Corrective Action Plans

Finding Number: 2023-002 Condition: Of the 19 students who received disbursements selected for testing, the Seminary did not notify any of the students or parents, as applicable, that received direct federal loans within the required 30 days. Planned Corrective Action: Directly after a students’ Direct Loan is disbursed, Financial Aid Director manually sends the loan disbursement notification email to the student (through the Jenzabar financial aid system), which specifies the amount that they borrowed for the term and the right to cancel the loan within 14 days by emailing the Financial Aid Office. This email is recorded in the Jenzabar Financial Aid system. The Financial Aid Director also created a spreadsheet to track Direct Loan disbursements and notifications each term. Contact person responsible for corrective action: Ashley Schreiner, Director of Financial Aid Anticipated Completion Date: 09/20/2023 (first day of Fall disbursement)

Finding Number: 2023-007 Condition: The Seminary did not identify or provide the appropriate notification to a student that was not meeting the Seminary's policy on satisfactory academic progress (SAP). Planned Corrective Action: Satisfactory academic progress is now being monitored more carefully. The Satisfactory academic progress report is run out of the student financial aid system. The internally generated report is reviewed by the Registrar and Financial Aid Director to confirm that student satisfactory academic progress statuses are correct. Once the appropriate status is confirmed, the Financial Aid Director will document students who are not in compliance with the institution’s policy and provide notifications to each student through email. The emails are recorded in the students' Jenzabar financial aid account. Contact person responsible for corrective action: Ashley Schreiner, Director of Financial Aid Anticipated Completion Date: 06/01/2024

Finding Number: 2023-003 Condition: The Seminary did not have controls in place to identify and document the students who have withdrawn and the applicability of performing a return of Title IV funds. Planned Corrective Action: Financial Aid Director has established a procedure to ensure that R2T4 calculations are completed and any funds due to be returned are sent back to the Department of Education within 45 days of the date of the student's withdrawal. The Financial Aid Director created a listing to track all student withdrawals (including details of withdrawal). The Registrar sends an email to the Financial Aid Director notifying when a student has withdrawn from the institution, which gets entered onto the list. The Financial Aid Director set up the Department of Education's R2T4 calculator for the 2023-2024 academic year. R2T4 calculations are completed for any student withdrawn and if necessary, funds are returned to the Department of Education. Contact person responsible for corrective action: Ashley Schreiner, Director of Financial Aid Anticipated Completion Date: 09/05/2023 (beginning of Fall 2023 term)

The City agrees with the finding. The Grant Administrator will work with City departments with construction contracts subject to wage rate requirements to ensure policies and procedures are documented and that a monitoring process is implemented to ensure adherence to established policies and grantor requirements. This will be complete by June 30, 2024.

The City agrees with the finding. Over the past several years, the City has developed a significant number of guidance documents and trainings in the area of federal procurement. All of the guidance documents for Central Purchasing are housed in the Purchasing SharePoint site. The guidance and training have in the past been directed at the members of the Purchasing Liaison User Group, but given the continued findings, the City intends to reach out to a much broader group to ensure compliance, including Directors, Deputy Directors, and program representatives. This will be complete by June 30, 2024.

The City agrees with the finding. Over the past several years, the City has developed a significant number of guidance documents and trainings in the area of federal procurement. All of the guidance documents for Central Purchasing are housed in the Purchasing SharePoint site. The guidance and training have in the past been directed at the members of the Purchasing Liaison User Group, but given the continued findings, the City intends to reach out to a much broader group to ensure compliance, including Directors, Deputy Directors, and program representatives. In addition, during Fiscal Year 2023 the City implemented a new system, Contracts Life :Management (CUA), which includes an intake form in the federal funding section. The intake form includes the question "Is the supplier suspended or debarred?" The user is required to upload the result of the SAMS check search, regardless of the status of the contractor. When the answer is yes, the contract process is not allowed to proceed. The system is set up for social services and professional services only at this time, with a slow rollout of the rest of the types of City contracts over the next year or so. This system did not go-live with the existing professional services contracts until the end of the Fiscal Year and management believes that, with sufficient time and build out of the system, this system will help to reduce the exceptions noted above. In addition, as discussed above, management will review and revise internal policies and procedures as appropriate and ensure changes are communicated to departments. This will be completed by June 30, 2024.

The City agrees with the finding. The Treasury Portal automatically fills in the amounts for revenue loss for 2022 with amounts reported in 2020. The Treasury portal has many flaws that would cause errors in reporting. In addition, the portal has changed every quarter, which makes it challenging to report accurately. The City will implement controls to ensure that a second review is completed prior to certification of the report. Additionally, the Grant Administrator will work with department staff responsible for reporting and ensure that each report's supporting documentation is complete and ties to underlying subrecipient reports, the general ledger and grantor reports. All supporting documentation, along with a copy of the submitted report, will be stored in a central location to ensure that they are available for subsequent reviews and audits. This will be completed by June 30, 2024.

The City agrees with the finding. The City will ensure that the federal report preparers reconcile all entries to program limitations prior to having the report submitted for final certification. This will be complete by June 30, 2024.

Finding 2023-004 Internal control deficiency and noncompliance over Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Reporting related to expenses attributable to coronavirus reported in the provider relief fund reports. The entity has excess lost revenues to cover all payments received (excluding the expenses submitted). Therefore, no refund is required for any payments received. Since the program has ended, the management has implemented the following procedures for future grants: 1) An education session occurred on February 15, 2024, with the relevant parties across Huntington Health entities to formally implement a review process whereby the Controller will review the support files prior to filings being made related to grant applications/programs across any of Huntington’s entities. Documentation of this review will be retained in the central file repository. These steps and controls will be updated and documented in the departmental policy. 2) A central folder on the Huntington Hospital’s main accounting drive has been created. This folder will be populated with all support for filed figures related to grant applications/programs across the hospital’s various entities. The support will be validated as having been placed into this folder as part of the reporting out process by the accounting manager and Controller handling the reporting. Files will be retained in this central drive for a minimum of 7 years. These steps and controls will be updated and documented in the departmental policy. Contact Person: Byron Davis, Controller and Steven Mohr, Senior Vice President and Chief Financial Officer, Huntington Hospital Anticipated Completion Date: Completed

Finding 2023-001 Internal control deficiency and noncompliance over Activities Allowed or Unallowed and Allowable Costs/Cost Principles related to salary cap limitation. In response to this finding management will implement the following: We are revising our internal controls to more frequently perform our salary cap reconciliation ensuring the appropriate sponsor invoicing for employees who are over the salary cap limitation. For the salary cap variances that were identified through the previous reconciliation process, they will be adjusted and posted by the close of our March 2024 accounting period. Lastly, we will offset our cash for the March 2024 letter of credit draw down process in the Payment Management System, and incorporate adjustments in our March 2024 invoices for federal pass-thru awards. In addition, the salary cap adjustment program in our new ERP system was designed to remove the defect experienced in our legacy system. Contact Person: Nicole Anderson Leonard, Vice President, Research and Vice Dean Anticipated Completion Date: March 31, 2024

INTERNAL CONTROLS OVER ALLOWABILITY West Virginia Military Authority (the Authority) Assistance Listing Number 97.036, COVID-19 97.036 The Authority is working internally to establish appropriate internal controls to document the review and approval of all West Virginia National Guard members’ timecard records to ensure that the members’ time is accurately reported and entered into the Oasis payroll system at the correct pay rates and amounts. The new internal controls will be implemented by April 1, 2024.

SPECIAL TESTS AND PROVISIONS – ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 The Condition section within prior year finding 2022-037 recognized that the DHHR has policies and procedures in place for performing periodic risk assessments and security reviews over the Recipient Automated Payment and Information Data System (RAPIDS), which is an internal system; however, the Condition section also proclaimed that the DHHR does not have policies and procedures to perform periodic risk assessments and security reviews over the Medicaid Management Information System (MMIS). The first sentence of the corrective action plan for prior year finding 2022-037 indicates that the MMIS is designed, developed, implemented, and operated by an external service organization. Within the last two paragraphs of the corrective action plan for prior year finding 2022-037, the DHHR opined that it was in compliance with 45 CFR 95.621 since it receives the SOC 1 Type 2 report from the MMIS service organization and since the report documents that the service organization establishes and maintains a program for conducting periodic risk analyses to ensure appropriate, cost effective safeguards are incorporated into new and existing systems or whenever significant system changes occur, as required per 45 CFR 95.621. However, the DHHR also recognized the underlying concern expressed within the finding, in that the DHHR does not include the SOC 1 Type 2 report as part of its own policies and procedures for ADP security over the MMIS. To enhance its controls, the DHHR Bureau for Medical Services (BMS) was going to develop a policy and procedures to document MMIS compliance with 45 CFR 95.621. The procedures were to include but not be limited to a requirement to review and approve the SOC 1 Type 2 report from the MMIS service organization and document the review and approval process (e.g., for such matters as the service organization’s assertions, descriptions of its systems and controls, control objectives, and related controls, and the service auditor’s description of tests of controls and results). Although the DHHR BMS has not developed a comprehensive policy or any written procedures to date, they have developed a form to document internal review of the SOC 1 Type 2 report for such matters as the control environment, systems development and maintenance, logical security, physical access, computer operations, and input controls. The BMS has also discussed this issue with an independent consulting firm that is under contract with the BMS for Medicaid expertise and performs existing services related to information technology and security; modernization and planning for the overall Medicaid Enterprise Systems (MES); organization development, including alignment strategies; project management; and data architecture and governance, which includes managing the availability, usability, integrity, and security of data with comprehensive standards and policies. The BMS and its independent consulting firm will work together to develop a statement of work for an independent review of the existing control environment, if deemed necessary, and any additional services that might need performed in order to ensure the DHHR maintains full compliance with 45 CFR 95.621 and can document compliance for future HHS reviewers, independent auditors, or other authorized officials.

SPECIAL TESTS AND PROVISIONS – FRAUD DETECTION AND REPAYMENT West Virginia Department of Health and Human Resources (DHHR) Assistance Listing Number 93.575, 93.596, COVID-19 93.575 Per 45 CFR 98.68(b)(2), there is no requirement for lead agencies to recoup Child Care and Development Fund overpayments, except in instances of fraud as defined by the lead agency. Within the State of West Virginia, the lead agency is the DHHR. As indicated in Section 8.1.6 of the CCDF [State] Plan for West Virginia for Federal fiscal years 2022-2024, the DHHR Office of Inspector General (OIG) is responsible for pursuing fraud and overpayments. As indicated in Section 1.1.2 of the CCDF [State] Plan, the Division of Early Care and Education within the DHHR Bureau for Family Assistance (BFA) administers the CCDF program. Accordingly, the OIG and BFA strive to work as a unified team within the DHHR and State as a whole to identify and prevent fraud or intentional program violations; to identify and recover misspent funds as a result of fraud; and to otherwise fight fraud and ensure program integrity. As the lead agency, and as necessary to ensure program integrity, the DHHR has policies and procedures in place to define fraud and to identify and recover payments resulting from fraud, as the auditors indicated within the condition and recommendation sections of this finding and to track referrals and determinations from beginning to end (i.e., beginning in the year of identification and continuing through resolution or the establishment and enforcement of repayment agreements). The policies and procedures are specifically referenced in Chapter 8 of the BFA’s “Child Care Subsidy Policy and Procedures Manual.” Chapter 8 of the manual is titled, “Improper Payments: Prevention, Identification, Measurement and Recoupment.” Improper Payments Per Chapter 8 of the manual, an improper payment occurs when the funds go to the wrong recipient, the recipient receives the incorrect amount of funds, or the recipient obtains or uses the funds in an improper manner. Improper payments include 1) worker error in determining eligibility, authorizing care, or paying for care; 2) misrepresentation on the part of the parent or provider; and 3) programmatic infractions by parents or providers. 1. Worker Error – Improper payments due to worker error are defined as payments that should not have been made or that were made in an incorrect amount due to an error in determining and verifying eligibility, calculating the benefit, or entering the data into the eligibility system. Repayment of an improper payment due to worker error is not mandatory regardless of the amount. 2. Misrepresentation – Misrepresentation (i.e., fraud) occurs when a specific section of the child care policy is violated as a result of the information not having been reported by the client or provider or reported falsely. Improper payments made as a result of mis-interpretation must be referred to the OIG when the amount exceeds $1,000.00. If the amount does not exceed $1,000.00, the BFA must initiate repayment procedures. A willfully false statement is one that is deliberately given, with the intent that it be accepted as true, with the knowledge that it is false. It is an essential element in a misrepresentation charge that the client or provider knew the statement was false. 3. Programmatic Infraction – There are times when it is difficult to discern whether an improper payment occurred due to willful misrepresentation or is simply the result of a client or provider’s genuine confusion over subsidy program rules and responsibilities. When the case manager believes that improper payments were the result of the client or provider’s failure to understand, it is considered to be a programmatic infraction; it is the BFA’s responsibility to collect the improper payment in this instance, regardless of the amount. If the case manager is in doubt as to whether an improper payment is a programmatic infraction or is the result of misrepresentation by the client or provider, and the improper payment is less than $1,000.00, the case manager discusses the case with the supervisor and the supervisor subsequently consults with the program director; together, they make the decision whether to pursue repayment. Referrals from the Bureau for Family Assistance to the Office of Inspector General If the overpayment is $1,000.00 or greater and is due to misrepresentation by the client or provider, the case manager prepares a memo explaining the circumstances, the time period, and an estimate of the amount involved; indicates the person(s) who can verify the information within the memo; attaches a copy of all applicable documentation including, but not limited to, the payment form and attendance sheets that help support the complaint; states what corrective actions the case manager has taken on the case; and sends a copy of the memo and supporting documents to the Office of Inspector General, Division of Investigations and Fraud Management. Recovery of Improper Payments Resulting from Misrepresentation (i.e., Fraud) The supervisors within the BFA are responsible for negotiating repayment schedules with providers and clients and completing a Child Care Benefit Repayment Agreement to include the amount to be recovered, the period of recovery, the monthly recovery amount, and the procedure for repayment. If the provider or client is active, the case manager attempts to collect the payment in full; if this is not feasible, the case manager requests that the client or provider be asked to repay the amount in monthly installment payments of approximately 10% of the amount due. If a payment is more than 45 days late (15 days past the due date), the entire unpaid balance becomes due and must be paid in full. Failure to repay the requested amount results in case closure for clients or denial of participation in the certificate system for child care providers. Client services will not be reinstated until full payment is received. There are no policies or procedures to pursue repayments or collection beyond that point. There is no method to recoup overpayments from ongoing benefits, and the CCDF is not subject to the Treasury Offset Program, as other Federal programs are. Corrective Action Plan As previously stated, the OIG and BFA strive to work as a unified team within the DHHR to identify and prevent fraud or intentional program violations; to identify and recover misspent funds as a result of fraud; and to otherwise fight fraud and ensure program integrity. In response to the auditor’s recommendation for this finding, the OIG and BFA will revisit existing policies and procedures over fraud detection and repayment and will attempt to enhance the controls related thereto, particularly in relation to ensuring that all efforts concerning fraud detection and repayment are sufficiently documented, thus demonstrating full compliance with 45 CFR 98.60. Maintaining documentation of the decision-making process, the activities performed, and the results of those activities is of paramount importance in achieving that objective. A high level of documentation is necessary to support that the DHHR has policies and procedures in place and is following those policies and procedures. Maintaining adequate records and other documentary evidence will resolve this audit finding, prevent the occurrence of future audit findings, and provide a means to corroborate statements and assurances provided to regulatory agencies and other authorized individuals with regards to the DHHR’s overall compliance with 45 CFR 98.60. It is not enough to perform the activities; there must be an adequate audit trail to show the “who, what, when, where, and how” of the activities performed. As such, the OIG and BFA will also develop and maintain an appropriate system for categorizing their files and organizing their records, reports, and documents in a systematic and orderly manner to ensure, among other purposes, that they can substantiate their efforts when audited, reviewed, or evaluated by internal staff or authorized external organizations.

ALLOWABILITY AND ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 For the one payment out of 40 whereby the provider requested and was paid for 13 non-traditional days although records indicated that only 11 of the days were non-traditional, the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), agrees that the condition resulted in an overpayment of $12.00. The BFA Case Manager entered 13 non-traditional days in the Family and Children Tracking System (FACTS), but the record indicated that only 11 days were non-traditional days. Per WV Child Care Policy and Procedures: 8.3.1. Worker Error Improper payments due to worker error are defined as payments that should not have been made, or that were made in an incorrect amount due to worker error in determining and verifying eligibility, and/or calculation and input of information into the Family and Children’s Tracking System (FACTS). Incorrect amounts include overpayments, underpayments and inappropriate denials of payment. 8.3.1.1. Examples of worker error: A. The child care regulatory specialist enables the “accreditation” box, allowing the provider to receive an extra $4 per day, when the provider has not achieved accreditation, and is not entitled to the enhanced rate. B. The case manager enters an incorrect number of days when entering information from the payment form into FACTS. C. The case manager enters more time on the child care assessment than the client’s work or school schedule supports. D. The case manager fails to verify income, school enrollment, or special needs status. 8.3.1.2. Repayment of an improper payment due to CCR&R worker error is not mandatory regardless of the amount. The BFA Division of Early Care and Education employs Child Care Policy Specialists who visit contracted Resource and Referral Agencies to monitor and audit both electronic and hard records. Training and coaching also takes place during these visits. These visits continued throughout the reporting period. The BFA will evaluate the effectiveness of the current training programs for the use of the FACTS system (and subsequently for the West Virginia People's Access to Help (PATH) system) for CCDF payments. Furthermore, the BFA will follow established policies and procedures to ensure client information is appropriately obtained and maintained and that all data is input accurately. For the payment whereby the $3.00 daily supplement was not included in the calculation or paid, although the documentation in the eligibility system indicated that the child was covered under a CPS Safety Plan, this was not in fact a CPS Safety Plan case. The CPS Safety Plan was being used as a temporary means to address an executive order regarding COVID-19 and grant eligibility to essential workers who would otherwise not have qualified for the child care subsidy assistance due to their monthly income being above the Federal Poverty Level but below 85% of the State Median Income. The payment in question was in March 2023. Via a case assessment on November 1, 2023, this case [and other similar cases] were approved in the eligibility system as formalized Policy Exceptions rather than being selected as part of a CPS Safety Plan.

TRANSPARENCY ACT REPORTING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 The DHHR concurs with the Condition section of the finding, in that one report was not submitted timely; however, the DHHR does not agree with the Cause section of the finding, which indicates a lack of oversight and adequate review of the FFATA reporting by DHHR Management. The DHHR hereby notes that the report was due on October 31, 2022 but was not submitted until November 1, 2022 (i.e., one day late). Submitting a report one day late is not an indication of a lack of oversight or adequate review of the FFATA reporting requirement. In this case, the report was submitted one day late because the person responsible for submitting the report was working remotely on October 31, 2022 and lost internet connection until November 1, 2022. Although the DHHR strives for perfection, such a condition cannot always be achieved, especially from the perspective of information technology within the rural state of West Virginia. Nonetheless, if the situation repeats in the future, the person responsible for submitting the report will be encouraged to find a location that has an adequate [and secure] internet connection.

INTERNAL CONTROLS OVER CHILD CARE PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Department of Health & Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 All funds resulting from the American Rescue Plan Act (ARPA) were expended and all related programs ended on or before September 30, 2023. The West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), Division of Early Care and Education, employs Child Care Policy Specialists who visit contracted Resource and Referral Agencies to monitor and audit both electronic and hard records. Training and coaching also takes place during these visits. These visits continued throughout the reporting period. The BFA will evaluate the effectiveness of the current training programs for the collection and storing of eligibility records. Furthermore, the BFA will follow established policies and procedures to ensure provider information and documentation is appropriately obtained, reviewed, and retained.

ALLOWABILITY OF EXPENDITURES, SPECIAL TEST AND PROVISIONS – PROVIDER ENROLLMENT & SPECIAL TEST AND PROVISIONS: PROVIDER HEALTH AND SAFETY STANDARDS (MEDICAID ONLY) Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778 The West Virginia Department of Health and Human Resources, Bureau for Medical Services (BMS), has developed a form to document internal review of the service organization’s SOC 1 Type 2 report for such matters as the control environment, system development and maintenance, logical security, physical access, computer operations, and input controls. The form also has dedicated sections for exceptions within the SOC 1 Type 2 report as noted by the reviewer(s) and for questions/comments that the reviewer(s) might have. As of the date of this writing, the BMS is still working on the instructions for completing the form and processing the form to the next level within the BMS as may be necessary (e.g., answering any questions or comments that the initial reviewer denoted on the form; evaluating whether any exceptions noted within the SOC 1 Type 2 report could have a negative effect on the MMIS or the Medicaid program in general; and eventually closing the SOC 1 Type 2 report and documenting the review, the overall effect, the resulting actions, and any pending actions within the appropriate system files).

ALLOWABILITY AND ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.658 As indicated in the Condition section of the finding, although the documentation related to safety considerations at child care institutions was not initially maintained in the official licensing files for 10 of the 40 cases tested for eligibility, the documentation was eventually provided to the auditors for eight of those 10 cases. For one of the remaining two cases, the child care institution is an out-of-state institution that is no longer in business. For the other case, the child care institution provided documentation, but the documentation did not include the dates of the institution’s safety checks. In an effort to enhance internal controls over the safety considerations at child care institutions, the West Virginia Department of Health and Human Resources, Bureau for Social Services (BSS), is continuing to analyze the condition that led to this finding and is considering a number of steps, including but not limited to the following as an immediate plan of action: • Transmit a copy of 2 CFR 1356.30(f) to all licensing personnel, supervisors, and other applicable staff within the BSS and oblige them to acknowledge that they have read and understand the requirements referenced therein. • Implement a formalized policy and develop written procedures for ensuring the licensing files for child care institutions contain documentation which verifies that safety considerations with respect to the staff of the institutions have been addressed. • Develop overall standards for the maintenance of documentation within licensing files (e.g., a consistent naming convention for the documents, which would improve internal tracking and ensure that requests from independent auditors are addressed efficiently and fully; personnel who have read-only access to documents versus those who can add, replace, and delete documents; record retention requirements; etc.). • Establish a formalized process for monitoring. Such a process would include a strategy for conducting internal reviews of all licensing files on a recurring basis, reporting the results of those reviews to appropriate officials internal and external to the DHHR, following up with those officials as may be necessary, and documenting the overall results accordingly. For example, if the results of a monitoring review indicated noncompliance [or potential noncompliance] on the part of a child care institution, the BSS would inform the institution, request a copy of the institution’s written policies and procedures regarding safety considerations, discuss it with the institution, and provide technical assistance to the maximum extent practicable. Once the BSS drafts the aforementioned policies and procedures and related monitoring process, or otherwise enhances their internal controls over the safety considerations at child care institutions, the BSS will discuss the matter with their regular programmatic contacts at the U.S. Department of Health and Human Services, Administration for Children and Families, and will ask the ACF if the BSS’s planned controls are aligned with the ACF’s universal expectations surrounding 2 CFR 1356.30(f).

INFORMATION TECHNOLOGY GENERAL CONTROLS – WVPATH Department of Health and Human Resources (DHHR) Assistance Listing Number 93.658, 93.659 The DHHR, Office of Management Information Services (OMIS), analyzed this finding and hereby offers more details into the condition and cause of the finding. The information technology system in question is named WVPATH, which stands for, “West Virginia People’s Access to Help.” WVPATH is a comprehensive social services/child welfare information system, allowing employees to more efficiently track and view data, streamline services, and ultimately improve the manner by which the State determines eligibility for programs and provides for the delivery of services. With respect to the Foster Care and Adoption programs, the WVPATH system replaced the “Family and Children’s Tracking System” (FACTS). The DHHR transitioned from FACTS to WVPATH in January 2023, which was approximately six months into fiscal year 2023. Fieldwork for the information technology portion of the West Virginia Single Audit began in June 2023. During fieldwork, the auditors inquired about the information technology general controls (ITGCs) within the WVPATH system. In particular, the auditors requested a description of the controls along with a copy of the policies, procedures, system generated listings, screenprints, and other documentation related to information security and access administration, change management, and backup recovery and restoration. Although the OMIS is of the opinion that the State of West Virginia indeed implemented all logical access and change management controls to support effective ITGCs over the WVPATH system, the OMIS did not address the auditor’s request in a timely manner during fieldwork. Therefore, the auditors were unable to determine whether the controls were designed sufficiently, nor were they able to conduct the requisite testing to confirm that the controls were in place and operating effectively during the applicable months of the audit period.   Upon receiving this finding, the OMIS conferred with the State’s third-party software vendor for the WVPATH system; prepared a description of controls; collected the documentation related to information security and access administration, change management, and backup recovery and restoration within the WVPATH system; and submitted the description of controls and related documentation to the auditors. On February 14, 2024, a meeting was held between the auditors, the OMIS, the third-party software vendor, and one of the audit coordinators from the DHHR central finance level. The purpose of the meeting was to discuss this finding and determine whether the documentation collected by the OMIS after fieldwork would have averted the finding in the first place. During the meeting, the auditors indicated that the description of controls is very detailed and appears to support the OMIS’s assertion that the controls are designed sufficiently. However, since the documentation was submitted to the auditors after fieldwork was complete, there was not enough time for the auditors to conduct the requisite testing to determine whether the processes and controls were in place and operating effectively during the applicable months of the audit period. In terms of a corrective action plan for this finding, the OMIS now has a greater understanding of the auditor’s objectives and procedures surrounding ITGCs. During fieldwork for the [forthcoming] West Virginia Single Audit for the year ended June 30, 2024, when the auditors are ready to test the required logical access and change management controls that are required to be in place to support effective ITGCs for the WVPATH system, the OMIS will undoubtedly be prepared to provide the auditors with a description of the controls along with a copy of all documentation related to information security and access administration, change management, and backup recovery and restoration within the WVPATH system.

ELIGIBILITY West Virginia Department of Health and Human Resources (DHHR) Assistance Listing Number 93.568, COVID-19 93.568 The LIHEAP policy staff within the DHHR, Bureau for Family Assistance (BFA), have worked with the Recipient Automated Payment and Information Data System (RAPIDS) team to confirm that the benefit table has been accurately entered into the RAPIDS system for fiscal year 2024. The LIHEAP policy staff will continue to review the work of the RAPIDS team to ensure that the benefit table has been accurately entered prior to the opening of LIHEAP application intake annually.

SPECIAL TESTS AND PROVISIONS – PENALTY FOR FAILURE TO COMPLY WITH WORK VERFICATION PLAN Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558 For each data element quarter of the calendar year, the new component entry deadline and the participation hours entry deadline are established by the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA). For the first data element quarter (January, February, March), the new component entry deadline is April 30, and the participation hours entry deadline is May 5. For the second data element quarter (April, May, June), the new component entry deadline is July 31, and the participation hours entry deadline is August 5. For the third data element quarter (July, August, September), the new component entry deadline is October 31, and the participation hours entry deadline is November 5. For the fourth data element quarter (October, November, December), the new component entry deadline is January 31, and the participation hours entry deadline is February 5. To resolve the condition that led to this finding, the BFA will work with the Recipient Automated Payment and Information Data System (RAPIDS) Data Team. The BFA will request joint meetings with the RAPIDS Data Team to review sample cases and the components and hours related thereto to ensure they have been entered into the data system correctly. The meetings will take place quarterly, within five days after the participation hours entry deadlines, and will be documented accordingly.

SPECIAL TESTS AND PROVISIONS – INCOME ELIGIBILITY AND VERIFICATION SYSTEM Department of Health & Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 The Division of Family Support within the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), will send the current desk guides to all WV WORKS (TANF) staff, which includes the Data Exchange desk guide and the Viewing Data Exchanges by Exchange Type desk guide. The BFA Division of Family Support will also work with the BFA Division of Professional Development to create a blackboard course for supervisors and community service managers [who supervise WV WORKS (TANF) staff] to assist the supervisors and management in identifying deficiencies regarding the IEVS system.

SPECIAL TESTS AND PROVISIONS – PENALTY FOR REFUSAL TO WORK Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 The TANF policy staff within the West Virginia Department of Health and Human Resources, Bureau for Family Assistance, will work with Optum, the State’s eligibility system vendor, and the Recipient Automated Payment and Information Data System (RAPIDS) team to ensure that the criteria for the population for penalty for refusal to work are interpreted and applied correctly. Policy staff will also conduct monthly reviews of a random sample of cases to which the penalty for refusal to work is applicable in order to ensure that it is being applied appropriately.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE Department of Health & Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 In August of 2023, the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), Division of Professional Development, released a mandatory Blackboard course on Sanctions (Course ID: BFA-ITT-WV-400-2023). All staff completed the training by September 21, 2023. The BFA will repeat this mandatory training on an annual basis for all staff that have the capability to impose, approve, or remove a sanction. Reminders and desk guides will also continue to be distributed to field staff. The BFA Policy Unit will also continue its monthly reviews of RAPIDS Management reports regarding 3rd level sanctions that are being sent to the unit for review and approval.

MAINTENANCE OF EFFORT Department of Education (DOE) Assistance Listing Number 84.425, COVID-19 84.425 The Maintenance of Effort (MOE) calculation is in process. A waiver was requested and approved for the FY 2023 MOE data. The MOE will be completed by March 15, 2024.