Corrective Action Plans

INTERNAL CONTROLS OVER ALLOWABILITY West Virginia Military Authority (the Authority) Assistance Listing Number 97.036, COVID-19 97.036 The Authority is working internally to establish appropriate internal controls to document the review and approval of all West Virginia National Guard members’ timecard records to ensure that the members’ time is accurately reported and entered into the Oasis payroll system at the correct pay rates and amounts. The new internal controls will be implemented by April 1, 2024.

SPECIAL TESTS AND PROVISIONS – ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 The Condition section within prior year finding 2022-037 recognized that the DHHR has policies and procedures in place for performing periodic risk assessments and security reviews over the Recipient Automated Payment and Information Data System (RAPIDS), which is an internal system; however, the Condition section also proclaimed that the DHHR does not have policies and procedures to perform periodic risk assessments and security reviews over the Medicaid Management Information System (MMIS). The first sentence of the corrective action plan for prior year finding 2022-037 indicates that the MMIS is designed, developed, implemented, and operated by an external service organization. Within the last two paragraphs of the corrective action plan for prior year finding 2022-037, the DHHR opined that it was in compliance with 45 CFR 95.621 since it receives the SOC 1 Type 2 report from the MMIS service organization and since the report documents that the service organization establishes and maintains a program for conducting periodic risk analyses to ensure appropriate, cost effective safeguards are incorporated into new and existing systems or whenever significant system changes occur, as required per 45 CFR 95.621. However, the DHHR also recognized the underlying concern expressed within the finding, in that the DHHR does not include the SOC 1 Type 2 report as part of its own policies and procedures for ADP security over the MMIS. To enhance its controls, the DHHR Bureau for Medical Services (BMS) was going to develop a policy and procedures to document MMIS compliance with 45 CFR 95.621. The procedures were to include but not be limited to a requirement to review and approve the SOC 1 Type 2 report from the MMIS service organization and document the review and approval process (e.g., for such matters as the service organization’s assertions, descriptions of its systems and controls, control objectives, and related controls, and the service auditor’s description of tests of controls and results). Although the DHHR BMS has not developed a comprehensive policy or any written procedures to date, they have developed a form to document internal review of the SOC 1 Type 2 report for such matters as the control environment, systems development and maintenance, logical security, physical access, computer operations, and input controls. The BMS has also discussed this issue with an independent consulting firm that is under contract with the BMS for Medicaid expertise and performs existing services related to information technology and security; modernization and planning for the overall Medicaid Enterprise Systems (MES); organization development, including alignment strategies; project management; and data architecture and governance, which includes managing the availability, usability, integrity, and security of data with comprehensive standards and policies. The BMS and its independent consulting firm will work together to develop a statement of work for an independent review of the existing control environment, if deemed necessary, and any additional services that might need performed in order to ensure the DHHR maintains full compliance with 45 CFR 95.621 and can document compliance for future HHS reviewers, independent auditors, or other authorized officials.

SPECIAL TESTS AND PROVISIONS – FRAUD DETECTION AND REPAYMENT West Virginia Department of Health and Human Resources (DHHR) Assistance Listing Number 93.575, 93.596, COVID-19 93.575 Per 45 CFR 98.68(b)(2), there is no requirement for lead agencies to recoup Child Care and Development Fund overpayments, except in instances of fraud as defined by the lead agency. Within the State of West Virginia, the lead agency is the DHHR. As indicated in Section 8.1.6 of the CCDF [State] Plan for West Virginia for Federal fiscal years 2022-2024, the DHHR Office of Inspector General (OIG) is responsible for pursuing fraud and overpayments. As indicated in Section 1.1.2 of the CCDF [State] Plan, the Division of Early Care and Education within the DHHR Bureau for Family Assistance (BFA) administers the CCDF program. Accordingly, the OIG and BFA strive to work as a unified team within the DHHR and State as a whole to identify and prevent fraud or intentional program violations; to identify and recover misspent funds as a result of fraud; and to otherwise fight fraud and ensure program integrity. As the lead agency, and as necessary to ensure program integrity, the DHHR has policies and procedures in place to define fraud and to identify and recover payments resulting from fraud, as the auditors indicated within the condition and recommendation sections of this finding and to track referrals and determinations from beginning to end (i.e., beginning in the year of identification and continuing through resolution or the establishment and enforcement of repayment agreements). The policies and procedures are specifically referenced in Chapter 8 of the BFA’s “Child Care Subsidy Policy and Procedures Manual.” Chapter 8 of the manual is titled, “Improper Payments: Prevention, Identification, Measurement and Recoupment.” Improper Payments Per Chapter 8 of the manual, an improper payment occurs when the funds go to the wrong recipient, the recipient receives the incorrect amount of funds, or the recipient obtains or uses the funds in an improper manner. Improper payments include 1) worker error in determining eligibility, authorizing care, or paying for care; 2) misrepresentation on the part of the parent or provider; and 3) programmatic infractions by parents or providers. 1. Worker Error – Improper payments due to worker error are defined as payments that should not have been made or that were made in an incorrect amount due to an error in determining and verifying eligibility, calculating the benefit, or entering the data into the eligibility system. Repayment of an improper payment due to worker error is not mandatory regardless of the amount. 2. Misrepresentation – Misrepresentation (i.e., fraud) occurs when a specific section of the child care policy is violated as a result of the information not having been reported by the client or provider or reported falsely. Improper payments made as a result of mis-interpretation must be referred to the OIG when the amount exceeds $1,000.00. If the amount does not exceed $1,000.00, the BFA must initiate repayment procedures. A willfully false statement is one that is deliberately given, with the intent that it be accepted as true, with the knowledge that it is false. It is an essential element in a misrepresentation charge that the client or provider knew the statement was false. 3. Programmatic Infraction – There are times when it is difficult to discern whether an improper payment occurred due to willful misrepresentation or is simply the result of a client or provider’s genuine confusion over subsidy program rules and responsibilities. When the case manager believes that improper payments were the result of the client or provider’s failure to understand, it is considered to be a programmatic infraction; it is the BFA’s responsibility to collect the improper payment in this instance, regardless of the amount. If the case manager is in doubt as to whether an improper payment is a programmatic infraction or is the result of misrepresentation by the client or provider, and the improper payment is less than $1,000.00, the case manager discusses the case with the supervisor and the supervisor subsequently consults with the program director; together, they make the decision whether to pursue repayment. Referrals from the Bureau for Family Assistance to the Office of Inspector General If the overpayment is $1,000.00 or greater and is due to misrepresentation by the client or provider, the case manager prepares a memo explaining the circumstances, the time period, and an estimate of the amount involved; indicates the person(s) who can verify the information within the memo; attaches a copy of all applicable documentation including, but not limited to, the payment form and attendance sheets that help support the complaint; states what corrective actions the case manager has taken on the case; and sends a copy of the memo and supporting documents to the Office of Inspector General, Division of Investigations and Fraud Management. Recovery of Improper Payments Resulting from Misrepresentation (i.e., Fraud) The supervisors within the BFA are responsible for negotiating repayment schedules with providers and clients and completing a Child Care Benefit Repayment Agreement to include the amount to be recovered, the period of recovery, the monthly recovery amount, and the procedure for repayment. If the provider or client is active, the case manager attempts to collect the payment in full; if this is not feasible, the case manager requests that the client or provider be asked to repay the amount in monthly installment payments of approximately 10% of the amount due. If a payment is more than 45 days late (15 days past the due date), the entire unpaid balance becomes due and must be paid in full. Failure to repay the requested amount results in case closure for clients or denial of participation in the certificate system for child care providers. Client services will not be reinstated until full payment is received. There are no policies or procedures to pursue repayments or collection beyond that point. There is no method to recoup overpayments from ongoing benefits, and the CCDF is not subject to the Treasury Offset Program, as other Federal programs are. Corrective Action Plan As previously stated, the OIG and BFA strive to work as a unified team within the DHHR to identify and prevent fraud or intentional program violations; to identify and recover misspent funds as a result of fraud; and to otherwise fight fraud and ensure program integrity. In response to the auditor’s recommendation for this finding, the OIG and BFA will revisit existing policies and procedures over fraud detection and repayment and will attempt to enhance the controls related thereto, particularly in relation to ensuring that all efforts concerning fraud detection and repayment are sufficiently documented, thus demonstrating full compliance with 45 CFR 98.60. Maintaining documentation of the decision-making process, the activities performed, and the results of those activities is of paramount importance in achieving that objective. A high level of documentation is necessary to support that the DHHR has policies and procedures in place and is following those policies and procedures. Maintaining adequate records and other documentary evidence will resolve this audit finding, prevent the occurrence of future audit findings, and provide a means to corroborate statements and assurances provided to regulatory agencies and other authorized individuals with regards to the DHHR’s overall compliance with 45 CFR 98.60. It is not enough to perform the activities; there must be an adequate audit trail to show the “who, what, when, where, and how” of the activities performed. As such, the OIG and BFA will also develop and maintain an appropriate system for categorizing their files and organizing their records, reports, and documents in a systematic and orderly manner to ensure, among other purposes, that they can substantiate their efforts when audited, reviewed, or evaluated by internal staff or authorized external organizations.

ALLOWABILITY AND ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 For the one payment out of 40 whereby the provider requested and was paid for 13 non-traditional days although records indicated that only 11 of the days were non-traditional, the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), agrees that the condition resulted in an overpayment of $12.00. The BFA Case Manager entered 13 non-traditional days in the Family and Children Tracking System (FACTS), but the record indicated that only 11 days were non-traditional days. Per WV Child Care Policy and Procedures: 8.3.1. Worker Error Improper payments due to worker error are defined as payments that should not have been made, or that were made in an incorrect amount due to worker error in determining and verifying eligibility, and/or calculation and input of information into the Family and Children’s Tracking System (FACTS). Incorrect amounts include overpayments, underpayments and inappropriate denials of payment. 8.3.1.1. Examples of worker error: A. The child care regulatory specialist enables the “accreditation” box, allowing the provider to receive an extra $4 per day, when the provider has not achieved accreditation, and is not entitled to the enhanced rate. B. The case manager enters an incorrect number of days when entering information from the payment form into FACTS. C. The case manager enters more time on the child care assessment than the client’s work or school schedule supports. D. The case manager fails to verify income, school enrollment, or special needs status. 8.3.1.2. Repayment of an improper payment due to CCR&R worker error is not mandatory regardless of the amount. The BFA Division of Early Care and Education employs Child Care Policy Specialists who visit contracted Resource and Referral Agencies to monitor and audit both electronic and hard records. Training and coaching also takes place during these visits. These visits continued throughout the reporting period. The BFA will evaluate the effectiveness of the current training programs for the use of the FACTS system (and subsequently for the West Virginia People's Access to Help (PATH) system) for CCDF payments. Furthermore, the BFA will follow established policies and procedures to ensure client information is appropriately obtained and maintained and that all data is input accurately. For the payment whereby the $3.00 daily supplement was not included in the calculation or paid, although the documentation in the eligibility system indicated that the child was covered under a CPS Safety Plan, this was not in fact a CPS Safety Plan case. The CPS Safety Plan was being used as a temporary means to address an executive order regarding COVID-19 and grant eligibility to essential workers who would otherwise not have qualified for the child care subsidy assistance due to their monthly income being above the Federal Poverty Level but below 85% of the State Median Income. The payment in question was in March 2023. Via a case assessment on November 1, 2023, this case [and other similar cases] were approved in the eligibility system as formalized Policy Exceptions rather than being selected as part of a CPS Safety Plan.

TRANSPARENCY ACT REPORTING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 The DHHR concurs with the Condition section of the finding, in that one report was not submitted timely; however, the DHHR does not agree with the Cause section of the finding, which indicates a lack of oversight and adequate review of the FFATA reporting by DHHR Management. The DHHR hereby notes that the report was due on October 31, 2022 but was not submitted until November 1, 2022 (i.e., one day late). Submitting a report one day late is not an indication of a lack of oversight or adequate review of the FFATA reporting requirement. In this case, the report was submitted one day late because the person responsible for submitting the report was working remotely on October 31, 2022 and lost internet connection until November 1, 2022. Although the DHHR strives for perfection, such a condition cannot always be achieved, especially from the perspective of information technology within the rural state of West Virginia. Nonetheless, if the situation repeats in the future, the person responsible for submitting the report will be encouraged to find a location that has an adequate [and secure] internet connection.

INTERNAL CONTROLS OVER CHILD CARE PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Department of Health & Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 All funds resulting from the American Rescue Plan Act (ARPA) were expended and all related programs ended on or before September 30, 2023. The West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), Division of Early Care and Education, employs Child Care Policy Specialists who visit contracted Resource and Referral Agencies to monitor and audit both electronic and hard records. Training and coaching also takes place during these visits. These visits continued throughout the reporting period. The BFA will evaluate the effectiveness of the current training programs for the collection and storing of eligibility records. Furthermore, the BFA will follow established policies and procedures to ensure provider information and documentation is appropriately obtained, reviewed, and retained.

ALLOWABILITY OF EXPENDITURES, SPECIAL TEST AND PROVISIONS – PROVIDER ENROLLMENT & SPECIAL TEST AND PROVISIONS: PROVIDER HEALTH AND SAFETY STANDARDS (MEDICAID ONLY) Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778 The West Virginia Department of Health and Human Resources, Bureau for Medical Services (BMS), has developed a form to document internal review of the service organization’s SOC 1 Type 2 report for such matters as the control environment, system development and maintenance, logical security, physical access, computer operations, and input controls. The form also has dedicated sections for exceptions within the SOC 1 Type 2 report as noted by the reviewer(s) and for questions/comments that the reviewer(s) might have. As of the date of this writing, the BMS is still working on the instructions for completing the form and processing the form to the next level within the BMS as may be necessary (e.g., answering any questions or comments that the initial reviewer denoted on the form; evaluating whether any exceptions noted within the SOC 1 Type 2 report could have a negative effect on the MMIS or the Medicaid program in general; and eventually closing the SOC 1 Type 2 report and documenting the review, the overall effect, the resulting actions, and any pending actions within the appropriate system files).

ALLOWABILITY AND ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.658 As indicated in the Condition section of the finding, although the documentation related to safety considerations at child care institutions was not initially maintained in the official licensing files for 10 of the 40 cases tested for eligibility, the documentation was eventually provided to the auditors for eight of those 10 cases. For one of the remaining two cases, the child care institution is an out-of-state institution that is no longer in business. For the other case, the child care institution provided documentation, but the documentation did not include the dates of the institution’s safety checks. In an effort to enhance internal controls over the safety considerations at child care institutions, the West Virginia Department of Health and Human Resources, Bureau for Social Services (BSS), is continuing to analyze the condition that led to this finding and is considering a number of steps, including but not limited to the following as an immediate plan of action: • Transmit a copy of 2 CFR 1356.30(f) to all licensing personnel, supervisors, and other applicable staff within the BSS and oblige them to acknowledge that they have read and understand the requirements referenced therein. • Implement a formalized policy and develop written procedures for ensuring the licensing files for child care institutions contain documentation which verifies that safety considerations with respect to the staff of the institutions have been addressed. • Develop overall standards for the maintenance of documentation within licensing files (e.g., a consistent naming convention for the documents, which would improve internal tracking and ensure that requests from independent auditors are addressed efficiently and fully; personnel who have read-only access to documents versus those who can add, replace, and delete documents; record retention requirements; etc.). • Establish a formalized process for monitoring. Such a process would include a strategy for conducting internal reviews of all licensing files on a recurring basis, reporting the results of those reviews to appropriate officials internal and external to the DHHR, following up with those officials as may be necessary, and documenting the overall results accordingly. For example, if the results of a monitoring review indicated noncompliance [or potential noncompliance] on the part of a child care institution, the BSS would inform the institution, request a copy of the institution’s written policies and procedures regarding safety considerations, discuss it with the institution, and provide technical assistance to the maximum extent practicable. Once the BSS drafts the aforementioned policies and procedures and related monitoring process, or otherwise enhances their internal controls over the safety considerations at child care institutions, the BSS will discuss the matter with their regular programmatic contacts at the U.S. Department of Health and Human Services, Administration for Children and Families, and will ask the ACF if the BSS’s planned controls are aligned with the ACF’s universal expectations surrounding 2 CFR 1356.30(f).

INFORMATION TECHNOLOGY GENERAL CONTROLS – WVPATH Department of Health and Human Resources (DHHR) Assistance Listing Number 93.658, 93.659 The DHHR, Office of Management Information Services (OMIS), analyzed this finding and hereby offers more details into the condition and cause of the finding. The information technology system in question is named WVPATH, which stands for, “West Virginia People’s Access to Help.” WVPATH is a comprehensive social services/child welfare information system, allowing employees to more efficiently track and view data, streamline services, and ultimately improve the manner by which the State determines eligibility for programs and provides for the delivery of services. With respect to the Foster Care and Adoption programs, the WVPATH system replaced the “Family and Children’s Tracking System” (FACTS). The DHHR transitioned from FACTS to WVPATH in January 2023, which was approximately six months into fiscal year 2023. Fieldwork for the information technology portion of the West Virginia Single Audit began in June 2023. During fieldwork, the auditors inquired about the information technology general controls (ITGCs) within the WVPATH system. In particular, the auditors requested a description of the controls along with a copy of the policies, procedures, system generated listings, screenprints, and other documentation related to information security and access administration, change management, and backup recovery and restoration. Although the OMIS is of the opinion that the State of West Virginia indeed implemented all logical access and change management controls to support effective ITGCs over the WVPATH system, the OMIS did not address the auditor’s request in a timely manner during fieldwork. Therefore, the auditors were unable to determine whether the controls were designed sufficiently, nor were they able to conduct the requisite testing to confirm that the controls were in place and operating effectively during the applicable months of the audit period.   Upon receiving this finding, the OMIS conferred with the State’s third-party software vendor for the WVPATH system; prepared a description of controls; collected the documentation related to information security and access administration, change management, and backup recovery and restoration within the WVPATH system; and submitted the description of controls and related documentation to the auditors. On February 14, 2024, a meeting was held between the auditors, the OMIS, the third-party software vendor, and one of the audit coordinators from the DHHR central finance level. The purpose of the meeting was to discuss this finding and determine whether the documentation collected by the OMIS after fieldwork would have averted the finding in the first place. During the meeting, the auditors indicated that the description of controls is very detailed and appears to support the OMIS’s assertion that the controls are designed sufficiently. However, since the documentation was submitted to the auditors after fieldwork was complete, there was not enough time for the auditors to conduct the requisite testing to determine whether the processes and controls were in place and operating effectively during the applicable months of the audit period. In terms of a corrective action plan for this finding, the OMIS now has a greater understanding of the auditor’s objectives and procedures surrounding ITGCs. During fieldwork for the [forthcoming] West Virginia Single Audit for the year ended June 30, 2024, when the auditors are ready to test the required logical access and change management controls that are required to be in place to support effective ITGCs for the WVPATH system, the OMIS will undoubtedly be prepared to provide the auditors with a description of the controls along with a copy of all documentation related to information security and access administration, change management, and backup recovery and restoration within the WVPATH system.

ELIGIBILITY West Virginia Department of Health and Human Resources (DHHR) Assistance Listing Number 93.568, COVID-19 93.568 The LIHEAP policy staff within the DHHR, Bureau for Family Assistance (BFA), have worked with the Recipient Automated Payment and Information Data System (RAPIDS) team to confirm that the benefit table has been accurately entered into the RAPIDS system for fiscal year 2024. The LIHEAP policy staff will continue to review the work of the RAPIDS team to ensure that the benefit table has been accurately entered prior to the opening of LIHEAP application intake annually.

SPECIAL TESTS AND PROVISIONS – PENALTY FOR FAILURE TO COMPLY WITH WORK VERFICATION PLAN Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558 For each data element quarter of the calendar year, the new component entry deadline and the participation hours entry deadline are established by the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA). For the first data element quarter (January, February, March), the new component entry deadline is April 30, and the participation hours entry deadline is May 5. For the second data element quarter (April, May, June), the new component entry deadline is July 31, and the participation hours entry deadline is August 5. For the third data element quarter (July, August, September), the new component entry deadline is October 31, and the participation hours entry deadline is November 5. For the fourth data element quarter (October, November, December), the new component entry deadline is January 31, and the participation hours entry deadline is February 5. To resolve the condition that led to this finding, the BFA will work with the Recipient Automated Payment and Information Data System (RAPIDS) Data Team. The BFA will request joint meetings with the RAPIDS Data Team to review sample cases and the components and hours related thereto to ensure they have been entered into the data system correctly. The meetings will take place quarterly, within five days after the participation hours entry deadlines, and will be documented accordingly.

SPECIAL TESTS AND PROVISIONS – INCOME ELIGIBILITY AND VERIFICATION SYSTEM Department of Health & Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 The Division of Family Support within the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), will send the current desk guides to all WV WORKS (TANF) staff, which includes the Data Exchange desk guide and the Viewing Data Exchanges by Exchange Type desk guide. The BFA Division of Family Support will also work with the BFA Division of Professional Development to create a blackboard course for supervisors and community service managers [who supervise WV WORKS (TANF) staff] to assist the supervisors and management in identifying deficiencies regarding the IEVS system.

SPECIAL TESTS AND PROVISIONS – PENALTY FOR REFUSAL TO WORK Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 The TANF policy staff within the West Virginia Department of Health and Human Resources, Bureau for Family Assistance, will work with Optum, the State’s eligibility system vendor, and the Recipient Automated Payment and Information Data System (RAPIDS) team to ensure that the criteria for the population for penalty for refusal to work are interpreted and applied correctly. Policy staff will also conduct monthly reviews of a random sample of cases to which the penalty for refusal to work is applicable in order to ensure that it is being applied appropriately.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE Department of Health & Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 In August of 2023, the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), Division of Professional Development, released a mandatory Blackboard course on Sanctions (Course ID: BFA-ITT-WV-400-2023). All staff completed the training by September 21, 2023. The BFA will repeat this mandatory training on an annual basis for all staff that have the capability to impose, approve, or remove a sanction. Reminders and desk guides will also continue to be distributed to field staff. The BFA Policy Unit will also continue its monthly reviews of RAPIDS Management reports regarding 3rd level sanctions that are being sent to the unit for review and approval.

MAINTENANCE OF EFFORT Department of Education (DOE) Assistance Listing Number 84.425, COVID-19 84.425 The Maintenance of Effort (MOE) calculation is in process. A waiver was requested and approved for the FY 2023 MOE data. The MOE will be completed by March 15, 2024.

ALLOWABILITY West Liberty University (WLU) Assistance Listing Number COVID-19 84.425F, 84.425M WLU’s CFO and Controller will have the Student Accounts Manager print and save documentation from the Banner System as evidence of supporting future calculations. WLU’s CFO and Controller will also review all invoices for proper approvals before payments are made and changed to HEERF or any other future programs that arise will be dealt with accordingly.

CASH MANAGEMENT Bluefield State University and West Virginia State University Assistance Listing Number 84.425J Bluefield State University (BSU) response Effective June 2024, BSU will draw down funds on appropriate expenditures that have already been disbursed to avoid any cash management violations. West Virginia State University (WVSU) response Currently all funds have been disbursed for HEERF awards P425E201113, P425F201736, and P425J200056. WVSU will reconcile the SEFA receipts and disbursements to internal data to locate the discrepancy and make the necessary corrections. Further, WVSU will review and update internal controls related to cash management rules to ensure compliance for drawdowns and disbursements.

REPORTING Department of Education (DOE) Assistance Listing Number COVID-19 84.425D, 84.425R 84.425U, 84.425V Effective February 2024, the DOE plans to continue to enforce the existing policies and procedures in place along with ensuring all required documentation is retained for review. The DOE plans to review the ESSER Reporting Workbook by testing several indicator values i.e. expenditure amounts, demographic data, etc. There will be an approval process put in place once the Local Education Agency (LEA) submits the reports to the state. This approval process will include reviewing the edit checks with the LEA prior to final certification of data. Certification data will include an email from the LEA approving the final copy of the ESSER Reporting Workbook.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – ENROLLMENT REPORTING Bluefield State University, Blueridge Community and Technical College, Concord University, Fairmont State University, Marshall University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia State University, West Virginia University, and West Virginia University at Parkersburg Assistance Listing Number 84.063, 84.268 Bluefield State University (BSU) response Effective February 2024, BSU will review the final enrollment report and approvals will be signed off to submit the report to NSC, the third party will consistently retain a copy within our institution. BSU will retain the record count reconciliation between the final enrollment report, text file, and the number of files received by the NSC, including documentation on how any rejected records were addressed. BSU will retain the details of the validation of the student’s information included in the report for accuracy. BSU will consistently retain the NSC automated emails used as a quality checklist regarding due dates, and receipt of the text files by the NSC. The availability and completion of the Error Resolution Report, as well as the confirmation of certification and processing by the NSC report, will all be retained. Blueridge Community and Technical College (BRCTC) response BRCTC asserts that the Enrollment Reporting process is accurate and reviewed in a timely manner; BRCTC further asserts that the emails from the National Student Clearinghouse are reviewed. As a result of this finding, BRCTC will expand its internal control to include documentation of reviews internally and externally with the NSC. This update to the internal control process was implemented in February 2024. Concord University (CU) response Effective February 2024, the internal controls at CU over the review and approval of the enrollment report sent to the National Student Clearinghouse (NSC) have been updated to include the following control measures in addition to the current controls on file: 1. CU has contacted NSC to begin generating the email response for the receipt of the .txt file when submitting it to the NSC FTP portal. This email notification will be kept on file with the other report documentation. 2. CU has implemented a new checklist sheet to accompany the report and its documentation to provide a clear and organized outline of required documents and to ensure these requirements are provided. This sheet will be part of the Spot Check Letter that is included in the current control method and signed off on by two members of the Registrar’s Office staff. 3. CU has also included in this new checklist a space to document the number of student files submitted to NSC and the number of files submitted to NSLDS as noted by NSC. The printout of this notation provided by NSC will also serve as documentation attached to the report. Fairmont State University (FSU) response Effective February 2024, FSU will retain a screen shot of the record count received by the NSC and will document any rejected records and what the plan is to address the rejected records. FSU will review a portion of the enrollment records being submitted before the submission is uploaded to NSC. This review will include detailed documentation, for a select few, of how we validated the student’s enrollment status. FSU will keep a spreadsheet of the students that are validated and the Banner screens that are used to do so.   Marshall University (MU) response Effective February 2024, MU will document that a record count reconciliation has been completed between the enrollment submission file and the number of files received by the NSC. MU will document and retain how any rejected records were addressed. MU will also document and retain records of the spot check validation for accuracy of student information included in the enrollment submission files. Mountwest Community and Technical College (MCTC) response Effective February 2024, a record count reconciliation between the final enrollment report and the number of files received by the National Student Clearinghouse (NSC) will be completed. MCTC will have the NSC query historical data and have it provided in Excel format. This will be a new source of data that will be collected and retained. This file will be generated after every rejection error report that is returned to the NSC. Each file will be saved, and a copy will be sent to the Registrar’s Office. Transmission history can also be saved by table, that can be exported to Excel. These files will also be saved, and a copy sent to the Registrar’s Office. For validation of student information, MCTC will being the process to collect data for the NSC submission first begin in audit mode. This will allow for review of the data to make any corrections that appear in the first stage of the report. Next, a second row of audits processed by the Associate Registrar will be conducted and confirm the data integrity. After this is complete, a copy of the final submission will be sent to the Registrar for final review and authorization. When approval is returned to the Associate Registrar, the data will be uploaded to the NSC. New River Community and Technical College (NRCTC) response Effective August 2024, the Registrar's office will run a random selection of 20 students from NSLDS to ensure students are correct in the clearinghouse, which will be done at least 50 days out from the time students were initially reported. The Registrar’s office will keep documentation of the sampled students. The Registrar’s office will keep records of how many files were accepted and how many were rejected. The Registrar’s office will provide documentation of validation of student information included in the enrollment report and retain emails by providing a file specially for NSC enrollment reporting emails received and sent regarding enrollment reporting. Emails to be retained are error resolution and confirmation of certification and processing by the NSC. The Registrar’s office will also create a checklist to follow and use as documentation to ensure all steps throughout the process are completed and checked off the list. Pierpont Community and Technical College (PCTC) response Effective February 2024, PCTC will complete the review of the file before it is submitted, not after it’s submitted. The Associate Registrar will pull the report prior to the due date to give those in the review process ample time to review the files before the Associate Registrar submits the document to the NSC. PCTC will keep track of the due date of submission, the date the text file was sent to the NSC, the date the error resolution report was received, the date it was sent back, and the date the report was certified by the NSC. A new tab in the worksheet in Teams has been created that will be completed each time an enrollment verification is submitted to the NSC. PCTC will note the actual enrollment count as of the time of the NSC submission, the enrollment count on the TXT file, the number of files received by the NSC, and the number of rejected files. This is to verify that all of the files intended to be submitted to the NSC were actually received by the NSC and processed. This information will be kept on each spreadsheet used to verify the information sent to the NSC. Shepherd University (SU) response Effective February 2024, SU will add a checklist to the existing reporting and retention structure that had already been established for Clearinghouse data transmission. The checklist will be completed with each transmission, organizing data retention efforts to ensure inclusion of the additional elements required.   West Liberty University (WLU) response To comply with internal control over the review and approval of the enrollment reporting to NSC, WLU will enhance their policies and procedures. The update of these policies and procedures will be effective February 2024 and carry forward into future academic years. WLU will ensure that enrollment reporting policies and procedures are compliant with the US DOE standards and retain evidence of the internal controls. Currently, WLU is reorganizing the processing of enrollment reporting from our IT System Administrator to our Enrollment Services Coordinator. This employee will add to the current policy a process by which a record count reconciliation will happen between the final enrollment report text file and the number of files received by NSC. There will also be documentation kept showing how many rejected records were addressed with each report. Proper documentation will also kept of a final review and approval signoff to submit the enrollment report to NSC. Lastly, WLU will create an email specific to enrollment reporting where all communication from NSC will be stored for auditing and record keeping purposes. West Virginia Northern Community College (WVNCC) response Effective February 2024, the enrollment reporting to the Clearinghouse (NSC) is being moved from the Registrar/Records office to the Institutional Research (PIER office). All reports including determination of reporting intervals per Clearinghouse and SFA guidelines, will be scheduled by the IR office with the Clearinghouse. The following items will be retained to match internal controls for each file sent to the Clearinghouse: 1) Retain internal emails or approval document regarding review and approval from two persons for file prior to sending to NSC 2) Retain verification of count of student record in file matching student enrollment at that time 3) Retain verification of record count with records received by NSC 4) Retain a spot check of students (approx. 8-10) from the file which were tested for accuracy including printout of where this was matched (usually SFAREGS time status page is printed) 5) Retain NSC Error Report for each file prior to resolution and document of resolution 6) Retain reminder email from NSC that the submission file is due 7) Retain initial txt file receipt email from NSC 8) Retain NSC posted error resolution report notification email 9) Retain NSC Completed Error Resolution report notification email 10) Retain NSC final processing email The following information for each file will also need maintained (this information is usually obtained from the NSC reporting page under the enrollment reporting link for approximately an 18 month time frame, header records on the files also show file generation date and term date information for the students reported). 1) Scheduled transmission date 2) File certification date 3) NSC received date 4) NSC processed date 5) Academic term the file is sent for 6) Submission type of the file (first of term, subsequent of term, graduate only, etc.) West Virginia State University (WVSU) response WVSU utilizes the National Student Clearinghouse (NSC) to update student’s enrollment and its effects on student’s direct loan and Pell statuses. Thorough edit checks of student data for each semester will be produced by IT on a regular basis. The Office of the Registrar, in coordination with Admissions, Dual Enrollment, and other contributors of student data, will make sure these errors are corrected. Special focus will be placed on resolving these errors before each enrollment file is produced. (initial data integrity, first check). On or around the 25th of each month, IT will produce the NSC enrollment file. Each time the file is produced, the file will be sent to the Registrar for review to ensure accuracy of the data being pulled from Banner. Registrar sends approval for upload to NSC. Emails from NSC, IT, and files with student checks to be retained. (process integrity, second check) The file will be uploaded to the NSC by IT, ensuring NSC received the appropriate number of records. The data will then be reviewed and any discrepancies in the data, when compared with past data, will be resolved in a timely manner. The NSC error report will be reviewed and any errors corrected. The NSC process makes sure these errors are resolved before the data is reported to the NSLDS, it is the responsibility of the Registrar to make sure these are resolved with accurate data. Emails from NSC, and screenshots of errors will be retained. (data integrity, third check) After resolution of errors, the NSC will perform a final review of data before sending to the NSLDS. This will be reported on the NSLDS Reporting tab of the Enrollment Reporting screen in the NSC website. If data is satisfactory, the submission will be marked with “Congrats. No Errors!” by the originator clearinghouse. The NSC sends emails whenever these items are updated. It is the responsibility of the Registrar to review and resolve any errors in a timely manner. Emails from NSC and screenshot of NSLDS reporting dashboard to be retained. (data integrity, fourth check) The enrollment data is then submitted to the NSLDS. After NSLDS reviews the data, any errors will be reported back through the NSC in the same manner as NSC errors. Resolution of these errors is of special importance and will be given top priority. The NSC sends emails whenever these items are updated. It is the responsibility of the registrar to review and resolve any errors in a timely manner. Emails from NSC and any error documentation to be retained. (data integrity, fifth check). These policies and procedures will be implemented in August 2024. West Virginia University (WVU) response WVU’s Registrar’s office reviews rejected records and takes appropriate action to clear the rejections. Many of these rejections require additional information from students, therefore resolution is based on student discretion in providing documentation. Effective February 2024, WVU will ensure that documentation of the submission record count and rejection follow up is maintained. West Virginia University at Parkersburg (WVU-P) response Effective February 2024, WVU-P will reconcile the record count of enrollment records processed by taking the following actions: 1. Highlighting the record count at the end of the Banner-generated enrollment report file as part of the spot-checking review process. 2. Screenshotting the number of files received by NSC once they acknowledge that the file has been received. 3. Retaining documentation to show that if for some reason the file count does not match, research was done to locate the reason for the discrepancy, and the discrepancy was either resolved or WVU-P is able to document why it could not be resolved. Records and Financial Aid are working together now to develop procedures to properly document the error resolution process. WVU-P will have this process in place by April 2024, in time for the new process to be fully implemented beginning with the Summer 2024 term. WVU-P will retain all documentation, including all emails sent by NSC throughout each enrollment reporting process, within a folder in a secure drive. The name of the folder will be the date that the enrollment report was sent to NSC.

INTERNAL CONTROLS OVER FINANCIAL REPORTING Pierpont Community and Technical College (PCTC) Assistance Listing Number 84.063, 84.268 Beginning October 2022, PCTC has performed the updated monthly reconciliation process that was originally to take place beginning July 1, 2022. Due to the loss of the Information Systems Specialist (ISS), PCTC failed to begin on the intended date. The DLSAS reports from COD are downloaded by the 10th of each month, as before, by the ISS. The reports are provided to the Assistant Director of Financial Aid (Asst.) and then reconciled to both Banner paid and Common Origination and Disbursement (COD). The Asst. takes screen captures of both Banner and COD for a monthly reconciliation of the Federal Pell Grant and DL programs. Screen captures are printed, and comparisons are made by the Asst. All necessary adjustments are performed to student accounts by the Asst. or Director of Financial Aid (Director) until balanced. Reports verifying reconciliation are then completed, initialed, and saved by the Asst. and then reviewed and signed by the Director for completion and accuracy. PCTC will maintain the documentation of the DLSAS statements each month and the reconciliation report along with evidence of said review. The completed reconciliation information files are in our shared drive. This process has been in place, ongoing and has been effectively followed since October 2022.

SPECIAL TESTS AND PROVISIONS – PERKINS LOAN RECORDKEEPING AND RECORD RETENTION Concord University, Marshall University, Shepherd University, West Liberty University, West Virginia School of Osteopathic Medicine, and West Virginia University Assistance Listing Number 84.038 Concord University (CU) response Due to changes in personnel, CU did not follow this regulation. CU will review ECSI’s report, specifically looking for instances of noncompliance and internal control breaches. This will be documented annually and will be effective August 2024. Marshall University (MU) response MU has regularly monitored the services provided by ECSI for accuracy and completeness throughout a 30-year relationship without significant issues. Additionally, during fiscal year 2023, MU worked closely with ECSI on the Department of Education’s government assignment of 837 Perkins loans going back as far as 1978. This process clearly involved several compliance requirements of this program and was completed with no compliance problems encountered. MU will document the review of ECSI’s annual audit going forward. Shepherd University (SU) response By April 2024, SU will develop and maintain a checklist that will be periodically reviewed and signed off related to this finding, specifically: Annually, SU will pull SOC reports along with any compliance audits for review of findings or areas of interest and will assess and determine any factors that may need further investigation or mitigation from SU. West Liberty University (WLU) response Effective February 2024, WLU’s CFO, Controller and Student Accounts Manager together will meet and review the most recent Title IV compliance audit. The meeting will be set using emails. Minutes and notes will be taken regarding items reviewed and conclusions reached and will retain documentation and all other relevant documentation will be retained. Any issues that arise will be dealt with accordingly. West Virginia School of Osteopathic Medicine (WVSOM) response Adequate due diligence was not performed to ensure that the third-party services, Educational Computer Systems, Inc. (ECSI) were following the requirements for the functions that they are performing for WVSOM. The third-party services Title IV compliance audit was obtained but was not signed off on as reviewed. A new procedure will be written with the following steps: 1) Accountant Senior in the Cashiers office will request the “Examination Report on Compliance with Title IV Programs” and the System and Organization Controls for Service Organizations: Controls Relevant to Security (SOC 2). The Accountant Senior will review the reports for compliance and sign off. 2) Accountant Senior will forward the reports to the Director of Finance. The reports will be reviewed for compliance and signed. 3) The Director of Finance will forward it to the Director of Accounting for submission with the audit. The new procedure will provide two reviews and sign-offs and are effective January 2024. West Virginia University (WVU) response WVU’s Student Financials Services (SFS) department receives the 3rd Party Servicer compliance reports annually and reviews these reports once received. WVU will maintain detailed meeting minutes to document the review of 3rd Party Servicer reports moving forward. The review of the report available for fiscal year 2024 was conducted on December 19, 2023 between members of Compliance and Training (CT) and Revenue Management (RM) teams. In this meeting, the following 3rd Party Servicer reports were discussed; report on controls at a service organization relevant to user entities’ internal control over financial reporting, SOC 2 report and examination report on compliance with Title IV programs. It was noted there were no findings in the reports. Regarding MPN’s, deferments and cancellations for Perkins loans, members of SFS are pursuing several areas of remediation to resolve the fiscal year 2023 finding. SFS personnel will review all open Perkins loans and inventory files to consolidate into one central location. All files will be reviewed for paper MPN’s, deferment and cancellations request and an inventory list will be attached to a central location for all Perkins records. Additionally, WVU is in the process of exploring liquidation of all Perkins loans currently held by the school. While SFS is committed to resolving the current issues regarding Perkins Recordkeeping, it should be noted that this commitment must be balanced with staff’s requirements to process student aid for current students that has been delayed numerous times due to FAFSA simplification delays.

SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE Bluefield State University, Blueridge Community & Technical College, Concord University, Mountwest Community and Technical College, Shepherd University, West Virginia Northern Community College, and West Virginia University at Parkersburg Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364 Bluefield State University (BSU) response BSU will submit the URL of their contract with their third-party servicer and cost information to the U.S. Department of Education for their publication in the Cash Management Contracts Database by Friday, February 23, 2024. BSU will also implement a detailed due diligence review over the fees assessed by the third-party servicer of Title IV credit balances. Blueridge Community & Technical College (BRCTC) response We acknowledge that BRCTC did not have internal controls in place to review the contract with our third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. By February 2024, documents will be requested and an annual due diligence review will be performed and documented of the third-party servicer contract and compliance audit as well as review of fees assessed by the third-party servicer. Concord University (CU) response CU agrees with this finding and due to changes in personnel, this regulation was not followed. CU will review and document the review of the Cash Management Database annually to ensure the link is posted. CU will review and document the review of other financial institutions charges compared against BankMobile’s fees annually. CU will annually review the servicer’s SOC report. CU will review BankMobile’s report, specifically looking for instances of noncompliance and internal control breaches. This will be documented annually. Mountwest Community and Technical College (MCTC) response Effective February 2024, MCTC will implement a review process to be conducted on an annual or monthly basis, as applicable, of all accounts opened with the Servicer during the specified timeframe. The "Activation & Preferences Report" available to management through the Servicers Administrator portal will be used to provide the data for review by management. The review process will consist of the following: • A request made of the servicer to provide a report of accounts opened with date/time stamp of consent to opening. Frequency: Monthly • Review of "Activation & Preferences Report" validated against Servicer "Accounts Opened" report. Frequency: Monthly • Generate a follow-up email to applicable students confirming the opening of the Servicer Account which will include an attachment of the Servicer "Terms and Conditions" and "Fee Schedules". Frequency: Monthly • Review the Servicers' Client Contract and Profile site for accuracy and completeness of information. Frequency: Annually • Review the Servicers' System and Organization Controls (SOC) and Compliance audits. Frequency: Annually • Management will incorporate as part of its "Due Diligence and Attestation" copies of comparable banking institution fee schedules that are date/time stamped to serve as evidence of review. Shepherd University (SU) response By April 2024, SU will develop and maintain a checklist that will be periodically reviewed and signed off related to this finding, specifically: Annually, SU will be submitting the URL to the Department of Education related to the contracts between SU and BankMobile, reviewing compliance audits and SOC reports for BankMobile, recording areas of risk, and noting ways to mitigate the potential risk moving forward. West Virginia Northern Community College (WVNCC) response Beginning June 2024, during the annual review meeting between WVNCC and BankMobile (the servicer that delivers Title IV credit balances to students), WVNCC will obtain a copy of the BankMobile compliance audit. This will be kept on file within the Business Office for reference if needed. In addition, the budget committee will review annual the fees charged by BankMobile and attempt to compare them to other providers of similar services. West Virginia University at Parkersburg (WVU-P) response WVU-P has submitted a URL to the US Department of Education of our contract and cost information with our third-party servicer. This submission should correct this portion of the finding although it was done after the end of the fiscal year under audit but serves to correct the finding in subsequent periods. WVU-P will ensure compliance with the remaining items noted by creating a written internal control policy requiring the following: • Verification of the required submission of the third-party contract with the Department of Education. • Documentation of a due diligence review of the fees assessed by the third-party servicer. • Obtain a copy of the annual compliance examination of the Title IV Programs. The 2022 report dated June 29, 2023, was received and reviewed by us for compliance with eligibility, systems, and internal controls, disbursements, Return of Title IV funds, and administrative requirements. • Obtain a list of students whose refunds were disbursed by the third-party vendor and cross-reference it with a list of the students processed and sent to the third-party vendor by WVU-P. For those students who elected to open a checking account, WVU-P will review supporting documentation to indicate that the student gave proper consent. These policies and procedures will be effective February 2024.

INTERNAL CONTROLS OVER CASH MANAGEMENT Bluefield State University, Fairmont State University, Mountwest Community and Technical College, and West Virginia Northern Community College Assistance Listing Number 84.007, 84.033, 84.063, 84.268 Bluefield State University (BSU) response By June 2024, BSU will ensure that if a drawdown approval occurs in person with the Director of Financial Aid, the approval signature will be obtained during the meeting. Fairmont State University (FSU) response Effective February 2023, FSU has added a second level review control and it was put into place to address the inadequate internal controls identified. Mountwest Community and Technical College (MCTC) response Effective February 2024, MCTC will make the appropriate effort to obtain "inked" approvals prior to initiating drawdown requests through G5/G6 to serve as proof of double verification. However, MCTC does note that single reviews are completed prior to any drawdown request as evident of the relationship between the requestor and initiator of the drawdown in G5/G6 to ensure accuracy and completeness. West Virginia Northern Community College (WVNCC) response Beginning April 1st, 2024, WVNCC will establish an electronic repository specifically designated for the retention of evidence that a review and approval of all drawdown requests occur. The repository will be reviewed internally on a quarterly basis by the CFO and any anomalies will immediately be brought to the attention of staff and resolved.

SPECIAL TESTS AND PROVISIONS – RETURN OF TITLE IV FUNDS Blueridge Community and Technical College, Bluefield State University, Fairmont State University, Mountwest Community & Technical College, Pierpont Community and Technical College, and West Virginia Northern Community College Assistance Listing Number 84.007, 84.033, 84.063, 84.268 Blueridge Community and Technical College (BRCTC) response BRCTC maintains a review procedure implemented in December 2023 over the entire Return of Title IV process; after this review, BRCTC will add a secondary review and sign off of those students whose aid does not have to be returned due to being outside the return window. Bluefield State University (BSU) response Effective February 2024, internal controls are in place to perform the Return of Title IV withdrawal and calculation ensuring records comply and that Return of Title IV Refunds are within the required time frame of 45 days. Controls include the review of “Permit to Withdraw” forms to ensure they are completed with all signatures of offices involved and the sign off of Return of Title IV calculations. All reviews will occur within the time frame of 45 days by the Financial Aid Director along with Business Office and Accounting. On February 8, 2024, the Director of Financial Aid spoke with the Registrar and the FA Counselors in separate meetings regarding the late submission of withdrawal forms and performing the Return of Title IV calculations. The Registrar understands they must submit the completed withdrawal forms to the Financial Aid office the same day they are completed by her office. When the forms are received by Financial Aid, a Return of Title IV will be completed within the same week of receipt and sent to the Business Office, if a Return of Title IV Aid is required. The Business Office will then review the calculations and perform the necessary repayment of Title IV Aid to the Department of Ed, utilizing the refund process through G5 within the required 45-day timeline. All adjustments to the students account will be made with in the same time frame.   Fairmont State University (FSU) response FSU has been identified as an institution that does not have adequate internal controls in place over the return of Title IV funds to prevent noncompliance. FSU has implemented the following Return of Title IV controls. Step by Step-Initial Review: 1. FSU (Information Systems Technician) performs all Return of Title IV calculations through FAA Access to CPS on-line. 2. In Banner, the funds are unapplied to the student’s account according to the Return of Title IV calculation from FAA Access. 3. Return completed Title IV Returns spreadsheet to the Accounting Assistant II that sent them to you with a ‘y’ in the column marked Aid Returned and the dollar amounts of any aid that was returned, and if a letter was mailed to the student and the dollar amount the student is responsible for paying. 4. In Banner comments are added to RHACOMM which include the date of withdraw(s), the type of funds that were returned and the amount of each fund that was returned. 5. If the student has to return Pell Grant (section 10 of the Title IV worksheet)- must send a letter then student has 45 days. Follow up according to federal regulations. 6. If there is a post withdraw disbursement, a letter is sent to the student. Follow up according to federal regulations. 7. FSU only completes the Return of Title IV calculation for students who have withdrawn outside of the withdraw window upon request. Secondary Review: FSU (Financial Aid Counselor) performs a second review of the Return of Title IV calculations through FAA Access to CPA on-line. This individual verified the data for the calculation has been entered correctly, the adjustments to the Banner system are accurate, and signs off on the Return to Title IV calculation worksheet. FSU has the following controls in place: Who performs the control? Finance Program Manager and Information Systems Technician. What are the reviewer’s qualifications? 3+ years’ experience. When or how often is the control performed? Weekly. What does the reviewer evaluate? Verifies the data for the calculation has been entered correctly, and the adjustments to the Banner system are accurate. What precision is encompassed? (How granular is the review? What are the criteria for investigation? What is the objective of the review?) By student. Additional investigation is needed when reviewer cannot produce the same results from the Return to Title IV form. Verify the accuracy of the calculation and to ensure the data being used for recalculation is accurate. What actions are taken or result? Redoing the recalculation worksheet after verifying the data from the system. Mountwest Career & Technical College (MCTC) response MCTC maintains email communication regarding the completion of Unofficial Return of Title IV Withdrawal Calculations each semester indicating timeliness of calculations. Sampling is done to check calculations and that will be made available in future audits, effective February 2024. MCTC will maintain the SFRWDRL reports for all withdrawals (both official and unofficial) run in “update” mode with notations to indicate timeliness, and to indicate that touch points along the calculation have been reviewed such as checking start and end dates in STVTERM and break days in SOATBRK as well as percentage calculated comparing Banner percentages to manually calculated percentages. Sampling of calculations will be compared to manual calculations using USDE supplied manual Return to Title IV worksheets to ensure that the Banner calculation of returns aligns with the manual calculation. Pierpont Community and Technical College (PCTC) response During the prior year’s audit, it was discovered that the prior processer was not completing the Return of Title IV properly. The processer left employment and Return of Title IV procedures were taught to the new processer and Asst. Director. This took place in November 2022. Unfortunately, the processer also did not complete two Return to Title IV before leaving and failed to communicate this information. It was not discovered until after the 45-day window for completion. Upon discovery, the two Return of Title IV were completed and PCTC have since followed the process and have had no additional similar findings. The process is functioning properly which will continue to be followed going forward. West Virginia Northern Community College (WVNCC) response Effective February 2024, for Return to Title IV review and processing in addition to the policies and procedures manual, these additional steps will be taken to maintain internal controls including maintaining email communication regarding the completion of Return of Title IV withdrawal calculations each semester indicating timeliness of calculations. Sampling will be done to check calculations and will be made available in future audits. WVNCC will continue to maintain in the Registrar’s office, the SFRWDRL reports for all withdrawals (both official and unofficial) run in “Update” mode with notations to indicate timeliness, and to indicate the calculations have been reviewed such as checking start and end dates in STVTERM and break days in SOATBRK as well as percentage calculated comparing Banner percentages to manually calculated percentages. The Financial Aid office will maintain a sampling of calculations that are compared to manual calculations using US Dept of Ed supplied manual Return of Title IV Worksheets to ensure that the Banner calculation of returns aligns with the manual calculation. Additionally for the Fall 2024 semester, a manual sampling of calculations will be reviewed to confirm that the calculations for the current award year are matching.

BANNER INFORMATION TECHNOLOGY GENERAL CONTROLS Blue Ridge Community and Technical College, Bluefield State University, Concord University, Fairmont State University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia State University, and West Virginia University at Parkersburg Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364 Effective February 2024, all West Virginia Higher Education institutions will ensure any new, modified or terminated access is defined and maintained to document the requestor, access rights modifications requested and approvals. Segregation of duties will be incorporated for the approval of any request. Processes for communication of terminated employees will be documented to ensure timely removal for any Banner user. Periodically, a review of user access will be performed to ensure access rights are consistent with current employees and job responsibilities. Documentation will be maintained for evidence of this review process. All Banner password settings will be configured to enhance overall security and privileged access will be granted to administrators by a unique identifier to ensure there will be no sharing of default accounts. Also, a formal documented change management process will be implemented to show authorization, testing and production approvals for any patches and releases of Banner application and supporting infrastructure to ensure the changes were properly authorized.