Corrective Action Plans

Browse how organizations respond to audit findings

Total CAPs
55,924
In database
Filtered Results
9,427
Matching current filters
Showing Page
114 of 378
25 per page

Filters

Clear
Active filters: Significant Deficiency
Finding 526389 (2024-001)
Significant Deficiency 2024
Finding No. 2024-001 Corrective Action Plan: The University concurs with this finding. The Financial Aid Office has updated procedures and ensures all student files have a thorough examination of all documents prior to document retention review. All MPNs and Perkins-related documents are now identif...
Finding No. 2024-001 Corrective Action Plan: The University concurs with this finding. The Financial Aid Office has updated procedures and ensures all student files have a thorough examination of all documents prior to document retention review. All MPNs and Perkins-related documents are now identified in this review and subsequently stored separately in secure fireproof storage. The files relating to this finding were not appropriately retained and the current procedure would have identified these for continued records retention. Responsible Official: Dane Fuhrman, CFO Anticipated Completion Date: June 2025
Contact Person Responsible for Corrective Action: Dr. Tammy Rowshandel, Chief Accountability Officer Contact Phone Number: 812-462-4224 Views of Responsible Official: The School Corporation's management will establish an effective system of internal control to ensure compliance and comply with the g...
Contact Person Responsible for Corrective Action: Dr. Tammy Rowshandel, Chief Accountability Officer Contact Phone Number: 812-462-4224 Views of Responsible Official: The School Corporation's management will establish an effective system of internal control to ensure compliance and comply with the grant agreement and the Special Tests and Provisions - Annual Report Card, High School Graduation Rate compliance requirement. Description of Corrective Action Plan: A system will be put in place that ensures compliance with the Special Tests and Provisions-Annual Report Card, High School Graduation Rate requirements. Records will be retained for audit so that appropriate documentation is available to substantiate all future reporting. Building registrars will enter state exit codes for students and upload documentation to substantiate the exit codes that are chosen. Once the documents are uploaded, the registrars will place the word “AUDIT” in the withdrawal comments. This indicates the exit is now audit ready. Schools will conduct regular internal cohort audits. Comparisons of IDOE cohort data and withdrawal information in Skyward will be done. The registrar, assistant principal, and data counselor in each building will work together to check the original uploads of documentation done by the registrar and keep record of this work. One final internal audit will take place at the school level by head counselors and assistant principals to indicate all graduates are correctly identified and all exits have proper documentation on file. The CFO and superintendent will digitally sign off on these records during IDOE July certification. Anticipated Completion Date: March 1, 2025
Action Plan: CCC’s managerial and quality assurance review processes include reviews of all client files to ensure appropriate documentation of eligibility, services rendered, and client progress. These reviews happen at intake and periodic intervals to ensure the accuracy and quality of the client ...
Action Plan: CCC’s managerial and quality assurance review processes include reviews of all client files to ensure appropriate documentation of eligibility, services rendered, and client progress. These reviews happen at intake and periodic intervals to ensure the accuracy and quality of the client record. We acknowledge that in some cases, management did not specifically document the management review of eligibility documentation, however the review process did ensure that all files did include appropriate documentation of client eligibility. Moving forward, we will ensure that all client files specifically evidence managerial confirmation of client eligibility with one or more of the following: 1. a signed checklist containing potential eligibility documents 2. a signature on the actual eligibility document or referral 3. an electronic case note to the file confirming review and presence of eligibility documentation. We have already begun working with relevant departments to implement these improvements and will monitor the implemented changes to ensure their effectiveness as we are committed to maintaining and enhancing our internal controls environment and the quality of services provided to the individuals and families we serve.
Responsible Contact Person(s): Naveen Abraham, Chief Core Infrastructure Services Corrective Action Planned: Ensuring that infrastructure suppliers fulfill all contractual requirements with respect to Commonwealth security policies and standards necessitates a programmatic, continuous improvement ap...
Responsible Contact Person(s): Naveen Abraham, Chief Core Infrastructure Services Corrective Action Planned: Ensuring that infrastructure suppliers fulfill all contractual requirements with respect to Commonwealth security policies and standards necessitates a programmatic, continuous improvement approach. VITA has made improved cybersecurity a primary goal and major initiatives have completed and are underway. Based on the improved SLAs and with the improved tools previously implemented, VITA will continue to monitor and improve the security of infrastructure services through ongoing governance, including the requirements of architecture documentation, system security plans, and audit reports. VITA’s infrastructure services group will work with our security group to confirm that the current state achieves security standards compliance. VITA will also continue to work with agencies to drive continued vulnerability remediation and access to log data and to further refine documentation regarding SOPs of the security program and regarding the responsibilities of VITA vs the responsibilities of agencies and suppliers. Estimated Completion Date: 6/30/2025
Responsible Contact Person(s): Barry Davis, Chief Information Security Officer Karen Holt, Human Resource Business Process Consultant Corrective Action Planned: An agency-wide work group will be established to determine the exact processes need to implement the controls necessary to address this fi...
Responsible Contact Person(s): Barry Davis, Chief Information Security Officer Karen Holt, Human Resource Business Process Consultant Corrective Action Planned: An agency-wide work group will be established to determine the exact processes need to implement the controls necessary to address this finding. Estimated Completion Date: 6/30/2025
Responsible Contact Person(s): Kevin Platea, Chief Information Officer Stephen Schleck, Associate Director of Enterprise Business Solutions Angela Morse, Benefit Programs Corrective Action Planned: A Change Request (CR), for the management system was developed 2 years ago and DSS is reviewing the CR...
Responsible Contact Person(s): Kevin Platea, Chief Information Officer Stephen Schleck, Associate Director of Enterprise Business Solutions Angela Morse, Benefit Programs Corrective Action Planned: A Change Request (CR), for the management system was developed 2 years ago and DSS is reviewing the CR to determine a status. It was agreed by Line of Business and ITS EBS and the O&M provider that there will be an iterative approach to completing the record retention and purge rules for implementation in the management system. DSS anticipates the first of a series of changes to address this finding to be implemented in the February 2024 Information Technology Services release. DSS is planning for the final phase of Purge by quarter three of 2025 and will include the following scope: • Scope of change is 150 EDBC tables across all programs beyond a defined cut-off date. • A one-time purge process and on-going purge process will be developed to purge the Uncertified/Unauthorized, Non-current Eligibility Determination. • Develop ongoing purge process for the Phase 1 and Phase 2 tables. • Purge Data files and Data logs App/Batch server. Estimated Completion Date: 12/30/2025
Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Fede...
Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 12/31/2025
Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management Corrective Action Planned: DSS Information Security and Risk Management security awareness and training assets will develop role based training for system administrat...
Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management Corrective Action Planned: DSS Information Security and Risk Management security awareness and training assets will develop role based training for system administrators and data custodians. Estimated Completion Date: 6/30/2025
Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management John Vosper, Assistant Director of Information Security & Risk Management Corrective Action Planned: DSS has contracted external IT auditors to perform IT audits once...
Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management John Vosper, Assistant Director of Information Security & Risk Management Corrective Action Planned: DSS has contracted external IT auditors to perform IT audits once every three years on an ongoing rotating basis in accordance with yellow book audit standards. Estimated Completion Date: 12/15/2025
Responsible Contact Person(s): Mike Jones, Chief Information Officer Steve Hanoka, Information Security Officer Corrective Action Planned: Vulnerability Management policies and procedures exist. These include scanning for both vulnerabilities and baseline configuration. They are being tracked acco...
Responsible Contact Person(s): Mike Jones, Chief Information Officer Steve Hanoka, Information Security Officer Corrective Action Planned: Vulnerability Management policies and procedures exist. These include scanning for both vulnerabilities and baseline configuration. They are being tracked according to SEC530 resolution standards. Goal is to ensure that all vulnerabilities are remediated within the SLA or have approved exceptions by May 30, 2025. In addition, DMAS has gained guidance from VITA on acceptable alternatives to penetration testing and are tracking completion. Estimated Completion Date: 5/30/2025
Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Fede...
Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 6/30/2025
Responsible Contact Person(s): Kavansa Gardner, IT Manager Corrective Action Planned: DSS performed an annual access review of user accounts for the system. As of December 20, 2024, the DSS projected completion date for the 2024 system Annual Review was December 31, 2024. The IT Manager is waiting f...
Responsible Contact Person(s): Kavansa Gardner, IT Manager Corrective Action Planned: DSS performed an annual access review of user accounts for the system. As of December 20, 2024, the DSS projected completion date for the 2024 system Annual Review was December 31, 2024. The IT Manager is waiting for eight more FIPs to submit screenshots of roles that have been removed or changed. The IT Manager has been in contact with all noncompliant agencies and has meetings scheduled to ensure all necessary documentation is obtained prior to the cutoff point. DSS will be reviewing final documents to certify the accuracy of the review before deadline. Estimated Completion Date: 1/31/2025
Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Kavansa Gardner, IT Manager Corrective Action Planned: DSS will perform and document a conflicting access review for the management system to identify the combinations of roles that could pose separation of duties conflicts an...
Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Kavansa Gardner, IT Manager Corrective Action Planned: DSS will perform and document a conflicting access review for the management system to identify the combinations of roles that could pose separation of duties conflicts and ensure compensating controls are in place to mitigate risks arising from those conflicts. Additionally, DSS will work with the vendor to update the role-based security access documentation to reflect all system changes from prior case management system related releases when there are proposed changes to the roles matrix. Estimated Completion Date: 12/31/2025
Responsible Contact Person(s): Kevin Platea, Chief Information Officer Dwayne Sneade, Director of Cybersecurity Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3...
Responsible Contact Person(s): Kevin Platea, Chief Information Officer Dwayne Sneade, Director of Cybersecurity Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 12/31/2025
Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management John Vosper, Assistant Director of Information Security & Risk Management Sam Owusu, IT Risk Manager of Information Security & Risk Management Corrective Action Plann...
Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management John Vosper, Assistant Director of Information Security & Risk Management Sam Owusu, IT Risk Manager of Information Security & Risk Management Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 12/31/2026
Responsible Contact Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federa...
Responsible Contact Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 4/30/2025
Responsible Contact Person(s): Steve Hanoka, Information Security Officer Corrective Action Planned: Third-party Management that will cover ensuring all deliverables required are part of a procedure and work instruction. In addition, to specifically address the points in the finding, ISO will ensure...
Responsible Contact Person(s): Steve Hanoka, Information Security Officer Corrective Action Planned: Third-party Management that will cover ensuring all deliverables required are part of a procedure and work instruction. In addition, to specifically address the points in the finding, ISO will ensure that the work instructions cover obtaining a confirmation on the geographic location of sensitive data monthly and vulnerability scan results at least every 90 days.  During this procedure implementation, ISO will also work to specifically obtain these deliverables from the vendor in question.  Estimated Completion Date: 3/31/2025
Responsible Contact Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: Language has been added to the Conduent contract renewal for option years 1 and 2 to require the SOC 1 Type II. The renewal is in the process of being reviewed and executed to go into effect July 1, 2025...
Responsible Contact Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: Language has been added to the Conduent contract renewal for option years 1 and 2 to require the SOC 1 Type II. The renewal is in the process of being reviewed and executed to go into effect July 1, 2025. Language added to contract renewal: Contractor Internal Controls Reports The Contractor shall provide the Department, at a minimum; annual, unredacted reports from its independent external auditor on the effectiveness of the Contractor’s internal controls conducted in accordance with the AICPA Statement on Standards for Attestation Engagements. If the reports disclose deficiencies in internal controls, the Contractor shall include management’s corrective action plans to remediate the deficiency. The Contractor shall provide the following reports: · SOC 1 Type 2 Report that reports on the controls at the service organization which are relevant to the user entities’ internal control over financial reporting · SOC 2 Type 2 Report covering all five Trust Services Criteria (Security, Availability, Processing Integrity, Privacy and Confidentiality) The contractor shall provide the Department with these internal control reports within 30 days of the report’s issue date. Reports shall cover a period of 12 months beginning from the end date of the prior audit period with the first report covering a period of 12 months from the execution date of this contract. The contractor shall provide unredacted SOC 1 Type 2 and/or SOC 2 Type 2 reports as described above for any subservice organizations which provide a service to the Contractor that may impact the Department’s financial, program operations, or data security as determined by the Department. Estimated Completion Date: 7/1/2026
Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS will perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve reporting errors. Additio...
Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS will perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve reporting errors. Additionally, DSS will create a systems modification request to correct errors that are identified as occurring as a result of inaccurate programming in the data modification phase of federal report creation. Estimated Completion Date: 12/31/2025
Responsible Contact Person(s): Ida Witherspoon, Chief Financial Officer Corrective Action Planned: Send periodic e-mail reminders to program staff responsible for submitting FFATA data to the Federal Reporting Unit for submission to the federal government. Estimated Completion Date: 3/15/2025
Responsible Contact Person(s): Ida Witherspoon, Chief Financial Officer Corrective Action Planned: Send periodic e-mail reminders to program staff responsible for submitting FFATA data to the Federal Reporting Unit for submission to the federal government. Estimated Completion Date: 3/15/2025
Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS will perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve reporting errors. Additio...
Responsible Contact Person(s): Angela Morse, Director of Benefit Programs Frank Smith, Associate Director of Benefit Programs Corrective Action Planned: DSS will perform an analysis of identified reporting errors to determine causality and the appropriate actions to resolve reporting errors. Additionally, DSS will create a systems modification request to correct errors that are identified as occurring as a result of inaccurate programming in the data modification phase of federal report creation. Benefit Program is working with appropriate parties to resolve outstanding errors. Estimated Completion Date: 6/30/2025
Responsible Contact Person(s): Kimberly Boehme, OPGS Director Corrective Action Planned: Policies and procedures for grant management - to include subrecipient monitoring and FFATA reporting - will be revised. Oversight responsibilities will be determined for the Office of Grant Management, Office...
Responsible Contact Person(s): Kimberly Boehme, OPGS Director Corrective Action Planned: Policies and procedures for grant management - to include subrecipient monitoring and FFATA reporting - will be revised. Oversight responsibilities will be determined for the Office of Grant Management, Office of Purchasing and General Services, and Office of Financial Management. Employees responsible for managing grants and subrecipients will receive training on the new process. Estimated Completion Date: 12/31/2025
Responsible Contact Person(s): Sherika Charity, Director of Financial Aid Linsha Xie, Controller Corrective Action Planned: Step 1: The Financial Aid Office and Controller's Office will jointly review the current reconciliation process for federal assistance programs. This will include identifying ...
Responsible Contact Person(s): Sherika Charity, Director of Financial Aid Linsha Xie, Controller Corrective Action Planned: Step 1: The Financial Aid Office and Controller's Office will jointly review the current reconciliation process for federal assistance programs. This will include identifying all steps involved in the reconciliation process, documenting the roles and responsibilities of each office, and pin pointing areas where communication breakdowns have occurred in the past. Step 2: Based on the review, the offices will enhance the reconciliation procedures to address identified weaknesses. This will include developing standardized templates for reconciliations, establishing clear timelines for each step of the process, defining specific procedures for investigating and resolving reconciling differences, and implementing a system of checks and balances to ensure accuracy. Step 3: Formalize communication protocols between the Financial Aid Office and the Controller's Office to facilitate timely and effective information sharing related to federal assistance programs. This will include designated points of contact in each office, regular meetings and reminders for discussing reconciliation issues, and a shared folder for archiving reconciliation working paper and supporting documents. Estimated Completion Date: 6/30/2025
Responsible Contact Person(s): Carla L. Dailey, Director of Financial Aid Corrective Action Planned: NSU Financial Aid Office will ensure that the Direct Loan Notification Process will be sent out timely to all students with Direct Loan disbursements. Additional personnel have been named back-up to...
Responsible Contact Person(s): Carla L. Dailey, Director of Financial Aid Corrective Action Planned: NSU Financial Aid Office will ensure that the Direct Loan Notification Process will be sent out timely to all students with Direct Loan disbursements. Additional personnel have been named back-up to ensure notifications are submitted timely. The Student Accounts Office will notify the NSU department via email when disbursement of aid occurs. Calendar notifications can be created to ensure notifications are sent out timely. Estimated Completion Date: 8/31/2025
GMU Responsible Contact Person(s): Alethia Shipman, Director, Student Financial Aid Corrective Action Planned: George Mason will implement the following plan of action: - Management will enhance its communications relating to enrollment reporting in the Registrar and Financial Aid Offices. - Implem...
GMU Responsible Contact Person(s): Alethia Shipman, Director, Student Financial Aid Corrective Action Planned: George Mason will implement the following plan of action: - Management will enhance its communications relating to enrollment reporting in the Registrar and Financial Aid Offices. - Implement corrective actions to ensure that the University reports accurate and timely student enrollment status changes to the National Student Loan Data System. - Management will consider implementing a quality control review process to monitor the accuracy of campus and program-level batch submissions, such as implementing regularly scheduled self-audits of NSC data. Estimated Completion Date: 12/31/2025 NSU Responsible Contact Person(s): Carla L. Dailey, Director of Financial Aid Corrective Action Planned: The University has developed detailed procedures to improve reporting to NSLDS. These procedures include reviewing and updating Colleague system processing, designating staff members in both the Registrar and Financial Aid Offices to process, review and resolve reporting issues, and continued monitoring and verification of reports transmitted to NSLDS from the National Student Clearinghouse. Estimated Completion Date: 8/31/2025 NVCC Responsible Contact Person(s): Angelique Robinson, College Registrar Zina Jemison, Associate College Registrar Corrective Action Planned: Step 1: College Registrar (CR) and Associate College Registrar (ACR) will review National Student Loan Data System trainings, documentation, and initiate training sessions with appropriate NSLDS staff to answer any outstanding questions about the system. Step 2: CR and ACR will review important NSLDS deadlines and incorporate lessons learned from the trainings to set the tone for internal deadline processing changes so that the semi-automated graduation process can be performed in a faster manner. The CR and ACR will also determine which additional team members within the College Records Office will assist in the completion of record updating and reporting requirements within NSLDS, outlining the specific tasks that will need to be done by each participating member and the information system queries that will be used for internal auditing purposes. Step 3: CR and ACR will consult with Financial Aid staff to finalize new internal record adjustment processing deadlines to ensure that the changes in procedures are made in a timely manner and in support of Financial Aid processes. Estimated Completion Date: 6/30/2025 ODU Responsible Contact Person(s): Carrie John, University Registrar Corrective Action Planned: The University is taking corrective action to ensure accurate and timely reporting of student enrollment changes to NSLDS. Corrective actions include enhancing procedures, providing additional training, and improving internal reviews. Estimated Completion Date: 6/30/2026 RU Responsible Contact Person(s): Katie Piper, Registrar Corrective Action Planned: The Registrar's Office has met and completed initial planning and timelines to address procedural changes needed to report the loan data timely. Estimated Completion Date: 12/31/2025 UVA Responsible Contact Person(s): Steve Kimata, Associate Vice President for Enrollment and University Registrar Corrective Action Planned: The University will implement additional controls to ensure the accuracy and timeliness of enrollment data reported to NSLDS. This includes working collaboratively with Student Financial Services and Information Technology Services to monitor and report late withdrawals, review and update the information system process for creating enrollment files, and implement a quality control review to check student status change batches for accuracy and timeliness. Estimated Completion Date: 6/30/2025 VSU Responsible Contact Person(s): Nedra Jones, University Registrar Corrective Action Planned: 1) VSU has implemented an automated alert system to notify staff of upcoming reporting deadlines, cross-referenced information system data with the SCHEV Degree Inventory Report, and are actively collaborating with SCHEV to resolve discrepancies. These items are complete. 2) Additionally, VSU is in the process of implementing the following additional corrective actions: A.) A comprehensive review of current enrollment reporting processes; B.) Closer collaboration with VSU third-party service provider to streamline and improve the enrollment reporting; C.) Designating an individual within the Registrar's Office to oversee National Student Clearinghouse (NSC) and NSLDS reporting duties; and D.) establishing a quality control process to include monthly random sample audits of enrollment data. Additionally, VSU will reconcile student addresses between the information system and NSLDS for Federal Direct Loan borrowers. Estimated Completion Date: 12/31/2025
« 1 112 113 115 116 378 »