Corrective Action Plans

The City of Portsmouth, New Hampshire respectfully submits the following corrective action plan for the year ended June 30, 2023. Audit period: July 1, 2022 – June 30, 2023 The finding from the schedule of findings and questioned costs is discussed below. The finding is numbered consistently with the number assigned in the schedule. FINDING—FEDERAL AWARD PROGRAMS AUDITS DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT 2023-001 Community Development Block Grant - Assistance Listing Number 14.218 Recommendation: We recommend the City enhance internal controls and procedures to comply with all FFATA reporting requirements. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Some FFATA reports were not entered timely into FSRS in FY 23. This was due to an incomplete understanding about the requirement as well as no FFATA reporting requests by the federal granting agency (HUD) to the City. All required FFATA reports were entered into the FSRS after the deadlines, and City staff responsible for FFATA reporting have completed additional training on the requirements. We do not anticipate untimely reports to the FSRS in the future. Name(s) of the contact person(s) responsible for corrective action: Elise Annunziata, Community Development Director Planned completion date for corrective action plan: All required FFATA reports were already entered into the FSRS, and City staff responsible for FFATA reporting have completed additional training on the requirements. We do not anticipate untimely reports to the FSRS in the future.

The implementation of the Corrective Action Plan 2023-003 will ensure that complete reports are submitted for the validation of the compliance with this finding. Additionally, we will analyze our approved budget by ACUDEN to meet supplemental the terms and conditions of the Child Care and Development Fund Program. Implementation Date: Fiscal Year 2023-2024 Responsible Person: Mr. Ángel L. Reyes Matos, Finance Director

As an internal control, the accountant in charge of the program will keep monthly reports of the expenditures to expedite the collection of information and submit timely and complete reports. The documentation of the reports will be physically filed and digitally saved in the accounting files. Implementation Date: Fiscal Year 2023-2024 Responsible Person: Mr. Ángel L. Reyes Matos, Finance Director

Internal control procedures will be strengthened between Financial Aid, the Registrar’s Office, and the Bursar’s Office.

During the year-end audit testing phase, the Financial Aid office was notified in August 2023 of the deficiencies noted on this finding. The Financial Aid office immediately took action to implement the recommendations in August 2023. The District established effective controls in August 2023 to ensure the return of funds occurs within 45 days from the date the institution determines the student withdrew from all classes and that the withdrawal determination is performed within the required timeframe. Additionally, the District implemented procedures in August 2023 to ensure that the academic calendar loaded in the financial aid software is accurate and based on the most up to date information. The District implemented procedures in August 2023 to ensure that the correct student status is utilized in the calculation of Return to Title IV.

Finding 2023-002 Sept. 27, 2023 Criteria: The College is responsible for designing, implementing, and maintaining internal control over compliance for special tests and provisions and for safeguarding sensitive data under the Gramm-Leach-Bliley Act, including a written information security program policy that addresses the six required minimum safeguard elements identified within 16 Code of Federal Regulations (CFR) 314.4 (b). Statement of Condition: A formal written policy was not completed and documented in fiscal 2023 which would have addressed the required written policy noted in 16 CFR 314.4 (b). Corrective Action Plan: • The College agrees and concurs with the audit finding. • The College is working with a cybersecurity partner, OculusIT (OculusIT.com) to assist us with GLBA compliance and cybersecurity hardening of the college’s IT infrastructure. OculusIT will assist us in preparing the required documentation that addresses risk assessment of all three areas noted in the finding. Many elements of GLBA compliance have already been put in place as elaborated below. • Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). Vince Vargiya is the College’s designated qualified individual. • Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 314.4(b)). OculusIT will undertake a GLBA risk assessment covering the following areas of the College: o Senior Management o IT Security o Admissions o Registrar Office o Financial Aid Office o HR and Payroll o Student Financial Services o Library Work on completing pre-audit questionnaires for each area is in progress. • Regarding a written information security policy that addresses the minimum safeguard requirements, see below. • Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: o Implement and periodically review access controls. We regularly review access controls to systems containing financial data. Our formal policy will document this. o Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. We maintain a server inventory, noting which sites contain financial information. Our formal policy will document this. o Encrypt customer information on the institution’s system and when it’s in transit. Our server data is encypted using standard SQL TDE encryption. All data transmitted to off campus partners uses the sftp protocol. Our formal policy will document this. o Assess apps developed by the institution. The College’s enterprise apps are commercially sourced, updated using vendor supplied processes per annual support contracts, and not developed in-house. Our formal policy will document this. o Implement multi-factor authentication for anyone accessing customer information on the institution’s system. All users who access Jenzabar (SIS, Financials), PowerFaids (Financial Aid) must use DUO MFA. RaisersEdge (Advancement/Donor Management) employs text or email MFA. All email accounts are secured with google 2 step authentication. Our formal policy will document this. o Dispose of customer information securely. When server hardware is decommissioned, the data drives are physically smashed. When leased endpoint systems are returned to the leasing company, their hard drives are wiped using standard software. Our formal policy will document this. o Anticipate and evaluate changes to the information system or network. We meet regularly with OculusIT to discuss changes to the network. Our endpoints are monitored for malware via a managed detection and response system. Our servers and network switches are monitored 24/7 by the Oculus SOC, and unusual events are flagged and presented to us for analysis. Our formal policy will document this. o Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. We have implemented a SIEM server which monitors server and network access and activity and is monitored by the OculusIT SOC. Our formal policy will document this. • Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). We have implemented a SIEM server which monitors server and network access and activity and is monitored by the OculusIT SOC. We receive weekly reports on any server vulnerabilities. We actively work to remediate identified vulnerabilities. We have implemented annual penetration testing, and have completed testing for 2023. We have remediated identified penetration issues. Our formal policy will document this. • Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). We require semi annual security awareness training and monthly phishing testing through KnowBe4. Our formal policy will document this. • Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). We require providers to submit SOC1 or HECVAT documentation. Our formal policy will document this. • Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). We work with OculusIT to follow up on results of testing and risk assessments. For example, we rescan our network to follow up on the results of pen testing. We meet with the Oculus SOC team to discuss server vulnerabilities uncovered on a monthly basis. Our formal policy will document this process. Names of Contact Persons Responsible for Corrective Action Plan: Gary Rodman (Senior Director of Information Technology), rodmang@ripon.edu, 920-748-8343 Vince Vargiya (Vice President Information Security | CISO, OculusIT) vince_varigiya@oculusit.com 844-462-8587 ext. 193 Anticipated Completion Date: Implementation of this plan began in March 2023, focusing on infrastructure hardening. Formal written polices will be put in place no later than June 30, 2024.

Finding 2023-001 Sept. 26, 2023 Criteria: The College is responsible for designing, implementing, and maintaining internal control over compliance for special tests and provisions and for accurately reporting significant data elements under the Campus-Level and Program-Level records within the National Student Loan Data System (NSLDS) that Department of Education (DOE) considers high risk. Statement of Condition: Management's review of the enrollment reporting did not detect errors on certain student data elements. Certain student records within the NSLDS were identified with inaccurate data elements. Corrective Action Plan: • The College agrees and concurs with the audit finding. • The Registrar’s Office has reviewed and remediated all files that were not accurately reported data elements in NSLDS as of September 2023. • The Registrar’s Office will work with the Financial Aid Office to review and regularly monitor student campus and program level enrollment status, especially in the cases of those that have dropped below full time, and are no longer enrolled for various reasons. • The Registrar’s Office will monitor the NSC error report which states discrepancies between NSC and NSLDS. • The Registrar’s Office will work with NSC to remediate processing issues between NSC and NSLDS reports in order to ensure that NSLDS is receiving accurate information. Names of Contact Persons Responsible for Corrective Action Plan: Michele Wittler (Associate Dean of Faculty and Registrar), wittlerm@ripon.edu, 920-748-8119 Katy Crane (Assistant Registrar), cranek@ripon.edu, 920-748-8119 Linda Kinziger (Director of Financial Aid), kinzigerl@ripon.edu, 920-748-8358 Anticipated Completion Date: This plan has been implemented with corrections already made as of September 2023 by the Registrar’s Office. It will be finalized with the fiscal year June 30, 2024 year-end review of Enrollment Reporting.

2023-007: Special Tests & Provisions Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Matters Recommendation: ISU should implement procedures to ensure that enrollment data, changes in status and effective dates within NSLDS match the records of the intuition and are reported timely. We also recommend that the University implement a formal review procedure to document the review process. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: During our discussion, it became apparent that a significant portion of the findings pertaining to the Office of the Registrar stemmed from enrollment status change not being reported to NSLDS within 60 days. To remedy this, we have added three new automated enrollment uploads right after the upload of the graduation file respectively in Fall, Spring and Summer. The three automated enrollment uploads to be sent to NSLDS are scheduled as follows: 1. On February 16; 2. On June 3; 3. On September 1. Name(s) of the contact person(s) responsible for corrective action: Hala Abou Arraj, Registrar Planned completion date for corrective action plan: Implemented in February 2024

2023-005: Special Tests & Provisions Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Matters Recommendation: ISU should review the requirements and implement a monitoring control to monitor the checks throughout the year. In addition, for the checks outstanding greater than 240 days, the University should return the funding to the U.S. Department of Education. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: ISU reopened the prior financial aid years in COD and completed returns of federal aid funds via G5/6 from identified outstanding checks. ISU has implemented the following monitoring controls: At the beginning of each month finance runs check reissue forms for all checks that the check date is 180 days or older. These are mailed to the check recipient. Around the 15th of the month any checks containing Title IV funds that have not been reissued will be turned to the financial aid office. Financial Aid is provided with the date by which the funds need to be returned. Financial Aid attempts to work with the student to get the checks cashed if they are not successful will return funds before the 240-day limit. They will then notify Finance to cancel the original check. Name(s) of the contact person(s) responsible for corrective action: Lisa Leyshon, AVP Finance/Controller, James Martin, Director of Financial Aid Planned completion date for corrective action plan: Implemented in 2020.

2023-004: Suspension Debarment Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Matters Recommendation: ISU should evaluate its procedures and implement an additional control to insure verification checks are occurring prior to entering into contract with a vendor/subrecipient. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: ISU has implemented PaymentWorks, a third-party vendor processing system that does 24-7 sanction and debarment checking. This is conducted on all ISU vendors that onboard through PaymentWorks. All ISU contracts will be processed through Jaggaer, which requires a Banner ID#. All vendors will be imitated through PaymentWorks. Accounts Payable checks sanction alerts in PaymentWorks and follows up with issues. Name(s) of the contact person(s) responsible for corrective action: Lisa Leyshon, AVP Finance/Controller and Kirsten Broughton, Director Grant Accounting Planned completion date for corrective action plan: Implemented in April 2024.

2023-002: Cash Management-Subrecipient Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Matters Recommendation: ISU should evaluate its procedures and implement an additional control to review and approve the subrecipient reimbursements timely. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Grant accounting staff will follow payment requests through the system to make sure payments are made in a timely manner. Name(s) of the contact person(s) responsible for corrective action: Kirsten Broughton, Director Grant Accounting Planned completion date for corrective action plan: Implemented in FY24

DEPARTMENT OF HEALTH AND HUMAN SERVICES 2023-001: Reporting Federal Program Titles: Every Student Succeeds/Preschool Development Grants Primary Care Training and Enhancement Assistance Listing Number: 93.884 & 93.434 Type of Finding: Significant Deficiency in Internal Control over Compliance Recommendation: ISU should implement formal review procedures to document review and approvals over required reports. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: ISU had a formal review procedure in place, but due to personnel changes it was not being followed. Staff has been trained and procedures will be followed. Name(s) of the contact person(s) responsible for corrective action: Kirsten Broughton, Director Grant Accounting Planned completion date for corrective action plan: Implemented FY24

U.S. Department of Transportation 2023-004 Formula Grants for Rural Areas – Assistance Listing No. 20.509 Recommendation: We recommend the Organization properly document Sam.gov searches. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Organization will take the steps necessary to properly document that they have searched Sam.gov. Names of the contact persons responsible for corrective action: Rich Pavek, Executive Director, and Kris Burkey, Finance Manager Planned completion date for corrective action plan: December 31, 2024

U.S. Department of Transportation 2023-003 Formula Grants for Rural Areas – Assistance Listing No. 20.509 Recommendation: We recommend the Organization review its policy and implement a procedure for proper approval over all disbursements. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Organization will take the steps necessary to ensure that costs are appropriately approved. Names of the contact persons responsible for corrective action: Rich Pavek, Executive Director, and Kris Burkey, Finance Manager Planned completion date for corrective action plan: December 31, 2024

2023-002 Housing Trust Fund Program – Assistance Listing No. 14.275 Recommendation: CLA recommended that PHFA review their procedures around administrative expenses charged to the HTF program. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: PHFA will implement electronic time tracking, this will replace the current manual process of preparing timesheets that are entered into a database used to accumulate administrative expenses charged to federal programs. PHFA is currently in the process of implementing a Human Capital Management system that will allow employees to track the time they work on federal programs. Name of the contact person responsible for corrective action: Adrianne Trumpy, Director of Accounting Planned completion date for corrective action plan: July 1, 2024

U.S. Department of Housing and Urban Development 2023-001 Home Investment Partnerships Program – Assistance Listing No. 14.239 Recommendation: CLA recommended that PHFA review their procedures surrounding the division sign-off form utilized in the pre-commitment meeting. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: PHFA implemented a new process to ensure the required divisional signoffs are received after the completion of the pre-commitment meeting. The Lending Officer prepares an electronic approval listing in Microsoft Teams to capture the approvals after the pre-commitment meeting. The Lending Officer follows up with the requested signors to ensure that all outstanding questions have been answered and the signer can mark the Microsoft Teams’ listing approved. Name of the contact person responsible for corrective action: Jessica Perry, Director of Development The new Microsoft Teams approval system was implemented in August 2023. To date, approximately 20 developments have been approved via the new system.

Corrective Actions: *Conduct a thorough review of the policies and procedures related to withdrawals, specifically focusing on the calculation of students' percentages of completion during the payment period and the proper handling of breaks in the academic calendar. *Implement additoinal training sessions for staff members responsible for calculating students' completion percentages to ensure they understand the correct methodology, particularly in accounting for breaks of at least five consecutive days. *Utilize the newly implemented Ellucian Colleague software in order to monitor and identify students who withdraw and receive Title IV funds promptly. Establish a clear protocol for performing return calculations and issuing refunds within the required 45-day timeline as per federal regulations. *Enhance oversight and monitoring processes to ensure compliance with 34 CFR 668.22 and other relevant regulations. Regular audits should be conducted to verify the accuracy of calculations and the timely return of Title IV funds. *Communicate updated procedures to all relevant staff members and provide ongoing support to ensure proper implementation and adherence to the revised policies. By implementing these corrective actions, the college can address the identified deficiencies and enhance its compliance with federal regulations concerning withdrawals and the treatment of Title IV funds. All actions listed above have been completed as of 03/01/2024.

Corrective Actions: *Conduct a comprehensive review of the policies and procedures related to packaging student financial aid. Ensure that the guidelines for awarding federal direct loans align with the Federal Student Aid Handbook, Volume 3. *Utilize the newly implemented Ellucian Colleague software that is integrated with all offices directly involved with any facet of Title IV (registrar and billing) to follow a systematic process to review and verify student financial aid packages for accuracy. Establish protocols for identifying and rectifying instances of under-awarding federal direct subsidized loans. *Utilize Federal Student Aid training programs and other options for financial aid staff to enhance their understanding of federal regulations governing financial aid packaging. Emphasize the significance of recalculating aid packages when there are changes in FAFSA information to prevent under-awarding situations. *Create a standardized procedure for tracking and documenting FAFSA information changes and the subsequent adjustments made to financial aid packages. This will ensure transparency and accountability in the repackaging process. *Address the issue of turnover within the Financial Aid Department by implementing measures to enhance continuity and knowledge transfer. Document key processes and responsibilities to mitigate the impact of staff changes on financial aid operations. *Conduct regular internal training to ensure compliance with federal regulations and the effectiveness of the revised policies and procedures. Make adjustments as needed based on audit findings to maintain accuracy in financial aid packaging. By following these corrective actions, the College can mitigate the identified deficiencies in financial aid packaging and improve overall compliance with federal regulations. Completion Date: All actions listed above have been completed as of 03/01/2024.

Material Weakness: Significant deficiency in internal control over compliance. Corrective Action Plan: Due to difficulty in hiring and engaging a fulltime Chief Financial Officer, Management has made the decision to outsource our finance department and has engaged the services of Withum, a premier accounting services firm. Management has implemented new accounting software with more robust cost allocation tools and internal controls. Management has also implemented cost allocation methodologies and grant management rules into the workflow and new process definitions associated with implementing new software. Grant reporting rules and cost allocations will be built into the accounting software. A quarterly review of grant expenditures and cash flow management will be conducted by the Board of Trustees Finance committee quarterly. Anticipated Completion Date: The engagement with Withum was entered into in May 2023. The financial systems update went live on February 1, 2024. Quarterly review of grant expenditures and cash flow management will be ongoing April – June 2024.

2023-009 Higher Education Emergency Relief Funding (HEERF) – Assistance Listing No. 84.425 Recommendation: We recommend the College establish a review process to ensure accurate submission. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Clarkson College will ensure that review procedures are in place to ensure accurate submission. Name(s) of the contact person(s) responsible for corrective action: Robyn Hansen Planned completion date for corrective action plan: March 2024

2023-008 Student Financial Assistance – Assistance Listing No. Various Recommendation: The College should ensure all necessary employees receive proper training, support, and time to follow the College's policies and federal requirements related to monthly reconciliations. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Clarkson College will ensure that procedures are in place and financial aid staff are trained in requirements related to monthly reconciliations. Name(s) of the contact person(s) responsible for corrective action: Andrea Padilla-Rosas Planned completion date for corrective action plan: March 2024

2023-007 Student Financial Assistance – Assistance Listing No. Various Recommendation: We recommend the College review the R2T4 requirements and implement procedures to ensure the R2T4 calculations are using the correct number of break days and are accurately completed. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Clarkson College will review the R2T4 requirements and will implement procedures to ensure R2T4 calculations are completed accurately. Name(s) of the contact person(s) responsible for corrective action: Andrea Padilla-Rosas Planned completion date for corrective action plan: July 2024

2023-006 Student Financial Assistance – Assistance Listing No. Various Recommendation: We recommend the College evaluate its procedures and policies around reporting Direct Loan disbursements to COD to ensure that student information is reported accurately and timely. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Clarkson College will review procedures and starting immediately, all disbursements reported to COD will be reported within the appropriate timeframe. Name(s) of the contact person(s) responsible for corrective action: Andrea Padilla-Rosas Planned completion date for corrective action plan: March 2024

2023-005 Student Financial Assistance – Assistance Listing No. Various Recommendation: We recommend the College review its policies and procedures around sending exit counseling information to students to ensure students are receiving proper counseling. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: An automatic email notification will be set up in Anthology, Clarkson College’s new student information system, so that students receive a notification to their student email of their exit counseling information. Name(s) of the contact person(s) responsible for corrective action: Andrea Padilla-Rosas Planned completion date for corrective action plan: May 2024

2023-004 Student Financial Assistance – Assistance Listing No. Various Recommendation: We recommend the College review and strengthen its procedures for notifying students of their Direct Loan disbursements within the required time frame and that documentation of the letters sent is maintained. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: An automatic email notification has been set up in Anthology, Clarkson College’s new student information system, so that students receive a notification to their student email of their loan disbursements. Documentation is maintained in Anthology. Name(s) of the contact person(s) responsible for corrective action: Andrea Padilla-Rosas Planned completion date for corrective action plan: March 2024