Corrective Action Plans

Finding 377373 (2023-001)

Significant Deficiency 2023

SC

Questioned Costs Eligibility HUD Housing Programs

Finding 2023-001 – Housing Opportunities for Persons with AIDS Tenant Files – Eligibility – Rent Calculations Noncompliance & Significant Deficiency Housing Opportunities for Persons with AIDS Program – ALN 14.241, Grant Year 2022 & 2023 Corrective Action Plan: The two tenant files with income c...

Finding 2023-001 – Housing Opportunities for Persons with AIDS Tenant Files – Eligibility – Rent Calculations Noncompliance & Significant Deficiency Housing Opportunities for Persons with AIDS Program – ALN 14.241, Grant Year 2022 & 2023 Corrective Action Plan: The two tenant files with income calculation errors resulting in the tenant overpaying. This has been corrected on both files and tenants have had a HAP payment in excess of their rental amount to provide a credit. The tenant file with no recertification in 2022. We have no idea how this could have happened unless a wrong date prior to this. The recertification was done in July 2023 and scheduled to be done for July 2024, so we are going forward. Additional file reviews will be done in the future. Person Responsible: Joseph Beasley and Connie Howard Anticipated Completion Date: Everything except the additional file reviews has already occurred (2/5/24).

View Audit 295163

Finding 377362 (2023-004)

Significant Deficiency 2023

Tri-County Community Action Partnership, Inc.

MN

Questioned Costs Allowable Costs / Cost Principles Significant Deficiency

Head Start - AL #93.6000 Recommendation: The Organization should review and approve the related to the indirect costs that are automatically allocated by the system and retain support of this review and approval. Explanation of disagreement with audit finding: There is no disagreement with the audit...

Head Start - AL #93.6000 Recommendation: The Organization should review and approve the related to the indirect costs that are automatically allocated by the system and retain support of this review and approval. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: We implement a policy to ensure review and approval of cost allocations. Name(s) of the contact person(s) responsible for corrective action: Rita Zilka, Fiscal Director Planned completion date for corrective action plan: September 30, 2024

View Audit 295153

Finding 377352 (2023-001)

Significant Deficiency 2023

Esperanza Health Centers

IL

Questioned Costs Cash Management Significant Deficiency

Action taken in response to finding: Esperanza reviewed the current year’s HRSA drawdown sheet and updated all personnel salaries. We will also revise the draw down sheet so each person’s current salary is visible each month, and apply conditional formatting to highlight any person making in excess ...

Action taken in response to finding: Esperanza reviewed the current year’s HRSA drawdown sheet and updated all personnel salaries. We will also revise the draw down sheet so each person’s current salary is visible each month, and apply conditional formatting to highlight any person making in excess of the salary cap. Name(s) of the contact person(s) responsible for corrective action: Ryan Gadia Planned completion date for corrective action plan: May 31, 2024. If there are any questions regarding this plan, please call Ryan Gadia at (773) 640-5792.

View Audit 295147 Questioned Costs: $1

Finding 377345 (2023-002)

Significant Deficiency 2023

Edgewood College, Inc.

WI

Questioned Costs Internal Control / Segregation of Duties Special Tests & Provisions

Finding: The College did not have documented controls in place reviewing that the comprehensive information security program was in compliance with the Safeguards Rule and was prepared and in place by June 9, 2023. The College did meet the compliance requirements. The College is required to have doc...

Finding: The College did not have documented controls in place reviewing that the comprehensive information security program was in compliance with the Safeguards Rule and was prepared and in place by June 9, 2023. The College did meet the compliance requirements. The College is required to have documented internal controls in place to monitor compliance over special tests in accordance with the Uniform Guidance. On December 9, 2021, the Federal Trade Commission issued final regulations for 16 Code of Federal Regulations Part 314 to mplement the Gramm-Leach-Bliley Act (GLBA) information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet. The FTC stated that it "believes many of the requirements set forth in the Final Rule are so fundamental to any information security program that the information security programs of many financial institutions will already include them if those programs are in compliance with the current Safeguards Rule." Institutions are required to be in compliance with the revised requirements no later June 9, 2023. Institutions are required to develop, implement and maintain a comprehensive information security program that is written in one or more readily accessible parts. The College did not have proper documented controls in place to ensure that the College was compliant with GLBA Safeguards equirements in the timeframe specified by 16 CFR Part 314. Corrective Action: Management agrees and has implemented necessary procedures/controls to ensure the College is in compliance with enrollment requirements.

View Audit 295133

Finding 377339 (2023-001)

Material Weakness 2023

Edgewood College, Inc.

WI

Questioned Costs Special Tests & Provisions Student Financial Aid

Finding: Management's review of the enrollment reporting did not detect errors on certain student data elements. Certain student records within the NSLDS were identified with inaccurate data elements. The College is responsible for designing, implementing, and maintaining internal control over compl...

Finding: Management's review of the enrollment reporting did not detect errors on certain student data elements. Certain student records within the NSLDS were identified with inaccurate data elements. The College is responsible for designing, implementing, and maintaining internal control over compliance for special tests and provisions and for accurately reporting significant data elements under the Campus-Level and Program-Level records within the National Student Loan Data System (NSLDS) that the Department of Education (ED) considers high risk. The College's internal control over compliance for special tests are not operating effectively. The preparer did not update the student's status into NSLDS resulting in inaccuracies in significant Campus-Level and Program-Level enrollment date elements that ED considers high risk. Additionally, student with status changes were incorrectly reported as withdrawn but upon review of internal documentation, those same students graduated. We recommend management review and enhance its review policies and procedures surrounding enrollment reporting submissions to ensure the accuracy of data elements reported to ED. A review performed by an appropriate individual separate from the prepared prior to the submission of the enrollment reports to NSLDS may improve the accuracy of enrollment reporting. We also recommend management review all students reported to NSLDS to verify they are accurately reported. Corrective Action: Management agrees and has implemented necessary procedures/controls to ensure the College is in compliance with enrollment requirements.

View Audit 295133

Finding 377328 (2023-001)

Significant Deficiency 2023

Midway Star Academy

MN

Questioned Costs School Nutrition Programs Internal Control / Segregation of Duties

CORRECTIVE ACTION PLAN (CAP): Explanation of Disagreement with Audit Findings: There is no disagreement with the audit finding as stated. Actions Planned in Response to Finding: Management will review expenditures coded to the food service program to ensure that only allowable expenditures are cha...

CORRECTIVE ACTION PLAN (CAP): Explanation of Disagreement with Audit Findings: There is no disagreement with the audit finding as stated. Actions Planned in Response to Finding: Management will review expenditures coded to the food service program to ensure that only allowable expenditures are charged there. Official Responsible for Ensuring CAP: The Executive Director is the official responsible for ensuring corrective action of the deficiency. Planned Complete Date for CAP: The planned completion date is June 30, 2024. Plan to Monitor Completion of CAP: The Executive Director and Financial Service Provider will monitor the expenditures in the food service program.

View Audit 295129 Questioned Costs: $1

Finding 377325 (2023-001)

Material Weakness 2023

Horizon Health and Wellness, Inc.

AZ

Questioned Costs Material Weakness Reporting § 200.303

Department of Health and Human Services Federal Assistance Listing #93.498 COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 4 TIN #860554593 Reporting Material Weakness in Internal Control Over Compliance and Material N...

Department of Health and Human Services Federal Assistance Listing #93.498 COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 4 TIN #860554593 Reporting Material Weakness in Internal Control Over Compliance and Material Noncompliance Finding Summary: The Organization selected option iii to calculate lost revenue using budgeted gross revenues to actual gross revenues. The Organization’s HHS Period 4 Report included lost revenues for three quarters that did not agree to the supporting calculation of lost revenues. Without proper implementation of internal controls over the Organization’s budget prior to submission errors could occur resulting in the Organization not calculating lost revenues correctly. Status: The Organization will be adopting a policy to enhance internal controls over the budget to ensure that the lost revenue calculation is not changed after submission and follows the option iii methodology utilized to calculate lost revenues. Responsibility of: Richard Leonard (Controller) and Andrew Horan (Director of F.P. and A.) Estimated Completion Date: 3/31/24

View Audit 295119

Finding 377324 (2023-002)

Significant Deficiency 2023

Sarasota County, Florida

FL

Procurement, Suspension & Debarment Questioned Costs § 200.318 § 200.326

COVID 19 Coronavirus State and Local Fiscal Recovery Funds/ ALN 21.027 - Significant Deficiency - Internal Controls over Procurement Prior to purchase, Sarasota County worked with the State of Florida Medical Examiner to create and document procurement policies in conformance with the Uniform Guidan...

COVID 19 Coronavirus State and Local Fiscal Recovery Funds/ ALN 21.027 - Significant Deficiency - Internal Controls over Procurement Prior to purchase, Sarasota County worked with the State of Florida Medical Examiner to create and document procurement policies in conformance with the Uniform Guidance, to include sourcing of quotes, issuance of purchase orders, and certifications by vendors on acknowledgment and adherence to applicable 2 CFR requirements. The County acknowledges that the State of Florida Medical Examiner conformed with these requirements prior to purchase to include noncompetitive purchases which was further supported in a dated letter provided by the Chief Medical Examiner. The Program Division Manager, Steve Hyatt shall require and retain such additional documentation within its procurement files and will conform to sourcing this documented information for these instances prior to any future purchases. Implementation date for this process - Immediately

View Audit 295115

Finding 377318 (2023-001)

Material Weakness 2023

Sarasota County, Florida

FL

Questioned Costs Subrecipient Monitoring Material Weakness § 200.303

Material Weakness - Internal Controls over Reporting and Noncompliance The Office of Financial Management (OFM) Grant Program Administrator, Heather Larson will monitor and ensure that Federal Funding Accountability and Transparency Act of 2006 (FFATA) reports are filed as required in the FSRS syste...

Material Weakness - Internal Controls over Reporting and Noncompliance The Office of Financial Management (OFM) Grant Program Administrator, Heather Larson will monitor and ensure that Federal Funding Accountability and Transparency Act of 2006 (FFATA) reports are filed as required in the FSRS system. Since the recent transition of the CDBG Entitlement Cluster from an outside agency back to Sarasota County, the County has implemented a standardized form to capture needed information from current and future subrecipients to report appropriately the requirements of the Federal Funding Accountability and Transparency Act of 2006 (FFATA). The OFM Grant Analyst assigned to the funding award, upon review of any pending subaward/ subaward amendment, will create an Action Item utilizing the Grants Administration module of OnBase. The Action Item will require completion of any required FSRS reporting. Action item will be assigned and have a deadline date no late than the last day of the month following the month in which the subaward/ subaward amendment obligation was made. Implementation date for this process - On or before February 28, 2024.

View Audit 295115

Finding 377304 (2023-005)

Significant Deficiency 2023

Floyd County Medical Center

IA

Questioned Costs Reporting Significant Deficiency § 200.303

Federal Agency Name: Department of Health and Human Services Program Name: COVID‐19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 4 TIN #420868216 Federal Financial Assistance Listing #93.498 Compliance Requirement: Reporting...

Federal Agency Name: Department of Health and Human Services Program Name: COVID‐19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 4 TIN #420868216 Federal Financial Assistance Listing #93.498 Compliance Requirement: Reporting Finding Summary: There was no evidence retained that the Hospital’s special report submitted to the Department of Health and Human Services for Period 4 TIN #420868216 was reviewed or approved by an individual separate from the preparer prior to submission. Responsible Individuals: Craig Carstens, CFO Corrective Action Plan: Management agrees with this finding. Management will designate specific individuals to review HHS special report submissions before submission to HHS. Management will require documentation verifying independent review and approval prior to submission. Management will provide comprehensive training to staff on the importance of independent review processes. Management will set up automated workflow systems and checklists to enforce review procedures. Management will regularly audit the review process, gather feedback, and make necessary adjustments for enhancement. Anticipated Completion Date: 2/26/2024.

View Audit 295111

Finding 377287 (2023-106)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Subrecipient Monitoring Reporting § 200.303

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS will perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve reporting errors. Additio...

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS will perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve reporting errors. Additionally, DSS will create a systems modification request to correct errors that are identified as occurring as a result of inaccurate programming in the data modification phase of federal report creation. Estimated Completion Date: 12/31/2024

View Audit 295106

Finding 377284 (2023-105)

Material Weakness 2023

Commonwealth of Virginia

VA

Questioned Costs Subrecipient Monitoring Material Weakness

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Mark Golden, Economic Assistance and Employment Manager Division of Benefit Programs Corrective Action Planned: Perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve r...

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Mark Golden, Economic Assistance and Employment Manager Division of Benefit Programs Corrective Action Planned: Perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve reporting errors. Create a systems modification request to correct errors that are identified as occurring as a result of inaccurate programming in the data modification phase of federal report creation. Estimated Completion Date: 6/30/2024

View Audit 295106

Finding 377283 (2023-104)

Material Weakness 2023

Commonwealth of Virginia

VA

Questioned Costs Eligibility Material Weakness § 200.303 § 200.501

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS has requested the vendor's records. Once received, DSS will audit those records to provide reasonable assurance that the contractor administer...

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS has requested the vendor's records. Once received, DSS will audit those records to provide reasonable assurance that the contractor administered the LIHWAP federal grant program in accordance with federal statutes, regulations, and the terms and conditions of the federal award before it closes the grant award. Estimated Completion Date: 6/30/2024

View Audit 295106

Finding 377280 (2023-103)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Subrecipient Monitoring Eligibility § 200.303

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director Senior Benefit Programs Denise Surber, EAP Manager - Division of Benefit Programs Corrective Action Planned: DSS will work to provide additional training to local agency eligibility workers on h...

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director Senior Benefit Programs Denise Surber, EAP Manager - Division of Benefit Programs Corrective Action Planned: DSS will work to provide additional training to local agency eligibility workers on how to properly determine and document eligibility determinations in the case management system. Additionally, DSS will consider monitoring local agency eligibility worker’s use of manual overrides to confirm that they properly document eligibility determinations in the case management system. Estimated Completion Date: 12/31/2024

View Audit 295106 Questioned Costs: $1

Finding 376168 (2023-086)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Questioned Costs Subrecipient Monitoring § 200.303

Responsible Contact Person(s): Steve Hanoka, Chief Information Security Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virgin...

Responsible Contact Person(s): Steve Hanoka, Chief Information Security Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 4/1/2024

View Audit 295106

Finding 376162 (2023-072)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Subrecipient Monitoring Reporting § 200.303

Responsible Contact Person(s): Naveen Abraham, Chief Core Infrastructure Services Corrective Action Planned: Ensuring that infrastructure suppliers fulfill all contractual requirements with respect to Commonwealth security policies and standards necessitates a programmatic, continuous improvement ap...

Responsible Contact Person(s): Naveen Abraham, Chief Core Infrastructure Services Corrective Action Planned: Ensuring that infrastructure suppliers fulfill all contractual requirements with respect to Commonwealth security policies and standards necessitates a programmatic, continuous improvement approach. VITA has made improved cybersecurity a primary goal and major initiatives have completed and are underway. VITA has established a scoring mechanism, based on the Common Vulnerability Scoring System (CVSS), that delineates the necessary response based on the criticality of the vulnerability (critical, high, and medium). For vulnerabilities with a CVSS score of (critical and high), service level agreement (SLA) 1.1.3 is now in place to measure supplier performance and adjust supplier compensation accordingly through SLA credits and RCDs. For vulnerabilities below the critical and high score, in Q4 of 2023, suppliers started providing data in a quarterly report to the MSI and VITA. The new SLAs combined with the reports of vulnerabilities below the critical and high score are used to ensure suppliers’ contractual compliance. VITA’s data shows that patches for software on the enterprise software list are being applied on an ongoing basis. VITA will work with agencies and suppliers if there are any new technical difficulties or questions about patching. New tools are now available to agencies so that they can monitor and verify the remediation of the vulnerabilities for which infrastructure suppliers are responsible. Dashboards have also been provided to the suppliers so that they can review a shared and common vulnerability list. VITA and the suppliers monitor and review enterprise level logs and security events on behalf of customer agencies through the system dashboard and a 24x7 Security Operations Center. The dashboard is available for access by agencies as of Q4 2023. VITA will continue to monitor and improve the security of infrastructure services through ongoing governance, including the requirements of architecture documentation, system security plans, and audit reports. VITA’s infrastructure services group will work with the VITA security group to confirm that the current state achieves security standards compliance. Estimated Completion Date: 6/30/2024

View Audit 295106

Finding 376159 (2023-066)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs HUD Housing Programs Significant Deficiency § 200.303

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Stephen Schleck, Associate Director of Enterprise Business Solutions Corrective Action Planned: A Change Request for the case management system was developed 2 years ago and DSS is reviewing the change request to determine a stat...

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Stephen Schleck, Associate Director of Enterprise Business Solutions Corrective Action Planned: A Change Request for the case management system was developed 2 years ago and DSS is reviewing the change request to determine a status. It was agreed by Line of Business and ITS EBS & a vendor (the systems provider) that there will be an iterative approach to completing the record retention and purge rules for implementation in the case management system. Estimated Completion Date: 12/31/2024

View Audit 295106

Finding 376134 (2023-061)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Diane Carnohan, Chief Information Security Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virg...

Responsible Contact Person(s): Diane Carnohan, Chief Information Security Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 6/1/2024

View Audit 295106

Finding 376131 (2023-058)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Fede...

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 12/31/2024

View Audit 295106

Finding 376128 (2023-056)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Questioned Costs Significant Deficiency § 200.303

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management John Vosper, Information Technology Audit Manager Corrective Action Planned: DSS has contracted with a contractor to perform IT audits once every three years on an on...

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management John Vosper, Information Technology Audit Manager Corrective Action Planned: DSS has contracted with a contractor to perform IT audits once every three years on an ongoing rotating basis. Estimated Completion Date: 12/31/2023

View Audit 295106

Finding 376125 (2023-055)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Special Tests & Provisions Questioned Costs

Responsible Contact Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: The vendor started the security audit in September 2023 and completed in December 2023. The report was sent to DMAS in February 2024. Next steps- The report needs to be reviewed and the Contract Administ...

Responsible Contact Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: The vendor started the security audit in September 2023 and completed in December 2023. The report was sent to DMAS in February 2024. Next steps- The report needs to be reviewed and the Contract Administrator will work with the vendor to ensure Plan of Action and Milestones (POAMs) are completed to address the risks and control gaps. The Contract Administrator will monitor the vendor to ensure the vendor meets to terms of the contract and submits a security audit every two years. Estimated Completion Date: 6/30/2024

View Audit 295106

Finding 376123 (2023-051)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): David Clark, Information Security Officer Corrective Action Planned: The Information Security Unit has documented a process for the types of changes that trigger a security impact analysis (SIA) as well as a request form for a security impact review. Part of the SIA pr...

Responsible Contact Person(s): David Clark, Information Security Officer Corrective Action Planned: The Information Security Unit has documented a process for the types of changes that trigger a security impact analysis (SIA) as well as a request form for a security impact review. Part of the SIA process will be to determine if pre-implementation testing is required. The Information Security Unit will retain documentation in accordance with the Configuration Management Policy. Once the processes are further defined, the Information Security Unit will update the Configuration Management Policy & Procedures. Estimated Completion Date: 3/31/2024

View Audit 295106

Finding 376120 (2023-049)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Fede...

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 6/30/2024

View Audit 295106

Finding 376117 (2023-043)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Reporting Significant Deficiency § 200.303

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management Melinda Raines, Director of Human Resources Karen Holt, Human Resources Business Process Consultant Corrective Action Planned: An agency-wide work group will be estab...

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management Melinda Raines, Director of Human Resources Karen Holt, Human Resources Business Process Consultant Corrective Action Planned: An agency-wide work group will be established to determine the exact processes need to implement the controls necessary to address this finding. HR and ISRM have identified the need for new reporting and interfaces to regain compliance. DSS had deployed DOA human capital management system and an internal system that will need to have interfaces developed. Estimated Completion Date: 6/30/2024

View Audit 295106

Finding 376114 (2023-036)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs HUD Housing Programs Significant Deficiency § 200.303

Responsible Contact Person(s): Mike Jones, Chief Information Officer Steve Hanoka, Chief Information Security Officer Corrective Action Planned: The 2023 Annual Access Review for the claims processing system through secure web application surveys began in the 4th Quarter 2023. Three separate surve...

Responsible Contact Person(s): Mike Jones, Chief Information Officer Steve Hanoka, Chief Information Security Officer Corrective Action Planned: The 2023 Annual Access Review for the claims processing system through secure web application surveys began in the 4th Quarter 2023. Three separate surveys were sent to perform access review for DSS, Contractor and DMAS Internal access review. • DSS annual review sent on November 9, 2023 and ended on November 20, 2023 • Contractor review sent on November 30, 2023 and ended on December 15, 2023 • DMAS review sent on December 15, 2023 and ended on January 13, 2024 All 3 surveys requested managers to review their employees access and confirm if it was required or if the access should be revoked. Survey results are available to perform follow up actions. DMAS Security is currently reviewing the survey results and revoking access where requested. Estimated Completion Date: 6/30/2024

View Audit 295106

Corrective Action Plans

Filters