Corrective Action Plans

Finding No. 2022-012 Department(s) New York City Human Resources Administration Program(s) Assistance Listing Number 14.239, HOME Investment Partnerships Program Corrective Action(s) Response: ? HRA agrees that the Agency had challenges in retaining some recertification documentation during the COVID Public Health crisis when staff were working from home and then ultimately leaving the Agency prior to the return to office. ? The identified HOME TBRA tenants had been originally found eligible over five years ago and have been recertified annually every year following. ? This FY22 audit was conducted on the heels of the FY21 audit where the finding was the same and the recommended Corrective Action was the development of a Quality Assurance Checklist due by November 2022 and ongoing. ? HRA agrees to strengthen internal controls and have created and implemented a Quality Assurance Tool that ensure eligibility is accurately assessed, allowable cost is correctly calculated and appropriate evidence (i.e. Recertification Information Form, Proof of Income, Rent Reasonableness Information, Passed Inspection, Landlord Packet, Client Packet, RAC, Tenant Breakdown) that support annual approval is maintained. Also, the payment system already fully requires supervisor approval before annual payments can be set up. Absolutely no payment can go out without supervisor approval. Corrective Actions: ? Strengthen internal governance and future compliance. ? Hire an Executive Director for the TBRA ? Create and implement a Quality Assurance tool that includes information that supports eligibility. ? Provide refresher training for staff involved with TBRA. Anticipated Completion Date May 2023 and ongoing Person(s) Responsible for Implementation Dori Hopkins-Figeroux Director, TBRA (929) 252-6089 Dwana Abraham Assistant Deputy Commissioner (929) 221-6726

Finding No. 2022-011 Department(s) New York City Human Resources Administration Program(s) Assistance Listing Number 14.239, HOME Investment Partnerships Program Corrective Action(s) HRA is committed to better understand the Housing Quality Standards (HQS) inspection process and strengthen our monitoring to ensure future compliance. Corrective Actions: ? Hire an Executive Director for the TBRA. ? Advance HRA understanding of the inspection process, deliverables and compliance including intentional notifications and requesting, collecting, and maintaining of documentation. ? Review and update, as determined, HRA procedures to strengthen monitoring of HQS inspections and ensure appropriate documentation is maintained. Anticipated Completion Date May 2023 and ongoing Person(s) Responsible for Implementation Dori Hopkins-Figeroux Director, TBRA (929) 252-6089 Dwana Abraham Assistant Deputy Commissioner (929) 221-6726

Views of responsible officials and planned corrective actions: Management agrees with this finding and will ensure proper review is performed and evidenced.

Finding 2022-025 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Managed Care Periodic Audits Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS formally added the Encounter Data Validation (EDV) protocol to its External Quality Review Organization contracts as of October 1, 2022. EDV activities are currently underway and a final report outlining the results of the review will be posted to the website once available. Anticipated Completion Date MDHHS anticipates the first review will be completed and posted to the website by September 30, 2023. Responsible Individual(s) Brad Barron, MDHHS Jackie Sproat, MDHHS Matthew Seager, MDHHS

Finding 2022-019 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Beneficiary Eligibility Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS continues to pursue other data sources for income verification and other system enhancements so that all case data is available to all reviewers. MDHHS conducts mandated training for local office caseworkers. In addition, MDHHS will continue to determine where additional training or enhancements to training are needed to ensure eligibility is accurately determined and documentation is properly maintained and loaded to the electronic case file. Lastly, MDHHS has been working since 2018 to ensure correct eligibility classifications in Bridges at the time of payment and a system change was implemented in April 2021 to correct the issue. All new cases are being correctly routed. MDHHS expects that all existing cases will be updated during the 14-month period following the May 11, 2023 end of the PHE, as allowed by the Centers for Medicare and Medicaid Services. Anticipated Completion Date MDHHS continues to pursue other data sources for income verification and other system enhancements, in addition to determining where training is needed, on an ongoing basis. MDHHS expects to have all existing cases updated by June 2024. Responsible Individual(s) Logan Dreasky, MDHHS Brant Cole, MDHHS Mariah Schaefer, MDHHS

Finding 2022-017 MDHHS - FFATA Reporting Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS has submitted all outstanding FFATA reports. MDHHS provided additional instruction to the individuals responsible for providing account code and funding source information related to FFATA submissions. Anticipated Completion Date Completed Responsible Individual(s) Jeanette Hensler, MDHHS Chad Dzingleski, MDHHS

Finding 2022-062 Unemployment Insurance, ALN 17.225 See Department of Labor and Economic Opportunity, Unemployment Insurance Agency, Unemployment Compensation Fund, Report on Expenditure of Federal Awards, Year Ended September 30, 2022, Corrective Action Plan, Finding 2022-001.

2022-002 Tenant Files: Eligibility Program: U.S. Department of HUD: Section 8 Housing Choice Vouchers (CFDA 14.871) Type of Finding: Material Weakness in Internal Control and Material Noncompliance This is a repeat finding of 2021-001 from September 30, 2021 (Other Matter and Significant Deficiency in Internal Control over Compliance). Originally reported as finding 2019-001 from September 30, 2019 (Material Weakness in Internal Control and Material Noncompliance) Statement of Condition: Out of a total tenant population of approximately 1,114 vouchers, 25 files were selected for testing. Exceptions were noted as follows: ? 1 tenant file had the following errors: o The tenant?s annual recertification application is missing. o The tenant?s signed 9886 form is missing. o The wrong utility allowance schedule was used to calculate the tenants? utility allowance. Correcting this error would cause the HAP rent to increase by $9. o The tenant?s signed HAP contract is missing. ? 1 tenant file had the following errors: o The name and social security number for one of the tenant?s dependents was reported incorrectly on the 50058 form. o The tenant?s utility allowance was calculated correctly but was reported incorrectly on the 50058 form. Correcting this error would cause the HAP rent to increase by $56. ? 1 tenant file had the following errors: o The lease agreement was not signed by the tenant. o The tenant?s assets was reported in error. Correcting this error would cause the rent to increase by $8. ? 2 tenant files where the tenants? income was miscalculated. Correcting the errors would cause the HAP rent for one of tenant files to decrease by $12 and the other to increase by $181. ? 2 tenant files where the wrong utility allowance schedule was used to calculate the tenants? utility allowance. Correcting these errors would cause the HAP rent for one of the tenant files to decrease by $13 and the other to increase by $14. ? 1 tenant file where the family?s assets was reported in error. Correcting the errors had no effect on the HAP rent. ? 1 tenant file where a member of the household moved but was reported on the 50058 form. ? 1 tenant file where the tenant?s signed HAP contract is missing. ? 1 tenant file where the EIV report was never generated or was misplaced. In addition to the above, we noted the following during our new admissions testing (out of a total of 118 new admission, 18 files were selected for testing.): ? 1 tenant file where the member of the household did not checkmark the checkbox on the 214-affidavit form indicating that they are a U.S. Citizen or permanent resident. However, the member?s birth certificate confirms that the member is a U.S. Citizen. ? 1 tenant file where the tenant?s signed 214-affidavit is missing. However, the member?s birth certificate confirms that the member is a U.S. Citizen. Recommendation: The Authority should correct the deficiencies noted in the tested files and utilize an ongoing quality control review process on the entire tenant population to ensure proper compliance with the requirements related to tenant eligibility. Ongoing staff training and timely management reviews should be utilized to ensure staff is aware of acceptable procedures. In addition, the Authority should review staffing levels, skill sets and case load. Action Taken: The Authority concurs with this finding. The Authority has an established review, oversight and training process and will continue to improve its review, oversight, and training process to ensure proper procedures are being followed. All audit findings of the files tested will have been corrected. The Authority has implemented a quality control system so that every file receives a quality review for appropriate third-party verification and upfront income and assistance is determined. The agency has created a Family Worksheet and an HCV Computation Worksheet to help staff identify errors in calculations and to check for accuracy prior to completing Annual Reexaminations and Interim Recertifications. The agency has changed its filing system to enable staff to thoroughly review all forms prior to admission and during regular recertification and interim adjustment processing. The agency created an Other Adult packet to ensure 214 forms and other pertinent are completed for all adult household members. The HCV Counselor caseloads have been distributed equitably amongst Counselors to promote efficiency and accuracy while working on each HCV participant?s file. The Counselor?s caseload is divided alphabetically and assigned by multifamily developments to track and monitor counselors? strength and weaknesses, and to determine if additional training and/or monitoring is needed. Internal file reviews are being completed and management will continue to conduct a 10% review for each Counselor?s processing of annual recertifications. This percentage may increase if work product indicates a need for more stringent review. To further ensure compliance and accuracy, the HCV Program Manager will review at least 1 out of every 5 intake files. The Authority has had a significant turnover in the HCV department over the past 24 months. All HCV staff will attend Voucher Specialist training and Nan McKay HCV Rental Calculation Certification training. Effective Date: June 20, 2023 Contact Information Gwendolyn B. Dawson, CEO Ocala Housing Authority 1629 NW 4th Street Ocala, Florida 34475 (352) 369-2636

Finding 2022-012 U.S. Department of Treasury AL No. 21.019 Coronavirus Relief Fund (CARES) Material Weakness over Subrecipient Monitoring Repeat Finding: Yes Auditee?s Corrective Action Plan: Per the auditor?s recommendation, the agency will seek training on the Uniform Guidance requirements related to sub-recipient monitoring. The agency will ensure that there is a written plan in place for how to monitor the sub-recipients that were awarded funds by the City from the CARES Act. Contact Person: Deputy Finance Director ? Bob Cenname Completion Date: December 2024

Finding 2022-001 Condition/Context The Center improperly calculated lost revenues as a result of improperly including contributions and improperly excluding contractual adjustments related to patient service revenues. This is not a statistically valid sample. Corrective Action Plan Corrective Action Planned: St. Joseph's Center will correct the lost revenues calculation in the Period 4 Submission due March 31, 2023. In order to ensure that St. Joseph's Center properly calculates lost revenues in the future, all lost revenue calculations and source documents will be prepared by the Accounting Manager and reviewed by the Chief Financial Officer. Name(s) of Contact Person(s) Responsible for Corrective Action: James Ceccoli, CFO Anticipated Completion Date: 3/31/2023

2022-003: Supporting Documentation Recommendation: We recommend the organization design controls to ensure an adequate review process is in place to review costs charged to grants are properly supported by documentation. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action planned in response to finding: We will better enforce a policy that expenses must be sufficiently supported by documentation before payment is made. Name(s) of the contact person(s) responsible for corrective action: Joseph Ferlo, President & CEO Planned completion date for corrective action plan: June 30, 2023

FINDING 2022-001 ? Material Weakness and Material Noncompliance ? Budget Variances / Allowable Costs Corrective Action Plan: Analyze actual expenditures monthly, review the budget to actual numbers monthly and use data from this review to prepare a more accurate final budget revision. Responsible Parties: Rod Livingston, Business Manager Anticipated complete date of June 30, 2023 Rod Livingston Business Manager

2022-002 Application of Sliding Fee Discounts Corrective action planned: The Center plans to: 1. Continue to provide frequent education and training for front-desk staff to assist in preparation and required completion of the sliding fee applications and proof of income forms. 2. Meet with front desk staff to identify and correct barriers to compliance with completion of sliding fee application and income verification and retention of those documents within the electronic record. 3. Develop workflow to identify when patients have exhausted their limited Medicaid dental benefits and would now qualify for sliding fee discount. Ensure sliding fee scale application and verification of income are completed prior to delivery of additional services. 4. Develop internal report to identify accounts with sliding fee scale identified with no end date recorded. For identified accounts, determine appropriate end date for sliding fee discount and enter it into the system. 5. Continue to do real time audits of front desk personnel to identify needs for additional training and to reinforce the process and appropriate documentation. 6. Institute a separate QA position for the purpose of review of patients with an identified sliding fee scale discount in place. Anticipated completion date: October 31, 2023 Contact person responsible for corrective action: Mary Sterhan, CEO

Compliance requirement ? Reporting Institutional Comments on Findings and Recommendations: 1. The institution does not concur with the auditor finding because the institution strictly followed and used the recommended HEERF methodology and reporting guidelines to prepare the quarterly and annual reports. Since the institution used the reimbursement method, the drawdown were the actual expenditures/costs incurred and requested for reimbursement. The HEERF reporting requirement does not make any indication nor reference to GAAP. The Institutional aid portion expenditures were supported by the proper invoice or check. The evidence was available to the auditors. 2. The institution concurs with the auditor finding. The institution inadvertently, did not include a line item from one of the quarterly reports. The period to make corrections was closed and we sent an e-mail to the department to amend this annual report. 3. The institution concurs with the auditor finding. The annual report contains detail statistical information that not necessarily is supported by our institutions data base and programs. As the ED expressed, this information was unique and challenging, and accordingly, the institution made some reasonable estimates and derivatives in the information provided. As you may notice in the referenced table by the auditor, the differences were minimal. 4. a. The institution concurs with the auditor finding on the difference in Item #5 of the quarterly report. The institution will accordingly amend the report. b. The institution does not concur with the auditor finding on the timely and accurate reporting in publicly posting the quarterly Student Aid Portion. The four quarterly reports were timely submitted with an e-mail to the HEERF reporting staff and timely posted in the institution web page as required by the HEERF reporting instructions. The reports were further reviewed by an officer of the Department of Education (ED). The ED expressed that this information may be unique and challenging to an audit, and indicated that for these public reporting requirements, the auditors may accept as evidence of compliance, contemporarily produced e-mails, webmaster logs, or other relevant documentation establishing good-faith indication that the institution posted the required information at approximately the timelines established by the public reporting requirements. Copy of the e-mails were available to the auditors as evidence of compliance. ED understands that this information may be unique and challenging to audit, particularly because auditors are asked to verify information posted on a webpage which may not be accessible during audit fieldwork. For these public reporting requirements, auditors may accept as evidence of compliance, contemporarily produced emails, webmaster logs, or other relevant documentation establishing a good-faith indication that the institution posted the required information at approximately the timelines established by the public reporting requirements (HEERF Grant Program Auditing Requirements, General Requirements and Information - All HEERF Grantees). 5. The institution does not concur with the auditor finding because the referenced payment was made in accordance with the Institution's fund distribution and the student financial needs, among other factors, at the time of the evaluation and distribution of the funds. The student financial circumstances may have change after the distribution and payments of the financial aid. Additionally, this is an immaterial amount as compare to the total amount of the funds distributed ant the quantity of students served (1 out of 460). Actions Taken or Planned: The institution understands that no further is needed or required.

1. The institution does not agree, nor concurs, with the auditors on this finding because the institution used the reimbursement payment method. This method was the preferred one when the non-federal entity, as our institution, cannot meet the requirements in 2 CFR, section 200.305(b)(1) for advance payment and the federal awarding agency sets a specific condition for use of the reimbursement. Title 2 of the CFR Part 200.305(b)(1), establish among others: "The non-Federal entity must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the non-Federal entity, and financial management systems that meet the standards for fund control and accountability as established in this part". Furthermore, 2 CFR Part 200.305(b)(3) states: "Reimbursement is the preferred method when the requirements in this paragraph (b) cannot be met, when the Federal awarding agency sets a specific condition per ? 200.208, or when the non-Federal entity requests payment by reimbursement. " Since our institution was not able to meet 2 CFR, section 200.305(b)(1), and the HEERF guidelines has specific condition on how to use the funds; we choose the reimbursement method in the execution of the funds. Our institution adopted all HEERF instructions and guidelines as their policies to comply with the HEERF requirements, in addition to the CFR's regulations. Below some of the guidelines, instructions ad FAQs we adopted followed" a. Higher Education Emergency Relief Fund III, Frequently Asked Questions, American Rescue Plan Act of 2021, Published May 11, 2021, Questions 7 and 11 updated May 24, 2021, Question 36 updated September 30, 2021 b. US Department of Education, Notice of Proposed Institutional Eligibility Criteria, February 25, 2021 c. Federal Register Notice of Interpretation (NOI), regarding Period of Allowable Expenses for Funds Administered under HEERF Program, March 22, 2021 d. HEERF Notice of Interpretation for Period of Allowable HEERF Expenses (March 22, 2021) e. HEERF Lost Revenue FAQs (March 19, 2021) f. HEERF Period of Allowable Expenses Grant Records Notice (March 19, 2021) g. HEERF Grant Program Auditing Requirements (March 8, 2021) h. CRRSAA HEERF II Section 314(a)(1) Frequently Asked Questions (Published January 14, 2021 and Updated: March 19, 2021) i. CRRSAA HEERF II Section 314(a)(2) Frequently Asked Questions (January 14, 2021) j. CRRSAA HEERF II Section 314(a)(4) Frequently Asked Questions (Published January 14, 2021 and Updated: March 19, 2021) k. HEERF I and HEERF II Comparison Fact Sheet (Published January 14, 2021 and Updated: March 19, 2021) 1. HEERF Lost Revenue FAQ's, Published March 19, 2021 m. HEERF II, Public and Private Nonprofit Institution (a)(2) Programs (CFDAs 84.425K), FAQ's, Published January 14, 2021 n. HEERF II, Proprietary Institution Grant Funds for Students (CFDA 84.425Q) ((a)(4) Program), FAQ's Published January 14, 2021, Updated March 19, 2021. o. HEERF II, Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F), FAQ's Published January 14, 2021, Updated March 19, 2021. p. CAREST Act HEERF Rollup FAQs (issued October 14, 2020 and revised November 20, 2020) q. CARES Act HEERF Round 3 FAQs (Issued October 14, 2020 and revised November 20, 2020) r. CARES Act HEERF Supplemental FAQs (Issued June 30, 2020 and revised September 08, 2020) s. CARES Act HEERF Student FAQ's (Issued May 15, 2020) t. CARES Act HEERF Institutional Portion under Section 18004(a)(1) and 18004(c) FAQ's, (Issued April 9, 2020) u. CARES Act HEERF Emergency Financial Aid Grants to Students under Section 18004(a)(1) and 18004(c) FAQ's, (Issued April 9, 2020) v. CARES Act HEERF Institutional Portion under Section 18004(a)(1) and 18004(c) FAQ's, Issued April 9, 2020 w. COVID-19 FAQ's for Title III, IV, V and VII Grantees, June 16, 2020 x. COVID-19 Letter to HEP Grantees on Flexibilities Available Under CARES Act Section 3518, July 1, 2020 2. The institution does not agree, nor concurs, with the auditors on this finding because, as we mention in number 1 above, the institution adopted and followed the federal award and HEERF guidelines in the execution of the funds. The HEER funds were provided during the special national emergency caused by COVID-19. The DOE and HEERF officials issued many written guidelines, instructions, and FAQ's (Frequently Asked Questions) documents, due to the nature and novel of the national emergency situation. The institution adopted, followed, and relied on the many referenced guidelines and exercise extreme judgment to ensure compliance with the federal requirements and use of the funds. The institution belief this referenced guidelines and instruction were very specific and sufficient to execute the use of the funds. All direct charges to federal awards were for allowable costs under the guidelines and instructions from the Department of Education. Some of the allowable costs were verified and validated by an officer of the Department of Education and reviewed by an independent consultant. 3. The institution concurs with the auditor finding. Actions Taken or Planned: The institution begins in addition to the adopted HEERF guidelines, instructions, and CFRs; to develop additional procurement policies and are in the process of completing those policies. The institution expects to have those completed by May 31, 2023.

Compliance requirement ? Special test and provisions - Return of Title IV Funds Institutional Comments on Findings and Recommendations: I. Compliance Requirements ? Applicable After a Student Begins Attendance: a. The institution agrees with the auditors on this finding in which there were two (2) cases where the auditors noted that the institution failed to determine that the students withdrew within 14 days after the student's last day of attendance. II. Compliance Requirements ? Applicable for a student who does not begin attendance: b. The Institution agrees with the auditors on this finding in which there was one (1) case were the student did not comply with the Incomplete course requirement and an unofficial withdrawal was not performed. Before the audit process was completed, the institution performed a R2T4 calculation and returned to the US Department of Education, the $439.00 associated with this finding. This process was evidenced to the auditors for their records. c. The Institution agrees with the auditors on this finding in which there was one (1) case were the student had stopped attending the enrolled courses without completing at least 60% of the payment period. Before the audit process was completed, the institution had returned to the US Department of Education, the $581.00 associated with this finding. This process was evidenced to the auditors for their records. d. The institution agrees with the auditors that in the cases mentioned in item b and c in that it failed to determine that the students withdrew within 14 days after the student's last day of attendance. e. The institution agrees with the auditors that in the cases mentioned in item b and c in that it failed to return Title IV funds after the 45 days' time frame. Actions Taken or Planned: The institution is aware of the importance to comply with Return of Title IV funds (R2T4) reporting requirements and deadlines. Also, the relation to students last day of attendance (date of withdrawal) vs date of school's determination that the students withdrew and the date of the return of any Title IV funds resulting from an R2T4 calculation. The issues as related to these findings were identified as ones being an oversight and lack in compliance with some of the academic processes as required by R2T4 and has already been discussed with the Academic Dean of the institution who in turn has revisited these matters with Faculty and administrative staff under her supervision including the Registrar. The already instituted task force that meets every Friday of each week to identify and review cases that could affect the R2T4 procedure and requirement has continued to review and evaluate information received from the faculty through the Academic Dean and from information the Registrar's office receives of students that are not attending classes in order to process all applicable withdrawals to assure that the return of Title IV funds procedures and the return of funds if any, are processed timely within the 14 days requirement of the student's last day of attendance and within the 45 days from the date that the institution determined that the student withdrew. Before the audit process was completed, the institution had returned to the US Department of Education, the $439.00 and $581.00 associated with this finding. This process was evidenced to the auditors for their records.

2022-004 NSLDS Enrollment Reporting Student Financial Aid Cluster ? Assistance Listing No. 84.268, 84.063, 84.007, 84.033 Auditors? Recommendation: The University must review their enrollment reporting policies and procedures to ensure accurate reporting. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The transition to new SIS will ensure that: 1. The student statuses within the system will update automatically based on changes in the student's schedule and enrollment. 2. The school will report the information from the SIS monthly to the National Student Clearinghouse for update to NSLDS to ensure timely and accurate updates to student statuses. Additional action taken: New procedures were created to follow-up on error files received from National Student Clearinghouse. These files will be reviewed by both the registrar?s office and the financial aid office within 10 days of receipt. This ensures multiple individuals know how to review and correct any data discrepancies to mitigate impact from staff turnover. Name(s) of the contact person(s) responsible for corrective action: Rusty Hassell, Chief Enrollment Officer; Stephen Waers, Chief Academic Officer, Rachal Wortham, Director of Financial Aid Quality and Compliance; Natalie Brown, Registrar Planned completion date for corrective action plan: Implementation complete April 2023. System transition complete August 2023

2022-002 Disbursement Date Reporting to COD Student Financial Aid Cluster ? Assistance Listing No. Various Auditors? Recommendation: The University must review their policies and procedures to ensure accurate reporting to COD.Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Implemented multistage review process to highlight differentials between COD and system disbursement date. Fiscal Year 2022 dates are accurate. Further, implementation of new SIS, Ellucian Colleague will correct the discrepancy issue due to automated functions that will align disbursement dates. Name(s) of the contact person(s) responsible for corrective action: Rusty Hassell, Chief Enrollment Officer; Rachal Wortham, Director of Financial Aid Quality and Compliance; Amanda Schmidt, Director of Student Accounts Planned completion date for corrective action plan: Fiscal year 2022 are corrected and accurate as of March 2023. System transcription complete August 2023.

FINDING 2022-004 (Auditor Assigned Reference Number) Contact Person Responsible for Corrective Action: Greg Hunt Contact Phone Number: (219) 362-7056 Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: LaPorte Community School Corporation will review the Education Stabilization Fund schedule of disbursements more closely prior to submission. Anticipated Completion Date: May 15, 2023

Finding 2022-018 U.S. Department of Health and Human Services AL No. 93.778 Medical Assistance Program (Medicaid; Title XIX) Material Weakness over Period of Performance Repeat Finding: No Auditee?s Corrective Action Plan: BCHD will implement controls to allow only costs within the period of performance to be charged to the correct grant period within the general ledger. BCHD will ensure that if there are any exceptions that allow for costs to be charged outside the period of performance, the proper supporting documents will be kept. Baltimore City's new financial system, Workday, allows for all supporting documentation to be kept electronically in one system. Policies and procedures for internal controls will be updated to incorporate processes in Workday, and accounting staff will be trained appropriately. Contact Person: Chief Financial Officer ? Unyime Ekpa Completion Date: December 2023

Finding 2022-017 U.S. Department of Health and Human Services AL No. 93.767 Children?s Health Insurance Program (CHIP) Significant Deficiency Over Reporting Repeat Finding: No Auditee?s Corrective Action Plan: BCHD will continue to work with the City's Finance department to ensure what is recorded on the general ledger reconciles to what is reported in the Form 440. The implementation of Workday Finance module should alleviate these findings. Contact Person: Chief Financial Officer ? Unyime Ekpa Completion Date: December 2023

Finding 2022-016 U.S. Department of Health and Human Services AL No. 93.767 Children?s Health Insurance Program (CHIP) Material Weakness Over Compliance and Internal Control over Period of Performance Repeat Finding: Yes Auditee?s Corrective Action Plan: BCHD will implement controls to allow only costs within the period of performance to be charged to a grant. BCHD will ensure that if there are any exceptions that allow for costs to be charged outside the period of performance, the proper supporting documents will be kept. Baltimore City's new financial system, Workday, allows for all supporting documentation to be kept electronically in one system. Policies and procedures for internal controls will be updated to incorporate processes in Workday and the accounting staff will be trained appropriately. Contact Person: Chief Financial Officer ? Unyime Ekpa Completion Date: December 2023

CORRECTIVE ACTION PLAN FOR THE YEAR ENDED DECEMBER 31, 2022 Title 2, U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Subpart F, Section 511 ? Audit Findings Follow-up requires the auditee to prepare a corrective action plan to address each audit finding included in the current year auditor?s reports. The Corrective Action Plan for Current Year Findings present our corrective action plan for the Financial Statement and/or Federal Award Findings described in the accompanying Schedule of Findings and Questioned Costs for the period ended December 31, 2022. Finding 2022-001 Responsible Party Name: Fred Gibbs Position: President ? Management Agent Telephone Number: 913-709-1811 Federal Agency U.S. Department of Housing and Urban Development Federal Program Mortgage Insurance for Purchase or Refinancing of Existing Multifamily Rental Housing (Section 207/223(F)) Compliance Requirements N ? Special Tests and Provisions Finding Type Financial Statement and Federal Awards Auditee?s Comment on Finding We agree with the auditor?s finding. Corrective Action We will follow our policies and procedures to ensure that our accounting records are kept accurate and complete, and a responsible official will review and sign off on the monthly financial statements. Anticipated Completion Date June 30, 2023

Finding 2022-005 Programs: All Material Weakness over Information Technology Security Repeat Finding: Yes Auditee?s Corrective Action Plan: We concur with the findings. The Baltimore City Office of Information & Technology (BCIT) has made significant progress in resolving this finding. Specific improvements are below: Vulnerability Management Status: ? BCIT continues to make progress on addressing the backlog of vulnerabilities in our environment. ? We transitioned to a new vulnerability management tool, Tenable, to reduce the number of false positives and issues with reporting that we had with our original tool. ? We hired an experienced vulnerability lead to take over the planning tracking and monitoring of backlog initiatives. ? As we finish up current initiatives like Win 10 v1909, SMBv1 Workstation, Flash Uninstall and Internet Explorer - we tee up new initiatives. ? We are currently in the planning / scoping phase to remove old versions of Adobe Acrobat, Adobe Products and Mozilla Firefox. ? For operational patching, we are deploying 90% of patches on critical servers within 7 days, but we are only deploying 70% of workstation patches within 3 weeks. Upcoming Vulnerability Management Milestones: ? We have a funded position to hire a full-time workstation vulnerability engineer to ensure workstation patching is at 95% completion after 3 weeks. We have reviewed resumes, selected a slate and plan to have a person join the team in May 2023. ? We have diagnosed the reason we are deploying 90% of patches on critical servers. We patch the operating system consistently, but we are not always patching applications on the servers. The server patching team has begun patching applications. For April 2023 critical server patches, we achieved 100% in 7 days. We will continue to monitor our corrective action. Privileged Access Entitlement Review Status: ? Developed and implemented a process to review privileged credentials city-wide. o The user requesting admin privileges fills out a privilege access agreement (PAA) that documents the privileges required. o The admin?s manager signs the request. o The user signs an acknowledgement of their responsibilities and attaches to form a ticket. o The ticket results in computer-based training being assigned to the admin. o The ticket is forwarded to appropriate team in BCIT ? server or desktop for their review / approval. o When training is verified and BCIT approvals are completed, the user is authorized to continue using existing credentials or assigned the new credentials requested. ? BCIT leveraged this exercise to standardize admin account naming conventions aligned with best practices. We now require separate admin accounts for workstation or server administration. We are disabling / doing away with the legacy one size fits all generic admin accounts (P accounts). Upcoming Milestones: o Complete the review and cleanup of the final wave of agencies ? BCIT, BCHD, BCFD and some stragglers from DPW, DHR and DOF ? May 2023 o Disable all privileged accounts that have not been used within 180 days ? May 2023 o Review any remaining P accounts for disposition ? June 2023 o Seek feedback from agencies on the FY 2023 Privileged Account review process and develop process improvements ? 1st quarter FY 24 o Begin FY 24 Privilege entitlement review process ? 2nd quarter FY 24. Segregation of Duties: The Blue Hill vendor now has a designated full-time Team Lead to oversee the City of Baltimore?s contract. Now that we have a dedicated Blue Hill Team Lead, the VMLIB process and programmer rights will be modified to only allow the Blue Hill Team Lead or the BCIT Mainframe Manager to promote programs to production. Mainframe Restoration: To restore mainframe operations at the secondary data center, BCIT employs Blue Hill, who maintains an alternative backup site in New Jersey (BlueZone) should the main location in Pearl River, New York ever go down. o Every night the data and code are replicated and transmitted to the backup site. o Should a disaster occur, the backup (BlueZone) site will be operational in less than 48 hours. Contact Person: Todd Carter, CIO/CDO Baltimore City Completion Date: June 2024 and continuously reviewing.

Finding 2022-004 Programs: All Material Weakness over Fixed Asset Accounting Repeat Finding: Yes Auditee?s Corrective Action Plan: The City has purchased Workday, an Enterprise Resource Planning (ERP) system, and implemented the software with the assistance of Accenture consultants. Although Workday is ?live? as of August 2022, the City is currently working to implement the business asset module. This module will allow assets to be flagged during the purchase process and the majority of existing assets to be uploaded and depreciated by Workday. Specific improvements are as follows: ? Depreciation will be run monthly rather than at the end of the year, allowing for a more regular review of the fixed assets. ? Workday reports which reconcile the subsidiary fixed asset module to the general ledger will be run monthly and reviewed. ? A new Workday role within each agency, an asset tracking specialist, will be responsible for reviewing the fixed asset listing and working with the Department of Finance ensuring that assets are capitalized properly. ? A Capital Assets policy has been drafted and is expected to be reviewed and approved. ? The City has uploaded assets in to Workday thru fiscal year 2021 and has agreed these to the ACFR publication for fiscal year 2021. The City has also uploaded the fiscal year 2022 assets and is in the process of paralleling the FY 22 results. Additionally, fiscal year 2023 assets purchased thru Workday have been capitalized in Workday using Workday functionality. The City expects to use Workday to calculate the fiscal year 2023 depreciation. Contact Person: Michael Moiseyev, Chief Financial Officer, Baltimore City. Completion Date: December 2023