Corrective Action Plans

Finding 1181300 (2025-007)

Material Weakness 2025

PA

Special Tests & Provisions Subrecipient Monitoring Material Weakness

DHS’ Office of Income Maintenance (OIM) Bureau of Operations (BOO): BOO will take the following actions to address the finding: The BOO will work with the EBT Project Office to create a dedicated section in the OIM EBT Procedure Manual to document the exceptions identified during the single audit ea...

DHS’ Office of Income Maintenance (OIM) Bureau of Operations (BOO): BOO will take the following actions to address the finding: The BOO will work with the EBT Project Office to create a dedicated section in the OIM EBT Procedure Manual to document the exceptions identified during the single audit each year. This addition will ensure that all offices are informed of the issues, can review their processes and procedures, and can make any necessary corrections. It will be added by April 1, 2026. The below items will be included: Knowing how to reconcile: • The Roles/Permissions Report from the EBT Card Tracking Database. • The Daily Log Summary and Weekly log report in the EBT Card Tracking Database. Reminders of the following concerns: • EBT card creation should end, and all cards should be logged in the EBT Card Tracking Database, by the close of business each day. No cards should be created after 5 PM. • When to use EBT Card Tracking Paper Logs, and how long to maintain them. • Ensuring that, upon receipt of each shipment of EBT cards and related supplies, the shipping manifest date is stamped. • Mailing locally created EBT cards directly to customers on the same day that the card is created. • Timeframes for completing and submitting the EPPIC EBT Systems Application forms to the OIM EBT Project Office. • Timeframe to deactivate user access in the EBT Card Tracking Database. • Timeframe for when to enter a shipment received into the EBT Card Tracking Database. The BOO, in conjunction with the EBT Project Office, distributes attestation forms to staff each year, typically during the first quarter. Employees are required to sign and return these forms to confirm that they have reviewed the procedure manual. The form for this cycle was sent out in February 2026. Anticipated Completion Date: 04/01/2026 Contact Name: Jeanette Coulston, Staff Assistant to BOO Director OIM Bureau of Program Evaluation (BPE) Division of Corrective Action (DCA): BPE will take the following actions to address the finding: The DCA conducts EBT Card Security reviews at every CAO and District Office that issues EBT cards. These reviews are conducted on a 3-year rotation to ensure compliance with documented policies and procedures. Annually, BPE/DCA EBT Headquarters staff provide training to DCA Income Maintenance Examiners in both field offices, to ensure awareness of any policy or procedure changes, prior to the start of EBT reviews. This training occurred on October 2, 2025. The current rotation schedule spans FFY 2025 through FFY 2027. Anticipated Completion Date: 04/01/2026 Contact Names: Amira Milikin, DCA Director; Bryan Bumpers, EBT Project Officer

View Audit 392533

Finding 1181256 (2025-010)

Material Weakness 2025

Commonwealth of Pennsylvania

PA

Internal Control / Segregation of Duties Subrecipient Monitoring Cash Management

The MatrixCare SOC2 report for 2025 was received on Friday February 6, 2026 and was reviewed by the Agency’s Information Technology (IT) Executive. The Agency’s Information Technology Executive/designee will educate the Information Technology Project Manager to request from Matrixcare on an annual b...

The MatrixCare SOC2 report for 2025 was received on Friday February 6, 2026 and was reviewed by the Agency’s Information Technology (IT) Executive. The Agency’s Information Technology Executive/designee will educate the Information Technology Project Manager to request from Matrixcare on an annual basis the SOC2 report and will review compliance criteria such as data security and confidentiality. An Agency Information Technology Resource Account will be developed for the SOC2 report/s to be sent to for review. Future contracts will request the vendor to automatically send SOC2 reports to the established IT Resource Account. Matrixcare security templates for Healthcare Record access have been updated by the Change Management Committee and activated by the Nurse Administrator-Technical for all users to ensure appropriate access. The Agency’s Human Resources Field Operations Manager/designee will educate the State Veterans Home (SVH) Human Resources Assistants of their responsibilities for on-boarding and off-boarding documentation for employee hires, classification changes and separations and of the DMVA’s Onboarding and Offboarding User Guides. The SVH Human Resource Analyst/designee will provide to the SVH Privacy Officer/designee all employee actions monthly to review for appropriate Healthcare Record access, the Bureau of Veterans Homes (BVH) Healthcare Record Management protocol will be updated to reflect this audit. The Agency’s Privacy Officer/designee will review 25% of all employee actions annually during each State Veterans’ Homes’ Facility Performance Assessment (FPA) to verify appropriate Healthcare Record access, the BVH FPA Protocol will be updated to reflect this audit. Anticipated Completion Date: 04/15/2026 Contact Name: Barbara L. Raymond, Director, Bureau of Veterans Homes

View Audit 392533

Finding 1181254 (2025-011)

Material Weakness 2025

Commonwealth of Pennsylvania

PA

Internal Control / Segregation of Duties

Alfred Yaney, Director, Enterprise e-Grants, opened a remedy ticket requesting to have the e-Grants group removed from the list of permitted groups. Screenshots were provided to the auditors as evidence of all the groups that have Admin access to validate the requested group had been removed. Antici...

Alfred Yaney, Director, Enterprise e-Grants, opened a remedy ticket requesting to have the e-Grants group removed from the list of permitted groups. Screenshots were provided to the auditors as evidence of all the groups that have Admin access to validate the requested group had been removed. Anticipated Completion Date: Completed Contact Name: Carolyn McCarthy, Head of Governance, Risk and Compliance

View Audit 392533

Finding 1180997 (2025-005)

Material Weakness 2025

Borden-Henryville School Corporation

IN

Procurement, Suspension & Debarment Subrecipient Monitoring Internal Control / Segregation of Duties § 200.303

FINDING 2025-005 SPED Procurement and Suspension and Debarment Finding Subject: Special Education Cluster (IDEA) – Procurement and Suspension and Debarment Contact Person Responsible for Corrective Action: Patty Kelley Contact Phone Number and Email Address: 812-913-9622 pkelley@bhsc.school Views of...

FINDING 2025-005 SPED Procurement and Suspension and Debarment Finding Subject: Special Education Cluster (IDEA) – Procurement and Suspension and Debarment Contact Person Responsible for Corrective Action: Patty Kelley Contact Phone Number and Email Address: 812-913-9622 pkelley@bhsc.school Views of Responsible Officials: We concur with the finding Description of Corrective Action Plan: The Accounting Department will start keeping a binder that will include all the Procurement and Suspension and Debarment Certificates pertaining to the vendors in our federal programs that equal or exceed $25,000 for each school year. The A/P Clerk will alert the Treasurer when a certificate is needed, and the Treasurer will first check SAM, and then proceed with collecting a certificate from the vendor if one is not found online. When applicable, we can add a clause or condition to a contract noting this acknowledgement. Anticipated Completion Date: This process will be in place by the end of the current fiscal year, June 30, 2026.

View Audit 392518

Finding 1180989 (2025-003)

Material Weakness 2025

Borden-Henryville School Corporation

IN

School Nutrition Programs Internal Control / Segregation of Duties Eligibility § 200.303

FINDING 2025-003 CNC Eligibility Finding Subject: Child Nutrition Cluster - Eligibility Contact Person Responsible for Corrective Action: Patty Kelley Contact Phone Number and Email Address: 812-913-9622 pkelley@bhsc.school Views of Responsible Officials: We concur with the finding Description of Co...

FINDING 2025-003 CNC Eligibility Finding Subject: Child Nutrition Cluster - Eligibility Contact Person Responsible for Corrective Action: Patty Kelley Contact Phone Number and Email Address: 812-913-9622 pkelley@bhsc.school Views of Responsible Officials: We concur with the finding Description of Corrective Action Plan: The Direct Certification downloads will be done once a month by the Cafeteria Director. The Cafeteria Director will sign the report and forward it to the Treasurer for verification and a second signature. The Direct Certification reports will be kept at the central office. Anticipated Completion Date: This process will be in place by the end of the current fiscal year, June 30, 2026.

View Audit 392518

Finding 1180984 (2025-001)

Material Weakness 2025

Logan County Board of Education

WV

Subrecipient Monitoring Allowable Costs / Cost Principles Cash Management

Trainings have been conducted during the current school year for principals, secretaries, and cooks at all schools on following correct meal patterns and point of service procedures. The current child nutrition director performs random audits and visits at all schools to make sure schools are follow...

Trainings have been conducted during the current school year for principals, secretaries, and cooks at all schools on following correct meal patterns and point of service procedures. The current child nutrition director performs random audits and visits at all schools to make sure schools are following these procedures consistently.

View Audit 392512

Finding 1180982 (2025-003)

Material Weakness 2025

Bergen Community College

NJ

Special Tests & Provisions Student Financial Aid Significant Deficiency

Views of Responsible Officials: The College acknowledges the audit finding that Return of Title IV (R2T4) calculations were not accurately completed for nine of the sixty students sampled, and that Title IV funds were not returned timely for fifteen of the sixty students sampled. During the audit pe...

Views of Responsible Officials: The College acknowledges the audit finding that Return of Title IV (R2T4) calculations were not accurately completed for nine of the sixty students sampled, and that Title IV funds were not returned timely for fifteen of the sixty students sampled. During the audit period, R2T4 tracking and oversight processes were in transition, which resulted in insufficient monitoring of calculation accuracy and timeliness. In addition, for several end-of-term cases involving unofficial withdrawals, the institution could not initiate R2T4 calculation until final grades were posted and an unofficial withdrawal determination was made based on non-passing (F) grades, in accordance with federal regulations governing unofficial withdrawals. The Fall 2024 semester ended on December 21st. The college was closed for the winter break and reopened January 2, 2025. Therefore, the Date of Determination (DOD) was not two days after the end of the semester but in January with the earliest available processing date being January 2, 2025. Corrective Action: The College has implemented enhanced internal controls to ensure compliance with Return of Title IV (R2T4) requirements. Responsibility for monitoring R2T4 calculations and timeliness has been assigned to the Director of Financial Aid and Compliance. A R2T4 tracking log has been established and is reviewed on a weekly basis to ensure that all official withdrawals are identified and processed within the required regulatory timeframe. For unofficial withdrawals, R2T4 calculations are initiated after the end of term once final grades are posted and an unofficial withdrawal date of determination (DOD) is made based on non-passing (F) grades, consistent with federal regulations. End-of-term R2T4 reviews for the fall semester are conducted upon return from winter break after the New Year to ensure complete and accurate academic records are available. Internal staff have received additional training on R2T4 regulatory requirements, timelines, and documentation standards. To ensure operational continuity, a senior specialist has been trained to manage R2T4 processing in the Director's absence. These corrective actions will strengthen internal controls and ensure accurate and timely processing of R2T4 calculations.

View Audit 392509

Finding 1180978 (2025-002)

Material Weakness 2025

Bergen Community College

NJ

Special Tests & Provisions Student Financial Aid Reporting

Views of Responsible Officials: After consultation with the College’s Information Technology department, management determined that the file was processed and submitted on time. However, the NSLDS discrepancy resulted from a data processing issue during the March 2025 enrollment status download. Spe...

Views of Responsible Officials: After consultation with the College’s Information Technology department, management determined that the file was processed and submitted on time. However, the NSLDS discrepancy resulted from a data processing issue during the March 2025 enrollment status download. Specifically, while the NSLDS file was being generated, staff from another office were simultaneously accessing the same student records. These concurrent activities caused the affected students’ enrollment statuses to default to data from a prior download, resulting in incorrect reporting for the two records of the sixty examined. Corrective action: The College has revised its NSLDS data reporting process to prevent a recurrence of concurrent access. A static, saved population list is now used to generate NSLDS enrollment status downloads, eliminating conflicts caused by concurrent system access. This change ensures that enrollment status data is not impacted and remains consistent at the time of submission. Management believes this corrective action adequately addresses the identified issue, strengthens controls, mitigate this issue for future status change reports, and allows for accurate submission within the required 60-day timeframe.

View Audit 392509

Finding 1180974 (2025-003)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Matching / Level of Effort / Earmarking Procurement, Suspension & Debarment Subrecipient Monitoring § 200.303

Corrective action plan: The CAPPS Financials team uses Pathlock to monitor and log privileged user activities. Pathlock maintains documentation of approvals and business justifications. Documentation of recurring privileged access reviews will be maintained as appropriate across all dedicated CAPPS ...

Corrective action plan: The CAPPS Financials team uses Pathlock to monitor and log privileged user activities. Pathlock maintains documentation of approvals and business justifications. Documentation of recurring privileged access reviews will be maintained as appropriate across all dedicated CAPPS Financial modules. IAM team will establish a documented process through which it will coordinate with the CAPPS Financial team to perform quarterly reviews of accounts and audit logs to strengthen privileged access provisioning. The review process will include documented approval, business justification, and periodic revalidation for all elevated roles in CAPPS Financial. Pathlock software is being used to manage single sign-on for granting privileged access to allowed users. With this software, the IAM team can grant access to a user, who would then login as themselves and then switch to the appropriate privileged role. Once the user switches to a privileged role, the Pathlock software maintains the audit log of user activity. Implementation date: February 27, 2026 Responsible persons: Daniel Kellogg, Deputy Chier Information Officer (DCIO), Infrastructure Services Leatha Marr, DCIO & Chief Product Officer, System Applications

View Audit 392506

Finding 1180972 (2025-012)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Internal Control / Segregation of Duties Special Tests & Provisions Significant Deficiency § 200.303

Corrective action plan: Long Term Care Regulation will enhance existing internal controls to ensure timely completion and distribution of Form 2567 to the providers. Implementation date: March 31, 2026 Responsible person: Michelle Dionne-Vahalik, Associate Commissioner, Long Term Care Regulations

View Audit 392506

Finding 1180968 (2025-011)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Internal Control / Segregation of Duties Special Tests & Provisions Subrecipient Monitoring § 200.303

Corrective action plan: HHS Information Security: • Has implemented a centralized governance process to ensure completion of all required biennial risk assessments. • Will establish and maintain oversight, validation, and escalation procedures for overdue assessments to ensure sustained adherence to...

Corrective action plan: HHS Information Security: • Has implemented a centralized governance process to ensure completion of all required biennial risk assessments. • Will establish and maintain oversight, validation, and escalation procedures for overdue assessments to ensure sustained adherence to federal and state requirements. • Will establish an inventory of systems to ensure information owners and custodians are assigned. • Will create an automated compliance dashboard to facilitate monthly reporting to executive leadership. • Will prioritize high-risk Medicaid systems, targeting completion within three months and achieving full compliance with Texas Administrative Code (TAC) 202 requirements within twelve months. The Deputy Chief Information Officers (DCIO) and Chief Product Officers for System Applications, Public Health Applications, and Texas Integrated Eligibility Redesign System (TIERS)/Medicaid Enterprise Systems (MES) will provide support and assistance to the program areas in creating Plan of Actions and Milestones and completing risk assessments for all systems provided in the executive report for their respective areas related to the audit. Implementation date: February 28, 2027 Responsible persons: Anil Koindala, Chief Information Security Officer Leatha Marr, DCIO and Chief Product Officer, System Applications Madhavi Koganti, DCIO and Chief Product Officer, Public Health Applications James Huang, DCIO and Chief Product Officer, TIERS/MES

View Audit 392506

Finding 1180959 (2025-022)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Subrecipient Monitoring Eligibility Internal Control / Segregation of Duties § 200.303

Corrective action plan: FDCM/OI has developed a comprehensive action plan to modernize and increase our detection of fraud in the child care program. Part of this modernization will include increased and more “real-time” monitoring of Board collection efforts. FDCM/OI is partnering with our Informat...

Corrective action plan: FDCM/OI has developed a comprehensive action plan to modernize and increase our detection of fraud in the child care program. Part of this modernization will include increased and more “real-time” monitoring of Board collection efforts. FDCM/OI is partnering with our Information, Innovation, and Insight Division (I3) to develop new dashboards and reports based upon weekly uploaded PIRTS data. This will allow FDCM/OI to generate weekly reports of Board collection letter non-compliance. If a Board fails to issue collection letters in a timely fashion, FDCM/OI will send a report to the Board Executive Director notifying them of non-compliance. Boards are also now required to have a Fraud Point of Contact (POC) that will be FDCM/OI’s direct liaison with the Board for all fraud matters. Additionally, FDCM/OI is conducting weekly PIRTS trainings throughout February for Boards. Boards have been asked to submit up to 5 fact finders who will be responsible for fraud case entry and management. The Board POC is ultimately responsible for every case. FDCM/OI is also reviewing our collection letters as a part of this process and generating prosecution referrals for cases which meet our criteria. It is our belief this will underscore the seriousness of the collection letters and increase their effectiveness. Finally, FDCM/OI will ensure that all relevant controlling documents, e.g. a new Workforce Development Letter, and all previous guidance is updated with this information. Implementation date: February 27, 2026 Responsible person: Jason Stalinsky, Division Director, Division of Fraud Deterrence and Compliance Monitoring.

View Audit 392506

Finding 1180910 (2025-001)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Subrecipient Monitoring Allowable Costs / Cost Principles Internal Control / Segregation of Duties § 200.303

Corrective action plan: ITS will: • Work with HR and Security to analyze and validate the size and scope of the late submission of access termination requests for separated employees. Communicate the analysis results and recommendations on or before May 1, 2026. • Work with the Information Security ...

Corrective action plan: ITS will: • Work with HR and Security to analyze and validate the size and scope of the late submission of access termination requests for separated employees. Communicate the analysis results and recommendations on or before May 1, 2026. • Work with the Information Security Office for continuation of periodic reconciliation of HR data and network accounts. Schedule for reconciliation to be established on or before May 1, 2026. • Work with Human Resources to establish a schedule of periodic reconciliation for HR data and case management application accounts. Schedule for reconciliation to be established on or before May 1, 2026. • Review existing business process for offboarding separated employees and provided recommendations to HR for training and communication for staff. Recommendations to be provided by May 1, 2026. • Determine what technology solution may be needed by August 31, 2026, with consideration of effectiveness of mitigation actions, as noted above. Implementation dates: See Corrective action plan Responsible person: Angie Lindemann, Deputy Chief Information Officer

View Audit 392506

Finding 1180909 (2025-018)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Reporting Internal Control / Segregation of Duties Subrecipient Monitoring § 200.303

Corrective action plan: Program staff will ensure that a formal review by the Team Lead and the Manager of Fiscal and Reporting is completed prior to submission. The Team Lead will initiate the process by obtaining the obligation amount from the LIHEAP Contract Specialist and entering the amount int...

Corrective action plan: Program staff will ensure that a formal review by the Team Lead and the Manager of Fiscal and Reporting is completed prior to submission. The Team Lead will initiate the process by obtaining the obligation amount from the LIHEAP Contract Specialist and entering the amount into the quarterly report. The Manager of Fiscal and Reporting will review and confirm the amount to be submitted. Implementation date: April 30, 2026 Responsible persons: Michael De Young, Director of Community Affairs Cathy Jung, Senior Manager of Finance and Reporting

View Audit 392506

Finding 1180907 (2025-017)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Cash Management Significant Deficiency Internal Control / Segregation of Duties § 200.303

Corrective action plan: The Department will enhance current procedures for the compilation and review of the Period 1 clearance pattern calculation in accordance with the Cash Management Improvement Act (CMIA) and as required in the Texas-State Agreement. The Manager of Accounting will use the State...

Corrective action plan: The Department will enhance current procedures for the compilation and review of the Period 1 clearance pattern calculation in accordance with the Cash Management Improvement Act (CMIA) and as required in the Texas-State Agreement. The Manager of Accounting will use the State Auditor Office’s template spreadsheet provided to agencies to calculate their annual Period 1 calculation and retain the worksheet as supporting documentation. The Director of Financial Administration will review the spreadsheet and calculation prior to CMIA certification. Implementation date: August 2026 Responsible persons: Jose Guevara, Director of Financial Administration Cristina Ortega, Manager of Accounting.

View Audit 392506

Finding 1180899 (2025-010)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Special Tests & Provisions Subrecipient Monitoring Eligibility § 200.303

Corrective action plan: HHSC will conduct an end-to-end review of the sanctions process to identify and implement any needed changes to the business process, training, or system. Implementation date: May 31, 2026 Responsible person: Carrie Robertson, Manager, Strategy and Innovation–Business Integra...

Corrective action plan: HHSC will conduct an end-to-end review of the sanctions process to identify and implement any needed changes to the business process, training, or system. Implementation date: May 31, 2026 Responsible person: Carrie Robertson, Manager, Strategy and Innovation–Business Integration and Support

View Audit 392506

Finding 1180893 (2025-008)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Reporting Significant Deficiency Internal Control / Segregation of Duties § 200.302 § 200.303 § 200.329

Corrective action plan: HHSC has taken steps to improve the consistency and reliability of financial reporting related to Maintenance of Effort (MOE) expenditures, specifically, amounts reported on the ACF 204, submitted by HHSC Budget and the ACF 196R, submitted by HHSC Federal Reporting (FR). To a...

Corrective action plan: HHSC has taken steps to improve the consistency and reliability of financial reporting related to Maintenance of Effort (MOE) expenditures, specifically, amounts reported on the ACF 204, submitted by HHSC Budget and the ACF 196R, submitted by HHSC Federal Reporting (FR). To address potential discrepancies and strengthen internal controls, HHSC Federal Reporting has implemented and documented a formal reconciliation process. This process involves the following key components: • Implementation and documentation of a formal reconciliation process that compares all MOE expenditures for HHSC, TEA, and TWC reported on the ACF 204 to those reported on the ACF 196R before report submission. The process outlines specific steps for data cross-referencing and validation to ensure completeness and accuracy. • Research, resolve, and correct any discrepancies identified during the reconciliation process before the reports are finalized and submitted for management review. • Reinforcement of management review and documentation of the reconciliation between the ACF-204 and ACF-196R will be incorporated into the approval process prior to report certification. Implementation date: February 28, 2026 Responsible person: Alan Flynn, Manager, Federal Reporting

View Audit 392506

Finding 1180876 (2025-002)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Allowable Costs / Cost Principles Internal Control / Segregation of Duties Subrecipient Monitoring § 200.303

Corrective action plan: ITS Management will establish a formal, documented user access review program applicable to both privileged and non-privileged network users. Key actions include: 1. Policy Updates: Revise information technology access control policies and procedures to re-quire periodic (at ...

Corrective action plan: ITS Management will establish a formal, documented user access review program applicable to both privileged and non-privileged network users. Key actions include: 1. Policy Updates: Revise information technology access control policies and procedures to re-quire periodic (at least annual) reviews of all network user access. 2. Standardized Process and Documentation: Implement a consistent, documented review process and maintain records in a centralized repository to ensure accountability and auditability. 3. Monitoring and Oversight: Implement oversight procedures to track completion of access re-views and remediation of identified issues, with reporting to IT and information security leadership to support governance. Implementation dates: 1. Policy and procedure updates: Expected completion by April 30, 2026 2. Standardized process and repository implementation: Expected completion by May 31, 2026 3. First completed annual review under the revised process: Expected completion by June 30, 2026 Responsible persons: Tara Mitchell, Director of IT Operations Sean Peterson, Chief Information Officer

View Audit 392506

Finding 1180875 (2025-020)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Internal Control / Segregation of Duties § 200.303

Corrective action plan: TWC will establish a new policy of 3 defined roles (preparation, review, and approval) and a standardized process for each role on each report. TWC will establish a log to capture the name and date of the staff completing each role for each report, and we will use the log to ...

Corrective action plan: TWC will establish a new policy of 3 defined roles (preparation, review, and approval) and a standardized process for each role on each report. TWC will establish a log to capture the name and date of the staff completing each role for each report, and we will use the log to confirm that no individual performs more than one role on a given report. For all staff with any participation in the ETA reporting function, TWC will have training on the new policy, procedures and log. Implementation date: June 30, 2026 Responsible person: Terri Warren, Unemployment Insurance Administration & Operational Support Department Director

View Audit 392506

Finding 1180872 (2025-016)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Procurement, Suspension & Debarment Subrecipient Monitoring Allowable Costs / Cost Principles § 200.303

Corrective action plan: • IT will coordinate with HR on strengthening the separation process, to include HR running separation reports quarterly and sending to IT to cross check. Will perform regular scheduled meetings to discuss the separation process/issues. • IT is testing automatic scripts that ...

Corrective action plan: • IT will coordinate with HR on strengthening the separation process, to include HR running separation reports quarterly and sending to IT to cross check. Will perform regular scheduled meetings to discuss the separation process/issues. • IT is testing automatic scripts that will aid in the process and will be implemented this year. • IT will document quarterly access reviews which are already done. • IT will work on enhancing automation and controls; Will utilize AI to assist. Implementation date: May 2026 Responsible person: Chris Bunton, CIO, Texas Department of Agriculture

View Audit 392506

Finding 1180855 (2025-001)

Material Weakness 2025

Catawba County, North Carolina

NC

Significant Deficiency Internal Control / Segregation of Duties

Finding: 2025-001 Name of Contact Person: Karen Harrington, DSS Director Corrective Action/Management’s Response: Agency agrees with finding. Corrective Action taken/to be taken below: Corrective Action: The Department will strengthen internal controls related to workstation security to prevent unat...

Finding: 2025-001 Name of Contact Person: Karen Harrington, DSS Director Corrective Action/Management’s Response: Agency agrees with finding. Corrective Action taken/to be taken below: Corrective Action: The Department will strengthen internal controls related to workstation security to prevent unattended access to state systems. Effective immediately, all DSS employees with access to state eligibility systems are required to lock their workstation when away from their desk or log out of the system entirely. Implementation Steps: 1. Policy Reinforcement: DSS management will reissue written guidance to all staff reminding them of the requirement to lock or log out of workstations when unattended, consistent with the DSS Fiscal Manual and county IT security standards. 2. Mandatory Staff Acknowledgment: All DSS employees with state system access will complete a brief acknowledgment confirming understanding of workstation security requirements. 3. IT Controls: In coordination with the County IT Department, automatic screen-lock settings will be verified on all DSS workstations accessing state systems. 4. Monitoring and Verification: Supervisors will conduct periodic unannounced walkthroughs to verify compliance with workstation security requirements. Results will be documented and reviewed by DSS management. 5. Corrective Follow-Up: Any noncompliance identified will be addressed promptly through retraining and, if necessary, progressive disciplinary action. Responsible Party: DSS Director, DSS Program Managers, and County DSS Staff Anticipated Completion Date: Immediately upon issuance of this CAP; monitoring will be ongoing. Plan to Prevent Recurrence: Ongoing supervisory monitoring, documented compliance checks, and annual refresher training will be used to ensure continued adherence to workstation security requirements.

View Audit 392499

Finding 1180811 (2025-004)

Material Weakness 2025

Benton Community School Corporation

IN

Internal Control / Segregation of Duties Procurement, Suspension & Debarment Subrecipient Monitoring § 200.303 § 200.309 § 200.461

Information on the federal program: Subject: Special Education Cluster (IDEA) – Period of Performance Federal Agency: Department of Education Federal Programs: Special Education Grants to States, Special Education Preschool Grants Assistance Listing Numbers: 84.027, 84.027X, 84.173, 84.173X Federal ...

Information on the federal program: Subject: Special Education Cluster (IDEA) – Period of Performance Federal Agency: Department of Education Federal Programs: Special Education Grants to States, Special Education Preschool Grants Assistance Listing Numbers: 84.027, 84.027X, 84.173, 84.173X Federal Award Numbers and Years (or Other Identifying Numbers): 22611-047-PN01, 22611-047-ARP, 22619-047-PN01, 22619-047-ARP Pass-Through Entity: Indiana Department of Education Compliance Requirement: Period of Performance Audit Finding: Material Weakness Condition: An effective internal control system was not in place at the School Corporation to ensure compliance with requirements related to the Special Education Cluster program and Period of Performance compliance requirements. Context: During fiscal year 2023-24, the School Corporation was a member of Cooperative School Services (Cooperative). The Cooperative operated the special education programs and spent the federal money on behalf of its member schools. As the grant agreement was between the Indiana Department of Education (IDOE) and each member school, the School Corporation was responsible for ensuring and providing oversight of the Cooperative. For Special Education Cluster awards, funds must be obligated during the 27 months, extending from July 1 of the fiscal year for which the funds were appropriated through September 30 of the second following fiscal year. When testing transactions occurred in the liquidation period for the 22611-047-PN01, 22611-047-ARP, 22619-047-PN01 and 22619-047-ARP grant awards, two exceptions were identified in the sample of five transactions. For the above listed awards, costs must be obligated by September 30, 2023. For the two identified exceptions, an initial purchase order was made in September, but the ultimate transaction was paid to a separate vendor than the original purchase order, and this obligation was incurred in November 2023. This issue was isolated to fiscal year 2024. No costs incurred outside of the period of performance were identified in fiscal year 2025. Views of Responsible Officials and Corrective Action Plan: Management disagrees with part of the finding. The term “obligate” can be interpreted in various ways within our context. While we have a purchase order that was completed by September 30, we do agree that we changed vendors after September 30 and paid the non-public school directly. We agree with the finding that direct payment to a non-public school is not allowable. The purchase order is an internal written commitment to acquire the items/supplies, but it is not a binding written agreement to acquire “property” when we are purchasing supplies until it is provided to the vendor. The purchase order is authorization and approval to purchase the items/supplies. Once the purchase order is provided to the vendor, it is committed and is the binding written agreement. The invoice is an order to pay the obligation. Responsible Party and Timeline for Completion: Corrective action plan has been implemented as this finding impacted fiscal year 2024 but did not recur in fiscal year 2025. Sarah Claton, Cooperative School Services director, and Tracy Albertson, Director of Finance, will oversee the corrective action plan to monitor the cooperative on an ongoing basis.

View Audit 392466

Finding 1180800 (2025-001)

Material Weakness 2025

Benton Community School Corporation

IN

School Nutrition Programs Internal Control / Segregation of Duties § 200.303

Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying ...

Information on the federal program: Subject: Child Nutrition Cluster - Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Federal Award Numbers and Years (or Other Identifying Numbers): FY23-24 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Eligibility Audit Finding: Material Weakness, Qualified Opinion Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the eligibility compliance requirement. Context: During the testing of internal controls and compliance over eligibility determinations for free and reduced meals, we selected a sample of 15 applications and 45 direct certifications for testing. For 3 of the 15 applications, the School Corporation was not able to provide any documentation to support the eligibility determination due to turnover in the food service director position. Therefore, we were unable to determine whether the School Corporation complied with the eligibility requirements. The internal control and noncompliance was isolated to fiscal year 2024. Views of Responsible Officials and Corrective Action Plan: School Corporation has implemented procedures to ensure a complete record is maintained for every free and reduced-price meal application and any subsequent eligibility status change. All applications, supporting documentation, and determination records are retained as hard copy files. An electronic Benefit Issuance Document will also be retained during the year and printed as a hard copy record. Any change in eligibility status is documented with the effective date and supporting rationale to provide a clear audit trail. These procedures are now part of the School Corporation’s standard operating practices in school food service to ensure ongoing compliance and continuity moving forward. Responsible Party and Timeline for Completion: Corrective action plan has been implemented as this finding impacted fiscal year 2024 but did not recur in fiscal year 2025. Missy Corns, Food Service Director, and Tracy Albertson, Director of Finance, will oversee the corrective action plan to monitor the eligibility requirements on an ongoing basis.

View Audit 392466

Finding 1180797 (2025-002)

Material Weakness 2025

Easter Seals Ucp North Carolina & Virginia, Inc.

NC

Reporting Internal Control / Segregation of Duties

FINDING 2025-002 Name of Responsible Individual: Jessi Ayers Corrective Action: Management has applied the suggested changes to the schedule and will implement additional control procedures to include quarterly reconciliations and enhanced identification of federal awards at the initial stages of an...

FINDING 2025-002 Name of Responsible Individual: Jessi Ayers Corrective Action: Management has applied the suggested changes to the schedule and will implement additional control procedures to include quarterly reconciliations and enhanced identification of federal awards at the initial stages of an agreement. Anticipated Completion Date: June 30, 2026

View Audit 392464

Finding 1180756 (2025-003)

Material Weakness 2025

City of Auburn

CA

Internal Control / Segregation of Duties § 200.303

Coronavirus State and Local Recovery Funds Reporting Planned Corrective Action: The City has adjusted the procedures to develop and submit the annual report to include segregation of duties. Anticipated Completion Date: March 1, 2026 Responsible Contact Person: Gretchen Hoskins, Finance Director

View Audit 392434

Corrective Action Plans

Filters