Corrective Action Plans

Finding 1218915 (2025-003)

Material Weakness 2025

The Salvation Army Golden State Division

CA

Material Weakness School Nutrition Programs Equipment & Real Property Management

The Division is in the process of designing and implementing a precise control to ensure that the inventory reports are reviewed prior to being submitted to the grantor and that the backup documentation is maintained. Anticipated Completion Date: 9/30/2026 Responsible Contact Person: Michael Zielins...

The Division is in the process of designing and implementing a precise control to ensure that the inventory reports are reviewed prior to being submitted to the grantor and that the backup documentation is maintained. Anticipated Completion Date: 9/30/2026 Responsible Contact Person: Michael Zielinski, Major, Divisional Commander.

View Audit 404948

Finding 1218841 (2025-002)

Material Weakness 2025

Avoyelles Child Development Services, INC

LA

Internal Control / Segregation of Duties Reporting

Compliance Finding – Uniform Guidance Head Start Program Cluster #93.600 Material Noncompliance 2025-002 Federal Reporting and Grant Drawdown RECOMMENDATION: Management should implement procedures to ensure 1) all required federal reports are submitted timely, 2) federal reporting systems are adequa...

Compliance Finding – Uniform Guidance Head Start Program Cluster #93.600 Material Noncompliance 2025-002 Federal Reporting and Grant Drawdown RECOMMENDATION: Management should implement procedures to ensure 1) all required federal reports are submitted timely, 2) federal reporting systems are adequately monitored and supported, and 3) grant funds are not drawn down prior to obtaining all required federal approvals. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTION: Management believes that the organization maintains a comprehensive and effective system of internal controls over financial reporting, compliance, and grant administration. The findings relate to a specific control deficiency identified during the audit which were both impacted by a lack of communications from the funding agency and the 43-day Federal Government shutdown from October 1, 2025 to November 12, 2025, and do not, in management's view, reflect a systemic weakness in the overall control environment. Management acknowledges the circumstances that resulted in the findings and recognizes the opportunity to strengthen certain procedures and documentation practices. The conditions identified were limited in scope and occurred despite the existence of established policies, oversight processes, and monitoring activities designed to promote compliance with applicable federal requirements.

View Audit 404935

Finding 1218840 (2025-001)

Material Weakness 2025

Avoyelles Child Development Services, INC

LA

Reporting Internal Control / Segregation of Duties

Internal Control Over Compliance – Uniform Guidance Head Start Program Cluster #93.600 Significant Deficiency in Internal Control Over Compliance 2025-001 Federal Reporting and Grant Drawdown RECOMENDATION: Management should strengthen internal controls over federal reporting and grant administratio...

Internal Control Over Compliance – Uniform Guidance Head Start Program Cluster #93.600 Significant Deficiency in Internal Control Over Compliance 2025-001 Federal Reporting and Grant Drawdown RECOMENDATION: Management should strengthen internal controls over federal reporting and grant administration by 1) implementing procedures to ensure timely submission of all required federal reports, 2) establishing contingency procedures for system interruptions, and 3) requiring documented evidence of federal approval prior to drawing down grant funds associated with capital expenditures or other restricted activities. VIEWS OF RESPONSIBLE OFFICIALS AND PLANNED CORRECTIVE ACTION: Management believes that the organization maintains a comprehensive and effective system of internal controls over financial reporting, compliance, and grant administration. The findings relate to a specific control deficiency identified during the audit which were both impacted by a lack of communications from the funding agency and the 43-day Federal Government shutdown from October 1, 2025 to November 12, 2025, and do not, in management's view, reflect a systemic weakness in the overall control environment. Management acknowledges the circumstances that resulted in the findings and recognizes the opportunity to strengthen certain procedures and documentation practices. The conditions identified were limited in scope and occurred despite the existence of established policies, oversight processes, and monitoring activities designed to promote compliance with applicable federal requirements.

View Audit 404935

Finding 1218822 (2025-001)

Material Weakness 2025

Little Rivers Health Care, Inc.

VT

Internal Control / Segregation of Duties Special Tests & Provisions Questioned Costs

Finding: 2025-001 Condition Found: Through testing a statistically valid sample of 25 individual patient balances, we noted one instance in which the sliding fee discount applied was inconsistent with the Organization's policy. Specifically, a contracted third-party billing company incorrectly appli...

Finding: 2025-001 Condition Found: Through testing a statistically valid sample of 25 individual patient balances, we noted one instance in which the sliding fee discount applied was inconsistent with the Organization's policy. Specifically, a contracted third-party billing company incorrectly applied a sliding fee discount to a patient account, resulting in a discount that was not consistent with the Organization's sliding fee discount policy. Individual(s) Responsible for Corrective Action: Andrew Barter, CEO Planned Corrective Action: The identified error resulted from a contracted third-party billing company applying a sliding fee discount that was inconsistent with Little Rivers Health Care's Sliding Fee Discount Program policy. Upon identification of the finding, the account was reviewed and corrected to ensure the patient received the appropriate discount. To prevent future occurrences, Little Rivers Health Care re-instituted its monthly monitoring and review procedures in May 2026. These monitoring activities had been conducted consistently through the fall of 2025 and include periodic audits of patient accounts receiving sliding fee discounts, verification of discount calculations, and oversight of third-party billing activities. Findings from these reviews are documented, and corrective action is taken promptly when discrepancies are identified. In addition, the contracted billing company has been reminded of the organization's sliding fee discount requirements and expectations for compliance. To provide ongoing oversight and validation of compliance with the Sliding Fee Discount Program, Little Rivers Health Care has also implemented quarterly review meetings involving the Billing Manager, Controller, and Chief Executive Officer. These meetings have been formally scheduled, with the first occurrence set for July 20, 2026. The quarterly reviews will evaluate monitoring results, validate adherence to policy requirements, identify trends or potential risks, and ensure continuous compliance with program requirements. Anticipated Completion Date: May 20, 2026 (Corrective action completed), for reinstatement of monthly monitoring procedures. Quarterly compliance review meetings with the Billing Manager, Controller, and CEO are scheduled to commence on July 20, 2026, and will continue on an ongoing basis as part of the Organization's continuous compliance monitoring process.

View Audit 404913

Finding 1218821 (2025-003)

Material Weakness 2025

Corpus Christi Housing Authority

TX

Questioned Costs Special Tests & Provisions HUD Housing Programs

Authority Response and Planned Corrective Action Plan: The Authority accepts the recommendation of the auditor and has initiated corrective actions to strengthen compliance with Housing Quality Standards (HQS) inspection requirements and related abatement procedures. Management identified that staff...

Authority Response and Planned Corrective Action Plan: The Authority accepts the recommendation of the auditor and has initiated corrective actions to strengthen compliance with Housing Quality Standards (HQS) inspection requirements and related abatement procedures. Management identified that staffing turnover and transition-related training gaps contributed to delays in the timely processing and enforcement of failed inspection reinspections and landlord abatements during the audit period. In response, the Authority has implemented enhanced monitoring and supervisory review procedures over failed inspections and reinspection timelines to ensure compliance with HUD requirements. Management has reinforced staff training related to HQS enforcement, reinspection tracking, and Housing Assistance Payment (HAP) abatement procedures. In addition, the Authority is utilizing system generated tracking reports and management oversight tools to identify failed inspections approaching required corrective action deadlines and to ensure timely follow-up and enforcement actions are completed. The Authority believes these corrective measures will strengthen internal controls over compliance and help ensure continued adherence to HUD Housing Quality Standards requirements and related special tests and provisions compliance requirements. Isaiah Norris, Vice President of the Housing Choice Vouchers Program, is responsible for ensuring the deficiencies have been rectified by September 30, 2026.

View Audit 404911

Finding 1218820 (2025-002)

Material Weakness 2025

Corpus Christi Housing Authority

TX

Questioned Costs Eligibility HUD Housing Programs

Authority's Response and Planned Corrective Plan: The Authority accepts the auditor’s recommendation. Management acknowledges the importance of maintaining complete and readily available tenant file documentation to support eligibility determinations and ongoing program compliance for the Housing Vo...

Authority's Response and Planned Corrective Plan: The Authority accepts the auditor’s recommendation. Management acknowledges the importance of maintaining complete and readily available tenant file documentation to support eligibility determinations and ongoing program compliance for the Housing Voucher Cluster. The documents noted as unavailable during the audit relate to file maintenance and documentation retention. Management does not believe the exceptions indicate that the sampled households were ineligible for assistance; however, the Authority recognizes that required documentation must be consistently maintained and available for audit review. In response, the Authority will implement a corrective action plan that includes increased supervisory review of tenant files, enhanced file completion checklists, periodic internal quality control reviews, and additional staff training on required eligibility documentation, including consent forms, lead-based paint documentation, HAP contracts, and tenancy addenda. The Authority will also strengthen monitoring procedures to ensure missing or incomplete documents are identified and corrected timely. Management will assign responsibility for periodic file review to Housing Choice Voucher leadership and will document follow-up actions taken. These procedures are intended to improve internal controls over tenant file maintenance and ensure continued compliance with HUD requirements, Uniform Guidance, and the applicable compliance supplement. Isaiah Norris, Vice President of the Housing Choice Vouchers Program, is responsible for ensuring the deficiencies have been rectified by September 30, 2026.

View Audit 404911

Finding 1218801 (2025-002)

Material Weakness 2025

Ponca Tribe of Nebraska

NE

Eligibility Internal Control / Segregation of Duties Questioned Costs § 200.303

Persons responsible for corrective action: Keith Morrow, Health Services Chief Executive Officer Corrective action planned: Developed and implemented process by which Business Services staff in Health Services review documents provided by non-Ponca Native Americans upon initial request for services ...

Persons responsible for corrective action: Keith Morrow, Health Services Chief Executive Officer Corrective action planned: Developed and implemented process by which Business Services staff in Health Services review documents provided by non-Ponca Native Americans upon initial request for services and on an annual basis to follow to confirm and verify their capacity to receive health services from the Ponca Tribe. Steps have been taken to see the staff verifying are independent from those who initially collect such documents. Additionally, confirmed such process is consistent with existing verification review of Ponca members requesting services. Implementation date: December 1, 2025.

View Audit 404885

Finding 1218776 (2025-002)

Material Weakness 2025

City of Lowell

MA

Procurement, Suspension & Debarment Subrecipient Monitoring Allowable Costs / Cost Principles § 200.327

Audit Finding Reference: 2025-002 Improve Procurement Procedures Planned Corrective Action: The District will strengthen its procurement procedures for federally funded purchases to ensure compliance with Uniform Guidance requirements. Specifically, the District will: 1. Revise procurement procedure...

Audit Finding Reference: 2025-002 Improve Procurement Procedures Planned Corrective Action: The District will strengthen its procurement procedures for federally funded purchases to ensure compliance with Uniform Guidance requirements. Specifically, the District will: 1. Revise procurement procedures to clearly identify when federal procurement requirements apply in addition to state and local procurement regulations. 2. Develop and implement a federal procurement checklist that must be completed prior to the award of any contract funded in whole or in part with federal grant funds. 3. Work with the Law Department to establish standardized contract templates containing all required federal contract provisions, including the Byrd Anti-Lobbying Amendment when applicable. 4. Require a secondary review bythe Business Office or Grants Management personnel before contract execution to verify compliance with Uniform Guidance procurement standards and required contract clauses. 5. Provide annual training to Business Office staff, grant managers, and other personnel involved in procurement activities regarding federal procurement requirements and contract provisions. 6. Conduct periodic internal reviews of federally funded procurement transactions to ensure ongoing compliance. Planned Implementation Date of Corrective Action: The revised procedures, procurement checklist, and standardized contract templates will be implemented by7 /1/2026. Training will be completed for applicable staff during the current fiscal year and prior to the initiation of future federally funded procurements. Person Responsible for Corrective Action: Assistant Superintendent of Finance Derek Pinto, Assistant Superintendent of Finance

View Audit 404883

Finding 1218766 (2025-001)

Material Weakness 2025

Nevada School District

AR

Subrecipient Monitoring Internal Control / Segregation of Duties

District management will adopt sound accounting policies and establish and maintain internal control that will initiate, authorize, record, process, and report transactions consistent with management's assertions embodied in the financial statements and that will safeguard District assets.

View Audit 404881

Finding 1218757 (2025-002)

Material Weakness 2025

Pact, Inc.

DC

Subrecipient Monitoring Reporting Internal Control / Segregation of Duties

Corrective Action Plan: Effective January 2026, Pact management implemented a new process that strengthens the internal controls over the FFATA reporting to ensure the required reports are submitted within the required timeframe. The monthly report being run to capture those subaward actions that re...

Corrective Action Plan: Effective January 2026, Pact management implemented a new process that strengthens the internal controls over the FFATA reporting to ensure the required reports are submitted within the required timeframe. The monthly report being run to capture those subaward actions that require FFATA reporting has been changed to encompass 45 days to ensure that no late entries are missed when the reporting is done.

View Audit 404865

Finding 1218756 (2025-001)

Material Weakness 2025

Pact, Inc.

DC

Subrecipient Monitoring Internal Control / Segregation of Duties Procurement, Suspension & Debarment

Corrective Action Plan: Misuse of Funds – Vehicle: Pact updated its Global Vehicle Policy effective November 1, 2025. The updated Global Vehicle Policy reinforces Pact’s zero-tolerance policy. No new reports of vehicle misuse have been received since November 2025, and all the reported cases of misu...

Corrective Action Plan: Misuse of Funds – Vehicle: Pact updated its Global Vehicle Policy effective November 1, 2025. The updated Global Vehicle Policy reinforces Pact’s zero-tolerance policy. No new reports of vehicle misuse have been received since November 2025, and all the reported cases of misuse occurred prior to November 1. Pact’s updated policy complies with all applicable laws and regulations, including the organization’s internal Code of Conduct, while aligning with the objectives and scope of work for the project. Pact’s guidelines specify roles and responsibilities and role assignments; identify authorized places to obtain fuel; where to store vehicle keys; where to park vehicles; and require individuals to enter detailed records regarding the use of the vehicle into a log. Misuse of Funds – Payroll: In alignment with Pact’s core principle of continuous quality improvement, and following substantiation of the misuse in one country office, Pact developed and implemented a corrective action plan. This plan included a comprehensive quality review of existing controls to identify and address any procedural gaps in the timesheet systems to ensure the timesheet systems have a functional auditable approval trail. We have reinforced, including in Senior Management Team meetings with staff, and other trainings supervisors’ responsibility to review and verify hours worked for their staff.

View Audit 404865

Finding 1218735 (2025-002)

Material Weakness 2025

Crossett Housing Authority

AR

Questioned Costs Subrecipient Monitoring Cash Management

Views of Responsible Officials and Planned Corrective Actions: The Crossett Housing Authority Director will immediately seek guidance from HUD officials and MRI/Lindsey to remedy this problem.

View Audit 404826

Finding 1218716 (2025-061)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties Questioned Costs Subrecipient Monitoring § 200.303

Finding 2025-061 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), ALN 93.323 and Block Grants for Prevention and Treatment of Substance Abuse, ALN 93.959 Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS is actively pursuing the implementation of an A...

Finding 2025-061 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), ALN 93.323 and Block Grants for Prevention and Treatment of Substance Abuse, ALN 93.959 Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS is actively pursuing the implementation of an API for the submission of FFATA data to the federal system, SAM, to improve both timeliness and accuracy through automation. This API will connect EGrAMS with SAM, enabling backend communication between the systems and allowing SAM to automatically retrieve data directly from EGrAMS. To ensure accurate reporting until the API is established, MDHHS will continue reviewing validation errors when submitting web-based information to SAM and will work with the SAM federal helpline to report federal system issues and identify interim alternatives to submit the required data. Also, MDHHS implemented an enhancement in August 2025 that validates federal funding sources in EGrAMS against their effective dates, reducing coding errors and improving data reliability. In addition, the query used to obtain certain FFATA data elements was modified during fiscal year 2026 to improve accuracy of reporting. Anticipated Completion Date December 31, 2027 Responsible Individual(s) Matt Blackburn, MDHHS Jeanette Hensler, MDHHS Rebecca Jones, MDHHS

View Audit 404775

Finding 1218710 (2025-019)

Material Weakness 2025

State of Michigan

MI

Questioned Costs Internal Control / Segregation of Duties

Finding 2025-019 MARIS Change Management Process Management Views MDHHS agrees that the procedural step of formalizing post implementation validation documentation was not completed for this specific request for change. MDHHS emphasizes that active operational monitoring of the Medicaid Audit Recove...

Finding 2025-019 MARIS Change Management Process Management Views MDHHS agrees that the procedural step of formalizing post implementation validation documentation was not completed for this specific request for change. MDHHS emphasizes that active operational monitoring of the Medicaid Audit Recovery and Investigation System (MARIS) environment occurred post deployment, mitigating the risk of unauthorized or inappropriate changes impacting the system's secure operation. In addition, MDHHS notes that verbal approval for the deployment was provided during a meeting with DTMB, and both parties proceeded with the understanding that the change was authorized. The absence of required written documentation was an administrative oversight stemming from a breakdown in the established interagency communication workflow, where DTMB did not send the standard notification email prompting the business owner's formal sign-off. Planned Corrective Action The MDHHS Office of Inspector General (OIG) formalized a communication protocol with DTMB to ensure the change management documentation lifecycle is completed. During April 2026, DTMB and the OIG implemented the use of Azure DevOps for monitoring scheduled MARIS implementation dates and documenting approvals. Anticipated Completion Date Completed Responsible Individual(s) Casey Barton, MDHHS

View Audit 404775

Finding 1218709 (2025-018)

Material Weakness 2025

State of Michigan

MI

Questioned Costs Subrecipient Monitoring Internal Control / Segregation of Duties

Finding 2025-018 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Medical Loss Ratio Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS updated and strengthened its medical loss ratio (MLR) reporting instructions and ...

Finding 2025-018 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Medical Loss Ratio Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS updated and strengthened its medical loss ratio (MLR) reporting instructions and comparison template for the MHP Comprehensive Health Care Plan (CHCP), Dental Health Plans, and MI Choice to ensure clearer expectations and alignment with federal requirements. The CHCP and MI Choice programs cited in the fiscal year 2024 audit did not have any identified issues during the fiscal year 2025 audit, demonstrating the impact of MDHHS’s efforts to improve internal controls and monitoring activities to ensure all submitted MLR reports are completed in accordance with federal regulations. MDHHS updated the MLR reporting instructions and the comparison template for the PIHPs to clarify federal requirements and ensure consistency across all managed care programs and distributed them to the PIHPs during May 2026. MDHHS will strengthen its internal tracking and review process to ensure inclusion of the federally required comparison to audited financial statements in all MLR submissions by September 1, 2026. This verification step, currently in place for PIHPs, will be expanded to all managed care entity types. MDHHS will document this verification and follow up with the managed care entity when the comparison is missing or incomplete to ensure compliance with federal regulations. Anticipated Completion Date September 1, 2026 Responsible Individual(s) Kristen Morningstar, MDHHS Keith White, MDHHS Chris Parker, MDHHS

View Audit 404775

Finding 1218708 (2025-017)

Material Weakness 2025

State of Michigan

MI

Questioned Costs Eligibility Internal Control / Segregation of Duties

Finding 2025-017 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Provider Screening Management Views MDHHS agrees with the finding. Planned Corrective Action During April 2026, MDHHS notified all relevant program areas of the CHAMPS screening re...

Finding 2025-017 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Provider Screening Management Views MDHHS agrees with the finding. Planned Corrective Action During April 2026, MDHHS notified all relevant program areas of the CHAMPS screening requirement and will provide recurring reminders and updates during monthly program operations meetings. MDHHS is also working across its internal program teams to ensure that plans and providers are aware of this requirement and are completing the required registration. In addition, to strengthen screening of out-of-state Managed Care Organization rendering providers, MDHHS will implement a system enhancement that will enforce CHAMPS registration for out-of-state providers by rejecting encounter claims for providers that are not properly registered. MDHHS anticipates full implementation of this system enhancement by December 31, 2027. Anticipated Completion Date December 31, 2027 Responsible Individual(s) Keith White, MDHHS Chris Parker, MDHHS

View Audit 404775

Finding 1218702 (2025-008)

Material Weakness 2025

State of Michigan

MI

Questioned Costs Eligibility Internal Control / Segregation of Duties

Finding 2025-008 CHAMPS Eligibility Interface Errors Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS has strengthened its processes to ensure that documentation is maintained for all eligibility records identified with errors and excluded from the Community Health Aut...

Finding 2025-008 CHAMPS Eligibility Interface Errors Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS has strengthened its processes to ensure that documentation is maintained for all eligibility records identified with errors and excluded from the Community Health Automated Medicaid Processing System (CHAMPS) interface processing. Bridges, as the system of record for eligibility, continues to generate reports identifying potential duplicate identification numbers (ID) for local office staff to review and merge the records when they determine the IDs represent the same individual. Until this review and merging process is completed, CHAMPS rejects these potential duplicate records to prevent duplicate beneficiary payments under different CHAMPS Medicaid IDs. In April 2026, MDHHS implemented a weekly query to identify potential duplicate IDs rejected by CHAMPS that were not captured on the standard Bridges reports and therefore require additional review. These records are forwarded to the MDHHS Enrollment Services Section for manual assessment to determine whether they represent new beneficiaries or existing beneficiaries associated with a different CHAMPS Medicaid ID. The Enrollment Services Section then completes the appropriate resolution and ensures the required documentation is maintained. Anticipated Completion Date Completed Responsible Individual(s) Jonathan Bair, MDHHS

View Audit 404775

Finding 1218700 (2025-004)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties Questioned Costs Subrecipient Monitoring § 200.303

Finding 2025-004 Bridges Security Management and Access Controls Management Views MDHHS agrees with the finding. Planned Corrective Action For parts a., b., c., and d., MDHHS implemented the Database Security Application (DSA) on October 2, 2023, which includes documenting incompatible role exceptio...

Finding 2025-004 Bridges Security Management and Access Controls Management Views MDHHS agrees with the finding. Planned Corrective Action For parts a., b., c., and d., MDHHS implemented the Database Security Application (DSA) on October 2, 2023, which includes documenting incompatible role exception requests and user access request approvals, semi-annual review of privileged users, and annual review for all users. Security management and access control processes will continue to be a standing agenda item for ongoing quarterly training sessions with local office security coordinators (LOSC). For parts a., c., and d., the Access Management Section began implementing a process to conduct quarterly reconciliations of the DSA to the Bridges Integrated Automated Eligibility Determination System (Bridges) during March 2025. Due to the complexity of the reconciliations and time constraints, MDHHS requested the Bridges technical team to develop a consolidated Excel based report to add a level of automation to the process. The report is now available on an ad hoc basis, and the Access Management Section began utilizing it during April 2026 to conduct reviews and provide remediation with the LOSCs and end users. Full automation of the report remains in progress due to significant competing priorities and limited resources. For part b., MDHHS implemented the automated DSA periodic access review process (PAR) during January 2026 to review all users every 90 days, instead of the current 180 days for privileged users. MDHHS updated its policy to require initiation of the PAR in the DSA for all users every 90 days, without exception, to comply with State standards. For part e., MDHHS local office directors, district managers, or designees review a monthly sample of high-risk Bridges transactions to ensure documentation was properly maintained. Beginning September 2024, MDHHS Business Service Centers (BSC) implemented a monitoring process to ensure monthly reviews are completed by the local offices timely and that the documentation is properly maintained. To strengthen compliance, MDHHS will reinforce expectations through manager training and emphasize the requirement to maintain complete records and to sign and date all review reports within 30 days of the report run date. Additional training sessions will be repeated as needed to ensure consistent adherence to documentation and timeliness standards across all local offices. Anticipated Completion Date a., c., and d. Ongoing b. Completed e. September 30, 2026 Responsible Individual(s) a., b., c., and d. Tim Kwast, MDHHS e. Tim Kwast and Veronica Maxson, MDHHS

View Audit 404775

Finding 1218699 (2025-003)

Material Weakness 2025

State of Michigan

MI

Questioned Costs Eligibility Internal Control / Segregation of Duties § 200.303

Finding 2025-003 Bridges Interface Controls Management Views DTMB agrees with the finding. Planned Corrective Action DTMB will establish a process to verify that the total number of processed, exception, and skipped records matches the number of records read from the data source. DTMB will investiga...

Finding 2025-003 Bridges Interface Controls Management Views DTMB agrees with the finding. Planned Corrective Action DTMB will establish a process to verify that the total number of processed, exception, and skipped records matches the number of records read from the data source. DTMB will investigate discrepancies identified through this validation process and implement appropriate corrective measures to resolve the issues. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Nathan Buckwalter, DTMB

View Audit 404775

Finding 1218698 (2025-002)

Material Weakness 2025

State of Michigan

MI

Questioned Costs Eligibility Internal Control / Segregation of Duties § 200.303

Finding 2025-002 DTMB, IT General Controls Management Views The Department of Technology, Management, and Budget (DTMB) agrees it did not perform the annual review of privileged accounts for the operating system servers. As stated in the finding, DTMB performed the recertification process after the ...

Finding 2025-002 DTMB, IT General Controls Management Views The Department of Technology, Management, and Budget (DTMB) agrees it did not perform the annual review of privileged accounts for the operating system servers. As stated in the finding, DTMB performed the recertification process after the issue was brought to its attention. Planned Corrective Action DTMB performed its user access recertification processes in November 2025. Anticipated Completion Date Completed Responsible Individual(s) Manny Rosales, DTMB

View Audit 404775

Finding 1218684 (2025-055)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties Questioned Costs Subrecipient Monitoring

Finding 2025-055 Social Services Block Grant, ALN 93.667 - Post-Expenditure Report Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS is modifying the process to obtain the required post-expenditure report data to ensure all individuals receiving Social Services Block Gr...

Finding 2025-055 Social Services Block Grant, ALN 93.667 - Post-Expenditure Report Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS is modifying the process to obtain the required post-expenditure report data to ensure all individuals receiving Social Services Block Grant supported services are appropriately included. Also, MDHHS will add a program validation step to review the applicable federal regulations and confirm the data extracted is accurate and complete. In addition, MDHHS will revise and resubmit the fiscal year 2025 report by September 30, 2026. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Tiffany Clarke, MDHHS Rebecca Jones, MDHHS Mary Lou Mahoney, MDHHS Aimee McDaniel, MDHHS

View Audit 404775

Finding 1218682 (2025-007)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties Questioned Costs Student Financial Aid

Finding 2025-007 MiSACWIS Security Management and Access Controls Management Views MDHHS agrees with the finding. Planned Corrective Action For part a., MDHHS currently has a process in place to review the user narrative describing the incompatible role exceptions within the DSA Michigan Statewide A...

Finding 2025-007 MiSACWIS Security Management and Access Controls Management Views MDHHS agrees with the finding. Planned Corrective Action For part a., MDHHS currently has a process in place to review the user narrative describing the incompatible role exceptions within the DSA Michigan Statewide Automated Child Welfare Information System (MiSACWIS) request as part of the approval process. Also, MDHHS added an incompatible role form in the DSA MiSACWIS request with automated routing for appropriate approval on November 11, 2025. In addition, MDHHS provides ongoing education during the quarterly LOSC webinars, where guidance is shared with the LOSCs on security management and access control topics, such as the correct procedures for processing system access requests. For part b., during April 2025, MDHHS updated the renewal processing start date to 15 days earlier to ensure renewal requests are reviewed prior to the annual recertification date. Anticipated Completion Date Completed Responsible Individual(s) Tim Kwast, MDHHS Alana Lowe, MDHHS

View Audit 404775

Finding 1218678 (2025-020)

Material Weakness 2025

State of Michigan

MI

Allowable Costs / Cost Principles Reporting Internal Control / Segregation of Duties

Finding 2025-020 Foster Care Title IV-E, ALN 93.658 and Adoption Assistance, ALN 93.659 - Accuracy of Financial Reports Management Views MDHHS disagrees with the finding. The expenditures noted were recorded through MDHHS’s normal, federally approved Public Assistance Cost Allocation Plan cost alloc...

Finding 2025-020 Foster Care Title IV-E, ALN 93.658 and Adoption Assistance, ALN 93.659 - Accuracy of Financial Reports Management Views MDHHS disagrees with the finding. The expenditures noted were recorded through MDHHS’s normal, federally approved Public Assistance Cost Allocation Plan cost allocation process. As part of this process, certain administrative costs are not identifiable or allocable to federal programs until the allocation is completed. At that point, MDHHS recognizes these costs as expenditures in the CB-496 report in the quarter in which the allocation occurs and the costs are assigned to the grant. Consistent with this approach, MDHHS has historically reported these amounts as current quarter expenditures. MDHHS previously consulted with the U.S. Department of Health and Human Services (HHS) Administration for Children and Families (ACF) on the appropriate use of the prior quarter adjustment column, and MDHHS was verbally instructed to no longer record these administrative costs as adjustments since this is part of the normal cost allocation process. ACF approves the CB-496 reports in the federal system and ensures the final award amount reconciles with the amounts reported. This approval process supports the reporting approach used by MDHHS is both consistent with prior guidance and accepted by ACF through its approval and award process. Planned Corrective Action Although MDHHS disagrees with the finding, MDHHS sought written guidance from ACF and will follow up to obtain clarification on the appropriate reporting of administrative costs. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Rebecca Jones, MDHHS

View Audit 404775

Finding 1218620 (2025-006)

Material Weakness 2025

State of Michigan

MI

Questioned Costs Special Tests & Provisions Internal Control / Segregation of Duties § 200.303

Finding 2025-006 ADP Security Program Management Views MDHHS and DTMB agree with the finding. Planned Corrective Action For 2 of the 3 systems cited, the Authority to Operate (ATO) was successfully re-established on July 8, 2025, and October 10, 2025, respectively. For the remaining system, MDHHS an...

Finding 2025-006 ADP Security Program Management Views MDHHS and DTMB agree with the finding. Planned Corrective Action For 2 of the 3 systems cited, the Authority to Operate (ATO) was successfully re-established on July 8, 2025, and October 10, 2025, respectively. For the remaining system, MDHHS and DTMB will complete a comprehensive update to the System Security Plan, incorporate all missing control assessments into the risk analysis, and implement the ATO by August 30, 2026. Anticipated Completion Date August 30, 2026 Responsible Individual(s) Nathan Buckwalter, DTMB Heather Frick, DTMB Veronica Maxson, MDHHS Jim Bowen, MDHHS Kasi Hunziger, MDHHS Lyndia Deromedi, MDHHS

View Audit 404775

Finding 1218548 (2025-010)

Material Weakness 2025

State of Michigan

MI

Internal Control / Segregation of Duties Questioned Costs § 200.303

Finding 2025-010 MDE, Change Management Process Management Views MDE partially agrees with the finding. MDE agrees that testing results were not fully documented. However, MDE does not agree that post implementation validation could be performed. The scan-vulnerability process could not be performed...

Finding 2025-010 MDE, Change Management Process Management Views MDE partially agrees with the finding. MDE agrees that testing results were not fully documented. However, MDE does not agree that post implementation validation could be performed. The scan-vulnerability process could not be performed in the production environment in this instance without significantly impacting system performance for users, making post implementation validation infeasible. Planned Corrective Action MDE management will review the testing documentation maintained in DevOps for all tickets classified as tasks and associated with change management activities and deployments and will remind staff of the required documentation standards for all DevOps tickets linked to a deployment. Additionally, MDE will evaluate whether an alternative method of validating the scan-vulnerability process in production is feasible. If no alternative method is identified, MDE will document that post implementation validation cannot be performed due to system constraints. Anticipated Completion Date December 31, 2026 Responsible Individual(s) Monica Butler, MDE

View Audit 404775

Corrective Action Plans

Filters