Corrective Action Plans

Finding 395355 (2023-018)

Significant Deficiency 2023

State of Oregon

OR

Matching / Level of Effort / Earmarking Subrecipient Monitoring Period of Performance § 200.303

2023-018 Oregon Housing and Community Services Ensure grant management report control is performed and documented MANAGEMENT RESPONSE: We agree with this recommendation. A dedicated staff resource has been trained and has brought grant reconciliations and reporting current. Additional training h...

2023-018 Oregon Housing and Community Services Ensure grant management report control is performed and documented MANAGEMENT RESPONSE: We agree with this recommendation. A dedicated staff resource has been trained and has brought grant reconciliations and reporting current. Additional training has been provided for awareness of the earmarking and obligation requirements as well. Anticipated Completion Date: June 30, 2024 Contact person: Dean Criscola, Controller

View Audit 305129

Finding 395353 (2023-027)

Significant Deficiency 2023

State of Oregon

OR

Questioned Costs Special Tests & Provisions Eligibility

2023-027 Department of Human Services Improve controls to ensure eligibility criteria are met MANAGEMENT RESPONSE: We agree with this recommendation. The department previously submitted a work item (WI) to have a question in ONE that asks ‘yes/no’ if IEVS has been checked. The WI was approved and...

2023-027 Department of Human Services Improve controls to ensure eligibility criteria are met MANAGEMENT RESPONSE: We agree with this recommendation. The department previously submitted a work item (WI) to have a question in ONE that asks ‘yes/no’ if IEVS has been checked. The WI was approved and deployed into the system on April 17, 2024. The IEVS question will trigger and be required for TANF at certification, re-certification, and adding a person. The Quick Reference Guide for staff will be updated to reflect the new system functionality. Communication regarding the new system functionality will be provided to staff. The department previously submitted a change request (CR) to have the employability screening questions put into ONE as part of the TANF application/intake process. The CR has been approved and in final stages of design with the ONE system contractor, Deloitte. Once the WI is implemented into the system, the quick reference guide will be updated to reflect new system functionality. Communication regarding the new system functionality will be provided to staff. Anticipated Completion Date: December 31, 2024 Contact person: Xochitl Esparza, Program Administration Manager

View Audit 305129 Questioned Costs: $1

Finding 395352 (2023-026)

Significant Deficiency 2023

State of Oregon

OR

Questioned Costs Special Tests & Provisions Significant Deficiency

2023-026 Department of Human Services Improve controls relating to client not cooperating with child support requirements MANAGEMENT RESPONSE: We agree with this recommendation. The department previously identified the need for more training and has been taking steps to address the issue. Based o...

2023-026 Department of Human Services Improve controls relating to client not cooperating with child support requirements MANAGEMENT RESPONSE: We agree with this recommendation. The department previously identified the need for more training and has been taking steps to address the issue. Based on feedback from staff, the Child Support Quick Reference Guide has been updated to make it more user friendly and easier to follow. Training on processing child support tasks has been provided both statewide alongside Department of Child Support in November 2023 and with individual districts. In addition to materials and training, department policy is working reports of both outstanding child support tasks and tasks cleared without processing. The department continues to monitor the reports and provide follow up guidance to individual branches. The department has developed a take time for training (TT4T) that was delivered to staff on May 4, 2022, which is now outdated. The current TT4T will be removed, a new one will be created, and delivered to staff within the next 120 days. The department will also consider adding this material to the regional accuracy and timeliness training during the summer of 2024. The Oregon Eligibility Partnership (OEP) -Learning and Engagement Team (LET) reviewed the eligibility guide and will be revising materials within the next 120 days. OEP will review and revise the current lesson plan delivered to staff within the next 90 days. Anticipated Completion Date: September 30, 2024 Contact person: Xochitl Esparza, Program Administration Manager

View Audit 305129 Questioned Costs: $1

Finding 395341 (2023-042)

Significant Deficiency 2023

State of Oregon

OR

Procurement, Suspension & Debarment Subrecipient Monitoring Allowable Costs / Cost Principles § 200.303 § 200.439

2023-042 Oregon Department of Education Retain support for pre-approval of equipment purchases MANAGEMENT RESPONSE: We agree with this recommendation. ODE has already developed and implemented updates to the capital expenditure request review and approval process to ensure equipment approvals are...

2023-042 Oregon Department of Education Retain support for pre-approval of equipment purchases MANAGEMENT RESPONSE: We agree with this recommendation. ODE has already developed and implemented updates to the capital expenditure request review and approval process to ensure equipment approvals are retained. Early ESSER capital project tag requests were split between a committee for large projects and the individual grant finance manager. Approvals were primarily sent via email from the grant finance manager. Some of those messages are archived in the ESSER.ODE inbox, however some went out directly from staff email. Records are available for the committee decisions. When the smaller approvals moved from the finance manager to an ESSER team, many of those decisions were made in conjunction with other meetings. Some records are available; however, the Capital Expenditure Tracker was the primary location of decisions. In October 2022, staffing changes allowed the committee and team structure to become more formalized. Committee meeting decisions shifted from a “minute”- style agenda to being more systematized in an online log. Team meeting decisions followed a similar process update in April 2023. The online agenda/log allows for consistent tracking of projects that are up for discussion and which approval are put on hold for elevation approval, correction, or clarification from the district. Committee and team meetings have been established weekly. When all information is received from a district, the project is placed on the appropriate agenda for that week. Approvals are sent out within 2 business days. A column was added to the Capital Expenditure Tracker, which remains the primary location of records, to track when the approval emails were sent. Corrections have already been developed and implemented as of April 2024. Anticipated Completion Date: April 30, 2024 Contact person: Cynthia Stinson, Senior Manager of Federal Investments and Pandemic Renewal Effort

View Audit 305129

Finding 395340 (2023-041)

Significant Deficiency 2023

State of Oregon

OR

Subrecipient Monitoring Reporting Significant Deficiency § 200.303

2023-041 Oregon Department of Education Improve FFATA reporting controls MANAGEMENT RESPONSE: We agree with this recommendation. ODE will implement the following corrective action to ensure monthly FFATA reports are independently reviewed to ensure accurate and complete reporting. 1. Review and u...

2023-041 Oregon Department of Education Improve FFATA reporting controls MANAGEMENT RESPONSE: We agree with this recommendation. ODE will implement the following corrective action to ensure monthly FFATA reports are independently reviewed to ensure accurate and complete reporting. 1. Review and update list of all FFATA eligible federal awards monthly. 2. Implement a new query tool that will reduce manual processes. 3. Collaborate with ODE partners to access agency-collected unique entity identifier (UEI) information for sub awardees. 4. Monthly review of FFATA reporting by a second accountant. Anticipated Completion Date: June 30, 2024 Contact person: Kristie Miller, Accounting Director

View Audit 305129

Finding 395338 (2023-031)

Significant Deficiency 2023

State of Oregon

OR

Eligibility Period of Performance Reporting

2023-031 Oregon Commission for the Blind Improve controls over compliance reporting MANAGEMENT RESPONSE: We agree with this recommendation. The agency is committed to ensuring the RSA-911 client case information report is accurate and well supported. The agency’s practice is to maintain documenta...

2023-031 Oregon Commission for the Blind Improve controls over compliance reporting MANAGEMENT RESPONSE: We agree with this recommendation. The agency is committed to ensuring the RSA-911 client case information report is accurate and well supported. The agency’s practice is to maintain documentation that supports information contained in the case management system. This practice includes requesting information from clients regarding the start date of employment in the primary occupation and the hourly wage at exit. This information can be difficult to locate due to the numerous case notes in the case management system. Due to the difficulty locating this documentation in the tight timelines of the audit, the agency spent some additional time attempting to locate it after the audit testing period had closed. The agency did find the supporting documentation for one of the two clients that was not located during the audit. For the other client, the agency identified documentation showing that we had requested this information from the client through multiple methods, but it was never received. The agency has created a new case-note category for documenting client employment start date and wages at exit. The agency will provide training to staff on the use of this case note category to ensure this documentation is able to be located more easily and to reinforce the importance of maintaining documentation to support information contained in the case management system. Anticipated Completion Date: August 1, 2024 Contact person: Angel Hale, Director of Vocational Rehabilitation Services

View Audit 305129

Finding 395337 (2023-030)

Significant Deficiency 2023

State of Oregon

OR

Questioned Costs Allowable Costs / Cost Principles Significant Deficiency

2023-030 Department of Human Services Strengthen controls over payroll expenditures MANAGEMENT RESPONSE: We disagree with this finding. This finding pertained to two State Independent Living Council (SILC) board members paid with VR Innovation & Expansion funding. Upon review of the Rehabilitati...

2023-030 Department of Human Services Strengthen controls over payroll expenditures MANAGEMENT RESPONSE: We disagree with this finding. This finding pertained to two State Independent Living Council (SILC) board members paid with VR Innovation & Expansion funding. Upon review of the Rehabilitation Act and 34 CFR 361.35 section (a) part (2), funding may be used “To support the funding of the State Rehabilitation Council, if the State has a Council, consistent with the resource plan identified in § 361.17(i) “ The SILC State Plan cover 2021-2023 references Innovation and Expansion funding on pages 5 and 6. Based on the department’s review we believe the VR funding used is appropriate and that no further corrective action is required. Anticipated Completion Date: N/A Contact person: Keith Ozols, Vocational Rehabilitation Services Director

View Audit 305129 Questioned Costs: $1

Finding 395334 (2023-043)

Significant Deficiency 2023

State of Oregon

OR

Reporting Significant Deficiency Internal Control / Segregation of Duties § 200.303

2023-043 Oregon Business Development Department Management should implement accounting review of quarterly reports before submitting to DAS MANAGEMENT RESPONSE: We agree with this recommendation. We agree with this finding. Business Oregon has gone through significant personnel change during the ...

2023-043 Oregon Business Development Department Management should implement accounting review of quarterly reports before submitting to DAS MANAGEMENT RESPONSE: We agree with this recommendation. We agree with this finding. Business Oregon has gone through significant personnel change during the period of American Rescue Plan Act (ARPA) grant disbursements, from January 2022 to June 2023. The Chief Financial Officer, Accounting Manager, and Accountants had moved on to other state agencies. The accounting positions were left vacant for months due to challenges in timely filling these positions with the right skill sets. Although there were only a few accounting staff left when majority of the grant disbursements were made, the remaining accounting processed the disbursements with very tight deadlines. The accounting staff processed grant disbursements through appropriate internal control procedures, reviewed supporting documents for appropriate signature approval on the requests, and made accounting entries for these grant activity transactions. Below is a list of staff hire dates to illustrate the turnover we faced during this time period: • Federal Grant Accountant – November 2023 • Chief Financial Officer – October 2023 • Deputy CFO/Accounting Manager – May 2023 • Program Accountant 2 – April 2023 • Accounting Technician – April 2023 • Debt Accountant 3 – March 2023 • Program Accountant 3 – January 2023 • Program Accountant 3 – August 2022 Due to the accounting team not having enough personnel at the time to prepare reports for the DAS ARPA Grant Program Coordinator, Business Oregon program staff (not accounting staff) took the initiative to complete the reports and submitted the periodic/quarterly reports to DAS. As the Business Oregon program staff did not have access to the SFMA (state accounting system), the program staff used data from another system (Salesforce, not an accounting system) to fill the needed information for the reports. The initial reports submitted to DAS were not reviewed by accounting staff. The program staff continued to complete the reports for DAS until first quarter of 2023, until accountant positions were filled in 2023. While preparing for the FY 2023 Year-End Closing process (June 2023 to July 2023), the newly hired accountants and Deputy CFO/Accounting Manager reviewed as many FY23 financial transactions as they could and made necessary adjustments and accounting entry corrections. Reporting discrepancies were identified between department accounting records and the reports submitted by program staff to DAS/US Dept of Treasury. Business Oregon accountants worked with DAS on revising the SEFA reports and identified ARPA grant-related items that needs to be corrected. The research continued even after the fiscal year 2023 reporting has closed. A reconciliation of records between department accounting and the reports submitted to the DAS Grant program coordinator was completed in January 2024, and the Business Oregon accounting team submitted a revised FY 2023 SEFA report corrections to the DAS SARS team. Going forward, management will ensure that the completion of quarterly financial reports for grant reporting is performed and submitted by the agency’s accounting team and not program staff to ensure data comes from the accounting system with the review by an accountant or accounting manager. Anticipated Completion Date: June 30, 2024 Contact person: Imee Anderson, Chief Financial Officer; Karl Mielke, Deputy Chief Financial Officer

View Audit 305129

Finding 395333 (2023-044)

Significant Deficiency 2023

State of Oregon

OR

Eligibility Reporting Significant Deficiency

2023-044 Oregon Housing and Community Services Ensure that the nature of program applicants' financial hardship is documented MANAGEMENT RESPONSE: The agency agrees with this finding. OHCS completed research to better isolate the problem and verified the nature of hardship fields are required to...

2023-044 Oregon Housing and Community Services Ensure that the nature of program applicants' financial hardship is documented MANAGEMENT RESPONSE: The agency agrees with this finding. OHCS completed research to better isolate the problem and verified the nature of hardship fields are required to submit an application in the homeowner application portal. Review of the hardship fields are now required, and program underwriters and housing counselors will request hardship statements where none exist in an application. The HAF team will review funded applications to determine if any deficiencies exist related to attestations of the nature of financial hardship. OHCS will request that those applicants supplement any missing information to adhere to regulatory standards. OHCS will also implement sampling quality assurance, compliance, and data report reviews to check for attestations of the nature of financial hardships. Anticipated completion date: September 30, 2024 Contact person: Ryan Vanden Brink, Grants, Loans, and Program Manager

View Audit 305129

Finding 395309 (2023-004)

Significant Deficiency 2023

School District of Thorp

WI

Internal Control / Segregation of Duties Reporting School Nutrition Programs

The Bookkeeper will look at and sign off on all final food service claims before being submitted.

View Audit 305106

Finding 395292 (2023-067)

Significant Deficiency 2023

State of Rhode Island

RI

Allowable Costs / Cost Principles Subrecipient Monitoring Significant Deficiency

Finding 2023-067 – Corrective Action Plan EOHHS amended and updated its guidelines and standard operating procedures leveraging the CMS ‘Delivering Service in School-Based Settings: A Comprehensive Guide to Medicaid Services and Administrative Claiming’ as a source document. In addition to ensurin...

Finding 2023-067 – Corrective Action Plan EOHHS amended and updated its guidelines and standard operating procedures leveraging the CMS ‘Delivering Service in School-Based Settings: A Comprehensive Guide to Medicaid Services and Administrative Claiming’ as a source document. In addition to ensuring alignment with CMS requirements, the updated guidelines include a uniform schedule of quarterly submission dates and details the billing responsibilities of participating LEAs. These responsibilities include meeting all Medicaid documentation requirements; submitting the Certification of Local Funds on a quarterly basis; and signing provider agreements and maintaining all other records used to support claims submitted for Medicaid reimbursement. Upon receipt of these submissions a new audit tool will be utilized to ensure each submissions contains the required documentation. EOHHS Medicaid Program Integrity will also collect the claims data, sort the list, comprise a sample, perform the review, and issue a report for participating LEAs. In the event of missing documentation, incomplete documentation, or an error, the LEA and their billing contractor will be notified. Failure to resubmit the missing file(s) or failure to address any errors identified will result in a withhold of reimbursement for that LEA until the following quarter. A finalized spreadsheet is then sent to finance for reimbursement. EOHHS is also engaged with the school-based services TA Center and will continue leverage this engagement to ensure compliance with CMS guidelines. Anticipated Completion Date: June 1, 2024 Contact Person: Tyler McFeeters, Health Program Administrator, Executive Office of Health & Human Services tyler.mcfeeters@ohhs.ri.gov

View Audit 305097

Finding 395291 (2023-066)

Significant Deficiency 2023

State of Rhode Island

RI

Allowable Costs / Cost Principles Cash Management Eligibility

Finding 2023-066 – Corrective Action Plan This audit finding refers to retroactive Medicaid billing from BHDDH for dates of service in 2022 and 2023 once the IMD status was removed from ESH. That provider type currently does not require the Medicare information to be submitted to EOHHS for process...

Finding 2023-066 – Corrective Action Plan This audit finding refers to retroactive Medicaid billing from BHDDH for dates of service in 2022 and 2023 once the IMD status was removed from ESH. That provider type currently does not require the Medicare information to be submitted to EOHHS for processing. They bill with a type of bill and if there is eligibility on file for Eleanor Slater, the claim is paid. EOHHS will pursue a project to correct this finding. Anticipated Completion Date: To Be Determined – State Fiscal Year 2025 Contact Person: Hector Rivera, Interdepartmental Project Manager, Executive Office of Health & Human Services hector.l.rivera@ohhs.ri.gov

View Audit 305097

Finding 395270 (2023-063)

Significant Deficiency 2023

State of Rhode Island

RI

Allowable Costs / Cost Principles Subrecipient Monitoring Eligibility

Finding 2023-063 – Corrective Action Plan Each health plan reports TPL recoveries to EOHHS in its quarterly financial report (FDCR). These recoveries are used as a direct offset to medical expenses. As such, claims paid by the plans on behalf of a member with TPL will remain in the EOHHS encounte...

Finding 2023-063 – Corrective Action Plan Each health plan reports TPL recoveries to EOHHS in its quarterly financial report (FDCR). These recoveries are used as a direct offset to medical expenses. As such, claims paid by the plans on behalf of a member with TPL will remain in the EOHHS encounter data warehouse. Health plans do not void claims that have previously been paid to account for any TPL liability. Rather, they seek to recover from the third party any amount owed and report that amount to the state. In each of the last two fiscal years, this reduced medical expenditures by just under $8 million. EOHHS sent the MCOs a full TPL file in July 2023. EOHHS will start the process for a new file in June 2024. Anticipated Completion Date: Ongoing Contact Person: Jeffrey Schmeltz, Chief of Family Health Systems, Executive Office of Health & Human Services jeffery.schmelts@ohhs.ri.gov

View Audit 305097

Finding 395252 (2023-055)

Significant Deficiency 2023

State of Rhode Island

RI

Subrecipient Monitoring Eligibility Significant Deficiency

Finding 2023-055 – Corrective Action Plan Management agrees with the finding. 2023-055a – DHS has subsequently reviewed the SOC 2 report and will submit to Accounts & Control. 2023-055b – Passwords have already been changed to meet the ETSS policy. 2023-055c – DHS will review user access every 60 d...

Finding 2023-055 – Corrective Action Plan Management agrees with the finding. 2023-055a – DHS has subsequently reviewed the SOC 2 report and will submit to Accounts & Control. 2023-055b – Passwords have already been changed to meet the ETSS policy. 2023-055c – DHS will review user access every 60 days or 90, respectively and terminate users as necessary. Anticipated Completion Date: June 30, 2024 Contact Persons: Deirdre Weedon, Chief Program Development, Low Income Home Energy Assistance Program (LIHEAP), Department of Human Services deirdre.weedon@dhs.ri.gov Ben Quattrucci, Associate Director, Financial & Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov

View Audit 305097

Finding 395247 (2023-054)

Significant Deficiency 2023

State of Rhode Island

RI

Subrecipient Monitoring Internal Control / Segregation of Duties Special Tests & Provisions

Finding 2023-054 – Corrective Action Plan 2023-054a – The State (EOHHS) receives quarterly user access reports from the MMIS fiscal agent. Anyone identified on the reports that have not logged in for a period of 60 days will have their access deleted. Currently, they are locked out and cannot acc...

Finding 2023-054 – Corrective Action Plan 2023-054a – The State (EOHHS) receives quarterly user access reports from the MMIS fiscal agent. Anyone identified on the reports that have not logged in for a period of 60 days will have their access deleted. Currently, they are locked out and cannot access the system without first requesting a password reset, which is reviewed and approved/denied by EOHHS systems group. In addition, when a user leaves state service or moves to another agency, their access is deleted. 2023-054b – The State (EOHHS) collaborates with system vendors (MMIS/Gainwell and Deloitte/RI Bridges) Maintenance & Operations (M&O) and Security teams and to ensure annual risk assessment/vulnerability best practices and lessons learned are integrated into annual planning and scope of work for future FYs. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, RIBridges Medicaid Administrator, Executive Office of Health & Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health & Human Services hector.l.rivera@ohhs.ri.gov

View Audit 305097

Finding 395246 (2023-053)

Significant Deficiency 2023

State of Rhode Island

RI

Reporting Significant Deficiency

Finding 2023-053 – Corrective Action Plan Management agrees with the finding. Reports are reviewed and certified by supervisors; however, the process will be enhanced to include a lookback for additional entries from prior quarters. Additionally, a procedure was created to ensure documentation wa...

Finding 2023-053 – Corrective Action Plan Management agrees with the finding. Reports are reviewed and certified by supervisors; however, the process will be enhanced to include a lookback for additional entries from prior quarters. Additionally, a procedure was created to ensure documentation was saved for all reports Anticipated Completion Date: June 30, 2024 Contact Person: Ben Quattrucci, Associate Director, Financial & Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov

View Audit 305097

Finding 395245 (2023-052)

Significant Deficiency 2023

State of Rhode Island

RI

Questioned Costs Significant Deficiency

Finding 2023-052 – Corrective Action Plan Management agrees with the finding. Staff was trained on completion of the transfer rules and the amount is now being tracked on the grant spreadsheet. Anticipated Completion Date: Implemented Contact Person: Ben Quattrucci, Associate Director, Financia...

Finding 2023-052 – Corrective Action Plan Management agrees with the finding. Staff was trained on completion of the transfer rules and the amount is now being tracked on the grant spreadsheet. Anticipated Completion Date: Implemented Contact Person: Ben Quattrucci, Associate Director, Financial & Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov

View Audit 305097 Questioned Costs: $1

Finding 395237 (2023-049)

Significant Deficiency 2023

State of Rhode Island

RI

Subrecipient Monitoring Reporting Significant Deficiency

Finding 2023-049 – Corrective Action Plan RIDOH agrees with the finding and recommendation. The unreported subawards of ELC funds were Memoranda of Understanding (MOU) agreements with Local Education Agencies and other schools in Rhode Island for the ELC COVID Reopening Schools award and were not ...

Finding 2023-049 – Corrective Action Plan RIDOH agrees with the finding and recommendation. The unreported subawards of ELC funds were Memoranda of Understanding (MOU) agreements with Local Education Agencies and other schools in Rhode Island for the ELC COVID Reopening Schools award and were not recognized as being subject to FFATA reporting. RIDOH will review all internal policies and procedures regarding both subawards and interagency agreements with federal funds (IAA-FF), and FFATA reporting thereof, to assure RIDOH is aligned with the statewide DOA policies for FFATA reporting. RIDOH will provide training to all contract managers, program managers for subawards, and staff responsible for reporting in FSRS to assure all subawarded funds are captured and reported appropriately. Anticipated Completion Date: December 31, 2024 Contact Persons: Alisha Colella, Chief Financial Officer, Rhode Island Department of Health alisha.colella@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Rhode Island Department of Health carla.lundquist@health.ri.gov

View Audit 305097

Finding 395225 (2023-045)

Significant Deficiency 2023

State of Rhode Island

RI

Internal Control / Segregation of Duties Allowable Costs / Cost Principles Eligibility

Finding 2023-045 – Corrective Action Plan This error was identified with the USDOE as part of the monitoring in May 2023. All prior years were correct – this was a one-time error in the calculation spreadsheet. As a result, the USDOE did not believe this occurrence rose to the level of a finding ...

Finding 2023-045 – Corrective Action Plan This error was identified with the USDOE as part of the monitoring in May 2023. All prior years were correct – this was a one-time error in the calculation spreadsheet. As a result, the USDOE did not believe this occurrence rose to the level of a finding – but rather a procedural suggestion to have the calculation spreadsheet reviewed as part of an internal control procedure. Although the issue was discovered in May 2023, the USDOE did not feel the corrections was necessary to be implemented prior to June 30, 2023, as suggested by RIDE. The rationale was due to a projection of a large amount of unexpended FY23 funding - prior to redistributing the unexpended funds, the correct allocation calculation would be applied which would correct most of the previous allocations. Anticipated Completion Date: The correct allocation calculation was applied to the FY2023 Perkins Secondary funds on June 6, 2023. Contact Person: Mark Dunham, Chief Financial Officer, Department of Elementary & Secondary Education mark.dunham@ride.ri.gov

View Audit 305097

Finding 395223 (2023-044)

Significant Deficiency 2023

State of Rhode Island

RI

Internal Control / Segregation of Duties Subrecipient Monitoring Allowable Costs / Cost Principles

Finding 2023-044 – Corrective Action Plan 2023-044a – RIDE has developed written policies and procedures for the maintenance of AcceleGrants user accounts that will have all inactive users removed after 12 months of inactivity. Anticipated Completion Date: October 31, 2024 2023-044b – RIDE financ...

Finding 2023-044 – Corrective Action Plan 2023-044a – RIDE has developed written policies and procedures for the maintenance of AcceleGrants user accounts that will have all inactive users removed after 12 months of inactivity. Anticipated Completion Date: October 31, 2024 2023-044b – RIDE finance and IT offices will review the user complementary controls noted in the vendors most currently available SOC2 report and implement suggested controls that are deemed appropriate, reasonable, and necessary by the joint RIDE team. RIDE will have this finding resolved by December 31,2024. Anticipated Completion Date: December 31, 2024 2023-044c – Finance and IT at RIDE are working together to determine the correct schedule for regular IT risk assessments. The departments are also in the process of reviewing the disaster recovery plans for the vendor, and a vendor management plan. Anticipated Completion Date: December 31, 2024 Contact Person: Mark Dunham, Chief Financial Officer, Department of Elementary & Secondary Education mark.dunham@ride.ri.gov

View Audit 305097

Finding 395218 (2023-041)

Significant Deficiency 2023

State of Rhode Island

RI

Special Tests & Provisions Student Financial Aid Significant Deficiency

Finding 2023-041 – Corrective Action Plan There is no disagreement with the audit finding. The financial aid office has identified the position within the department that is responsible for completing monthly reconciliation or the Direct Lending program. This position has been given the policy an...

Finding 2023-041 – Corrective Action Plan There is no disagreement with the audit finding. The financial aid office has identified the position within the department that is responsible for completing monthly reconciliation or the Direct Lending program. This position has been given the policy and procedures related to reconciliation and has immediately begun following these procedures. This position will also seek out additional resources and trainings to ensure compliance moving forward. The director will support the process by allowing the time for these processes to be done on a monthly basis as well as provide support for future trainings. Anticipated Completion Date: January 2024 Contact Person: Jennifer Burke, Interim Director of Financial Aid, Rhode Island College jburke1@ric.edu

View Audit 305097

Finding 395210 (2023-042)

Significant Deficiency 2023

State of Rhode Island

RI

Special Tests & Provisions Student Financial Aid Significant Deficiency § 200.303

Finding 2023-042 – Corrective Action Plan There is no disagreement with the audit finding. The University has enacted an Information Security Policy, “URI Information Technology Standard”, which was issued on December 6, 2023. This standard defines the minimum information security requirements fo...

Finding 2023-042 – Corrective Action Plan There is no disagreement with the audit finding. The University has enacted an Information Security Policy, “URI Information Technology Standard”, which was issued on December 6, 2023. This standard defines the minimum information security requirements for the University of Rhode Island. The full standard can be found at the following URL: https://uri0.sharepoint.com/sites/URIInformationTechnologyServicesCommunication/SitePages/ITS-Security.aspx?ga=1. Anticipated Completion Date: December 6, 2023 Contact Persons: Gabrile Fariello, Interim Chief Information Officer, University of Rhode Island gfariello@uri.edu Michael Khalfayan, Chief Information Systems Officer, University of Rhode Island mkhalfayan@uri.edu

View Audit 305097

Finding 395209 (2023-040)

Significant Deficiency 2023

State of Rhode Island

RI

Subrecipient Monitoring Special Tests & Provisions Student Financial Aid

Finding 2023-040 – Corrective Action Plan There is no disagreement with the audit finding. The College has designated the Director of Information Security to oversee the information security function. The College has contracted with a firm to function as a virtual Certified Information Security O...

Finding 2023-040 – Corrective Action Plan There is no disagreement with the audit finding. The College has designated the Director of Information Security to oversee the information security function. The College has contracted with a firm to function as a virtual Certified Information Security Officer (vCISO) to support compliance as well as provide training and consulting services. The Assistance Vice President, Chief Information Officer is tasked with ensuring that the Written Information Security Program is updated annually and that compliance is maintained. Anticipated Completion Date: June 2024 Contact Person: Pamela Christman, Assistance Vice President, Chief Information Officer, Rhode Island College pchristman@ric.edu

View Audit 305097

Finding 395204 (2023-038)

Significant Deficiency 2023

State of Rhode Island

RI

Subrecipient Monitoring Reporting Significant Deficiency

Finding 2023-038 – Corrective Action Plan Auditee Views: SFRF reporting utilized physical posted date pulled from PowerBI environment. The issue with physical posted date is that the report can change based on when pulled. PRO project was not detailed in Annual Report. The blank sections of the do...

Finding 2023-038 – Corrective Action Plan Auditee Views: SFRF reporting utilized physical posted date pulled from PowerBI environment. The issue with physical posted date is that the report can change based on when pulled. PRO project was not detailed in Annual Report. The blank sections of the downloaded reports are due to a US Treasury system issue that affects all States, not just Rhode Island. PRO began taking screenshots once it became aware of the problem and will continue to do so. There is a tedious review process that is completed for reporting on this data and information supplied to PRO by the entities. Corrective Actions: Modify the U.S. Treasury reporting process to utilize cash date to align with RIFANS federal transaction register both cumulatively and quarterly. Anticipated Completion Date: May 15, 2024 Add PRO project description to SFRF Annual report to U.S. Treasury. Anticipated Completion Date: July 31, 2024 Collect additional information from component unit agency to support provided reporting data. Anticipated Completion Date: June 30, 2024 Contact Person: Paul L. Dion, Ph.D., Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov

View Audit 305097

Finding 395194 (2023-032)

Significant Deficiency 2023

State of Rhode Island

RI

Allowable Costs / Cost Principles Subrecipient Monitoring Eligibility

Finding 2023-032 – Corrective Action Plan RIDOH agrees with the finding and recommendation. This finding is centered around some local agency staff being inactive for longer periods of time (60+ days) and the security risk around them not being terminated or made inactive in our Crossroads system....

Finding 2023-032 – Corrective Action Plan RIDOH agrees with the finding and recommendation. This finding is centered around some local agency staff being inactive for longer periods of time (60+ days) and the security risk around them not being terminated or made inactive in our Crossroads system. While RI WIC is routinely notified of terminations and transfers of local agency staff, there are instances of people with varying degrees of access going over 60 days without accessing the system. It is sometimes due to a local agency staff person who is in more of an administrator role and not routinely working in the Crossroads system. RI WIC will review policies and procedures regarding user access to the Crossroads System and will work to strengthen and monitor controls for system access. Policies and procedures will be updated as needed, and internal controls will be implemented and documented. Anticipated Completion Date: December 31, 2024 Contact Persons: Ann Barone, Chief, Office of Women, Infants & Children, Rhode Island Department of Health ann.barone@health.ri.gov Anthony Manzi, WIC Fiscal Manager, Rhode Island Department of Health anthony.manzi@health.ri.gov

View Audit 305097

Corrective Action Plans

Filters