Corrective Action Plans

Finding 2022-017 MDHHS - FFATA Reporting Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS has submitted all outstanding FFATA reports. MDHHS provided additional instruction to the individuals responsible for providing account code and funding source information related to FFATA submissions. Anticipated Completion Date Completed Responsible Individual(s) Jeanette Hensler, MDHHS Chad Dzingleski, MDHHS

Finding 2022-062 Unemployment Insurance, ALN 17.225 See Department of Labor and Economic Opportunity, Unemployment Insurance Agency, Unemployment Compensation Fund, Report on Expenditure of Federal Awards, Year Ended September 30, 2022, Corrective Action Plan, Finding 2022-001.

2022-002 Tenant Files: Eligibility Program: U.S. Department of HUD: Section 8 Housing Choice Vouchers (CFDA 14.871) Type of Finding: Material Weakness in Internal Control and Material Noncompliance This is a repeat finding of 2021-001 from September 30, 2021 (Other Matter and Significant Deficiency in Internal Control over Compliance). Originally reported as finding 2019-001 from September 30, 2019 (Material Weakness in Internal Control and Material Noncompliance) Statement of Condition: Out of a total tenant population of approximately 1,114 vouchers, 25 files were selected for testing. Exceptions were noted as follows: ? 1 tenant file had the following errors: o The tenant?s annual recertification application is missing. o The tenant?s signed 9886 form is missing. o The wrong utility allowance schedule was used to calculate the tenants? utility allowance. Correcting this error would cause the HAP rent to increase by $9. o The tenant?s signed HAP contract is missing. ? 1 tenant file had the following errors: o The name and social security number for one of the tenant?s dependents was reported incorrectly on the 50058 form. o The tenant?s utility allowance was calculated correctly but was reported incorrectly on the 50058 form. Correcting this error would cause the HAP rent to increase by $56. ? 1 tenant file had the following errors: o The lease agreement was not signed by the tenant. o The tenant?s assets was reported in error. Correcting this error would cause the rent to increase by $8. ? 2 tenant files where the tenants? income was miscalculated. Correcting the errors would cause the HAP rent for one of tenant files to decrease by $12 and the other to increase by $181. ? 2 tenant files where the wrong utility allowance schedule was used to calculate the tenants? utility allowance. Correcting these errors would cause the HAP rent for one of the tenant files to decrease by $13 and the other to increase by $14. ? 1 tenant file where the family?s assets was reported in error. Correcting the errors had no effect on the HAP rent. ? 1 tenant file where a member of the household moved but was reported on the 50058 form. ? 1 tenant file where the tenant?s signed HAP contract is missing. ? 1 tenant file where the EIV report was never generated or was misplaced. In addition to the above, we noted the following during our new admissions testing (out of a total of 118 new admission, 18 files were selected for testing.): ? 1 tenant file where the member of the household did not checkmark the checkbox on the 214-affidavit form indicating that they are a U.S. Citizen or permanent resident. However, the member?s birth certificate confirms that the member is a U.S. Citizen. ? 1 tenant file where the tenant?s signed 214-affidavit is missing. However, the member?s birth certificate confirms that the member is a U.S. Citizen. Recommendation: The Authority should correct the deficiencies noted in the tested files and utilize an ongoing quality control review process on the entire tenant population to ensure proper compliance with the requirements related to tenant eligibility. Ongoing staff training and timely management reviews should be utilized to ensure staff is aware of acceptable procedures. In addition, the Authority should review staffing levels, skill sets and case load. Action Taken: The Authority concurs with this finding. The Authority has an established review, oversight and training process and will continue to improve its review, oversight, and training process to ensure proper procedures are being followed. All audit findings of the files tested will have been corrected. The Authority has implemented a quality control system so that every file receives a quality review for appropriate third-party verification and upfront income and assistance is determined. The agency has created a Family Worksheet and an HCV Computation Worksheet to help staff identify errors in calculations and to check for accuracy prior to completing Annual Reexaminations and Interim Recertifications. The agency has changed its filing system to enable staff to thoroughly review all forms prior to admission and during regular recertification and interim adjustment processing. The agency created an Other Adult packet to ensure 214 forms and other pertinent are completed for all adult household members. The HCV Counselor caseloads have been distributed equitably amongst Counselors to promote efficiency and accuracy while working on each HCV participant?s file. The Counselor?s caseload is divided alphabetically and assigned by multifamily developments to track and monitor counselors? strength and weaknesses, and to determine if additional training and/or monitoring is needed. Internal file reviews are being completed and management will continue to conduct a 10% review for each Counselor?s processing of annual recertifications. This percentage may increase if work product indicates a need for more stringent review. To further ensure compliance and accuracy, the HCV Program Manager will review at least 1 out of every 5 intake files. The Authority has had a significant turnover in the HCV department over the past 24 months. All HCV staff will attend Voucher Specialist training and Nan McKay HCV Rental Calculation Certification training. Effective Date: June 20, 2023 Contact Information Gwendolyn B. Dawson, CEO Ocala Housing Authority 1629 NW 4th Street Ocala, Florida 34475 (352) 369-2636

Finding 2022-012 U.S. Department of Treasury AL No. 21.019 Coronavirus Relief Fund (CARES) Material Weakness over Subrecipient Monitoring Repeat Finding: Yes Auditee?s Corrective Action Plan: Per the auditor?s recommendation, the agency will seek training on the Uniform Guidance requirements related to sub-recipient monitoring. The agency will ensure that there is a written plan in place for how to monitor the sub-recipients that were awarded funds by the City from the CARES Act. Contact Person: Deputy Finance Director ? Bob Cenname Completion Date: December 2024

Finding 2022-001 Condition/Context The Center improperly calculated lost revenues as a result of improperly including contributions and improperly excluding contractual adjustments related to patient service revenues. This is not a statistically valid sample. Corrective Action Plan Corrective Action Planned: St. Joseph's Center will correct the lost revenues calculation in the Period 4 Submission due March 31, 2023. In order to ensure that St. Joseph's Center properly calculates lost revenues in the future, all lost revenue calculations and source documents will be prepared by the Accounting Manager and reviewed by the Chief Financial Officer. Name(s) of Contact Person(s) Responsible for Corrective Action: James Ceccoli, CFO Anticipated Completion Date: 3/31/2023

2022-003: Supporting Documentation Recommendation: We recommend the organization design controls to ensure an adequate review process is in place to review costs charged to grants are properly supported by documentation. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action planned in response to finding: We will better enforce a policy that expenses must be sufficiently supported by documentation before payment is made. Name(s) of the contact person(s) responsible for corrective action: Joseph Ferlo, President & CEO Planned completion date for corrective action plan: June 30, 2023

FINDING 2022-001 ? Material Weakness and Material Noncompliance ? Budget Variances / Allowable Costs Corrective Action Plan: Analyze actual expenditures monthly, review the budget to actual numbers monthly and use data from this review to prepare a more accurate final budget revision. Responsible Parties: Rod Livingston, Business Manager Anticipated complete date of June 30, 2023 Rod Livingston Business Manager

2022-002 Application of Sliding Fee Discounts Corrective action planned: The Center plans to: 1. Continue to provide frequent education and training for front-desk staff to assist in preparation and required completion of the sliding fee applications and proof of income forms. 2. Meet with front desk staff to identify and correct barriers to compliance with completion of sliding fee application and income verification and retention of those documents within the electronic record. 3. Develop workflow to identify when patients have exhausted their limited Medicaid dental benefits and would now qualify for sliding fee discount. Ensure sliding fee scale application and verification of income are completed prior to delivery of additional services. 4. Develop internal report to identify accounts with sliding fee scale identified with no end date recorded. For identified accounts, determine appropriate end date for sliding fee discount and enter it into the system. 5. Continue to do real time audits of front desk personnel to identify needs for additional training and to reinforce the process and appropriate documentation. 6. Institute a separate QA position for the purpose of review of patients with an identified sliding fee scale discount in place. Anticipated completion date: October 31, 2023 Contact person responsible for corrective action: Mary Sterhan, CEO

Compliance requirement ? Reporting Institutional Comments on Findings and Recommendations: 1. The institution does not concur with the auditor finding because the institution strictly followed and used the recommended HEERF methodology and reporting guidelines to prepare the quarterly and annual reports. Since the institution used the reimbursement method, the drawdown were the actual expenditures/costs incurred and requested for reimbursement. The HEERF reporting requirement does not make any indication nor reference to GAAP. The Institutional aid portion expenditures were supported by the proper invoice or check. The evidence was available to the auditors. 2. The institution concurs with the auditor finding. The institution inadvertently, did not include a line item from one of the quarterly reports. The period to make corrections was closed and we sent an e-mail to the department to amend this annual report. 3. The institution concurs with the auditor finding. The annual report contains detail statistical information that not necessarily is supported by our institutions data base and programs. As the ED expressed, this information was unique and challenging, and accordingly, the institution made some reasonable estimates and derivatives in the information provided. As you may notice in the referenced table by the auditor, the differences were minimal. 4. a. The institution concurs with the auditor finding on the difference in Item #5 of the quarterly report. The institution will accordingly amend the report. b. The institution does not concur with the auditor finding on the timely and accurate reporting in publicly posting the quarterly Student Aid Portion. The four quarterly reports were timely submitted with an e-mail to the HEERF reporting staff and timely posted in the institution web page as required by the HEERF reporting instructions. The reports were further reviewed by an officer of the Department of Education (ED). The ED expressed that this information may be unique and challenging to an audit, and indicated that for these public reporting requirements, the auditors may accept as evidence of compliance, contemporarily produced e-mails, webmaster logs, or other relevant documentation establishing good-faith indication that the institution posted the required information at approximately the timelines established by the public reporting requirements. Copy of the e-mails were available to the auditors as evidence of compliance. ED understands that this information may be unique and challenging to audit, particularly because auditors are asked to verify information posted on a webpage which may not be accessible during audit fieldwork. For these public reporting requirements, auditors may accept as evidence of compliance, contemporarily produced emails, webmaster logs, or other relevant documentation establishing a good-faith indication that the institution posted the required information at approximately the timelines established by the public reporting requirements (HEERF Grant Program Auditing Requirements, General Requirements and Information - All HEERF Grantees). 5. The institution does not concur with the auditor finding because the referenced payment was made in accordance with the Institution's fund distribution and the student financial needs, among other factors, at the time of the evaluation and distribution of the funds. The student financial circumstances may have change after the distribution and payments of the financial aid. Additionally, this is an immaterial amount as compare to the total amount of the funds distributed ant the quantity of students served (1 out of 460). Actions Taken or Planned: The institution understands that no further is needed or required.

1. The institution does not agree, nor concurs, with the auditors on this finding because the institution used the reimbursement payment method. This method was the preferred one when the non-federal entity, as our institution, cannot meet the requirements in 2 CFR, section 200.305(b)(1) for advance payment and the federal awarding agency sets a specific condition for use of the reimbursement. Title 2 of the CFR Part 200.305(b)(1), establish among others: "The non-Federal entity must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the non-Federal entity, and financial management systems that meet the standards for fund control and accountability as established in this part". Furthermore, 2 CFR Part 200.305(b)(3) states: "Reimbursement is the preferred method when the requirements in this paragraph (b) cannot be met, when the Federal awarding agency sets a specific condition per ? 200.208, or when the non-Federal entity requests payment by reimbursement. " Since our institution was not able to meet 2 CFR, section 200.305(b)(1), and the HEERF guidelines has specific condition on how to use the funds; we choose the reimbursement method in the execution of the funds. Our institution adopted all HEERF instructions and guidelines as their policies to comply with the HEERF requirements, in addition to the CFR's regulations. Below some of the guidelines, instructions ad FAQs we adopted followed" a. Higher Education Emergency Relief Fund III, Frequently Asked Questions, American Rescue Plan Act of 2021, Published May 11, 2021, Questions 7 and 11 updated May 24, 2021, Question 36 updated September 30, 2021 b. US Department of Education, Notice of Proposed Institutional Eligibility Criteria, February 25, 2021 c. Federal Register Notice of Interpretation (NOI), regarding Period of Allowable Expenses for Funds Administered under HEERF Program, March 22, 2021 d. HEERF Notice of Interpretation for Period of Allowable HEERF Expenses (March 22, 2021) e. HEERF Lost Revenue FAQs (March 19, 2021) f. HEERF Period of Allowable Expenses Grant Records Notice (March 19, 2021) g. HEERF Grant Program Auditing Requirements (March 8, 2021) h. CRRSAA HEERF II Section 314(a)(1) Frequently Asked Questions (Published January 14, 2021 and Updated: March 19, 2021) i. CRRSAA HEERF II Section 314(a)(2) Frequently Asked Questions (January 14, 2021) j. CRRSAA HEERF II Section 314(a)(4) Frequently Asked Questions (Published January 14, 2021 and Updated: March 19, 2021) k. HEERF I and HEERF II Comparison Fact Sheet (Published January 14, 2021 and Updated: March 19, 2021) 1. HEERF Lost Revenue FAQ's, Published March 19, 2021 m. HEERF II, Public and Private Nonprofit Institution (a)(2) Programs (CFDAs 84.425K), FAQ's, Published January 14, 2021 n. HEERF II, Proprietary Institution Grant Funds for Students (CFDA 84.425Q) ((a)(4) Program), FAQ's Published January 14, 2021, Updated March 19, 2021. o. HEERF II, Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F), FAQ's Published January 14, 2021, Updated March 19, 2021. p. CAREST Act HEERF Rollup FAQs (issued October 14, 2020 and revised November 20, 2020) q. CARES Act HEERF Round 3 FAQs (Issued October 14, 2020 and revised November 20, 2020) r. CARES Act HEERF Supplemental FAQs (Issued June 30, 2020 and revised September 08, 2020) s. CARES Act HEERF Student FAQ's (Issued May 15, 2020) t. CARES Act HEERF Institutional Portion under Section 18004(a)(1) and 18004(c) FAQ's, (Issued April 9, 2020) u. CARES Act HEERF Emergency Financial Aid Grants to Students under Section 18004(a)(1) and 18004(c) FAQ's, (Issued April 9, 2020) v. CARES Act HEERF Institutional Portion under Section 18004(a)(1) and 18004(c) FAQ's, Issued April 9, 2020 w. COVID-19 FAQ's for Title III, IV, V and VII Grantees, June 16, 2020 x. COVID-19 Letter to HEP Grantees on Flexibilities Available Under CARES Act Section 3518, July 1, 2020 2. The institution does not agree, nor concurs, with the auditors on this finding because, as we mention in number 1 above, the institution adopted and followed the federal award and HEERF guidelines in the execution of the funds. The HEER funds were provided during the special national emergency caused by COVID-19. The DOE and HEERF officials issued many written guidelines, instructions, and FAQ's (Frequently Asked Questions) documents, due to the nature and novel of the national emergency situation. The institution adopted, followed, and relied on the many referenced guidelines and exercise extreme judgment to ensure compliance with the federal requirements and use of the funds. The institution belief this referenced guidelines and instruction were very specific and sufficient to execute the use of the funds. All direct charges to federal awards were for allowable costs under the guidelines and instructions from the Department of Education. Some of the allowable costs were verified and validated by an officer of the Department of Education and reviewed by an independent consultant. 3. The institution concurs with the auditor finding. Actions Taken or Planned: The institution begins in addition to the adopted HEERF guidelines, instructions, and CFRs; to develop additional procurement policies and are in the process of completing those policies. The institution expects to have those completed by May 31, 2023.

Compliance requirement ? Special test and provisions - Return of Title IV Funds Institutional Comments on Findings and Recommendations: I. Compliance Requirements ? Applicable After a Student Begins Attendance: a. The institution agrees with the auditors on this finding in which there were two (2) cases where the auditors noted that the institution failed to determine that the students withdrew within 14 days after the student's last day of attendance. II. Compliance Requirements ? Applicable for a student who does not begin attendance: b. The Institution agrees with the auditors on this finding in which there was one (1) case were the student did not comply with the Incomplete course requirement and an unofficial withdrawal was not performed. Before the audit process was completed, the institution performed a R2T4 calculation and returned to the US Department of Education, the $439.00 associated with this finding. This process was evidenced to the auditors for their records. c. The Institution agrees with the auditors on this finding in which there was one (1) case were the student had stopped attending the enrolled courses without completing at least 60% of the payment period. Before the audit process was completed, the institution had returned to the US Department of Education, the $581.00 associated with this finding. This process was evidenced to the auditors for their records. d. The institution agrees with the auditors that in the cases mentioned in item b and c in that it failed to determine that the students withdrew within 14 days after the student's last day of attendance. e. The institution agrees with the auditors that in the cases mentioned in item b and c in that it failed to return Title IV funds after the 45 days' time frame. Actions Taken or Planned: The institution is aware of the importance to comply with Return of Title IV funds (R2T4) reporting requirements and deadlines. Also, the relation to students last day of attendance (date of withdrawal) vs date of school's determination that the students withdrew and the date of the return of any Title IV funds resulting from an R2T4 calculation. The issues as related to these findings were identified as ones being an oversight and lack in compliance with some of the academic processes as required by R2T4 and has already been discussed with the Academic Dean of the institution who in turn has revisited these matters with Faculty and administrative staff under her supervision including the Registrar. The already instituted task force that meets every Friday of each week to identify and review cases that could affect the R2T4 procedure and requirement has continued to review and evaluate information received from the faculty through the Academic Dean and from information the Registrar's office receives of students that are not attending classes in order to process all applicable withdrawals to assure that the return of Title IV funds procedures and the return of funds if any, are processed timely within the 14 days requirement of the student's last day of attendance and within the 45 days from the date that the institution determined that the student withdrew. Before the audit process was completed, the institution had returned to the US Department of Education, the $439.00 and $581.00 associated with this finding. This process was evidenced to the auditors for their records.

2022-004 NSLDS Enrollment Reporting Student Financial Aid Cluster ? Assistance Listing No. 84.268, 84.063, 84.007, 84.033 Auditors? Recommendation: The University must review their enrollment reporting policies and procedures to ensure accurate reporting. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The transition to new SIS will ensure that: 1. The student statuses within the system will update automatically based on changes in the student's schedule and enrollment. 2. The school will report the information from the SIS monthly to the National Student Clearinghouse for update to NSLDS to ensure timely and accurate updates to student statuses. Additional action taken: New procedures were created to follow-up on error files received from National Student Clearinghouse. These files will be reviewed by both the registrar?s office and the financial aid office within 10 days of receipt. This ensures multiple individuals know how to review and correct any data discrepancies to mitigate impact from staff turnover. Name(s) of the contact person(s) responsible for corrective action: Rusty Hassell, Chief Enrollment Officer; Stephen Waers, Chief Academic Officer, Rachal Wortham, Director of Financial Aid Quality and Compliance; Natalie Brown, Registrar Planned completion date for corrective action plan: Implementation complete April 2023. System transition complete August 2023

2022-002 Disbursement Date Reporting to COD Student Financial Aid Cluster ? Assistance Listing No. Various Auditors? Recommendation: The University must review their policies and procedures to ensure accurate reporting to COD.Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Implemented multistage review process to highlight differentials between COD and system disbursement date. Fiscal Year 2022 dates are accurate. Further, implementation of new SIS, Ellucian Colleague will correct the discrepancy issue due to automated functions that will align disbursement dates. Name(s) of the contact person(s) responsible for corrective action: Rusty Hassell, Chief Enrollment Officer; Rachal Wortham, Director of Financial Aid Quality and Compliance; Amanda Schmidt, Director of Student Accounts Planned completion date for corrective action plan: Fiscal year 2022 are corrected and accurate as of March 2023. System transcription complete August 2023.

FINDING 2022-004 (Auditor Assigned Reference Number) Contact Person Responsible for Corrective Action: Greg Hunt Contact Phone Number: (219) 362-7056 Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: LaPorte Community School Corporation will review the Education Stabilization Fund schedule of disbursements more closely prior to submission. Anticipated Completion Date: May 15, 2023

Finding 2022-018 U.S. Department of Health and Human Services AL No. 93.778 Medical Assistance Program (Medicaid; Title XIX) Material Weakness over Period of Performance Repeat Finding: No Auditee?s Corrective Action Plan: BCHD will implement controls to allow only costs within the period of performance to be charged to the correct grant period within the general ledger. BCHD will ensure that if there are any exceptions that allow for costs to be charged outside the period of performance, the proper supporting documents will be kept. Baltimore City's new financial system, Workday, allows for all supporting documentation to be kept electronically in one system. Policies and procedures for internal controls will be updated to incorporate processes in Workday, and accounting staff will be trained appropriately. Contact Person: Chief Financial Officer ? Unyime Ekpa Completion Date: December 2023

Finding 2022-017 U.S. Department of Health and Human Services AL No. 93.767 Children?s Health Insurance Program (CHIP) Significant Deficiency Over Reporting Repeat Finding: No Auditee?s Corrective Action Plan: BCHD will continue to work with the City's Finance department to ensure what is recorded on the general ledger reconciles to what is reported in the Form 440. The implementation of Workday Finance module should alleviate these findings. Contact Person: Chief Financial Officer ? Unyime Ekpa Completion Date: December 2023

Finding 2022-016 U.S. Department of Health and Human Services AL No. 93.767 Children?s Health Insurance Program (CHIP) Material Weakness Over Compliance and Internal Control over Period of Performance Repeat Finding: Yes Auditee?s Corrective Action Plan: BCHD will implement controls to allow only costs within the period of performance to be charged to a grant. BCHD will ensure that if there are any exceptions that allow for costs to be charged outside the period of performance, the proper supporting documents will be kept. Baltimore City's new financial system, Workday, allows for all supporting documentation to be kept electronically in one system. Policies and procedures for internal controls will be updated to incorporate processes in Workday and the accounting staff will be trained appropriately. Contact Person: Chief Financial Officer ? Unyime Ekpa Completion Date: December 2023

CORRECTIVE ACTION PLAN FOR THE YEAR ENDED DECEMBER 31, 2022 Title 2, U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Subpart F, Section 511 ? Audit Findings Follow-up requires the auditee to prepare a corrective action plan to address each audit finding included in the current year auditor?s reports. The Corrective Action Plan for Current Year Findings present our corrective action plan for the Financial Statement and/or Federal Award Findings described in the accompanying Schedule of Findings and Questioned Costs for the period ended December 31, 2022. Finding 2022-001 Responsible Party Name: Fred Gibbs Position: President ? Management Agent Telephone Number: 913-709-1811 Federal Agency U.S. Department of Housing and Urban Development Federal Program Mortgage Insurance for Purchase or Refinancing of Existing Multifamily Rental Housing (Section 207/223(F)) Compliance Requirements N ? Special Tests and Provisions Finding Type Financial Statement and Federal Awards Auditee?s Comment on Finding We agree with the auditor?s finding. Corrective Action We will follow our policies and procedures to ensure that our accounting records are kept accurate and complete, and a responsible official will review and sign off on the monthly financial statements. Anticipated Completion Date June 30, 2023

Finding 2022-005 Programs: All Material Weakness over Information Technology Security Repeat Finding: Yes Auditee?s Corrective Action Plan: We concur with the findings. The Baltimore City Office of Information & Technology (BCIT) has made significant progress in resolving this finding. Specific improvements are below: Vulnerability Management Status: ? BCIT continues to make progress on addressing the backlog of vulnerabilities in our environment. ? We transitioned to a new vulnerability management tool, Tenable, to reduce the number of false positives and issues with reporting that we had with our original tool. ? We hired an experienced vulnerability lead to take over the planning tracking and monitoring of backlog initiatives. ? As we finish up current initiatives like Win 10 v1909, SMBv1 Workstation, Flash Uninstall and Internet Explorer - we tee up new initiatives. ? We are currently in the planning / scoping phase to remove old versions of Adobe Acrobat, Adobe Products and Mozilla Firefox. ? For operational patching, we are deploying 90% of patches on critical servers within 7 days, but we are only deploying 70% of workstation patches within 3 weeks. Upcoming Vulnerability Management Milestones: ? We have a funded position to hire a full-time workstation vulnerability engineer to ensure workstation patching is at 95% completion after 3 weeks. We have reviewed resumes, selected a slate and plan to have a person join the team in May 2023. ? We have diagnosed the reason we are deploying 90% of patches on critical servers. We patch the operating system consistently, but we are not always patching applications on the servers. The server patching team has begun patching applications. For April 2023 critical server patches, we achieved 100% in 7 days. We will continue to monitor our corrective action. Privileged Access Entitlement Review Status: ? Developed and implemented a process to review privileged credentials city-wide. o The user requesting admin privileges fills out a privilege access agreement (PAA) that documents the privileges required. o The admin?s manager signs the request. o The user signs an acknowledgement of their responsibilities and attaches to form a ticket. o The ticket results in computer-based training being assigned to the admin. o The ticket is forwarded to appropriate team in BCIT ? server or desktop for their review / approval. o When training is verified and BCIT approvals are completed, the user is authorized to continue using existing credentials or assigned the new credentials requested. ? BCIT leveraged this exercise to standardize admin account naming conventions aligned with best practices. We now require separate admin accounts for workstation or server administration. We are disabling / doing away with the legacy one size fits all generic admin accounts (P accounts). Upcoming Milestones: o Complete the review and cleanup of the final wave of agencies ? BCIT, BCHD, BCFD and some stragglers from DPW, DHR and DOF ? May 2023 o Disable all privileged accounts that have not been used within 180 days ? May 2023 o Review any remaining P accounts for disposition ? June 2023 o Seek feedback from agencies on the FY 2023 Privileged Account review process and develop process improvements ? 1st quarter FY 24 o Begin FY 24 Privilege entitlement review process ? 2nd quarter FY 24. Segregation of Duties: The Blue Hill vendor now has a designated full-time Team Lead to oversee the City of Baltimore?s contract. Now that we have a dedicated Blue Hill Team Lead, the VMLIB process and programmer rights will be modified to only allow the Blue Hill Team Lead or the BCIT Mainframe Manager to promote programs to production. Mainframe Restoration: To restore mainframe operations at the secondary data center, BCIT employs Blue Hill, who maintains an alternative backup site in New Jersey (BlueZone) should the main location in Pearl River, New York ever go down. o Every night the data and code are replicated and transmitted to the backup site. o Should a disaster occur, the backup (BlueZone) site will be operational in less than 48 hours. Contact Person: Todd Carter, CIO/CDO Baltimore City Completion Date: June 2024 and continuously reviewing.

Finding 2022-004 Programs: All Material Weakness over Fixed Asset Accounting Repeat Finding: Yes Auditee?s Corrective Action Plan: The City has purchased Workday, an Enterprise Resource Planning (ERP) system, and implemented the software with the assistance of Accenture consultants. Although Workday is ?live? as of August 2022, the City is currently working to implement the business asset module. This module will allow assets to be flagged during the purchase process and the majority of existing assets to be uploaded and depreciated by Workday. Specific improvements are as follows: ? Depreciation will be run monthly rather than at the end of the year, allowing for a more regular review of the fixed assets. ? Workday reports which reconcile the subsidiary fixed asset module to the general ledger will be run monthly and reviewed. ? A new Workday role within each agency, an asset tracking specialist, will be responsible for reviewing the fixed asset listing and working with the Department of Finance ensuring that assets are capitalized properly. ? A Capital Assets policy has been drafted and is expected to be reviewed and approved. ? The City has uploaded assets in to Workday thru fiscal year 2021 and has agreed these to the ACFR publication for fiscal year 2021. The City has also uploaded the fiscal year 2022 assets and is in the process of paralleling the FY 22 results. Additionally, fiscal year 2023 assets purchased thru Workday have been capitalized in Workday using Workday functionality. The City expects to use Workday to calculate the fiscal year 2023 depreciation. Contact Person: Michael Moiseyev, Chief Financial Officer, Baltimore City. Completion Date: December 2023

Finding 2022-003 Programs: All Material Weakness over Water and Wastewater Billing Function Repeat Finding: Yes Auditee?s Corrective Action Plan: The Department of Public Works (DPW) took several steps to assess, evaluate, and improve water and wastewater billing functions, including the following: ? The Office of the Mayor led a review of unbilled properties that have no accounts established within the billing system. A minimal number of properties were found and, upon further investigation, the majority of those properties were improperly coded. ? Baltimore City and Baltimore County undertook a joint review of the entire water and wastewater utility, using a private consultant. This analysis provided a framework for how to improve the utility, including billing. Additionally, Baltimore City and Baltimore County have formed a strong partnership on utility-related issues, meeting every month. Both jurisdictions are tracking the findings of a joint Baltimore City and Baltimore County Office of Inspector General Report on billing-related issues. The City/County team continues to evaluate the issues identified in the OIG report with those identified by the consultant to find areas of overlap. ? There is an initiative to reform the DPW meter shop. This initiative involves a task force made up of DPW and Mayor?s Office staff who immersed themselves full-time in the meter shop. Thus far, vehicle issues, equipment issues, logistical issues, and some training issues have been assessed and resolved, leading to improved morale and more effective operations. ? In late November 2020, DPW optimized water billing cycles and schedules through a software program called Route Smart. City customers are billed monthly. Route Smart realigned the billing cycles so that customers were evenly divided into the 15 groups and were also located in the same geographic area of the City. This allows the meter technicians to stay in one region when addressing meter issues rather than wasting time traveling back and forth throughout the City. Since optimization, DPW averages 99% of bills being issued for each cycle on a regular basis. ? In July 2021, the Customer Support and Services Division (CSSD) implemented an Escalations and Adjustments committee to review all adjustments over $500. Any adjustment over $500 cannot be entered into UMAX without approval from this committee. Adjustments are audited weekly to ensure the integrity of the process. ? All CSSD and Meter Shop supervisors have completed training to write and document standard operating procedures (SOPs). SOPs will be revised for all Billing, Customer Service, and Meter Operations. DPW staff anticipate the SOPs will be completed and finalized by January 31, 2023. ? In July 2022, DPW launched an internal dashboard tracking a wide array of vital operational and performance metrics for CSSD and Meter Shop staff. Management is using the dashboard to benchmark and set KPIs for improving customer response times, work order completions, accurate billing, and revenue collections. ? Reorganization of CSSD and Meter Shop operations to include an Internal Process Improvement team (Quality Assurance) and a Data Team (Quality Control) for monthly billing and customer service response times. ? CSSD and the Meter Shop work collaboratively to ensure reads are entered and meters are fixed or replaced so that we can provide timely and accurate monthly billing ? In addition to the reactive training provided to CSSD staff from August 2021 to March 2022, CSSD has created a monthly training calendar to provide proactive and leadership development sessions since April 2022 to increase knowledge, skills, and abilities. Contact Person: Michael Moiseyev, Chief Financial Officer, Baltimore City Jason W. Mitchell, Director, Department of Publix Works Completion Date: Completed June 2022. Currently in support phase for ongoing improvements.

Finding 2022-002 Programs: All Material Weakness over Financial Reporting Repeat Finding: Yes Auditee?s Corrective Action Plan: The City has purchased Workday, an Enterprise Resource Planning (ERP) system, and implemented the software with the assistance of Accenture consultants. Although Workday went ?live? as of August 2022, the City is currently working to refine the software and fully utilize its functionality. The new system includes improved financial reporting and functionality. Specific improvements available are: ? Allocations which were calculated manually, such as overhead allocations, are being automatically calculated and created in Workday. ? There has been an extensive review of the chart of accounts, including the use of hierarchies, which more closely align the financial and budgetary reporting needs of the City. ? The City will be using ?control? accounts for accounts receivable and accounts payable, which requires the subsidiary systems to reconcile to the general ledger. ? The City will be using multi-book accounting, which will allow for GAAP entries to be entered into a separate ledger. ? The City is purchasing Workiva, a cloud-based software, which will interface with Workday and update the Annual Comprehensive Financial Report (ACFR) document. It will provide an audit trail for changes to the ACFR document. This implementation is slated to begin in June 2023, but full implementation may not occur until fiscal year 2024. Contact Person: Michael Moiseyev, Chief Financial Officer, Baltimore City Completion Date: December 2024

Finding 2022-024 U.S. Department of Health and Human Services AL No. 93.977 Sexually Transmitted Diseases (STD) Prevention and Control Grants Significant Deficiency and Noncompliance over Period of Performance Repeat Finding: No Condition: For 4 of 40 expenditure transactions selected for testing, the transactions were incurred outside of the period of the performance for the grant. Criteria: In accordance with 2 CFR ?200.303: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. According to 2 CFR section 200.309, a non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance and any costs incurred before the Federal awarding agency or pass-through entity made the Federal award that were authorized by the Federal awarding agency or pass-through entity. Cause: There was a timing delay at the end of the fiscal year between the agency billing the grant and when the actual expenditure was recorded in the GL system to create the SEFA. Effect: The City was not in compliance with the period of performance requirements. Questioned Costs: $276,183. Recommendation: We recommend the City establish and implement internal controls that provide reasonable assurance that grant expenditures recorded in the general ledgers are recorded in the proper grant period. Auditee Response and Corrective Action Plan: Management agrees with the finding. Refer to the corrective action plan on current findings in Part V of this report. Auditor?s Conclusion: Finding remains as stated.

2022-003 Housing Voucher Cluster ? Assistance Listing No. 14.871 Recommendation: The Authority should review their HQS inspection policies to ensure that all inspections are performed timely and that all necessary documentation is maintained for each inspection. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Northwest Oregon Housing Authority has reviewed its inspection policies regarding timely inspections and maintenance of inspection documents. NOHA attempted to conduct inspections on all units following the lifting of COVID restrictions. NOHA is continuing to clean up software data to ensure proper documentation of inspections. Name(s) of the contact person(s) responsible for corrective action: Sandra Soucie, HCV Manager, HCVManager@nwoha.org Planned completion date for corrective action plan: 3/31/2023

Finding 2022-022 U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Material Weakness over Period of Performance Repeat Finding: Yes Auditee?s Corrective Action Plan: BCHD will implement controls to allow only costs within the period of performance to be charged to a grant. BCHD will ensure that if there are any exceptions that allow for costs to be charged outside the period of performance, the proper supporting documents will be kept. Baltimore City's new financial system, Workday, allows for all supporting documentation to be kept electronically in one system. Policies and procedures for internal controls will be updated to incorporate processes in Workday and the accounting staff will be trained appropriately. Contact Person: Chief Financial Officer ? Unyime Ekpa Completion Date: December 2023