reporting instructions and ...

Finding 2025-018 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Medical Loss Ratio Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS updated and strengthened its medical loss ratio (MLR) reporting instructions and comparison template for the MHP Comprehensive Health Care Plan (CHCP), Dental Health Plans, and MI Choice to ensure clearer expectations and alignment with federal requirements. The CHCP and MI Choice programs cited in the fiscal year 2024 audit did not have any identified issues during the fiscal year 2025 audit, demonstrating the impact of MDHHS’s efforts to improve internal controls and monitoring activities to ensure all submitted MLR reports are completed in accordance with federal regulations. MDHHS updated the MLR reporting instructions and the comparison template for the PIHPs to clarify federal requirements and ensure consistency across all managed care programs and distributed them to the PIHPs during May 2026. MDHHS will strengthen its internal tracking and review process to ensure inclusion of the federally required comparison to audited financial statements in all MLR submissions by September 1, 2026. This verification step, currently in place for PIHPs, will be expanded to all managed care entity types. MDHHS will document this verification and follow up with the managed care entity when the comparison is missing or incomplete to ensure compliance with federal regulations. Anticipated Completion Date September 1, 2026 Responsible Individual(s) Kristen Morningstar, MDHHS Keith White, MDHHS Chris Parker, MDHHS

View Audit 404775

Finding 1218708 (2025-017)

Material Weakness 2025

State of Michigan

MI

Eligibility Internal Control / Segregation of Duties

Finding 2025-017 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Provider Screening Management Views MDHHS agrees with the finding. Planned Corrective Action During April 2026, MDHHS notified all relevant program areas of the CHAMPS screening re...

Finding 2025-017 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Provider Screening Management Views MDHHS agrees with the finding. Planned Corrective Action During April 2026, MDHHS notified all relevant program areas of the CHAMPS screening requirement and will provide recurring reminders and updates during monthly program operations meetings. MDHHS is also working across its internal program teams to ensure that plans and providers are aware of this requirement and are completing the required registration. In addition, to strengthen screening of out-of-state Managed Care Organization rendering providers, MDHHS will implement a system enhancement that will enforce CHAMPS registration for out-of-state providers by rejecting encounter claims for providers that are not properly registered. MDHHS anticipates full implementation of this system enhancement by December 31, 2027. Anticipated Completion Date December 31, 2027 Responsible Individual(s) Keith White, MDHHS Chris Parker, MDHHS

View Audit 404775

Finding 1218702 (2025-008)

Material Weakness 2025

State of Michigan

MI

Eligibility Internal Control / Segregation of Duties

Finding 2025-008 CHAMPS Eligibility Interface Errors Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS has strengthened its processes to ensure that documentation is maintained for all eligibility records identified with errors and excluded from the Community Health Aut...

Finding 2025-008 CHAMPS Eligibility Interface Errors Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS has strengthened its processes to ensure that documentation is maintained for all eligibility records identified with errors and excluded from the Community Health Automated Medicaid Processing System (CHAMPS) interface processing. Bridges, as the system of record for eligibility, continues to generate reports identifying potential duplicate identification numbers (ID) for local office staff to review and merge the records when they determine the IDs represent the same individual. Until this review and merging process is completed, CHAMPS rejects these potential duplicate records to prevent duplicate beneficiary payments under different CHAMPS Medicaid IDs. In April 2026, MDHHS implemented a weekly query to identify potential duplicate IDs rejected by CHAMPS that were not captured on the standard Bridges reports and therefore require additional review. These records are forwarded to the MDHHS Enrollment Services Section for manual assessment to determine whether they represent new beneficiaries or existing beneficiaries associated with a different CHAMPS Medicaid ID. The Enrollment Services Section then completes the appropriate resolution and ensures the required documentation is maintained. Anticipated Completion Date Completed Responsible Individual(s) Jonathan Bair, MDHHS

View Audit 404775

Finding 1218700 (2025-004)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties Subrecipient Monitoring Eligibility § 200.303

Finding 2025-004 Bridges Security Management and Access Controls Management Views MDHHS agrees with the finding. Planned Corrective Action For parts a., b., c., and d., MDHHS implemented the Database Security Application (DSA) on October 2, 2023, which includes documenting incompatible role exceptio...

Finding 2025-004 Bridges Security Management and Access Controls Management Views MDHHS agrees with the finding. Planned Corrective Action For parts a., b., c., and d., MDHHS implemented the Database Security Application (DSA) on October 2, 2023, which includes documenting incompatible role exception requests and user access request approvals, semi-annual review of privileged users, and annual review for all users. Security management and access control processes will continue to be a standing agenda item for ongoing quarterly training sessions with local office security coordinators (LOSC). For parts a., c., and d., the Access Management Section began implementing a process to conduct quarterly reconciliations of the DSA to the Bridges Integrated Automated Eligibility Determination System (Bridges) during March 2025. Due to the complexity of the reconciliations and time constraints, MDHHS requested the Bridges technical team to develop a consolidated Excel based report to add a level of automation to the process. The report is now available on an ad hoc basis, and the Access Management Section began utilizing it during April 2026 to conduct reviews and provide remediation with the LOSCs and end users. Full automation of the report remains in progress due to significant competing priorities and limited resources. For part b., MDHHS implemented the automated DSA periodic access review process (PAR) during January 2026 to review all users every 90 days, instead of the current 180 days for privileged users. MDHHS updated its policy to require initiation of the PAR in the DSA for all users every 90 days, without exception, to comply with State standards. For part e., MDHHS local office directors, district managers, or designees review a monthly sample of high-risk Bridges transactions to ensure documentation was properly maintained. Beginning September 2024, MDHHS Business Service Centers (BSC) implemented a monitoring process to ensure monthly reviews are completed by the local offices timely and that the documentation is properly maintained. To strengthen compliance, MDHHS will reinforce expectations through manager training and emphasize the requirement to maintain complete records and to sign and date all review reports within 30 days of the report run date. Additional training sessions will be repeated as needed to ensure consistent adherence to documentation and timeliness standards across all local offices. Anticipated Completion Date a., c., and d. Ongoing b. Completed e. September 30, 2026 Responsible Individual(s) a., b., c., and d. Tim Kwast, MDHHS e. Tim Kwast and Veronica Maxson, MDHHS

View Audit 404775

Finding 1218699 (2025-003)

Material Weakness 2025

State of Michigan

MI

Eligibility Internal Control / Segregation of Duties § 200.303

Finding 2025-003 Bridges Interface Controls Management Views DTMB agrees with the finding. Planned Corrective Action DTMB will establish a process to verify that the total number of processed, exception, and skipped records matches the number of records read from the data source. DTMB will investiga...

Finding 2025-003 Bridges Interface Controls Management Views DTMB agrees with the finding. Planned Corrective Action DTMB will establish a process to verify that the total number of processed, exception, and skipped records matches the number of records read from the data source. DTMB will investigate discrepancies identified through this validation process and implement appropriate corrective measures to resolve the issues. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Nathan Buckwalter, DTMB

View Audit 404775

Finding 1218698 (2025-002)

Material Weakness 2025

State of Michigan

MI

Eligibility Internal Control / Segregation of Duties § 200.303

Finding 2025-002 DTMB, IT General Controls Management Views The Department of Technology, Management, and Budget (DTMB) agrees it did not perform the annual review of privileged accounts for the operating system servers. As stated in the finding, DTMB performed the recertification process after the ...

Finding 2025-002 DTMB, IT General Controls Management Views The Department of Technology, Management, and Budget (DTMB) agrees it did not perform the annual review of privileged accounts for the operating system servers. As stated in the finding, DTMB performed the recertification process after the issue was brought to its attention. Planned Corrective Action DTMB performed its user access recertification processes in November 2025. Anticipated Completion Date Completed Responsible Individual(s) Manny Rosales, DTMB

View Audit 404775

Finding 1218684 (2025-055)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties Subrecipient Monitoring Material Weakness

Finding 2025-055 Social Services Block Grant, ALN 93.667 - Post-Expenditure Report Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS is modifying the process to obtain the required post-expenditure report data to ensure all individuals receiving Social Services Block Gr...

Finding 2025-055 Social Services Block Grant, ALN 93.667 - Post-Expenditure Report Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS is modifying the process to obtain the required post-expenditure report data to ensure all individuals receiving Social Services Block Grant supported services are appropriately included. Also, MDHHS will add a program validation step to review the applicable federal regulations and confirm the data extracted is accurate and complete. In addition, MDHHS will revise and resubmit the fiscal year 2025 report by September 30, 2026. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Tiffany Clarke, MDHHS Rebecca Jones, MDHHS Mary Lou Mahoney, MDHHS Aimee McDaniel, MDHHS

View Audit 404775

Finding 1218682 (2025-007)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties Student Financial Aid Subrecipient Monitoring

Finding 2025-007 MiSACWIS Security Management and Access Controls Management Views MDHHS agrees with the finding. Planned Corrective Action For part a., MDHHS currently has a process in place to review the user narrative describing the incompatible role exceptions within the DSA Michigan Statewide A...

Finding 2025-007 MiSACWIS Security Management and Access Controls Management Views MDHHS agrees with the finding. Planned Corrective Action For part a., MDHHS currently has a process in place to review the user narrative describing the incompatible role exceptions within the DSA Michigan Statewide Automated Child Welfare Information System (MiSACWIS) request as part of the approval process. Also, MDHHS added an incompatible role form in the DSA MiSACWIS request with automated routing for appropriate approval on November 11, 2025. In addition, MDHHS provides ongoing education during the quarterly LOSC webinars, where guidance is shared with the LOSCs on security management and access control topics, such as the correct procedures for processing system access requests. For part b., during April 2025, MDHHS updated the renewal processing start date to 15 days earlier to ensure renewal requests are reviewed prior to the annual recertification date. Anticipated Completion Date Completed Responsible Individual(s) Tim Kwast, MDHHS Alana Lowe, MDHHS

View Audit 404775

Finding 1218678 (2025-020)

Material Weakness 2025

State of Michigan

MI

Allowable Costs / Cost Principles Reporting Internal Control / Segregation of Duties

Finding 2025-020 Foster Care Title IV-E, ALN 93.658 and Adoption Assistance, ALN 93.659 - Accuracy of Financial Reports Management Views MDHHS disagrees with the finding. The expenditures noted were recorded through MDHHS’s normal, federally approved Public Assistance Cost Allocation Plan cost alloc...

Finding 2025-020 Foster Care Title IV-E, ALN 93.658 and Adoption Assistance, ALN 93.659 - Accuracy of Financial Reports Management Views MDHHS disagrees with the finding. The expenditures noted were recorded through MDHHS’s normal, federally approved Public Assistance Cost Allocation Plan cost allocation process. As part of this process, certain administrative costs are not identifiable or allocable to federal programs until the allocation is completed. At that point, MDHHS recognizes these costs as expenditures in the CB-496 report in the quarter in which the allocation occurs and the costs are assigned to the grant. Consistent with this approach, MDHHS has historically reported these amounts as current quarter expenditures. MDHHS previously consulted with the U.S. Department of Health and Human Services (HHS) Administration for Children and Families (ACF) on the appropriate use of the prior quarter adjustment column, and MDHHS was verbally instructed to no longer record these administrative costs as adjustments since this is part of the normal cost allocation process. ACF approves the CB-496 reports in the federal system and ensures the final award amount reconciles with the amounts reported. This approval process supports the reporting approach used by MDHHS is both consistent with prior guidance and accepted by ACF through its approval and award process. Planned Corrective Action Although MDHHS disagrees with the finding, MDHHS sought written guidance from ACF and will follow up to obtain clarification on the appropriate reporting of administrative costs. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Rebecca Jones, MDHHS

View Audit 404775

Finding 1218620 (2025-006)

Material Weakness 2025

State of Michigan

MI

Special Tests & Provisions Internal Control / Segregation of Duties § 200.303

Finding 2025-006 ADP Security Program Management Views MDHHS and DTMB agree with the finding. Planned Corrective Action For 2 of the 3 systems cited, the Authority to Operate (ATO) was successfully re-established on July 8, 2025, and October 10, 2025, respectively. For the remaining system, MDHHS an...

Finding 2025-006 ADP Security Program Management Views MDHHS and DTMB agree with the finding. Planned Corrective Action For 2 of the 3 systems cited, the Authority to Operate (ATO) was successfully re-established on July 8, 2025, and October 10, 2025, respectively. For the remaining system, MDHHS and DTMB will complete a comprehensive update to the System Security Plan, incorporate all missing control assessments into the risk analysis, and implement the ATO by August 30, 2026. Anticipated Completion Date August 30, 2026 Responsible Individual(s) Nathan Buckwalter, DTMB Heather Frick, DTMB Veronica Maxson, MDHHS Jim Bowen, MDHHS Kasi Hunziger, MDHHS Lyndia Deromedi, MDHHS

View Audit 404775

Finding 1218548 (2025-010)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties § 200.303

Finding 2025-010 MDE, Change Management Process Management Views MDE partially agrees with the finding. MDE agrees that testing results were not fully documented. However, MDE does not agree that post implementation validation could be performed. The scan-vulnerability process could not be performed...

Finding 2025-010 MDE, Change Management Process Management Views MDE partially agrees with the finding. MDE agrees that testing results were not fully documented. However, MDE does not agree that post implementation validation could be performed. The scan-vulnerability process could not be performed in the production environment in this instance without significantly impacting system performance for users, making post implementation validation infeasible. Planned Corrective Action MDE management will review the testing documentation maintained in DevOps for all tickets classified as tasks and associated with change management activities and deployments and will remind staff of the required documentation standards for all DevOps tickets linked to a deployment. Additionally, MDE will evaluate whether an alternative method of validating the scan-vulnerability process in production is feasible. If no alternative method is identified, MDE will document that post implementation validation cannot be performed due to system constraints. Anticipated Completion Date December 31, 2026 Responsible Individual(s) Monica Butler, MDE

View Audit 404775

Finding 1218547 (2025-009)

Material Weakness 2025

State of Michigan

MI

Subrecipient Monitoring Cash Management Internal Control / Segregation of Duties § 200.303

Finding 2025-009 MDE, Security Management and Access Controls Management Views MDE agrees with the finding. Planned Corrective Action For part a., management will review the exceptions with the team responsible for processing security forms to reinforce appropriate review and processing. MDE will al...

Finding 2025-009 MDE, Security Management and Access Controls Management Views MDE agrees with the finding. Planned Corrective Action For part a., management will review the exceptions with the team responsible for processing security forms to reinforce appropriate review and processing. MDE will also implement an automated security access request process, which will eliminate any human error as a result of processing forms. For part b., management will refine the NexSys annual recertification process to reduce errors. NexSys staff will improve internal user list reviews and confirm completeness during the upcoming recertification cycle prior to management’s final review. MDE is currently developing an automated process to handle the annual recertification of the Grant Electronic Monitoring System/Michigan Administrative Review System (GEMS/MARS) users and anticipates implementation in September 2026. For part c., MDE updated the procedure for disabling accounts in April 2026 to strengthen and clarify the process to ensure MDE disables inactive user accounts after 18 months. Anticipated Completion Date a. May 2027 b. NexSys: October 2026 GEMS/MARS: September 2026 c. Completed Responsible Individual(s) Monica Butler, MDE Joshua Long, MDE Drew Finkbeiner, MDE

View Audit 404775

Finding 1218543 (2025-001)

Material Weakness 2025

State of Michigan

MI

Subrecipient Monitoring Internal Control / Segregation of Duties

Finding 2025-001 SIGMA High-Risk Activity Monitoring Management Views The Michigan Department of Lifelong Education, Advancement, and Potential (MiLEAP) agrees with the finding. Planned Corrective Action MiLEAP started monitoring its high-risk activity report weekly to ensure users performed only au...

Finding 2025-001 SIGMA High-Risk Activity Monitoring Management Views The Michigan Department of Lifelong Education, Advancement, and Potential (MiLEAP) agrees with the finding. Planned Corrective Action MiLEAP started monitoring its high-risk activity report weekly to ensure users performed only authorized override actions in SIGMA beginning June 20, 2025. Anticipated Completion Date Completed Responsible Individual(s) Lora MacKay, MiLEAP Dawn Lake, MiLEAP Erica Nowland, MiLEAP

View Audit 404775

Finding 1218522 (2025-063)

Material Weakness 2025

State of Michigan

MI

Subrecipient Monitoring Allowable Costs / Cost Principles Internal Control / Segregation of Duties

Finding 2025-063 Special Education Cluster (IDEA), ALN 84.027 and 84.173 Management Views MDE disagrees with the finding. MDE maintains that its current monitoring approach satisfies federal requirements. The MDE Office of Special Education’s (OSE) monitoring framework is consistent with the risk-ba...

Finding 2025-063 Special Education Cluster (IDEA), ALN 84.027 and 84.173 Management Views MDE disagrees with the finding. MDE maintains that its current monitoring approach satisfies federal requirements. The MDE Office of Special Education’s (OSE) monitoring framework is consistent with the risk-based requirements of the Uniform Guidance (2 CFR 200.332). The Uniform Guidance does not require routine review of underlying supporting documentation for every subrecipient in every monitoring cycle. Rather, source documentation review is one available monitoring tool, which MDE OSE uses, when warranted, based on risk, audit results, identified concerns, or other relevant information. MDE OSE’s monitoring activities include budget review and approval, budget-to-actual analysis, review of expenditure activity, direct engagement and technical assistance with subrecipients, review of single audit reports, issuance of management decisions (when applicable), and enhanced review procedures for higher-risk subrecipients. These activities collectively provide reasonable assurance that funds are used for authorized purposes and in compliance with applicable requirements. MDE OSE also notes that subrecipient single audits have not routinely identified questioned costs or significant noncompliance, which supports the effectiveness of the existing monitoring framework. Planned Corrective Action MDE disagrees with the finding and does not believe corrective action is required to resolve noncompliance. However, MDE OSE will update its internal monitoring procedures to document the circumstances under which expenditure sampling may be performed for medium- and low-risk subrecipients to enhance clarity of MDE OSE procedures. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Sean McLaughlin, MDE

View Audit 404775

Finding 1218520 (2025-060)

Material Weakness 2025

State of Michigan

MI

Procurement, Suspension & Debarment Subrecipient Monitoring Reporting § 200.303

Finding 2025-060 Coronavirus Capital Projects Fund, ALN 21.029 Management Views LEO agrees with the finding. Planned Corrective Action The LEO Finance Division and the LEO Grants Division have identified the deficiencies that led to the audit finding. LEO will correct the internal FFATA reporting pr...

Finding 2025-060 Coronavirus Capital Projects Fund, ALN 21.029 Management Views LEO agrees with the finding. Planned Corrective Action The LEO Finance Division and the LEO Grants Division have identified the deficiencies that led to the audit finding. LEO will correct the internal FFATA reporting process to ensure that new and amended subaward contract information is received by the LEO Finance Division in a timely manner and in accordance with FFATA requirements. LEO will utilize the EGrAMS vendor to update software functionality that will generate an email notification to the LEO Finance Division when a grant agreement is finalized or amended. This notification will ensure communication with the LEO Finance Division occurs in a timely manner and in accordance with FFATA requirements. Anticipated Completion Date June 30, 2026 Responsible Individual(s) Jennifer Duffey, LEO Heidi Parker, LEO

View Audit 404775

Finding 1218515 (2025-027)

Material Weakness 2025

State of Michigan

MI

Subrecipient Monitoring Internal Control / Segregation of Duties Allowable Costs / Cost Principles § 200.303

Finding 2025-027 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Salesforce Security Management and Access Controls Management Views MSF agrees that Salesforce was not written as an exception in the identified policy but disagrees that there is a control deficiency. MSF maintains eff...

Finding 2025-027 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Salesforce Security Management and Access Controls Management Views MSF agrees that Salesforce was not written as an exception in the identified policy but disagrees that there is a control deficiency. MSF maintains effective controls within its control environment that effectively mitigate risks associated with exempting Salesforce from the identified policy and provide reasonable assurance MSF is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Planned Corrective Action Based on the factors that led MSF to exempt Salesforce from SECU.01.020.01 (Access Control Standard), including risk assessments and MSF’s existing control environment, Salesforce will be included in the policy as a written exception. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Alex Fox, MSF Ian McCorvie, MSF Calvin Myers, MSF William Chaffee, MSF

View Audit 404775

Finding 1218510 (2025-022)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties Subrecipient Monitoring Allowable Costs / Cost Principles § 200.303

Finding 2025-022 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Concur Security Management and Access Controls Management Views The Michigan Strategic Fund (MSF) agrees that Concur was not written as an exception in the identified policy but disagrees that there is a control deficie...

Finding 2025-022 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Concur Security Management and Access Controls Management Views The Michigan Strategic Fund (MSF) agrees that Concur was not written as an exception in the identified policy but disagrees that there is a control deficiency. MSF maintains effective controls within its control environment that effectively mitigate risks associated with exempting Concur from the identified policy and provide reasonable assurance MSF is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Planned Corrective Action Based on the factors that led MSF to exempt Concur from SECU.01.020.01 (Access Control Standard), including risk assessments and MSF’s existing control environment, Concur will be included in the policy as a written exception. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Alex Fox, MSF Ian McCorvie, MSF Calvin Myers, MSF William Chaffee, MSF

View Audit 404775

Corrective Action Plans

Filters