Corrective Action Plans

The City agrees with the finding. The Treasury Portal automatically fills in the amounts for revenue loss for 2022 with amounts reported in 2020. The Treasury portal has many flaws that would cause errors in reporting. In addition, the portal has changed every quarter, which makes it challenging to report accurately. The City will implement controls to ensure that a second review is completed prior to certification of the report. Additionally, the Grant Administrator will work with department staff responsible for reporting and ensure that each report's supporting documentation is complete and ties to underlying subrecipient reports, the general ledger and grantor reports. All supporting documentation, along with a copy of the submitted report, will be stored in a central location to ensure that they are available for subsequent reviews and audits. This will be completed by June 30, 2024.

Finding 2023-004 Internal control deficiency and noncompliance over Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Reporting related to expenses attributable to coronavirus reported in the provider relief fund reports. The entity has excess lost revenues to cover all payments received (excluding the expenses submitted). Therefore, no refund is required for any payments received. Since the program has ended, the management has implemented the following procedures for future grants: 1) An education session occurred on February 15, 2024, with the relevant parties across Huntington Health entities to formally implement a review process whereby the Controller will review the support files prior to filings being made related to grant applications/programs across any of Huntington’s entities. Documentation of this review will be retained in the central file repository. These steps and controls will be updated and documented in the departmental policy. 2) A central folder on the Huntington Hospital’s main accounting drive has been created. This folder will be populated with all support for filed figures related to grant applications/programs across the hospital’s various entities. The support will be validated as having been placed into this folder as part of the reporting out process by the accounting manager and Controller handling the reporting. Files will be retained in this central drive for a minimum of 7 years. These steps and controls will be updated and documented in the departmental policy. Contact Person: Byron Davis, Controller and Steven Mohr, Senior Vice President and Chief Financial Officer, Huntington Hospital Anticipated Completion Date: Completed

06/30/2023 Corrective Action Plan Reference Number: 2023-001 Program Information: Student Financial Assistance Cluster – Federal Direct Loan Program, Federal Pell Grant Program Contact Person: Donna Lane Anticipated Completion: 08/30/2024 Fiscal year in which finding occurred: 2023 Condition Certain students with enrollment changes were not timely transmitted to National Student Loan Data System (“NSLDS’). Management View Management recognizes the importance of reporting enrollment status changes in a timely manner for lenders and servicers of student loans to determine in-school status, deferments, grace periods, and repayment schedules, as well as the federal government’s payment of interest subsidies. Corrective Action The University has taken the following steps to improve the accuracy and timeliness of enrollment reporting with respect to federal requirements: • In addition to the National Student Clearinghouse’s implementation of new password reset requirements, the University will verify the staff representatives on the NSC FTP-site communication list are current. The NSC Enrollment Reporting procedures have been updated to include the FTP communication list and the steps to add or remove members if there are staff changes in the future. • For students who initiate a withdrawal prior to the end of the spring term, the Registrar’s Office will maintain a list to submit manual updates after the final spring enrollment file has been processed. This will ensure timely reporting of the withdrawal without overwriting the spring enrollment submission. • Summer withdrawals will now be reported directly to NSC at the time of withdrawal, ensuring timely and accurate reporting. The Registrar's Office will submit a manual enrollment status change to NSC.

Corrective Action Plan: Reimbursement of Department of Agriculture cash has been completed for year-end 2022-2023. District Administration will assess staffing needs to determine separation of duties and to determine additional staffing needs to meet the requirements of duty separation. Currently, the Finance Department consists of one Payroll/Benefits position, one Accounts Payable/Receivable Position, one Grants Specialist Position, and one Finance Director. In prior years, the Finance Department had two additional positions that have since been eliminated, causing position duties to be absorbed amongst the remaining staff. Journal postings to reimburse shown below. Anticipated Completion Date: March 29, 2024

Prior to the completion of the audit, the Organization has entered a contract with a CPA firm, CLA, to outsource its accounting functions. This will allow the Organization to have qualified accounting professionals perform and oversee accounting activity. The finding was shared with CLA and CLA has committed to working with the audit firm to meet deadlines so that all entries are recorded prior to fieldwork and if there are any open items that may result in an entry, those items are clearly communicated to the audit firm prior to fieldwork.

We categorically reject the assessment that our county “did not establish and maintain effective internal controls over compliance with coronavirus State and Local Recovery Fund requirement”. The transactions cited happened before state auditors finally clarified how they believed interfund transfers of those funds should have been handled. Before that moment, there had been little to no clear, written guidance from the state on the proper procedure for utilizing these funds for other needs within our budgets (in our case, fixing roads). Our staff spent weeks combing through and attempting to understand federal documents issued with spending rules that changed often and continue to change today. We have traced and will track every penny of those monies were spend and account for them in any way we are required. I believe it is not fair to our county to suggest otherwise in this finding, but we will certainly follow your instructions on interfund transfers, now that we finally know what those are.

INTERNAL CONTROLS OVER TRANSPARENCY ACT REPORTING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 To correct the finding, DEM met with federal partners in February 2023 to ensure understanding of what was to be reported, and ensured all staff managing grants with reportable awards knew the requirements. In March 2023, DEM implemented an internal control review between the Program Manager and the Section Chief for FFATA reporting. To ensure this finding is resolved, DEM will continue to utilize the internal control review that has been put in place.

SPECIAL TESTS AND PROVISIONS – ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 The Condition section within prior year finding 2022-037 recognized that the DHHR has policies and procedures in place for performing periodic risk assessments and security reviews over the Recipient Automated Payment and Information Data System (RAPIDS), which is an internal system; however, the Condition section also proclaimed that the DHHR does not have policies and procedures to perform periodic risk assessments and security reviews over the Medicaid Management Information System (MMIS). The first sentence of the corrective action plan for prior year finding 2022-037 indicates that the MMIS is designed, developed, implemented, and operated by an external service organization. Within the last two paragraphs of the corrective action plan for prior year finding 2022-037, the DHHR opined that it was in compliance with 45 CFR 95.621 since it receives the SOC 1 Type 2 report from the MMIS service organization and since the report documents that the service organization establishes and maintains a program for conducting periodic risk analyses to ensure appropriate, cost effective safeguards are incorporated into new and existing systems or whenever significant system changes occur, as required per 45 CFR 95.621. However, the DHHR also recognized the underlying concern expressed within the finding, in that the DHHR does not include the SOC 1 Type 2 report as part of its own policies and procedures for ADP security over the MMIS. To enhance its controls, the DHHR Bureau for Medical Services (BMS) was going to develop a policy and procedures to document MMIS compliance with 45 CFR 95.621. The procedures were to include but not be limited to a requirement to review and approve the SOC 1 Type 2 report from the MMIS service organization and document the review and approval process (e.g., for such matters as the service organization’s assertions, descriptions of its systems and controls, control objectives, and related controls, and the service auditor’s description of tests of controls and results). Although the DHHR BMS has not developed a comprehensive policy or any written procedures to date, they have developed a form to document internal review of the SOC 1 Type 2 report for such matters as the control environment, systems development and maintenance, logical security, physical access, computer operations, and input controls. The BMS has also discussed this issue with an independent consulting firm that is under contract with the BMS for Medicaid expertise and performs existing services related to information technology and security; modernization and planning for the overall Medicaid Enterprise Systems (MES); organization development, including alignment strategies; project management; and data architecture and governance, which includes managing the availability, usability, integrity, and security of data with comprehensive standards and policies. The BMS and its independent consulting firm will work together to develop a statement of work for an independent review of the existing control environment, if deemed necessary, and any additional services that might need performed in order to ensure the DHHR maintains full compliance with 45 CFR 95.621 and can document compliance for future HHS reviewers, independent auditors, or other authorized officials.

TRANSPARENCY ACT REPORTING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558, 93.568, COVID-19 93.568 The DHHR enhanced its controls over Transparency Act reporting for LIHEAP during State Fiscal Year 2023 and met with various staff members internal and external to the DHHR (e.g., at other State agencies) to ensure everyone was aware and understood their roles in ensuring compliance on behalf of the State. Although those controls are in full effect for fiscal year 2024, the DHHR will revisit and enhance the controls to the maximum extent possible. Furthermore, the DHHR will reopen its previous submissions to the FSRS and revise the data elements to those assigned by the other State agency to their subrecipients; considering the need to consult with the DHHR spending unit and the other State agency, the anticipated date for completion is April 1, 2024.

CASH MANAGEMENT Bluefield State University and West Virginia State University Assistance Listing Number 84.425J Bluefield State University (BSU) response Effective June 2024, BSU will draw down funds on appropriate expenditures that have already been disbursed to avoid any cash management violations. West Virginia State University (WVSU) response Currently all funds have been disbursed for HEERF awards P425E201113, P425F201736, and P425J200056. WVSU will reconcile the SEFA receipts and disbursements to internal data to locate the discrepancy and make the necessary corrections. Further, WVSU will review and update internal controls related to cash management rules to ensure compliance for drawdowns and disbursements.

REPORTING Department of Education (DOE) Assistance Listing Number COVID-19 84.425D, 84.425R 84.425U, 84.425V Effective February 2024, the DOE plans to continue to enforce the existing policies and procedures in place along with ensuring all required documentation is retained for review. The DOE plans to review the ESSER Reporting Workbook by testing several indicator values i.e. expenditure amounts, demographic data, etc. There will be an approval process put in place once the Local Education Agency (LEA) submits the reports to the state. This approval process will include reviewing the edit checks with the LEA prior to final certification of data. Certification data will include an email from the LEA approving the final copy of the ESSER Reporting Workbook.

TRANSPARENCY ACT REPORTING Department of Education (DOE) Assistance Listing Number COVID-19 84.425C, COVID-19 84.425D The West Virginia Department of Education, Office of Internal Operations have established internal controls and procedures over the FFATA reporting and were set in place as of July 1, 2023. These procedures involve a second reviewer of the monthly FFATA reports and a signature of approval prior to reporting each month.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – ENROLLMENT REPORTING Bluefield State University, Blueridge Community and Technical College, Concord University, Fairmont State University, Marshall University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia State University, West Virginia University, and West Virginia University at Parkersburg Assistance Listing Number 84.063, 84.268 Bluefield State University (BSU) response Effective February 2024, BSU will review the final enrollment report and approvals will be signed off to submit the report to NSC, the third party will consistently retain a copy within our institution. BSU will retain the record count reconciliation between the final enrollment report, text file, and the number of files received by the NSC, including documentation on how any rejected records were addressed. BSU will retain the details of the validation of the student’s information included in the report for accuracy. BSU will consistently retain the NSC automated emails used as a quality checklist regarding due dates, and receipt of the text files by the NSC. The availability and completion of the Error Resolution Report, as well as the confirmation of certification and processing by the NSC report, will all be retained. Blueridge Community and Technical College (BRCTC) response BRCTC asserts that the Enrollment Reporting process is accurate and reviewed in a timely manner; BRCTC further asserts that the emails from the National Student Clearinghouse are reviewed. As a result of this finding, BRCTC will expand its internal control to include documentation of reviews internally and externally with the NSC. This update to the internal control process was implemented in February 2024. Concord University (CU) response Effective February 2024, the internal controls at CU over the review and approval of the enrollment report sent to the National Student Clearinghouse (NSC) have been updated to include the following control measures in addition to the current controls on file: 1. CU has contacted NSC to begin generating the email response for the receipt of the .txt file when submitting it to the NSC FTP portal. This email notification will be kept on file with the other report documentation. 2. CU has implemented a new checklist sheet to accompany the report and its documentation to provide a clear and organized outline of required documents and to ensure these requirements are provided. This sheet will be part of the Spot Check Letter that is included in the current control method and signed off on by two members of the Registrar’s Office staff. 3. CU has also included in this new checklist a space to document the number of student files submitted to NSC and the number of files submitted to NSLDS as noted by NSC. The printout of this notation provided by NSC will also serve as documentation attached to the report. Fairmont State University (FSU) response Effective February 2024, FSU will retain a screen shot of the record count received by the NSC and will document any rejected records and what the plan is to address the rejected records. FSU will review a portion of the enrollment records being submitted before the submission is uploaded to NSC. This review will include detailed documentation, for a select few, of how we validated the student’s enrollment status. FSU will keep a spreadsheet of the students that are validated and the Banner screens that are used to do so.   Marshall University (MU) response Effective February 2024, MU will document that a record count reconciliation has been completed between the enrollment submission file and the number of files received by the NSC. MU will document and retain how any rejected records were addressed. MU will also document and retain records of the spot check validation for accuracy of student information included in the enrollment submission files. Mountwest Community and Technical College (MCTC) response Effective February 2024, a record count reconciliation between the final enrollment report and the number of files received by the National Student Clearinghouse (NSC) will be completed. MCTC will have the NSC query historical data and have it provided in Excel format. This will be a new source of data that will be collected and retained. This file will be generated after every rejection error report that is returned to the NSC. Each file will be saved, and a copy will be sent to the Registrar’s Office. Transmission history can also be saved by table, that can be exported to Excel. These files will also be saved, and a copy sent to the Registrar’s Office. For validation of student information, MCTC will being the process to collect data for the NSC submission first begin in audit mode. This will allow for review of the data to make any corrections that appear in the first stage of the report. Next, a second row of audits processed by the Associate Registrar will be conducted and confirm the data integrity. After this is complete, a copy of the final submission will be sent to the Registrar for final review and authorization. When approval is returned to the Associate Registrar, the data will be uploaded to the NSC. New River Community and Technical College (NRCTC) response Effective August 2024, the Registrar's office will run a random selection of 20 students from NSLDS to ensure students are correct in the clearinghouse, which will be done at least 50 days out from the time students were initially reported. The Registrar’s office will keep documentation of the sampled students. The Registrar’s office will keep records of how many files were accepted and how many were rejected. The Registrar’s office will provide documentation of validation of student information included in the enrollment report and retain emails by providing a file specially for NSC enrollment reporting emails received and sent regarding enrollment reporting. Emails to be retained are error resolution and confirmation of certification and processing by the NSC. The Registrar’s office will also create a checklist to follow and use as documentation to ensure all steps throughout the process are completed and checked off the list. Pierpont Community and Technical College (PCTC) response Effective February 2024, PCTC will complete the review of the file before it is submitted, not after it’s submitted. The Associate Registrar will pull the report prior to the due date to give those in the review process ample time to review the files before the Associate Registrar submits the document to the NSC. PCTC will keep track of the due date of submission, the date the text file was sent to the NSC, the date the error resolution report was received, the date it was sent back, and the date the report was certified by the NSC. A new tab in the worksheet in Teams has been created that will be completed each time an enrollment verification is submitted to the NSC. PCTC will note the actual enrollment count as of the time of the NSC submission, the enrollment count on the TXT file, the number of files received by the NSC, and the number of rejected files. This is to verify that all of the files intended to be submitted to the NSC were actually received by the NSC and processed. This information will be kept on each spreadsheet used to verify the information sent to the NSC. Shepherd University (SU) response Effective February 2024, SU will add a checklist to the existing reporting and retention structure that had already been established for Clearinghouse data transmission. The checklist will be completed with each transmission, organizing data retention efforts to ensure inclusion of the additional elements required.   West Liberty University (WLU) response To comply with internal control over the review and approval of the enrollment reporting to NSC, WLU will enhance their policies and procedures. The update of these policies and procedures will be effective February 2024 and carry forward into future academic years. WLU will ensure that enrollment reporting policies and procedures are compliant with the US DOE standards and retain evidence of the internal controls. Currently, WLU is reorganizing the processing of enrollment reporting from our IT System Administrator to our Enrollment Services Coordinator. This employee will add to the current policy a process by which a record count reconciliation will happen between the final enrollment report text file and the number of files received by NSC. There will also be documentation kept showing how many rejected records were addressed with each report. Proper documentation will also kept of a final review and approval signoff to submit the enrollment report to NSC. Lastly, WLU will create an email specific to enrollment reporting where all communication from NSC will be stored for auditing and record keeping purposes. West Virginia Northern Community College (WVNCC) response Effective February 2024, the enrollment reporting to the Clearinghouse (NSC) is being moved from the Registrar/Records office to the Institutional Research (PIER office). All reports including determination of reporting intervals per Clearinghouse and SFA guidelines, will be scheduled by the IR office with the Clearinghouse. The following items will be retained to match internal controls for each file sent to the Clearinghouse: 1) Retain internal emails or approval document regarding review and approval from two persons for file prior to sending to NSC 2) Retain verification of count of student record in file matching student enrollment at that time 3) Retain verification of record count with records received by NSC 4) Retain a spot check of students (approx. 8-10) from the file which were tested for accuracy including printout of where this was matched (usually SFAREGS time status page is printed) 5) Retain NSC Error Report for each file prior to resolution and document of resolution 6) Retain reminder email from NSC that the submission file is due 7) Retain initial txt file receipt email from NSC 8) Retain NSC posted error resolution report notification email 9) Retain NSC Completed Error Resolution report notification email 10) Retain NSC final processing email The following information for each file will also need maintained (this information is usually obtained from the NSC reporting page under the enrollment reporting link for approximately an 18 month time frame, header records on the files also show file generation date and term date information for the students reported). 1) Scheduled transmission date 2) File certification date 3) NSC received date 4) NSC processed date 5) Academic term the file is sent for 6) Submission type of the file (first of term, subsequent of term, graduate only, etc.) West Virginia State University (WVSU) response WVSU utilizes the National Student Clearinghouse (NSC) to update student’s enrollment and its effects on student’s direct loan and Pell statuses. Thorough edit checks of student data for each semester will be produced by IT on a regular basis. The Office of the Registrar, in coordination with Admissions, Dual Enrollment, and other contributors of student data, will make sure these errors are corrected. Special focus will be placed on resolving these errors before each enrollment file is produced. (initial data integrity, first check). On or around the 25th of each month, IT will produce the NSC enrollment file. Each time the file is produced, the file will be sent to the Registrar for review to ensure accuracy of the data being pulled from Banner. Registrar sends approval for upload to NSC. Emails from NSC, IT, and files with student checks to be retained. (process integrity, second check) The file will be uploaded to the NSC by IT, ensuring NSC received the appropriate number of records. The data will then be reviewed and any discrepancies in the data, when compared with past data, will be resolved in a timely manner. The NSC error report will be reviewed and any errors corrected. The NSC process makes sure these errors are resolved before the data is reported to the NSLDS, it is the responsibility of the Registrar to make sure these are resolved with accurate data. Emails from NSC, and screenshots of errors will be retained. (data integrity, third check) After resolution of errors, the NSC will perform a final review of data before sending to the NSLDS. This will be reported on the NSLDS Reporting tab of the Enrollment Reporting screen in the NSC website. If data is satisfactory, the submission will be marked with “Congrats. No Errors!” by the originator clearinghouse. The NSC sends emails whenever these items are updated. It is the responsibility of the Registrar to review and resolve any errors in a timely manner. Emails from NSC and screenshot of NSLDS reporting dashboard to be retained. (data integrity, fourth check) The enrollment data is then submitted to the NSLDS. After NSLDS reviews the data, any errors will be reported back through the NSC in the same manner as NSC errors. Resolution of these errors is of special importance and will be given top priority. The NSC sends emails whenever these items are updated. It is the responsibility of the registrar to review and resolve any errors in a timely manner. Emails from NSC and any error documentation to be retained. (data integrity, fifth check). These policies and procedures will be implemented in August 2024. West Virginia University (WVU) response WVU’s Registrar’s office reviews rejected records and takes appropriate action to clear the rejections. Many of these rejections require additional information from students, therefore resolution is based on student discretion in providing documentation. Effective February 2024, WVU will ensure that documentation of the submission record count and rejection follow up is maintained. West Virginia University at Parkersburg (WVU-P) response Effective February 2024, WVU-P will reconcile the record count of enrollment records processed by taking the following actions: 1. Highlighting the record count at the end of the Banner-generated enrollment report file as part of the spot-checking review process. 2. Screenshotting the number of files received by NSC once they acknowledge that the file has been received. 3. Retaining documentation to show that if for some reason the file count does not match, research was done to locate the reason for the discrepancy, and the discrepancy was either resolved or WVU-P is able to document why it could not be resolved. Records and Financial Aid are working together now to develop procedures to properly document the error resolution process. WVU-P will have this process in place by April 2024, in time for the new process to be fully implemented beginning with the Summer 2024 term. WVU-P will retain all documentation, including all emails sent by NSC throughout each enrollment reporting process, within a folder in a secure drive. The name of the folder will be the date that the enrollment report was sent to NSC.

INTERNAL CONTROLS OVER FINANCIAL REPORTING Pierpont Community and Technical College (PCTC) Assistance Listing Number 84.063, 84.268 Beginning October 2022, PCTC has performed the updated monthly reconciliation process that was originally to take place beginning July 1, 2022. Due to the loss of the Information Systems Specialist (ISS), PCTC failed to begin on the intended date. The DLSAS reports from COD are downloaded by the 10th of each month, as before, by the ISS. The reports are provided to the Assistant Director of Financial Aid (Asst.) and then reconciled to both Banner paid and Common Origination and Disbursement (COD). The Asst. takes screen captures of both Banner and COD for a monthly reconciliation of the Federal Pell Grant and DL programs. Screen captures are printed, and comparisons are made by the Asst. All necessary adjustments are performed to student accounts by the Asst. or Director of Financial Aid (Director) until balanced. Reports verifying reconciliation are then completed, initialed, and saved by the Asst. and then reviewed and signed by the Director for completion and accuracy. PCTC will maintain the documentation of the DLSAS statements each month and the reconciliation report along with evidence of said review. The completed reconciliation information files are in our shared drive. This process has been in place, ongoing and has been effectively followed since October 2022.

SPECIAL TESTS AND PROVISIONS – PERKINS LOAN RECORDKEEPING AND RECORD RETENTION Concord University, Marshall University, Shepherd University, West Liberty University, West Virginia School of Osteopathic Medicine, and West Virginia University Assistance Listing Number 84.038 Concord University (CU) response Due to changes in personnel, CU did not follow this regulation. CU will review ECSI’s report, specifically looking for instances of noncompliance and internal control breaches. This will be documented annually and will be effective August 2024. Marshall University (MU) response MU has regularly monitored the services provided by ECSI for accuracy and completeness throughout a 30-year relationship without significant issues. Additionally, during fiscal year 2023, MU worked closely with ECSI on the Department of Education’s government assignment of 837 Perkins loans going back as far as 1978. This process clearly involved several compliance requirements of this program and was completed with no compliance problems encountered. MU will document the review of ECSI’s annual audit going forward. Shepherd University (SU) response By April 2024, SU will develop and maintain a checklist that will be periodically reviewed and signed off related to this finding, specifically: Annually, SU will pull SOC reports along with any compliance audits for review of findings or areas of interest and will assess and determine any factors that may need further investigation or mitigation from SU. West Liberty University (WLU) response Effective February 2024, WLU’s CFO, Controller and Student Accounts Manager together will meet and review the most recent Title IV compliance audit. The meeting will be set using emails. Minutes and notes will be taken regarding items reviewed and conclusions reached and will retain documentation and all other relevant documentation will be retained. Any issues that arise will be dealt with accordingly. West Virginia School of Osteopathic Medicine (WVSOM) response Adequate due diligence was not performed to ensure that the third-party services, Educational Computer Systems, Inc. (ECSI) were following the requirements for the functions that they are performing for WVSOM. The third-party services Title IV compliance audit was obtained but was not signed off on as reviewed. A new procedure will be written with the following steps: 1) Accountant Senior in the Cashiers office will request the “Examination Report on Compliance with Title IV Programs” and the System and Organization Controls for Service Organizations: Controls Relevant to Security (SOC 2). The Accountant Senior will review the reports for compliance and sign off. 2) Accountant Senior will forward the reports to the Director of Finance. The reports will be reviewed for compliance and signed. 3) The Director of Finance will forward it to the Director of Accounting for submission with the audit. The new procedure will provide two reviews and sign-offs and are effective January 2024. West Virginia University (WVU) response WVU’s Student Financials Services (SFS) department receives the 3rd Party Servicer compliance reports annually and reviews these reports once received. WVU will maintain detailed meeting minutes to document the review of 3rd Party Servicer reports moving forward. The review of the report available for fiscal year 2024 was conducted on December 19, 2023 between members of Compliance and Training (CT) and Revenue Management (RM) teams. In this meeting, the following 3rd Party Servicer reports were discussed; report on controls at a service organization relevant to user entities’ internal control over financial reporting, SOC 2 report and examination report on compliance with Title IV programs. It was noted there were no findings in the reports. Regarding MPN’s, deferments and cancellations for Perkins loans, members of SFS are pursuing several areas of remediation to resolve the fiscal year 2023 finding. SFS personnel will review all open Perkins loans and inventory files to consolidate into one central location. All files will be reviewed for paper MPN’s, deferment and cancellations request and an inventory list will be attached to a central location for all Perkins records. Additionally, WVU is in the process of exploring liquidation of all Perkins loans currently held by the school. While SFS is committed to resolving the current issues regarding Perkins Recordkeeping, it should be noted that this commitment must be balanced with staff’s requirements to process student aid for current students that has been delayed numerous times due to FAFSA simplification delays.

SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE Bluefield State University, Blueridge Community & Technical College, Concord University, Mountwest Community and Technical College, Shepherd University, West Virginia Northern Community College, and West Virginia University at Parkersburg Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364 Bluefield State University (BSU) response BSU will submit the URL of their contract with their third-party servicer and cost information to the U.S. Department of Education for their publication in the Cash Management Contracts Database by Friday, February 23, 2024. BSU will also implement a detailed due diligence review over the fees assessed by the third-party servicer of Title IV credit balances. Blueridge Community & Technical College (BRCTC) response We acknowledge that BRCTC did not have internal controls in place to review the contract with our third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. By February 2024, documents will be requested and an annual due diligence review will be performed and documented of the third-party servicer contract and compliance audit as well as review of fees assessed by the third-party servicer. Concord University (CU) response CU agrees with this finding and due to changes in personnel, this regulation was not followed. CU will review and document the review of the Cash Management Database annually to ensure the link is posted. CU will review and document the review of other financial institutions charges compared against BankMobile’s fees annually. CU will annually review the servicer’s SOC report. CU will review BankMobile’s report, specifically looking for instances of noncompliance and internal control breaches. This will be documented annually. Mountwest Community and Technical College (MCTC) response Effective February 2024, MCTC will implement a review process to be conducted on an annual or monthly basis, as applicable, of all accounts opened with the Servicer during the specified timeframe. The "Activation & Preferences Report" available to management through the Servicers Administrator portal will be used to provide the data for review by management. The review process will consist of the following: • A request made of the servicer to provide a report of accounts opened with date/time stamp of consent to opening. Frequency: Monthly • Review of "Activation & Preferences Report" validated against Servicer "Accounts Opened" report. Frequency: Monthly • Generate a follow-up email to applicable students confirming the opening of the Servicer Account which will include an attachment of the Servicer "Terms and Conditions" and "Fee Schedules". Frequency: Monthly • Review the Servicers' Client Contract and Profile site for accuracy and completeness of information. Frequency: Annually • Review the Servicers' System and Organization Controls (SOC) and Compliance audits. Frequency: Annually • Management will incorporate as part of its "Due Diligence and Attestation" copies of comparable banking institution fee schedules that are date/time stamped to serve as evidence of review. Shepherd University (SU) response By April 2024, SU will develop and maintain a checklist that will be periodically reviewed and signed off related to this finding, specifically: Annually, SU will be submitting the URL to the Department of Education related to the contracts between SU and BankMobile, reviewing compliance audits and SOC reports for BankMobile, recording areas of risk, and noting ways to mitigate the potential risk moving forward. West Virginia Northern Community College (WVNCC) response Beginning June 2024, during the annual review meeting between WVNCC and BankMobile (the servicer that delivers Title IV credit balances to students), WVNCC will obtain a copy of the BankMobile compliance audit. This will be kept on file within the Business Office for reference if needed. In addition, the budget committee will review annual the fees charged by BankMobile and attempt to compare them to other providers of similar services. West Virginia University at Parkersburg (WVU-P) response WVU-P has submitted a URL to the US Department of Education of our contract and cost information with our third-party servicer. This submission should correct this portion of the finding although it was done after the end of the fiscal year under audit but serves to correct the finding in subsequent periods. WVU-P will ensure compliance with the remaining items noted by creating a written internal control policy requiring the following: • Verification of the required submission of the third-party contract with the Department of Education. • Documentation of a due diligence review of the fees assessed by the third-party servicer. • Obtain a copy of the annual compliance examination of the Title IV Programs. The 2022 report dated June 29, 2023, was received and reviewed by us for compliance with eligibility, systems, and internal controls, disbursements, Return of Title IV funds, and administrative requirements. • Obtain a list of students whose refunds were disbursed by the third-party vendor and cross-reference it with a list of the students processed and sent to the third-party vendor by WVU-P. For those students who elected to open a checking account, WVU-P will review supporting documentation to indicate that the student gave proper consent. These policies and procedures will be effective February 2024.

REPORTING Division of Highways (the Division) Assistance Listing Number 20.933 Effective January 2024, procedures have been put in place where pre-project performance management and quarterly progress reports on federal award projects will be compiled by WVDOT recipient/key personnel indicated in the BUILD Transportation Discretionary Federal Grants and submitted to USDOT by the 20th day after each calendar year quarter has closed as required by the grants. Prior reports that were not submitted to the USDOT as identified by the fiscal year 2023 audit will be sent.

REPORTING Workforce West Virginia (WWV) Assistance Listing Number 17.225 WWV updated reporting procedures in April 2023 and provided training to appropriate staff regarding the ETA 9050, 9052, and 9055 reports that did not have proper reviews documented prior to submission. That training is reflected in the reports selected after May 2023 that show proper documented reviews prior to submission.

SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS Department of Environmental Protection (DEP) Assistance Listing Number 15.252 Effective March 2024, DEP will develop and implement a standard operating procedure to track indirect costs. DEP will create a separate spreadsheet to track indirect costs to be included in the year ending SEFA reporting. DEP will attend training sessions conducted by the West Virginia Financial and Accounting Reporting Section to ensure all expenses are reported correctly on the SEFA. Additional training from accredited educational institutions will also be researched if necessary.

REPORTING Department of Environmental Protection (DEP) Assistance Listing Number 15.252 Effective March 2024, DEP will implement the following steps to correct the finding: 1. Review the Office of Surface Mining Federal Assistance Manual for information and instructions in regard to preparing the required financial reports for periodic and annual submissions. The information obtained from the Federal Assistance Manual will be compared to 2 CFR 200.328 and 329 to ensure all required information is included in the financial reports. 2. Review the Federal Notice of Grant Award documents to ensure that reporting period dates and the submitted reports reconcile and are in agreement. 3. Create and implement written narrative that agrees with the requirements set forth in the Federal Assistance Manual. 4. Develop and implement standard operating procedures to ensure timely, accurate reporting that involves a review and approval process prior to submission. 5. Create a checklist of required items, and signature lines to show that reviews/approvals have taken place.

TRANSPARENCY ACT REPORTING Department of Environmental Protection (DEP) Assistance Listing Number 15.252 Effective February 2024, DEP will implement the following steps to correct the finding: 1. Review 2 CFR 200.303 and the Federal Funding Accountability and Transparency Act (2 CFR 170) to determine the requirements and proper procedures in submitting FFATA reports in FSRS. 2. Evaluate the agency’s current standard operating procedure for submitting FFATA reports and identify deficiencies that address accuracy, accountability, and segregation of duties in approving and submitting reports. 3. Update the agency’s current standard operating procedures to better meet the requirements 2 CFR 200.303 and the Federal Funding Accountability and Transparency Act (2 CFR 170) and addresses proper segregation of duties in reviewing, approving, and submitting FFATA reports.

TRANSPARENCY ACT REPORTING West Virginia Community Development Block Grant Program (CDBG) Assistance Listing Number 14.228 The CDBG program has experienced turnover in staff during the last year. While CDBG knows the FFATA report was submitted, a physical copy of this report could not be provided, and it cannot be verified if it was submitted on time. In the FSRS system, only the person who creates the original report can view, edit, and pull the actual report, and since the employee who was responsible for submitting this report is no longer with the agency, it cannot be determined when it was originally submitted. CAD staff have since recreated the report in the FSRS system so there is a copy of the report. To ensure this doesn't happen in the future, CAD staff has completed FFATA training for the personnel involved in the reporting process. CAD staff is creating a calendar with due dates for the programs reporting requirements to ensure the dates are not missed. Once the report is submitted in the FSRS system, staff is required to save a copy of the report in shared files. CAD is also looking to implement a system where a centralized person is responsible for submitting the FSRS reports to ensure all processes are completed and documents saved correctly.

TRANSPARENCY ACT REPORTING Department of Education (DOE) Assistance Listing Number 10.553, 10.555, 10.556, 10.559, 10.582 Setting up a process to comply with the FFATA reporting requires retrieving information from multiple systems. In addition, child nutrition reimbursements are more complex than grants that have a known subrecipient amount. Due to the complexity, DOE is relying on guidance from the USDA to complete reporting procedures. DOE is currently waiting to get answers to several questions that are preventing full development of a process. USDA is also working to help DOE find another state agency that can help with unanswered questions. A FFATA reporting process is anticipated to be in place by July 1, 2024.

SPECIAL TESTS AND PROVISIONS – ADP SYSTEM FOR SNAP Department of Health and Human Resources (DHHR) Assistance Listing Number 10.551, 10.561, COVID-19 10.561 Management within the DHHR, Bureau for Family Assistance (BFA), appreciates and shares the auditors’ concern with SNAP program integrity as it relates to the Recipient Automated Payment and Information Data System (RAPIDS) ADP system. The BFA notes that 7 CFR § 272.10 begins with, “(1) Purpose. All state agencies are required to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP. Sufficient automation levels are those which result in effective programs or in cost effective reductions in errors and improvements in management efficiency, such as decreases in program administrative costs...” Within the RAPIDS ecosystem for SNAP administration, this automation includes data matching measures undertaken, in compliance with related federal rules as specified in 7 CFR § 272.8, 7 CFR § 272.16, etc., to automate the validation of client-provided, worker-input information while mitigating the additional administrative burden of secondary review for all worker interactions with a client’s case. Policy regarding state and federal data matching is laid out in Chapter 6 of the State’s Income Maintenance Manual (IMM) at https://dhhr.wv.gov/bfa/policyplans/Documents/ Binder4.pdf. The primary data exchange system detailed in IMM Chapter 6 that is applicable to SNAP is the Income and Eligibility Verification System (IEVS) required by 7 CFR § 272.8. Systems mandated federally for inclusion in the IEVS include those operated by WorkForce WV, the Internal Revenue Service (IRS), and the U.S. Social Security Administration (SSA). A variety of other sources may also be queried for the purpose of validating client-provided information entered into RAPIDS by a worker, including Veterans Affairs (VA), Beneficiary and Earnings Data Exchange (BENDEX), Beneficiary Earnings and Exchange Record System (BEERS), National Directory of New Hires, and Prisoner Matching with the Department of Corrections as well as the Federal Data Services Hub (FDSH). IMM Chapter 6, page 2 describes the purpose of data matching through the IEVS thusly: Information obtained through IEVS is used for the following purposes: • To verify the eligibility of the assistance group (AG). • To verify the proper amount of benefits. • To determine if the AG received benefits to which it was not entitled. • To obtain information for use in criminal or civil prosecution based on receipt of benefits to which the AG was not entitled. IMM Chapter 6, pages 2-3 further detail the points at which a match with the IEVS must take place: A data exchange in the eligibility system occurs: • When a new case is created; • When a new person is added to a benefit; • When a person’s demographic information is changed; and, • On a periodic basis for all individuals in the eligibility system, depending on the type of benefit being received. Requirements for independent verification of information when automated data matches fail or report a discrepancy with client-provided, worker-input information are spelled out in IMM 6.4.4. The BFA believes that these automations, while perhaps not foolproof, are in keeping with both the word and intent of 7 CFR § 272.10, 7 CFR § 272.8, 7 CFR § 272.16, etc., which aim to automate processes in order to reduce administrative burden and associated costs, such as those that would be associated with a secondary review of all worker interactions with a client’s case. Furthermore, page 4-10.551-9 of the Compliance Supplement 2023, which lays out the suggested audit procedures for this topic, recommends the use of the USDA-FNS SNAP System Integrity Review Tool (SIRT) to ensure that the State’s ADP system is in alignment with USDA-FNS requirements and ensure that automated processes within RAPIDS continue to comport with federal requirements for ADP systems. To our knowledge, the auditors neither utilized that tool to guide their work nor requested verification from the State that the SIRT had been completed and previously employed. To support this response, management advocates a review of the SIRT submitted to FNS on October 26, 2023 in preparation for the go-live stage of the West Virginia People’s Access to Help (WV PATH) Family Assistance pilot program; as there is no significant difference in system functionality between the Family Assistance module of WV PATH and the existing eRAPIDS system, the responses/comments/replies from both FNS and the State that are included in this version of the SIRT generally apply both to eRAPIDS and to PATH. Throughout 2023, the BFA Division of Performance and Quality Improvement continued its ongoing SNAP case reviews, as well as its efforts to report compliance with monthly requirements for expanded supervisor case reviews conducted and tracked through the Rushmore case review system, as mandated in a December 7, 2022 memorandum to supervisors and made available to the auditors last year. Furthermore, the BFA developed additional worker training, including the reinstatement of face-to-face Statewide Payment Accuracy Conferences (held throughout the summer of 2023), with the aim to ensure that client information is accurately captured in RAPIDS so the APD can perform its automated functions with integrity.

DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS Department of Health and Human Resources (DHHR) Assistance Listing Number 10.551, 10.561, COVID-19 10.561, 93.558, COVID-19 93.558, 93.568, COVID-19 93.568, 93.575, 93.596, COVID-19 93.575, 93.658, 93.659, 93.767, 93.775, 93.777, COVID-19 93.777, 93.778 The DHHR is currently phasing in a new information technology system for determining eligibility, making payments, maintaining documentation, etc. The name of the new system is WVPATH (West Virginia People's Access to Help). The WVPATH system will replace the Family and Children's Tracking System (FACTS) and the Recipient Automated Payment Information Data System (RAPIDS), which are currently referenced in the finding. The WVPATH system will have additional controls and levels of review as compared with the FACTS and RAPIDS systems. Due to the timing of the phase-in process, the DHHR anticipates the finding will be resolved for the year ended June 30, 2024.