Corrective Action Plans

Finding: The Health Care Authority did not have adequate internal controls to ensure payments to providers for the Block Grants for Prevention and Treatment of Substance Abuse program were allowable and met period of performance requirements. Questioned Costs: Assistance Listing # 93.959 93.959 COVID-19 Amount $3,447,346 Status: Corrective action not taken Corrective Action: The Authority does not concur with the finding. The Authority maintains that its internal controls are effective, and procedures are compliant with grant requirements. No corrective action will be implemented. The costs questioned by the auditor do not reflect funds that have been paid or drawn from the grantor. As a result, there are no funds to return to the grantor. The conditions noted in this finding were previously reported in findings 2022-067, 2021-057, and 2020-059. Completion Date: Not applicable Agency Contact: William Sogge, CPA, CIA External Audit Liaison PO Box 45502 Olympia, WA 98504-5502 (360) 725-5110 william.sogge@hca.wa.gov

Finding: The Department of Social and Health Services did not have adequate internal controls to ensure individuals are eligible to receive benefits for the Money Follows the Person program. Questioned Costs: Assistance Listing # 93.791 Amount $0 Status: Corrective action complete Corrective Action: The Department partially agrees with the finding. The Department agrees that the Financial and Social Services Communication (14-443) forms were not provided to terminate the enrollment of the four exceptions identified in the finding. However, in those exceptions, the Roads to Community Living (RCL) disenrollment communication was made in accordance with the existing Nursing Facility Case Management policy as defined in Chapter 10 of the Long-Term Care (LTC) Manual. In addition, all clients met eligibility criteria for RCL services or were converted to another Home and Community Based program within the 365-day RCL demonstration year limitation. In these cases, the client was converted to a state plan or waiver with the new program start date noted on the 14-443 forms. The 14-443 form is a communication tool used by the Department’s public benefit specialists. For Modified Adjusted Gross Income (MAGI) enrolled Medicaid participants, benefits are managed by the Washington State Health Care Authority and the 14-443 form is not required or used by the Department’s public benefit specialists. This MAGI beneficiary communication detail was not articulated in the RCL chapter of the LTC Manual. As of May 2024, the Department updated Chapter 29 of the LTC Manual to clarify instructions related to when the 14-443 form must be completed for MAGI participants and what needs to be included on the form when it is required. Completion Date: May 2024 Agency Contact: Richard Meyer External Audit Compliance Manager PO Box 45804 Olympia, WA 98504-5804 (360) 664-6027 Richard.Meyer@dshs.wa.gov

Finding: The Health Care Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and Children’s Health Insurance Program. Questioned Costs: Assistance Listing # 93.767 93.767 COVID 93.775 93.777 93.777 COVID 93.778 93.778 COVID Amount $0 Status: Corrective action in progress Corrective Action: The Authority partially concurs with the finding. The Authority does not concur that four providers did not receive a proper license check, nor that the backdated provider was noncompliant with regulations prior to receiving a National Provider Identifier (NPI). When a provider’s license expires, the Authority enters an end date for the provider taxonomy to prevent future payments. The Authority does not pay claims without an NPI and this is compliant with federal requirements. Corrective action has been in process to address revalidation issues. As of January 1, 2024, the Authority implemented a system change moving the revalidation date to 90 days before the end of the five-year period. The Authority is developing additional procedures to strengthen internal controls over provider enrollment. The conditions noted in this finding were previously reported in findings 2022-055, 2021-047, 2020-046, 2019-048, 2018-042, 2017-033, and 2016-035. Completion Date: Estimated December 2024 Agency Contact: William Sogge, CPA, CIA External Audit Liaison PO Box 45502 Olympia, WA 98504-5502 (360) 725-5110 william.sogge@hca.wa.gov

Finding: The Department of Children, Youth, and Families did not have adequate internal controls over and did not comply with requirements to ensure payments to providers were allowable and properly supported for the Social Services Block Grant. Questioned Costs: Assistance Listing # 93.667 Amount $8,518,020 Status: Corrective action in progress Corrective Action: The Department maintains that funds were not improperly charged to the Social Services Block Grant (SSBG) program. The Department utilizes grant-level management for all federal funds, including the SSBG program. This process consists of making grant-level adjustments between allowable grant sources to properly spend grant funds within the allowable period of performance and ensure level of effort and matching requirements are met. The Department allocated the SSBG funds to eligible clients and allowable activities in compliance with 45 CFR 98.67 but did not include the level of data recommended by the State Auditor’s Office (SAO) for some transfers. Cost objectives within the accounting system are used to track SSBG funding. Expenditures eligible for the SSBG program are transferred at the cost objective level and not the transaction level. The SAO tested a sample of 16,006 payments which totaled 94% of total provider payments charged to the grant. SAO found that all payments were for activities that were supported, allowable, authorized, and accurate. SAO is questioning the costs of the remaining payments because the transfer of expenditures was not completed at the transaction level. Those remaining payments were transferred from eligible and allowable expenditures for the SSBG program. The Department is committed to collaborating with SAO to determine an appropriate methodology which identifies a sampling unit that can be used to accurately test compliance. In response to the auditor’s recommendations, the Department will develop and maintain a business process that would allow adjustments to include transaction level data. Completion Date: Agency Contact: Estimated December 2025 Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Children, Youth, and Families did not have adequate internal controls to ensure group care facility employees and adults residing in prospective caregivers’ households had cleared background checks before having unsupervised access to children. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Department partially concurs with the finding. The auditors identified two exceptions where fingerprint checks for two family foster home adults were completed two days later than the required timeline of 15 calendar days. The delay was due to the misspelling of one applicant’s last name in the system. Upon correction, the applicants subsequently completed the fingerprint checks and were determined eligible. As stated in the finding’s Cause of Condition, the Department developed a corrective action plan to address the internal control deficiencies in response to the prior year’s finding which had not been fully implemented within the current audit period. The Department is confident that all staff who work with children and youth have cleared background checks. As of April 1, 2023, the Department implemented a new process for processing background checks for group care facilities to strengthen internal controls, documentation, and clarification on the “effective date.” The updated process is outlined below: • A new form was created with clear instructions for the group care facilities to provide the applicant/employee information, including the background check confirmation code, directly to the Department’s Background Check Unit (BCU). • The BCU works with the applicant/employee through the fingerprint background check process. • The results are sent directly to the BCU, at which time they complete a child abuse/neglect history check and if needed a suitability assessment. The BCU documents the results in FamLink with the date the background check is completed. • The BCU emails the results to the group care facility and the Department’s Licensing Division (LD) group. If the applicant/employee is cleared and is not a renewal, LD staff adds the applicant/employee to the group care facility in FamLink with the clearance information attached. The conditions noted in this finding were previously reported in finding 2022-050. Completion Date: April 2023 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Health did not have adequate internal controls to ensure payments to subrecipients were allowable, met cost principles, and were within the period of performance for the Immunization Cooperative Agreements program. Questioned Costs: Assistance Listing # 93.268 93.268 COVID-19 Amount $416,027 Status: Corrective action not taken Corrective Action: The Department does not concur with the finding. The Department disagrees with the State Auditor’s Office (SAO) assessment of a material weakness in internal controls over the consolidated contract provider payment process for the Immunizations Cooperative Agreements program. The level of documentation received from the subrecipient accounting system provided assurance that the exceptions questioned by SAO met federal cost principles for allowability and period of performance. The Department has established processes in place to ensure payments are allowable and meet cost principles for the program. These include: • Program staff maintain detailed budget information for each subrecipient by project area, and as A-19s are submitted, program and accounting staff update budget spreadsheets. When reviewing the support provided by the subrecipient, staff ensure amounts submitted by project are reasonable and align with expectations for the budget period submitted. • Program staff refer to the federal Immunization Program Operations Manual to determine procedures related to allowable costs, purchases, and procurement. • The Fiscal Monitoring Unit provides technical assistance and training to program staff and subrecipients while onsite and at the request of the entities receiving funding. • Program staff provides policy guidance, technical assistance, and training to subrecipients related to program compliance requirements. The program has continued to strengthen processes to ensure supporting documentation aligns with the agency’s documentation matrix for subrecipients in accordance with assigned risk level. The Department is planning on meeting with federal grantors to work through the exceptions and questioned costs identified in the finding. The conditions noted in this finding were previously reported in finding 2022-031. Completion Date: Not applicable Agency Contact: Jeff Arbuckle External Audit Manager PO Box 47890 Olympia, WA 98504-7890 (360) 701-0798 Jeff.Arbuckle@doh.wa.gov

Finding: The Office of Financial Management did not have adequate internal controls over and did not comply with reporting requirements for the Coronavirus State and Local Fiscal Recovery Funds. Questioned Costs: Assistance Listing # 21.027 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Office has continued to strengthen internal controls for the Coronavirus State and Local Fiscal Recovery Fund (SLFRF) reporting to ensure compliance with the federal requirements. The Office will continue to: • Monitor updates to the U.S Treasury’s Project and Expenditure Report User Guide. • Improve the quarterly reporting template and assist state agencies during the reporting process. • Communicate with agencies to remind them of the requirement to maintain adequate supporting documentation for all reports, including quarterly reported obligations. • Ensure reported amounts, including corrections or adjustments made during the reporting period, are properly tracked and documented for the subsequent reporting cycles. • Perform reconciliations of reported expenditures to ensure agency expenditures are accurately reported, allowing for adjustments/ corrections required due to issues with the reporting system. • Ensure reported expenditures and supporting accounting records are adequately reviewed by management before the information is uploaded to the federal reporting system. • Document correspondences with the U.S. Treasury when system errors are identified and resolutions recommended by the grantor, if received. The conditions noted in this finding were previously reported in finding 2022-020. Completion Date: January 2024 Agency Contact: Sara Rupe Deputy Statewide Accounting Director PO Box 43127 Olympia, WA 98504-3127 (360) 974-9252 sara.rupe@ofm.wa.gov

Finding: The Department of Social and Health Services did not have adequate internal controls over and did not comply with requirements for monitoring subrecipients to ensure payments were allowable, properly supported and met period of performance requirements for the Coronavirus State and Local Fiscal Recovery Funds. Questioned Costs: Assistance Listing # 21.027 COVID-19 Amount $312,659,850 Status: Corrective action in progress Corrective Action: The Department partially concurs with the finding. The Department’s Office of Refugee and Immigrant Assistance (ORIA) administered this funding through the Washington COVID-19 Immigrant Relief Fund program and contracted with a subrecipient organization to conduct eligibility determinations to approve and disburse funds to undocumented immigrants. This program is now closed, with all subrecipient contracts ended and the final payments sent in early 2023. The Department is taking action to strengthen internal controls over subrecipient monitoring for ORIA’s contracts. By July 2024, the Department will: • Complete a review of all active contracts utilizing federal funding to ensure subrecipients are accurately identified. • Explore the feasibility of increasing ORIA and Economic Services Administration accounting staff resources to support the workload increase associated with monitoring subrecipients. By October 2024, the Department will convene a work group with contracts and accounting staff to create effective internal controls and written procedures for fiscal and program monitoring of ORIA’s subrecipient contracts. This will include the following: • Verify the subrecipient status for each contract is correctly determined and recorded in the Agency Contracts Database. • Include the required subrecipient language in the contract. • Obtain a copy of the indirect rate certification or cost allocation plan from the subrecipient. • Complete risk assessments. • Create appropriate monitoring plans for each subrecipient. • Conduct fiscal monitoring of each subrecipient to obtain assurance that the use of federal funds complies with federal laws and regulations. • Create corrective action plans when required. By January 2025, the Department will ensure all ORIA program staff responsible for monitoring receive training on the updated procedures. In addition, the Office of the Secretary will request the Department’s Internal Audit and Consultation office conduct an internal audit of ORIA to ensure the program implements strong internal controls, properly accounts for federal funds, and materially complies with federal requirements. The Department does not concur with the questioned costs. The funds were used to assist Washington workers/families who were affected by the COVID-19 pandemic but were unable to access federal stimulus programs and other social support due to their immigration status. Repayment of these funds would only hinder the state’s ability to provide critical services to our clients. If the grantor contacts the Department regarding the questioned costs, the Department will discuss this with the Department of Health & Human Services and will take additional action as appropriate. Completion Date: Estimated January 2025 Agency Contact: Richard Meyer External Audit Compliance Manager PO Box 45804 Olympia, WA 98504-5804 (360) 664-6027 Richard.Meyer@dshs.wa.gov

Identifying Number: 2023-001 Finding: Swope Health Services and Subsidiaries expended federal funding on an invoice with a service period outside of the Period of Availability for Period 5 of the Provider Relief Fund. Corrective Actions Taken or Planned: Management will evaluate and alter the accounts payable invoice review process as necessary to mitigate the risk of inaccurate recording of prepaid expenditures, as was the case in this finding. Management will consider the need to reorganize the assignment of duties as they pertain to the processing and review of invoices and vendor payments to ensure a sufficient level of review of material transactions to ensure accurate accounting of vendor payments. Person Responsible: Naimish Patel, CFO Anticipated Completion Date: Plan to be completed by December 31, 2024

Federal Agency Name: Department of Health and Human Services Program Name: Block Grants for Community Mental Health Services CFDA # 93.958 Finding Summary: There was no formal documentation of review and approval of wage rates prior to the submission of the reimbursement request to SAMHSA for three months selected for testing. Responsible Individuals: Mohamed Omar, MBA, MS, Chief Administrative Officer and Mark Copps, Finance Director / Controller Corrective Action Plan: During 2023, management implemented a formal documentation of the review including the appropriate level of management sign off and date of review on the supporting documentation. Anticipated Completion Date: October 2023

Finding: 2023-047 - DPA obligated more than 10 percent of the FFY 22 grant award during the second fiscal year of the award. Questioned Costs: None Assistance Listing Number: 93.568 Assistance Listing Title: LIHEAP Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): DOH agrees with the finding. Corrective Action (corrective action planned): The Division of Public Assistance (DPA) expanded administrative personnel to enhance oversight and compliance. A comprehensive staff training plan will ensure understanding and adherence to compliance measures. Completion Date (list anticipated completion date): DOH anticipates the finding will be resolved in FY2025. Agency Contact (name of person responsible for corrective action): Josie Stern, Assistant Commissioner

The questioned costs were immaterial and relate to a pay period that was split across the fiscal year (6/27/22 to 7/8/22, with a pay date of 7/15/22). Reports to the funder for the year ending 6/30/22 were due on 7/10/22, before all payroll information and supporting documentation for this pay period was available. Therefore, the full pay period was included in the July reimbursement report. This practice was approved by the funder. Moving forward, the organization will be more cognizant of accrual dates for payroll reporting and submit a true-up as needed to ensure that payroll costs are correctly allocated at the end of the fiscal year. Additionally, in May 2024, the organization will be implementing a new electronic payroll system that will allow us to obtain this information more quickly at the close of each fiscal year to complete billing reports.

2023-018 Oregon Housing and Community Services Ensure grant management report control is performed and documented MANAGEMENT RESPONSE: We agree with this recommendation. A dedicated staff resource has been trained and has brought grant reconciliations and reporting current. Additional training has been provided for awareness of the earmarking and obligation requirements as well. Anticipated Completion Date: June 30, 2024 Contact person: Dean Criscola, Controller

2023-031 Oregon Commission for the Blind Improve controls over compliance reporting MANAGEMENT RESPONSE: We agree with this recommendation. The agency is committed to ensuring the RSA-911 client case information report is accurate and well supported. The agency’s practice is to maintain documentation that supports information contained in the case management system. This practice includes requesting information from clients regarding the start date of employment in the primary occupation and the hourly wage at exit. This information can be difficult to locate due to the numerous case notes in the case management system. Due to the difficulty locating this documentation in the tight timelines of the audit, the agency spent some additional time attempting to locate it after the audit testing period had closed. The agency did find the supporting documentation for one of the two clients that was not located during the audit. For the other client, the agency identified documentation showing that we had requested this information from the client through multiple methods, but it was never received. The agency has created a new case-note category for documenting client employment start date and wages at exit. The agency will provide training to staff on the use of this case note category to ensure this documentation is able to be located more easily and to reinforce the importance of maintaining documentation to support information contained in the case management system. Anticipated Completion Date: August 1, 2024 Contact person: Angel Hale, Director of Vocational Rehabilitation Services

2023-028 Department of Human Services Strengthen controls to ensure adequate supporting documentation and accuracy over reporting MANAGEMENT RESPONSE: We agree with the first recommendation. We disagree with the second recommendation. We agree with the first recommendation and will ensure adequate supporting documentation is maintained and readily available to support information reported in the RSA-911. We disagree with the second recommendation. The RSA-17 is currently reviewed by both Program Leadership as well as the ODHS Grant Accounting Manager. Certification is evidenced by the signed RSA-17. This level of review meets federal requirements. Additional review and discussion may be had as a form of best practice but should not be considered a control mechanism. The Grant Accounting Unit will highlight the certification process in the RSA-17 desk manual to delineate between control functions and best practices. Anticipated Completion Date: June 30, 2024 Contact person: Keith Ozols, Vocational Rehabilitation Services Director; Travis Labrum, Grant Accounting Manager

Federal Agency: Department of Homeland Security Federal Program Name: Hazard Mitigation Grant Assistance Listing Number: 97.039 Recommendation: We recommend that the quarterly reports be reviewed by an appropriate member of management. That review should be documented to ensure a complete audit trail. In addition, all reports should be stored in a centralized location for easy future access. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County is working on implementing a review by management for all HMGP Grant quarterly reports. In addition, this review will be documented and stored in a centralized location for easy future access. The County is looking into creating a policy that would require divisions to save their grant information on a shared drive, while we are also looking at purchasing a grant management software as a repository for all related grant documents. Name(s) of the contact person(s) responsible for corrective action: These HMGP grants are in several divisions, so the directors over those divisions should be responsible for the corrective actions. This would include Tamara Richardson, Utilities Director; Gaye Sharpe, Parks and Natural Resources Director; Jay Jarvis, Roads and Drainage Director; and Keith Tate, Facilities Management Director. Planned completion date for corrective action plan: September 30, 2024

Criteria: According to 2 CFR, Part 200.303 of the Office of Management and Budget’s Uniform Grant Guidance, a non-federal entity must establish and maintain effective internal controls to ensure compliance with federal statues, regulations, and the terms and conditions of federal awards. Condition: Domestic Abuse Intervention Services, Inc.'s internal controls over review of cost allocation journal entries, allowable costs and activities, period of performance, cash management, matching, and reporting were not properly documented. Cause: Sufficient training was not provided to individuals responsible for the documentation of internal controls over compliance requirements. Effect or Potential Effect: This could result in noncompliance, disallowed costs, or discontinuance of federal funding. Recommendation: We recommend formally documenting the controls over each area by providing additional training on documentation and forms to provide evidence of review. Views of Responsible Officials and Planned Corrective Actions: Domestic Abuse Intervention Services, Inc. agrees with the finding. DAIS will implement effective and written procedures and training for the review of cost allocation journal entries, allowable costs and activities, period of performance, cash management, matching, and reporting. The written procedures will explicitly lay out the processes for review and approval of each of these compliance components per each federal Assistance Listing that DAIS receives. The Director of Administration will use the most up to date 2 CFR Part 200, Appendix XI - Compliance Supplement to identify the specific compliance requirements for each of the Assistance Listings and create the written procedures. All reviews and approvals will also be documented henceforth. Shawn Walker, Director of Administration, will oversee the implementation of this corrective action.

The YWCA will implement the following changes in its accounting procedures. 1. The Staff Accountant will review the period each expenditure is related to and record the invoice to the appropriate period when entering it into accounts payable. The month and year will be noted on the invoice. 2. The CFO will review the month and year noted by the Staff Accountant prior to entry into accounts payable.

The YWCA will implement the following changes in its accounting procedures: 1. The Staff Accountant will review the period each expenditure is related to and record the invoice to the appropriate period when entering it into accounts payable. The month and year will be noted on the invoice. 2. The CFO will review the month and year noted by the Staff Accountant prior to entry into accounts payable.

COVID-19 Emergency Rental Assistance – Assistance Listing Number 21.023 Recommendation: We recommend the Authority implements an internal control over compliance to evidence the expenses are approved to be charged to the grant. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action planned/taken in response to finding: Monthly reports are provided for Cost Distribution by Deputy Director of Financial Operations to Deputy Director Programs for review of appropriate charging. Corrections are provided back to Finance and made in the financial system. Name(s) of the contact person(s) responsible for corrective action: Ellen Eudy, Deputy Director, Financial Operations and Marni Holloway, Deputy Director, Programs Planned completion date for corrective action plan: June 30, 2024

See response in attached financial statements

Federal Award Findings and Questions Costs Corrective Action Plan Year Ended August 31, 2023 Finding No. 2023-001: Inaccurate Enrollment Reporting CFDA Numbers: Various Program: Student Financial Assistance Cluster Corrective Action: Students will be required to request special permission to re-enroll, thus ensuring that their graduation is reported before any additional enrollment or withdrawal. Additionally, a thorough assessment of the management review process will be performed to identify areas that will help ensure the accurate submission of data to the NSLDS. We anticipate revised processes in the Spring of 2024. Contact Person: Jaci Casazza Expected Implementation: April 30, 2024

Currently, the College marks students withdrawn on the date the withdrawal is officially processed in the system, indicating their last data of attendance. The withdrawal policy will be updated to indicate that the withdraw date to be reported for all students withdrawing at either the program or campus level should be processed as the "last date of attendance". In the case of the 5-year program (4+1 internally), we currently do not officially "enroll" a student into the master's program until their bachelor's degree is conferred. The official admit date will be updated to reflect the term a student enters the master's program officially, which will begin after the conferral of their bachelor's degree. Our policy and processes for the 4+1 program will be updated to reflect this change.

The finding from the schedule of findings and questioned costs for the year ended December 31, 2023 are discussed below. The findings are numbered consistently with the numbers assigned in the Schedule. Finding 2023-001 Condition: The Organization does not have proper segregation of duties and appropriate level of review and approval prior to charging costs to a federal program. The same individual was approving timecards and reimbursement packets without an additional layer of review. Additionally there was no documentation of review of the reimbursement packets prior to being submitted for reimbursement. Planned Corrective Action: Management has implemented a process to ensure review of the reports prior to finalization and submission to the funder. One person will gather data and appropriate paperwork for reporting and reimbursement purposes. To ensure proper segregation of duties, there will be 2 different individuals that approve timecards and gather reimbursement packets. In addition, a second person will review and approve completed reports and packet prior to submission. This review process will be properly documented and evidenced through signature of the reports. Anticipated Completion Date: March 31, 2024 Contact Person: Pam Schuellerman, Executive Director

For expenditures made pursuant to the American Rescue Plan Act funds received pursuant to Act 2 of 2022, management concurs there were 26 payments totaling $25,836 made after the 90-day performance period ended and more than one retention payment was made to 34 qualified staff members amounting to $31,530. Management will contact the Pennsylvania Department of Human Services and inform them of this finding to determine the appropriate corrective measures.