Corrective Action Plans

Finding 380419 (2023-001)

Material Weakness 2023

Milwaukee Institute of Art and Design, Inc.

WI

Reporting Questioned Costs Special Tests & Provisions

Corrective Action Plan For the Year Ended May 31, 2023 Finding 2023-001 Assistance Listing Number(s), Federal Agency and Program Name: 84.063, 84.007, 84.033, and 84.268; United States Department of Education (DOE), Student financial assistance cluster. Finding Type: Noncompliance and material weakn...

Corrective Action Plan For the Year Ended May 31, 2023 Finding 2023-001 Assistance Listing Number(s), Federal Agency and Program Name: 84.063, 84.007, 84.033, and 84.268; United States Department of Education (DOE), Student financial assistance cluster. Finding Type: Noncompliance and material weakness in internal control over compliance relating to special tests. Criteria: The Institute is responsible for designing, implementing, and maintaining internal control over compliance for special tests and provisions and for accurately and timely reporting significant data elements under the Campus- Level and Program-Level records within the National Student Loan Data System (NSLDS) that DOE considers high risk. Statement of Condition: Management implemented controls that specifically addressed the circumstances surrounding prior year finding 2022-001. Management's review of the enrollment reporting did not detect other errors on certain student data elements or timely reporting. Certain student records within the NSLDS were identified with inaccurate data elements and not timely reported. Questioned Costs: Questioned costs could not be determined. Context: 10 students were identified with inaccurate data elements and not timely reported out of a total of 25 students tested. Cause: The Institute’s internal control over compliance did not detect and correct the errors. The preparer incorrectly input the student's effective date and status into NSLDS resulting in inaccuracies in significant Campus- Level and Program-Level enrollment data elements that DOE considers high risk. Effect: The Institute incorrectly reported certain Campus-Level and Program-Level records in NSLDS which is information that DOE considers high risk and the Institute’s internal controls over compliance did not detect and correct the errors. Recommendation: We recommend management review policies and procedures surrounding enrollment reporting submissions to ensure the accuracy of data elements reported to DOE. A review performed by an appropriate individual separate from the preparer prior to the submission of the enrollment reports to NSLDS may improve the accuracy of enrollment reporting. Status: Completed February 2024 Corrective Action: Management agrees with the finding. Through internal investigation, it was determined that there was a procedural issue with the manual entry of two date fields which both need to be the same when submitted to National Student Clearinghouse (NSC). Human error during these manual checks caused one data field to be correct, and the other incorrect. This error has been fixed so that both fields will always be the same and accurate. We have also updated our enrollment reporting procedures to have the registrar log into NSLDS monthly to confirm that the prior month NSC status changes are properly recorded in NSLDS. Contact Jean Weimer Registrar 414-847-3272 jeanweimer@miad.edu Submitted Feb 23, 2024

View Audit 295200

Finding 377382 (2023-006)

Significant Deficiency 2023

University of California

CA

Reporting § 200.502 § 200.510

2023-006 – Completeness and accuracy of certain programs on the Prior Year Schedules of Expenditures of Federal Awards (SEFA) - (Significant Deficiency) Cluster: Not applicable Sponsoring Agency: Department of Health and Human Services (DHHS) - Health Resources and Services Administration (HRSA), D...

2023-006 – Completeness and accuracy of certain programs on the Prior Year Schedules of Expenditures of Federal Awards (SEFA) - (Significant Deficiency) Cluster: Not applicable Sponsoring Agency: Department of Health and Human Services (DHHS) - Health Resources and Services Administration (HRSA), Department of Education (ED) and Federal Emergency Management Agency (FEMA) Award Names: COVID-19 Provider Relief Fund and ARP (ARP) Rural Distribution (PRF), COVID-19 Higher Education Emergency Relief Fund (HEERF) Student Portion, COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) and Maternal and Child Health Federal Consolidated Programs Award Numbers: Various Assistance Listing Titles: COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution, COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters), COVID-19 Higher Education Emergency Relief Fund (HEERF) Student Aid Portion, COVID-19 HEERF Institutional Aid Portion, COVID-19 HEERF Minority Serving Institutions, and Maternal and Child Health Federal Consolidated Programs Assistance Listing Number: 93.498, 97.036, 84.425E, 84.425F, 84.425L, 93.110 Award Year: 2020-2021, 2021-2022, 2019-2020, 2021-2023 Pass-through entity: Not applicable Management has implemented additional reconciliation and review procedures over the last two years to improve the accuracy and completeness of the SEFA. · UCOP implemented an annual SEFA review process to include the systemwide Controller and campus Controllers. UCOP also distributed one interim SEFA draft to the External Fund Managers (EFMs) that had historically been tasked with only a year-end review. · UCOP continued to reconcile atypical federal programs (e.g., PRF, FEMA, etc.) and included in the fiscal year 2023 SEFA drafts for campus Controller review. Beginning in FY 2024, UCOP will implement more comprehensive financial reporting controls as follows: · Interim SEFA reports, inclusive of atypical programs, will be prepared centrally and distributed to campuses for review and alignment with campus records. Campus management will be tasked with the responsibility for overall review and signoff for both interim and final SEFA reports. · The Systemwide Controller will also be included in the review process by performing an overall review and signoff for both interim and final SEFA reports. With respect to the specific findings in FY2023 for atypical / nonrecurring federal programs, the following actions have been and/or will be taken: • FEMA: A reconciliation process was implemented within UCOP in FY2023, the result of which was the discovery of the understatement referenced in the finding. FEMA expenses are now reconciled to, and obligation dates retrieved from, the Federal FEMA Grants Portal to ensure project expenses are accurately reported in the proper fiscal year. Data from the State portal is distributed to campuses for validation. UCOP has also reminded campus and medical center Controllers of the reporting requirements and will cover this topic again in future trainings. Additionally, UCOP will remind campuses and medical centers of the requirement to account for the FEMA project in the federal fund range at the time of obligation to trigger SEFA reporting. • PRF – A reconciliation process was implemented by UCOP in FY2022 and the reconciliation itself was completed in FY2023, the result of which was the discovery of the understatement referenced in the finding. PRF expenses reported by campuses are now reconciled to the HRSA online portal which will continue for the duration of the program. UCOP has also reminded campus and medical center Controllers of their responsibility to report on these dollars for their entire enterprise (Faculty Practice Group, School of Medicine, etc.). As with all other federal funding, PRF amounts will continue to be part of the SEFA reports distributed to campuses for review and signoff. Coordination between campuses and medical centers will be expected for this review and signoff. • HEERF – while the program ended in FY2023, UCOP will apply lessons learned to any future “special” funding. When atypical programs such as this are awarded in the future, UCOP will provide more consistent guidance upfront and establish more consistent accounting and reporting requirements for campuses and the medical centers to follow. Requirements will include regular reporting of these dollars to UCOP with a reconciliation of campus ledgers to any sponsor reporting. As with all other federal funding, amounts will be part of the SEFA reports distributed to campuses for review and signoff. • Program Income – UCOP will develop and conduct expanded training to campus Controllers, EFMs and their staff to include SEFA requirements generally, including treatment for program income (and other SEFA exclusions), new review procedures, etc. UCOP will target training for the spring of 2024. For inquiries regarding this finding, please contact Barbara Cevallos at barbara.cevallos@ucop.edu who is responsible for the corrective action.

View Audit 295197

Finding 377379 (2023-002)

None 2023

University of California

CA

Questioned Costs Procurement, Suspension & Debarment Subrecipient Monitoring

2023-002 – Transfer of costs from HEERF to FEMA not reported in HEERF quarterly report Cluster: Not applicable Sponsoring Agency: Department of Education (ED) Award Name: COVID-19 Higher Education Emergency Relief Fund (HEERF) – Institutional Portion Award Number: P425F202631 - 20B Assistance ...

2023-002 – Transfer of costs from HEERF to FEMA not reported in HEERF quarterly report Cluster: Not applicable Sponsoring Agency: Department of Education (ED) Award Name: COVID-19 Higher Education Emergency Relief Fund (HEERF) – Institutional Portion Award Number: P425F202631 - 20B Assistance Listing Title: COVID-19 - Education Stabilization Fund Assistance Listing Number: 84.425F Award Year: 2020-2021 Pass-through entity: Not applicable The campus amended the March 31, 2021, quarterly HEERF institutional report by prominently highlighting the modifications. • A revised report has been uploaded to the campus website (UCLA Financial Aid and Scholarships – HEERF Institutional Portion Reports) alongside the other completed quarterly HEERF reports. • In accordance with ED guidelines, the old report has been replaced with the updated version, clearly indicating the date of the revision. For inquiries regarding this finding, please contact Selina Martin at selinamartin@finance.ucla.edu who is responsible for the corrective action.

View Audit 295197

Finding 377368 (2023-001)

Material Weakness 2023

Cloverdale Community School Corporation

IN

Internal Control / Segregation of Duties Material Weakness Reporting § 200.303

FINDING 2023-001 Finding Subject: Education Stabilization Fund - Internal Controls Over Annual Data Report Summary of Finding: Significant Deficiency; A failure to establish an effective internal control system creating a risk of noncompliance with the grant agreement and the reporting compliance r...

FINDING 2023-001 Finding Subject: Education Stabilization Fund - Internal Controls Over Annual Data Report Summary of Finding: Significant Deficiency; A failure to establish an effective internal control system creating a risk of noncompliance with the grant agreement and the reporting compliance requirement. Contact Person Responsible for Corrective Action: Mendy Shrout Contact Phone Number and Email Address: 765-795-4664 mshrout@cloverdale.k12.in.us Views of Responsible Officials: We concur with the finding. Explanation and Reasons for Disagreement: NA Description of Corrective Action Plan: Management has created a google doc to record the reviewed by and submitted by dates of the reporting. As well as including financial reports in respective report files. Anticipated Completion Date: Google doc was created February 5, 2024

View Audit 295157

Finding 377339 (2023-001)

Material Weakness 2023

Edgewood College, Inc.

WI

Questioned Costs Special Tests & Provisions Student Financial Aid

Finding: Management's review of the enrollment reporting did not detect errors on certain student data elements. Certain student records within the NSLDS were identified with inaccurate data elements. The College is responsible for designing, implementing, and maintaining internal control over compl...

Finding: Management's review of the enrollment reporting did not detect errors on certain student data elements. Certain student records within the NSLDS were identified with inaccurate data elements. The College is responsible for designing, implementing, and maintaining internal control over compliance for special tests and provisions and for accurately reporting significant data elements under the Campus-Level and Program-Level records within the National Student Loan Data System (NSLDS) that the Department of Education (ED) considers high risk. The College's internal control over compliance for special tests are not operating effectively. The preparer did not update the student's status into NSLDS resulting in inaccuracies in significant Campus-Level and Program-Level enrollment date elements that ED considers high risk. Additionally, student with status changes were incorrectly reported as withdrawn but upon review of internal documentation, those same students graduated. We recommend management review and enhance its review policies and procedures surrounding enrollment reporting submissions to ensure the accuracy of data elements reported to ED. A review performed by an appropriate individual separate from the prepared prior to the submission of the enrollment reports to NSLDS may improve the accuracy of enrollment reporting. We also recommend management review all students reported to NSLDS to verify they are accurately reported. Corrective Action: Management agrees and has implemented necessary procedures/controls to ensure the College is in compliance with enrollment requirements.

View Audit 295133

Finding 377325 (2023-001)

Material Weakness 2023

Horizon Health and Wellness, Inc.

AZ

Questioned Costs Material Weakness Reporting § 200.303

Department of Health and Human Services Federal Assistance Listing #93.498 COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 4 TIN #860554593 Reporting Material Weakness in Internal Control Over Compliance and Material N...

Department of Health and Human Services Federal Assistance Listing #93.498 COVID-19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 4 TIN #860554593 Reporting Material Weakness in Internal Control Over Compliance and Material Noncompliance Finding Summary: The Organization selected option iii to calculate lost revenue using budgeted gross revenues to actual gross revenues. The Organization’s HHS Period 4 Report included lost revenues for three quarters that did not agree to the supporting calculation of lost revenues. Without proper implementation of internal controls over the Organization’s budget prior to submission errors could occur resulting in the Organization not calculating lost revenues correctly. Status: The Organization will be adopting a policy to enhance internal controls over the budget to ensure that the lost revenue calculation is not changed after submission and follows the option iii methodology utilized to calculate lost revenues. Responsibility of: Richard Leonard (Controller) and Andrew Horan (Director of F.P. and A.) Estimated Completion Date: 3/31/24

View Audit 295119

Finding 377318 (2023-001)

Material Weakness 2023

Sarasota County, Florida

FL

Questioned Costs Subrecipient Monitoring Material Weakness § 200.303

Material Weakness - Internal Controls over Reporting and Noncompliance The Office of Financial Management (OFM) Grant Program Administrator, Heather Larson will monitor and ensure that Federal Funding Accountability and Transparency Act of 2006 (FFATA) reports are filed as required in the FSRS syste...

Material Weakness - Internal Controls over Reporting and Noncompliance The Office of Financial Management (OFM) Grant Program Administrator, Heather Larson will monitor and ensure that Federal Funding Accountability and Transparency Act of 2006 (FFATA) reports are filed as required in the FSRS system. Since the recent transition of the CDBG Entitlement Cluster from an outside agency back to Sarasota County, the County has implemented a standardized form to capture needed information from current and future subrecipients to report appropriately the requirements of the Federal Funding Accountability and Transparency Act of 2006 (FFATA). The OFM Grant Analyst assigned to the funding award, upon review of any pending subaward/ subaward amendment, will create an Action Item utilizing the Grants Administration module of OnBase. The Action Item will require completion of any required FSRS reporting. Action item will be assigned and have a deadline date no late than the last day of the month following the month in which the subaward/ subaward amendment obligation was made. Implementation date for this process - On or before February 28, 2024.

View Audit 295115

Finding 377305 (2023-006)

Significant Deficiency 2023

Floyd County Medical Center

IA

Reporting Significant Deficiency

Federal Agency Name: Department of Health and Human Services Program Name: COVID‐19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 4 TIN #420868216 Federal Financial Assistance Listing #93.498 Compliance Requirement: Preparati...

Federal Agency Name: Department of Health and Human Services Program Name: COVID‐19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 4 TIN #420868216 Federal Financial Assistance Listing #93.498 Compliance Requirement: Preparation of Schedule of Expenditures of Federal Awards ‐ Other Finding Summary: The Hospital does not have an internal control system designed to provide for a complete and accurate Schedule being audited. Eide Bailly, LLP, the auditors, were requested to draft the Schedule and notes to the Schedule. Responsible Individuals: Craig Carstens, CFO Corrective Action Plan: Management agrees with this finding. Management will develop and implement an internal control system tailored to ensure completeness and accuracy in auditing the Schedule. Management will clearly define the objectives of the internal control system to address gaps in auditing procedures. Management will set clear standards and protocols for auditing processes, ensuring adherence to regulatory requirements. Management will provide comprehensive training to staff involved in auditing processes to ensure they understand their roles and responsibilities. Management will conduct regular assessments and reviews of the internal control system's effectiveness and make adjustments as needed to improve accuracy and completeness. Anticipated Completion Date: 2/26/2024.

View Audit 295111

Finding 377304 (2023-005)

Significant Deficiency 2023

Floyd County Medical Center

IA

Questioned Costs Reporting Significant Deficiency § 200.303

Federal Agency Name: Department of Health and Human Services Program Name: COVID‐19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 4 TIN #420868216 Federal Financial Assistance Listing #93.498 Compliance Requirement: Reporting...

Federal Agency Name: Department of Health and Human Services Program Name: COVID‐19 Provider Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year – Period 4 TIN #420868216 Federal Financial Assistance Listing #93.498 Compliance Requirement: Reporting Finding Summary: There was no evidence retained that the Hospital’s special report submitted to the Department of Health and Human Services for Period 4 TIN #420868216 was reviewed or approved by an individual separate from the preparer prior to submission. Responsible Individuals: Craig Carstens, CFO Corrective Action Plan: Management agrees with this finding. Management will designate specific individuals to review HHS special report submissions before submission to HHS. Management will require documentation verifying independent review and approval prior to submission. Management will provide comprehensive training to staff on the importance of independent review processes. Management will set up automated workflow systems and checklists to enforce review procedures. Management will regularly audit the review process, gather feedback, and make necessary adjustments for enhancement. Anticipated Completion Date: 2/26/2024.

View Audit 295111

Finding 377298 (2023-109)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Subrecipient Monitoring Reporting Significant Deficiency

Responsible Contact Person(s): Kassandra Bullock, Director of Grants Management DeAndrea Williams, Grants Admin Supervisor Joseph Thompson, Grants Compliance Supervisor John Colligan, Director of Finance and Administration Corrective Action Planned: An internal compliance review has been implemented...

Responsible Contact Person(s): Kassandra Bullock, Director of Grants Management DeAndrea Williams, Grants Admin Supervisor Joseph Thompson, Grants Compliance Supervisor John Colligan, Director of Finance and Administration Corrective Action Planned: An internal compliance review has been implemented to ensure accuracy and timely reporting of FFATA data. Data is confirmed prior to upload by the Grants Compliance Team to address errors, missing information, and conflicting dates. Training has occurred via the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) by Grants Admin staff. Additionally all changes in statements of grant awards (SOGA) will be reviewed and reissued when needed and data re-entered to ensure FFATA correlates with SOGA. Estimated Completion Date: 1/26/2024

View Audit 295106

Finding 377290 (2023-107)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Subrecipient Monitoring Matching / Level of Effort / Earmarking Reporting § 200.303

Responsible Contact Person(s): Ida Witherspoon, Chief Financial Officer Corrective Action Planned: Send periodic e-mail reminders to program staff responsible for submitting FFATA data to the Federal Reporting Unit for submission to the federal government. Additional time is needed to fully impleme...

Responsible Contact Person(s): Ida Witherspoon, Chief Financial Officer Corrective Action Planned: Send periodic e-mail reminders to program staff responsible for submitting FFATA data to the Federal Reporting Unit for submission to the federal government. Additional time is needed to fully implement an automated solution. Estimated Completion Date: 10/30/2024

View Audit 295106

Finding 377287 (2023-106)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Subrecipient Monitoring Reporting § 200.303

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS will perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve reporting errors. Additio...

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS will perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve reporting errors. Additionally, DSS will create a systems modification request to correct errors that are identified as occurring as a result of inaccurate programming in the data modification phase of federal report creation. Estimated Completion Date: 12/31/2024

View Audit 295106

Finding 377284 (2023-105)

Material Weakness 2023

Commonwealth of Virginia

VA

Questioned Costs Subrecipient Monitoring Material Weakness

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Mark Golden, Economic Assistance and Employment Manager Division of Benefit Programs Corrective Action Planned: Perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve r...

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Mark Golden, Economic Assistance and Employment Manager Division of Benefit Programs Corrective Action Planned: Perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve reporting errors. Create a systems modification request to correct errors that are identified as occurring as a result of inaccurate programming in the data modification phase of federal report creation. Estimated Completion Date: 6/30/2024

View Audit 295106

Finding 377283 (2023-104)

Material Weakness 2023

Commonwealth of Virginia

VA

Questioned Costs Eligibility Material Weakness § 200.303 § 200.501

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS has requested the vendor's records. Once received, DSS will audit those records to provide reasonable assurance that the contractor administer...

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS has requested the vendor's records. Once received, DSS will audit those records to provide reasonable assurance that the contractor administered the LIHWAP federal grant program in accordance with federal statutes, regulations, and the terms and conditions of the federal award before it closes the grant award. Estimated Completion Date: 6/30/2024

View Audit 295106

Finding 377280 (2023-103)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Subrecipient Monitoring Eligibility § 200.303

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director Senior Benefit Programs Denise Surber, EAP Manager - Division of Benefit Programs Corrective Action Planned: DSS will work to provide additional training to local agency eligibility workers on h...

Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director Senior Benefit Programs Denise Surber, EAP Manager - Division of Benefit Programs Corrective Action Planned: DSS will work to provide additional training to local agency eligibility workers on how to properly determine and document eligibility determinations in the case management system. Additionally, DSS will consider monitoring local agency eligibility worker’s use of manual overrides to confirm that they properly document eligibility determinations in the case management system. Estimated Completion Date: 12/31/2024

View Audit 295106 Questioned Costs: $1

Finding 376165 (2023-085)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Reporting Significant Deficiency § 200.303

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: DSS has 15 plus applications that are in active oversight; IT Business Administration is in receipt of the required SOC 2, Type 2 reports. However, additional requirements to capture the SOC 1, Type 2 ...

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: DSS has 15 plus applications that are in active oversight; IT Business Administration is in receipt of the required SOC 2, Type 2 reports. However, additional requirements to capture the SOC 1, Type 2 reports have not yet been accomplished. Several SOC reports were not captured by VITA and then provided to DSS for review. Additional requirements to capture SOC 1, Type 2 reports have been identified and VITA is requesting this information of the providers. Estimated Completion Date: 12/31/2024

View Audit 295106

Finding 376162 (2023-072)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Subrecipient Monitoring Reporting § 200.303

Responsible Contact Person(s): Naveen Abraham, Chief Core Infrastructure Services Corrective Action Planned: Ensuring that infrastructure suppliers fulfill all contractual requirements with respect to Commonwealth security policies and standards necessitates a programmatic, continuous improvement ap...

Responsible Contact Person(s): Naveen Abraham, Chief Core Infrastructure Services Corrective Action Planned: Ensuring that infrastructure suppliers fulfill all contractual requirements with respect to Commonwealth security policies and standards necessitates a programmatic, continuous improvement approach. VITA has made improved cybersecurity a primary goal and major initiatives have completed and are underway. VITA has established a scoring mechanism, based on the Common Vulnerability Scoring System (CVSS), that delineates the necessary response based on the criticality of the vulnerability (critical, high, and medium). For vulnerabilities with a CVSS score of (critical and high), service level agreement (SLA) 1.1.3 is now in place to measure supplier performance and adjust supplier compensation accordingly through SLA credits and RCDs. For vulnerabilities below the critical and high score, in Q4 of 2023, suppliers started providing data in a quarterly report to the MSI and VITA. The new SLAs combined with the reports of vulnerabilities below the critical and high score are used to ensure suppliers’ contractual compliance. VITA’s data shows that patches for software on the enterprise software list are being applied on an ongoing basis. VITA will work with agencies and suppliers if there are any new technical difficulties or questions about patching. New tools are now available to agencies so that they can monitor and verify the remediation of the vulnerabilities for which infrastructure suppliers are responsible. Dashboards have also been provided to the suppliers so that they can review a shared and common vulnerability list. VITA and the suppliers monitor and review enterprise level logs and security events on behalf of customer agencies through the system dashboard and a 24x7 Security Operations Center. The dashboard is available for access by agencies as of Q4 2023. VITA will continue to monitor and improve the security of infrastructure services through ongoing governance, including the requirements of architecture documentation, system security plans, and audit reports. VITA’s infrastructure services group will work with the VITA security group to confirm that the current state achieves security standards compliance. Estimated Completion Date: 6/30/2024

View Audit 295106

Finding 376117 (2023-043)

Significant Deficiency 2023

Commonwealth of Virginia

VA

Questioned Costs Reporting Significant Deficiency § 200.303

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management Melinda Raines, Director of Human Resources Karen Holt, Human Resources Business Process Consultant Corrective Action Planned: An agency-wide work group will be estab...

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management Melinda Raines, Director of Human Resources Karen Holt, Human Resources Business Process Consultant Corrective Action Planned: An agency-wide work group will be established to determine the exact processes need to implement the controls necessary to address this finding. HR and ISRM have identified the need for new reporting and interfaces to regain compliance. DSS had deployed DOA human capital management system and an internal system that will need to have interfaces developed. Estimated Completion Date: 6/30/2024

View Audit 295106

Finding 376063 (2023-004)

Material Weakness 2023

Batesville Community School Corporation

IN

Internal Control / Segregation of Duties Material Weakness Reporting § 200.303

FINDING 2023-004 Finding Subject: COVID-19 - Education Stabilization Fund – Reporting Summary of Finding: Reports were not reviewed by someone other than the preparer Contact Person Responsible for Corrective Action: Todd Nobbe Contact Phone Number: 812-934-2194 Views of Responsible Official: We con...

FINDING 2023-004 Finding Subject: COVID-19 - Education Stabilization Fund – Reporting Summary of Finding: Reports were not reviewed by someone other than the preparer Contact Person Responsible for Corrective Action: Todd Nobbe Contact Phone Number: 812-934-2194 Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: The school corporation will establish a proper system for internal controls and develop procedure to ensure report are review by someone other than the preparer. Completion Date: Immediately 2/26/2024

View Audit 295088

Finding 376045 (2023-002)

Material Weakness 2023

Crown Point Community School Corporation

IN

Internal Control / Segregation of Duties Material Weakness Reporting § 200.303

FINDING 2023-002 Finding Subject: Title I Grants to Local Educational Agencies - Reporting Summary of Finding: The School Corporation had established a system of internal controls over the Final Expenditure report for Title I. However, the internal control process was not documented. It is recommend...

FINDING 2023-002 Finding Subject: Title I Grants to Local Educational Agencies - Reporting Summary of Finding: The School Corporation had established a system of internal controls over the Final Expenditure report for Title I. However, the internal control process was not documented. It is recommended that the School Corporation's management establish a system of internal controls. Contact Person Responsible for Corrective Action: James H. Hardman Contact Phone Number and Email Address: 219-663-3371 jhardman@cps.k12.in.us Views of Responsible Officials: The management of the Crown Point Community School Corporation concurs with the finding. Description of Corrective Action Plan: The management of the Crown Point Community School Corporation will establish a system of internal controls consisting of policies and procedures. Anticipated Completion Date: April 5, 2024

View Audit 295075

Finding 376044 (2023-002)

Significant Deficiency 2023

Massachusetts Bay Community College

MA

Student Financial Aid Reporting Matching / Level of Effort / Earmarking

Finding number: 2023-002 Federal agency: U.S. Department of Education Programs: Student Financial Assistance Clusters AL #’s: 84.268 Award year: 2023 Corrective Action Plan: The College will be looking at making some business process changes to review files submitted to ...

Finding number: 2023-002 Federal agency: U.S. Department of Education Programs: Student Financial Assistance Clusters AL #’s: 84.268 Award year: 2023 Corrective Action Plan: The College will be looking at making some business process changes to review files submitted to NSC(National Student Clearing House) and NSLDS (National Student Loan Data Service) on a monthly basis and perform monthly reconciliation between responsible offices to ensure students are accurately reported to ED/NSLDS. This new implementation will allow the College/Office to better verify each student’s enrollment status visibility of reporting issues in the future. Timeline for Implementation of Corrective Action Plan: This new procedure was implemented starting with the Fall 2023 semester and beyond. Contact Person Alex Jean-Jacques Director of Financial Aid of Operations

View Audit 295071

Finding 376018 (2023-001)

Significant Deficiency 2023

Gwynedd Mercy University

PA

Student Financial Aid Reporting Significant Deficiency

Finding 2023-001- Enrollment Reporting Recommendation: It is recommended that the University review policies and procedures in place to resolve reporting issues in a timely manner to facilitate compliance with Title IV regulations. Action Taken: Each error was corrected within the system. Going forw...

Finding 2023-001- Enrollment Reporting Recommendation: It is recommended that the University review policies and procedures in place to resolve reporting issues in a timely manner to facilitate compliance with Title IV regulations. Action Taken: Each error was corrected within the system. Going forward, the reports submitted to NSLDS will be closely reviewed to ensure effective dates for student changes are appropriately reported. In addition, the registrar has updated their process notes which are used each time they pull the report. Responsible Individual for Corrective Action: Registrar - Joanna Raudenbush Anticipated Completion Date: December 31, 2023

View Audit 295042

Finding 376015 (2023-001)

None 2023

Hiram College

OH

Questioned Costs Reporting § 200.329

Corrective Actions Taken or Planned: Management will make necessary revisions to previous reporting. Management will complete and file all past due quarterly and annual reports accurately and in compliance with all HEERF reporting requirements. The fiscal year 2024 annual report will be filed in a t...

Corrective Actions Taken or Planned: Management will make necessary revisions to previous reporting. Management will complete and file all past due quarterly and annual reports accurately and in compliance with all HEERF reporting requirements. The fiscal year 2024 annual report will be filed in a timely manner. Anticipated Completion Date: March 31, 2024 Responsible Contact Person: Jacalyn Kovach, AVP Finance/Controller

View Audit 295035

Finding 375947 (2023-003)

None 2023

Corban University

OR

Student Financial Aid Matching / Level of Effort / Earmarking Cash Management

FISAP Reporting Planned Corrective Action: Corban will work collaboratively with the Department of Education to investigate FISAP reporting and resolve any inconsistencies appropriately. Additionally, independent of the individual who prepares the FISAP, Corban will appoint a knowledgeable individua...

FISAP Reporting Planned Corrective Action: Corban will work collaboratively with the Department of Education to investigate FISAP reporting and resolve any inconsistencies appropriately. Additionally, independent of the individual who prepares the FISAP, Corban will appoint a knowledgeable individual to review the completed FISAP for quality assurance (QA). These actions will ensure a diversity of accountability and prevent reoccurrence. Person Responsible for Corrective Action Plan: Jordan Lindsey, Associate Vice President for Enrollment Management and Marketing Anticipated Date of Completion: April 30, 2024

View Audit 294999

Finding 375938 (2023-003)

Material Weakness 2023

Imagine the Possibilities, Inc.

IA

Allowable Costs / Cost Principles Eligibility Material Weakness § 200.303

Finding 2023-003: Allowable Cost/Cost Principles and Reporting Federal Agency Name: Department of Health and Human Services Program Name: COVID-19 Provide Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year Period 4 TIN#237224698 Federal Financial A...

Finding 2023-003: Allowable Cost/Cost Principles and Reporting Federal Agency Name: Department of Health and Human Services Program Name: COVID-19 Provide Relief Fund and American Rescue Plan (ARP) Rural Distribution Applicable Federal Award Number and Year Period 4 TIN#237224698 Federal Financial Assistance Listing Number: 93.498 Finding Summary: Imagine the Possibilities, Inc. final eligible expenditure listing identified as eligible and claimed under the Provider Relief Fund program was not reviewed and approved by a separate individual outside of the preparer. In addition, the Organization’s special report submitted to the Department of Health and Human Services for Period 4 TIN #237224698 was not reviewed and approved by a separate individual outside of the preparer. Responsible Individuals: Megan Simmons, CFO Corrective Action Plan: Management agrees with the finding. The Organization will review the internal controls and implement improvements related to allowability of all federal cost claimed, including those regarding the identification of duplicate items and approved costs. Anticipated Completion Date: March 31, 2024

View Audit 294998

Corrective Action Plans

Filters