Corrective Action Plans

Program: AL 93.558 – Temporary Assistance for Needy Families (TANF) – Allowability & Eligibility Corrective Action Plan: The Agency is working on a new process to ensure that only eligible claims are charged to the Federal grant. Contact: Snita Soni, Will Varicak Anticipated Completion Date: 6/30/2024

Program: AL 93.323 – COVID-19 Epidemiology & Laboratory Capacity for Infectious Diseases – Allowability & Subrecipient Monitoring Corrective Action Plan: DHHS will work with the Health Center Association of Nebraska (HCAN) to collect complete source documentation from HCAN's subrecipients and subcontractors. In addition, the ordering process has been updated to ensure adequate documentation is maintained, including delivery receipts. Contact: Ryan Daly, Caryn Vincent, Lucas Atkinson Anticipated Completion Date: 6/30/2024

Program: AL 93.268 – Immunization Cooperative Agreements; AL 93.323 – Epidemiology and Laboratory Capacity for Infectious Diseases (ELC); AL 93.558 – Temporary Assistance for Needy Families (TANF); AL 93.563 – Child Support Enforcement; AL 93.778 – Medical Assistance Program – Allowable Costs/Cost Principles Corrective Action Plan: Issue stems from RPAs not being submitted/processed timely and by incoming and outgoing supervisors for internal moves. Communication to involved parties reminding of the importance of completing RPAs timely and accurately. Contact: Patrick Werner Anticipated Completion Date: 6/30/2024

Program: AL 93.069 – Public Health Emergency Preparedness (PHEP); AL 93.889 – National Bioterrorism Hospital Preparedness Program (HPP) – Matching and Reporting Corrective Action Plan: The agency will ensure total reported match is substantiated by source documentation. In addition, DHHS will work with Federal Partners to make necessary reporting adjustments to the IDC rate used. Contact: Ryan Daly, Lisa Osborne, Ann Murphy Anticipated Completion Date: 6/30/2024

Program: AL 93.069 – Public Health Emergency Preparedness (PHEP); AL 93.889 – National Bioterrorism Hospital Preparedness Program (HPP) – Allowability & Subrecipient Monitoring Corrective Action Plan: The agency will continue to monitor subrecipient expenditures for compliance with applicable federal requirements. Contact: Ryan Daly, Lisa Osborne Anticipated Completion Date: 6/30/2024

Program: Various, including AL 84.027 – Special Education Grants to States; AL 84.173 – COVID-19 Special Education Preschool Grants; AL 84.425D – COVID-19 Education Stabilization Fund – Elementary and Secondary School Emergency Relief Fund (ESSER I and ESSER II); AL 84.425U – COVID-19 Education Stabilization Fund – American Rescue Plan – Elementary and Secondary School Emergency Relief Fund (ARP ESSER) – Subrecipient Monitoring Corrective Action Plan: First SPED subrecipient – As education subrecipients have had a significant influx of subawards to mitigate post-COVID supports for Nebraska education with limited staff capacity, the Department has remained mindful of these conditions and is on schedule to complete its annual fiscal monitoring efforts within the normal timelines afforded each year. Second SPED subrecipient – Because the UNL utilizes PVS as allowed by 2 CFR 200.430 in regard to salary and wage benefit costs for employees working on a project under a contractual grant agreement, the NDE going forward will require PVS supporting documentation be submitted as a minimum semi-annually for each contract to verify the salary and benefit costs being requested for reimbursement as recommended by the U.S. Department of Education beginning with any payments occurring after March 1, 2023. Third SPED subrecipient – The documentation to support the review of purchased services and supplies during fiscal monitoring was provided to the APA on March 4, 2024. Single Audits – The Director of Grants Management and Director of Grants Compliance will work collaboratively to ensure all subrecipient audits are reviewed and applicable management decision letters are issued within the requested timeframe. Contact: Jen Utemark, Administrator, Office of Budget & Grants Management Anticipated Completion Date: July 1, 2024

Program: AL 10.555 – National School Lunch Program – Allowability Corrective Action Plan: In the future, the FNS640 report will be checked monthly by two team members: Director of Child Nutrition Programs and the Program Specialist who is responsible for Administrative Review quality control effort. The FNS640 report identifies if an AR did not have the claim validation completed; if this is discovered, the Program Specialist will be notified and required to complete the claim validation and accompanying information within 10 working days. Contact: Kayte Partch, Assistant Administrator, Office of Coordinated Student Support Anticipated Completion Date: Immediately

Program: AL 93.658 – Foster Care Title IV-E; AL 10.561 – State Administrative Matching Grants for the Supplemental Nutrition Assistance Program; AL 93.659 – Adoption Assistance – Allowable Costs/Cost Principles Corrective Action Plan: DHHS will assign RMTS Administrator rolls to Program staff to better monitor the RMTS process. Contact: Patrick Werner Anticipated Completion Date: 6/30/2024

Program: AL 93.558 – Temporary Assistance for Needy Families; AL 93.563 – Child Support Enforcement; AL 93.568 – Low Income Home Energy Assistance (LIHEAP); AL 93.575 – Child Care and Development Block Grant; AL 93.658 – Foster Care Title IV-E; AL 93.778 – Medical Assistance Program; AL 10.561 – State Administrative Matching Grants for the Supplemental Nutrition Assistance Program – Allowable Costs/Cost Principles Corrective Action Plan: Training will be completed that highlights the importance of complete and accurate Journal Entries and how they may affect Federal Funding. Contact: Patrick Werner Anticipated Completion Date: 6/30/2024

The School Board Administration Building (SBAB),Cooling Tower Replacement project 02190000 was originally funded using Comprehensive Needs for the Design Phase. When the project was ready to commence to the construction phase it was decided to fund this phase with ESSER Funds. Subsequently, the contractor was not advised this project was subject to Davis Bacon requirements. All other projects reviewed did adhere to the Davis Bacon prevailing wages and certified payroll. We consider the SBAB Project to be an isolated incident. Moving forward, we have changed our procedures hen requesting project numbers. The requestor must identify the funding source and include a note in the project description when requesting project numbers. We have also updated our Contracting Software so that projects funded with ESSER Funds are identified at the beginning of the project. These procedures will prevent this from occurring in the future.

The school has implemented the recommendation by reviewing the eligible expenditures with the appropriate administrative staff to ensure they are following the proper procedures and reporting only allowed expenses.

Management will enhance its internal controls to ensure payroll allocation costs are properly calculated and costs are charged to the federal program properly.

FINDING 2023-007 Information on the federal program: Subject: COVID-19 - Education Stabilization Fund – Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425D Federal Award Numbers and Years (or Other Identifying Numbers): S425D200013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Findings: Material Weakness, Modified Opinion Contact Persons Responsible for Corrective Action: Regin Johnson, Title I Director Chris Akers, Treasurer Adrian Wilkerson, Chief Financial Officer Contact Phone Number and Email Address: (219) 838-1819 rjohnson@lakeridgeschools.net cakers@lakeridgeschools.net awilkerson@lakeridgeschools.net Condition: An effective internal control system was not in place at the School Corporation to ensure compliance with requirements related to the grant agreement and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements. Context: A number of transfer adjustments were made during the audit period from Corporation fund 7923 (ESSER III) to fund 7941 (CARES Ed Stabilization). These transfers were made move payroll disbursement activity for reimbursement. Support for these adjustments was traced to School Corporation’s records to verify the Gross Payroll activity moved for all but one transaction, which totaled $27,824. The supporting documentation for this transaction exceeded the amount of the transaction. Inquiry with School Corporation officials and review of the documentation determined that the amount transferred in this transaction was based on the remaining grant budget amounts in the grant fund 7941. The transaction was not based on actual payroll disbursements as all other transfer adjustments were. The $27,824 without supporting documentation is considered questioned costs. Views of Responsible Officials: We concur with the finding. Description of Corrective Action Plan: For future transfers of payroll disbursements, both the Treasurer and Grant Director will ensure that the amount transferred corresponds to actual, documented payroll expenses and not an aggregate salary and/or benefit expenditure. The Chief Financial Officer shall review and approve these transfers to ensure compliance. Anticipated Completion Date: Immediate

FINDING 2023-003 Information on the federal program: Subject: Child Nutrition Cluster - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Agriculture Federal Programs: School Breakfast Program, National School Lunch Program, Summer Food Service Program for Children, Fresh Fruit and Vegetable Program Assistance Listings Numbers: 10.553, 10.555, 10.559, 10.582 Federal Award Number and Year (or Other Identifying Numbers): FY2021-2022, FY2022-2023 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness, Modified Opinion Contact Person Responsible for Corrective Action: Adrian Wilkerson, Chief Financial Officer Contact Phone Number and Email Address: (219) 838-1819 awilkerson@lakeridgeschools.net Condition: An effective internal control system was not in place at the School Corporation to ensure compliance with requirements related to the grant agreement and the Activities Allowed or Unallowed and the Allowable Costs/Cost Principles. Context: The School Corporation had not designed or implemented a system of internal control to ensure that program costs incurred by the Food Service Management Company were supported by proper documentation and were allowable. The School Corporation entered into a cost reimbursement contract with a food service management company (FSMC). The FSMC incurred costs and invoiced the School Corporation for reimbursement of the costs. Due to the lack of effective internal controls, the following errors were noted: In a test of 44 items, 22 items (50%) totaling $6,641 did not have proper documentation to support that the expenses were allowable and for the benefit of food service. Views of Responsible Officials: We concur with the finding. Description of Corrective Action Plan: In addition to the monthly review of the FSMC invoice and budget, the Chief Financial Officer will review and approve the supporting documentation (invoices, payroll records) provided by the FSMC to ensure that expenses are allowable and for the benefit of food service. Anticipated Completion Date: Immediate

Audit Finding Reference: 2023-002 Planned Corrective Action: Review of purchasing policy and federal procurement procedures with grant managers as well as the AP/Grant reporting staff. No purchase will be processed without proper documentation. Name of Contact Person and Completion Date: Brian Cisneros (Business Administrator) Anticipated Completion Date – 4/1/24

Audit Finding Reference: 2023-001 Planned Corrective Action: Onboarding procedure is being changed where employees are not able to start working until a signed contract is on file in their HR file. Name of Contact Person and Completion Date: Brian Cisneros (Business Administrator) Michael Hatfield (HR Director) Anticipated Completion Date – 4/1/24

FINDING #2023-004: EDUCATION STABILIZATION FUNDS (ESF)- EQUIPMENT AND OTHER CAPITAL EXPENDITURES (50000) Corrective Action Plan: If the district would like to use Elementary and Secondary School Emergency Relief Ill (ESSER Ill) Fund (Resource 3213) to support capital expenses, the district will seek prior approval from the California Department of Education. The district will keep the approval on file.

FIDING NO. 2023-003 PROCUREMENT SUSPENSION AND DEBARMENT CONDITION We examined one hundred percent (100%) of the disbursed made and charged to HEERF Institutional Aid for the fiscal year 2022-2023 and noted the following: 1) UPM did not have documentation related Schools are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. 2) UPM made five (5) payments for $100,406.71 in advance for goods or services not received at the disbursement date. RECOMMENDATION The Institution should reinforce the established procedures and adhere to them before any payment is made for goods or services. The amount of $100,406.71 should be reimbursed to the U.S. Department of Education. In addition, UPM should be included in its procedures steps to adopting regulations, to verify that the vendor entity is not suspended or debarred or otherwise excluded from participating in the transaction. Corrective Action Plan: The UPM requested the documents from potential vendors that authorized them to do business in Puerto Rico. The selected company, Vitaltek, provided documents showing that it was established and compliant with the law, precisely the evidence that they were not debarred or suspended. The UPM has a procurement process titled " Reglamento para la Adquisici6n de Equipos, Materiales y Servicios No Personales de la Universidad Pentecostal MIZPA" that states the process for verifying debarment and suspension. Prepayments The UPM has analyzed each prepayment, and we have evidence that the services, equipment. and materials have been received. In addition to having the purchase orders, contract, and invoices, we have the equipment in our facilities in good condition and inspected per our internal procedures, titled "Reglamento para la Administraci6n de Propiedad Mueble (Equipo) de la Universidad Pentecostal Mizpa." Vitaltek was the only company that provided a quote and was selected due to the COVID-19 emergency. Their purchase condition required a prepayment for ordering and obtaining products. Regarding the Service Contract for the photocopiers, we recognize that it was paid in advance; however, to date, all services related to this contract that we have required have been offered in compliance with each of the clauses and agreements signed. The acquisition of this type of equipment comes with a multiyear plan and maintenance services included in the package, which is the industry standard and necessary for the institution's administrative and academic operations. Understanding the seriousness of the correct administration of these funds, the Dean of Administration will periodically evaluate compliance with any contract. If it is not complied with, we will proceed through legal action to quickly recover these funds. The UPM understands that it should not reimburse this money to the United States Department of Education because there is sufficient evidence to demonstrate that the funds have been used within legal parameters, that they have strengthened the University in academic and administrative and that from now on we will observe the following to comply with such an essential and necessary reservation. Corrective action plan to follow: All employees. including those in the office of the presidency, have been finally and firmly alerted that advance payments should be avoided or only considered in emergency situations. All employees authorized to reach contractual agreements will be trained on this topic, and the internal procedures will be reviewed and edited to address prepayments and emergency processes. We will appoint an employee in charge of managing all compliance documentation so that, together with the Dean of Administration and Finance, they can locate and group all the relevant standards and regulatory procedures and have the power to guide so that each of its recommendations is willingly observed. This will be supported by the requirements that always accompany each award. In addition, these officers will have the power to make external consultations with professionals familiar with these matters.

Special Tests and Provisions Education Stabilization Fund: Assistance Listing No. 84.425 Recommendation: We recommend that for future construction contracts financed by federal education funds PLA verify that subcontractors comply with prevailing wage requirements. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: PLA will train operations and business office staff on the compliance requirements under Davis-Bacon to ensure construction contracts are entered into with qualified contractors and obtain and retain appropriate certified payroll documentation during the construction period. Name(s) of the contact person(s) responsible for corrective action: Carlo Hershberger, Director of Finance and Accounting; Javier Dimas, Vice-President of Operations; Martha Arellano, Procurement Manager and Buyer Planned completion date for corrective action plan: April 1, 2024 If the United States Department of Education has questions regarding this plan, please call Eva Spilker, Chief Financial Officer, at 410-598-3087.

FINDING 2023-005 Subject: Child Nutrition Cluster (CNC) – Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirements. Context: During testing of reporting, we identified a control breakdown in the claim submission process. Although student meal data is summarized at the school level and reviewed by both the Food Services Bookkeeper and the Food Services Director, there is not a review of the actual claim submission prior to being submitted to the portal. Due to the breakdown in controls, we identified that the October 2022 revision claim overstated breakfasts served by 10 meals. Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: The Director of Food Services will input the monthly claims into the state reporting system. This will be checked by the bookkeeper prior to submission to ensure data was entered correctly. Responsible Party and Timeline for Completion: Beginning January 2024

FINDING 2023-003 Subject: Child Nutrition Cluster (CNC) – Internal Controls Federal Agency: Department of Agriculture Federal Program: School Breakfast Program, National School Lunch Program Assistance Listing Number: 10.553, 10.555 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Allowable Costs Audit Findings: Material Weakness Condition: The School Corporation did not have adequate internal controls in place to ensure that the School Corporation complied with the allowable cost requirements. Context: During our testing of the School Corporation’s compliance with the allowable costs requirements for CNC, we noted the following exceptions in our testing of 120 disbursements (60 vendor and 60 payroll): 1. The School Corporation paid $233 of sales tax across three vendor food purchases. 2. For two employee payroll selections, we were unable to trace their rate of pay to a Board approved wage rate ordinance or contract. The total amount paid out to the two employees was $2,635. FINDING 2023-003 (Continued) 3. We identified one employee that the School Corporation incorrectly paid one hour more than what the timecard stated, resulting in an overpayment of $14. Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: Food Service Director will review and signature all fund 800 expenditures prior to disbursement. All Food Service employee wages will align with the board approved rates. Payroll will be signed as reviewed by direct supervisors and the Business Office prior to remittance. Responsible Party and Timeline for Completion: Implement immediately

Finding Number 2023-003 • Significant deficiency in internal controls over compliance related to procurement. Federal Agency: U.S. Department of Commerce Program Title: Pacific Fisheries Data Program Assistance Listing Number: 11.437 Award Numbers: NOAA-NMFS-AK-2023-2007663 Award Period: October 1, 2022 to September 30, 2027 Criteria • 2 U.S. Code of Federal Regulations (CFR) Part 200 Uniform Administrative Requirements, Procurement Standards require that awardees use documented procurement procedures for the acquisition of property or services required under a Federal award or subaward. Condition/Context for Evaluation • IPHC's internal controls over procurement do not include the controls and procedures required by 2 CFR 200. Questioned Costs • Not applicable. Cause • IPHC has not yet modified its procurement policies with the requirements of the 2 CFR Part 200 Procurement Standards. Effect or Potential Effect • As a result, IPHC cannot be certain that procurements were conducted in accordance with the 2 CFR Part 200 Procurement Standards. Repeat Finding • Not applicable. Recommendation • We recommend that IPHC update its procurement policy to include all procurement requirements of 2 CFR Part 200. - Procurement standards 2 CFR 200 Subpart D or 200.318-200.327 - Requirement for documented policies consistent with standards 200.318(a) Contact Person(s): • Executive Director: David Wilson (david.wilson@iphc.int); • Assistant Director: Andrea Keikkala (andrea.keikkala@iphc.int) Explanation and specific reasons for disagreement with the audit finding or that corrective action is not required (if applicable): Not applicable. Corrective action planned: As this was the IPHC’s first full GAAP Audit, Single Audit of federal grant funds, and also our first year transitioned from a Cash-basis of accounting to an Accrual-basis of accounting, there are a number of policies and procedures that are in the process of being amended. It will take the Secretariat several months to bring our written process guides into alignment with “2 U.S. Code of Federal Regulations (CFR) Part 200”, as well as our Financial Regulations (2021) that will be considered for amendment at the upcoming 100th Session of the IPHC Finance and Administration Committee (FAC100) and subsequent 100th Session of the IPHC Annual Meeting (AM100) in late January 2024. During the 2nd quarter of FY2024 (1 January – 31 March 2024) the IPHC will undertake a thorough review of “2 U.S. Code of Federal Regulations (CFR) PART 200—UNIFORM ADMINISTRATIVE REQUIREMENTS, COST PRINCIPLES, AND AUDIT REQUIREMENTS FOR FEDERAL AWARDS” and update our procurement policies and processes accordingly. Anticipated completion date: Deadline: 1 April 2024.

Finding Number 2023-002 • Significant deficiency in internal controls over compliance related to allowable costs and period of performance. Criteria • 2 U.S. CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards require that costs must be necessary and reasonable for the performance of the Federal Award, that costs be determined in accordance with GAAP, and that costs be adequately documented including the allocation of those costs. Condition/Context for Evaluation • IPHC’s internal controls over non-payroll charges to the Federal Award did not include review for allowability, accrual in the proper period, or that adequate documentation existed to support the amounts charged or allocated. Three out of 25 nonpayroll disbursements tested did not include evidence supporting one or more of these controls. Questioned Costs • $2,674 Cause • IPHC’s operation of internal controls were not sufficient to ensure allowable costs were charged in accordance with 2 U.S. CFR 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Effect or Potential Effect • As a result, charges were made to Federal awards that were not allowable. Repeat Finding • Not applicable. Recommendation • We recommend that IPHC ensure internal controls include reviewing costs charged to the Federal Award for conformity with 2 U.S. CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards for allowability, allocability, and reasonableness. o Allowability 200.403, 200.404, 200.405 o Allowable budget period – 200.403 (h) Contact Person(s): • Executive Director: David Wilson (david.wilson@iphc.int); • Assistant Director: Andrea Keikkala (andrea.keikkala@iphc.int) Explanation and specific reasons for disagreement with the audit finding or that corrective action is not required (if applicable): Not applicable. Corrective action planned: We acknowledge that the deficiencies identified, while minor in dollar value to the grant, represent areas for improvement. The specific issues identified were: 1. Field office rental: A field office rental statement was partially charged to the incorrect fiscal year. Reason: The landlord submitted the invoice for payment after the year-end close (FY2022) and was subsequently fully charged to FY2023, instead of being split across fiscal years. 2. Postage (2 elements): The IPHC loads postage stamps on a stamps.com account to process missing logbook notices to vessel owners, a function that pertains to a grant. Clear delineation of the cost of the stamps allocated to the grant and the stamps allocated to activities that do not qualify under the grant were not enumerated. The employee that requested the stamps in the procurement software did so because the lead team member was not available. When procuring the stamps the face-value of a stamp was used at $0.60 instead of $0.57, a discount the organization receives due to bulk purchase and stamp.com membership. The cost of this error was $9.96. At the start of FY2023, we used a single operating Fund (Fund 30 – Statistics) to record income and expenses for data related activities that included some grant funds. During the course of the year, we commenced the development of the new 5-year grant application with NOAA Fisheries to cover IPHC’s Directed Commercial Catch Sampling of Pacific halibut in Alaska (IPHC Grant 802) (Grant Number: NOAA-NMFS-AK-2023-2007663) from FY2022-FY2026. During this grant renewal/development process, a decision was taken to split Fund 30 – Statistics into two, with Fund 35 AK Cost-Recovery being created. This new Fund 35 was developed to contain only those expenses and income that were deemed as eligible under the grant rules. Over the course of the year, the Secretariat categorized income and expenses between the two Funds, which involved recoding some transactions coded to Fund 30 at the start of the fiscal year, to Fund 35 later in the year. For FY2024, we will continue to undertake monthly reconciliation and month-end close processes to ensure charges are appropriately coded and attributed. In addition, the year-end reconciliation and close processes will support the attestation of funds spent under the grant within one month of the fiscal year ending. This proactive approach aims to ensure timely completion for the single audit, allowing for comprehensive scrutiny of costs assigned to the grant before incorporating financial statements for review during the single audit process. Further, we will ensure preliminary scrutiny and month-end close of financial reports pertaining to grant funds before loading them to the auditors for review. Finally, our procedures have already been improved to ensure that costs charged to the federal awards are charged to the appropriate activity code and are allowable under federal cost principles. Anticipated completion date: Completed - 1 December 2023, and annually by year-end closeout.

Finding 2023-003: Student Financial Assistance Cluster Gramm-Leach-Bliley Act-Student Information Security Management Response: Management agrees with the finding. The Vice President of Information Technology will ensure that specific actions and strategic initiatives have been implemented to ensure full compliance with the GLBA requirements for the 2023-2024 fiscal year. Corrective Action Plan: We have undertaken a thorough review of our current information security practices and policies. This document outlines the specific actions and strategic initiatives that have been implemented or are planned for implementation to ensure full compliance with the GLBA requirements for the 23/24 fiscal audit. Summary: 1. Element-Specific Actions: Responses to Elements 1 through 9 demonstrate active and ongoing improvements in our information security infrastructure, highlighting key areas such as risk assessment, staff training, vendor management, and incident response protocols. 2. Policy Implementation: A suite of critical security policies, including areas like Access Control, Incident Response, and Encryption, will be rolled out by the 23/24 audit cycle, significantly strengthening our security posture. 3. Security Operations Center (SOC): The establishment of a SOC by the upcoming June 24 board meeting marks a pivotal step in enhancing our real-time security monitoring and response capabilities. 4. Third-Party Compliance Review: The involvement of Deep Seas in a thorough review of our documentation and policies before the next audit cycle ensures an additional layer of scrutiny and compliance assurance. This plan reflects our commitment to not only address the current audit findings but also to continuously evolve our security practices to protect customer information and maintain compliance with GLBA standards.

Federal Agency Name: Department of Health and Human Services Program Name: COVID-19 Provider Relief Fund and American Rescue Plan Federal Financial Assistance Listing #93.498 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Costs Principles and Reporting Finding Summary: Winneshiek Medical Center claimed expenses that had been reimbursed by another source. The Medical Center is a critical access hospital which means that a portion of their expenditures are covered by Medicare. The Medical Center did not decrease their expenses for the portion that was reimbursed by Medicare. The Medical Center’s special report submitted to the Department of Health and Human Services for Period 4 TIN #420680487 reported these expenses that were reimbursed by other sources which made the report inaccurate as well. Responsible Individuals: Ben Stevens, CFO Corrective Action Plan: Management agrees with the finding. The Medical Center created a “Federal Reporting Review Policy” dated March 9, 2023 as a result of working with HRSA and the 2021FY audit. This policy was approved and is now in process. Anticipated Completion Date: No future reports are anticipated to be filed under this program.