Corrective Action Plans

Condition: The University did not accurately report the effective date of student's status change to the NSLDS. Of the 40 students selected for enrollment reporting testing, the effective date of the status change for 12 students was not accurately reported. Planned Corrective Action: The cause of the error has been found to be a software issue and the University is actively working with the vendor to determine the ultimate solution. The University has implemented additional controls to ensure that the accurate effective date is reported to the NSLDS in a timely manner. Contact person responsible for corrective action: Diane M. Praet, Associate Vice President and University Registrar Anticipated Completion Date: 3/31/2024

Action taken in response to finding: Fiscal Affairs will review reporting requirements for any funding received; communicate such requirements to the appropriate parties within the University; and coordinate with Office of Research & Sponsored Programs to ensure that the reporting requirement is met.

Action taken in response to finding: Fiscal Affairs will more carefully review methodologies provided by the granting agency when seeking funding, maintain more thoroughly documented records of any pertinent calculations and communications, and ensure that information is disseminated to appropriate parties.

We will review processes uon termination to ensure all necessary documentation is maintained.

Finding Number: 2023-001 Condition: The University did not report the status changes of certain students to the NSLDS in an accurate and timely manner during the fiscal year. Planned Corrective Action: Campus wide operational operation software (Workday) has already implemented software updates fixing this issue. The software upgrade occurred March 24, 2023, and was operational for the 23-24 academic year. Contact person responsible for corrective action: Not applicable Anticipated Completion Date: Not applicable

The City was not aware of the CDBG quarterly PR29 (SF-425) reporting errors. The City has trained staff and implemented revised policies and procedures when preparing the CDBG PR29 (SF-425) quarterly reports to ensure proper reporting of program income on hand and the appropriate federal expenditures utilizing both federal grant and program income.

Corrective Action: After the Food and Nutrition Director reviews the monthly claims, she will send an email noting her approval, before the claim is submitted to the state. This email approval will be attached to the journal entry support that is posted in the financial system when recording the revenue. Contact Person: Amanda Miller, Director of Food & Nutrition Services and Logistics / Ray Serrano - Accountant Anticipated Completion Date: June 30, 2024

CORRECTIVE ACTION PLAN FOR THE YEAR ENDED JUNE 30, 2023 Title 2, U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Subpart F, Section 511 – Audit Findings Follow-up requires the auditee to prepare a corrective action plan to address each audit finding included in the current year auditor’s reports. The Corrective Action Plan for Current Year Findings present our corrective action plan for the Financial Statement and/or Federal Award Findings described in the accompanying Schedule of Findings and Questioned Costs for the period ended June 30, 2023. Finding 2023-001 Responsible Party Name: Amy Spaeth Position: Co-CEO – Management Agent Telephone Number: 816-236-2435 Federal Agency U.S. Department of Housing and Urban Development Federal Program Supportive Housing for Persons with Disabilities (Section 811) Compliance Requirements N – Special Tests and Provisions Finding Type Federal Awards Auditee’s Comment on Finding We agree with the auditor’s finding. Corrective Action We have deposited the shortfall of $4,320 into the reserve for replacement account in July 2023. We will follow our process to deposit and reconcile the reserve for replacement account on a monthly basis. Anticipated Completion Date N/A

The City of Portsmouth, New Hampshire respectfully submits the following corrective action plan for the year ended June 30, 2023. Audit period: July 1, 2022 – June 30, 2023 The finding from the schedule of findings and questioned costs is discussed below. The finding is numbered consistently with the number assigned in the schedule. FINDING—FEDERAL AWARD PROGRAMS AUDITS DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT 2023-001 Community Development Block Grant - Assistance Listing Number 14.218 Recommendation: We recommend the City enhance internal controls and procedures to comply with all FFATA reporting requirements. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Some FFATA reports were not entered timely into FSRS in FY 23. This was due to an incomplete understanding about the requirement as well as no FFATA reporting requests by the federal granting agency (HUD) to the City. All required FFATA reports were entered into the FSRS after the deadlines, and City staff responsible for FFATA reporting have completed additional training on the requirements. We do not anticipate untimely reports to the FSRS in the future. Name(s) of the contact person(s) responsible for corrective action: Elise Annunziata, Community Development Director Planned completion date for corrective action plan: All required FFATA reports were already entered into the FSRS, and City staff responsible for FFATA reporting have completed additional training on the requirements. We do not anticipate untimely reports to the FSRS in the future.

The implementation of the Corrective Action Plan 2023-003 will ensure that complete reports are submitted for the validation of the compliance with this finding. Additionally, we will analyze our approved budget by ACUDEN to meet supplemental the terms and conditions of the Child Care and Development Fund Program. Implementation Date: Fiscal Year 2023-2024 Responsible Person: Mr. Ángel L. Reyes Matos, Finance Director

As an internal control, the accountant in charge of the program will keep monthly reports of the expenditures to expedite the collection of information and submit timely and complete reports. The documentation of the reports will be physically filed and digitally saved in the accounting files. Implementation Date: Fiscal Year 2023-2024 Responsible Person: Mr. Ángel L. Reyes Matos, Finance Director

Internal control procedures will be strengthened between Financial Aid, the Registrar’s Office, and the Bursar’s Office.

During the year-end audit testing phase, the Financial Aid office was notified in August 2023 of the deficiencies noted on this finding. The Financial Aid office immediately took action to implement the recommendations in August 2023. The District established effective controls in August 2023 to ensure the return of funds occurs within 45 days from the date the institution determines the student withdrew from all classes and that the withdrawal determination is performed within the required timeframe. Additionally, the District implemented procedures in August 2023 to ensure that the academic calendar loaded in the financial aid software is accurate and based on the most up to date information. The District implemented procedures in August 2023 to ensure that the correct student status is utilized in the calculation of Return to Title IV.

Finding 2023-002 Sept. 27, 2023 Criteria: The College is responsible for designing, implementing, and maintaining internal control over compliance for special tests and provisions and for safeguarding sensitive data under the Gramm-Leach-Bliley Act, including a written information security program policy that addresses the six required minimum safeguard elements identified within 16 Code of Federal Regulations (CFR) 314.4 (b). Statement of Condition: A formal written policy was not completed and documented in fiscal 2023 which would have addressed the required written policy noted in 16 CFR 314.4 (b). Corrective Action Plan: • The College agrees and concurs with the audit finding. • The College is working with a cybersecurity partner, OculusIT (OculusIT.com) to assist us with GLBA compliance and cybersecurity hardening of the college’s IT infrastructure. OculusIT will assist us in preparing the required documentation that addresses risk assessment of all three areas noted in the finding. Many elements of GLBA compliance have already been put in place as elaborated below. • Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). Vince Vargiya is the College’s designated qualified individual. • Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 314.4(b)). OculusIT will undertake a GLBA risk assessment covering the following areas of the College: o Senior Management o IT Security o Admissions o Registrar Office o Financial Aid Office o HR and Payroll o Student Financial Services o Library Work on completing pre-audit questionnaires for each area is in progress. • Regarding a written information security policy that addresses the minimum safeguard requirements, see below. • Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: o Implement and periodically review access controls. We regularly review access controls to systems containing financial data. Our formal policy will document this. o Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. We maintain a server inventory, noting which sites contain financial information. Our formal policy will document this. o Encrypt customer information on the institution’s system and when it’s in transit. Our server data is encypted using standard SQL TDE encryption. All data transmitted to off campus partners uses the sftp protocol. Our formal policy will document this. o Assess apps developed by the institution. The College’s enterprise apps are commercially sourced, updated using vendor supplied processes per annual support contracts, and not developed in-house. Our formal policy will document this. o Implement multi-factor authentication for anyone accessing customer information on the institution’s system. All users who access Jenzabar (SIS, Financials), PowerFaids (Financial Aid) must use DUO MFA. RaisersEdge (Advancement/Donor Management) employs text or email MFA. All email accounts are secured with google 2 step authentication. Our formal policy will document this. o Dispose of customer information securely. When server hardware is decommissioned, the data drives are physically smashed. When leased endpoint systems are returned to the leasing company, their hard drives are wiped using standard software. Our formal policy will document this. o Anticipate and evaluate changes to the information system or network. We meet regularly with OculusIT to discuss changes to the network. Our endpoints are monitored for malware via a managed detection and response system. Our servers and network switches are monitored 24/7 by the Oculus SOC, and unusual events are flagged and presented to us for analysis. Our formal policy will document this. o Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. We have implemented a SIEM server which monitors server and network access and activity and is monitored by the OculusIT SOC. Our formal policy will document this. • Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). We have implemented a SIEM server which monitors server and network access and activity and is monitored by the OculusIT SOC. We receive weekly reports on any server vulnerabilities. We actively work to remediate identified vulnerabilities. We have implemented annual penetration testing, and have completed testing for 2023. We have remediated identified penetration issues. Our formal policy will document this. • Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). We require semi annual security awareness training and monthly phishing testing through KnowBe4. Our formal policy will document this. • Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). We require providers to submit SOC1 or HECVAT documentation. Our formal policy will document this. • Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). We work with OculusIT to follow up on results of testing and risk assessments. For example, we rescan our network to follow up on the results of pen testing. We meet with the Oculus SOC team to discuss server vulnerabilities uncovered on a monthly basis. Our formal policy will document this process. Names of Contact Persons Responsible for Corrective Action Plan: Gary Rodman (Senior Director of Information Technology), rodmang@ripon.edu, 920-748-8343 Vince Vargiya (Vice President Information Security | CISO, OculusIT) vince_varigiya@oculusit.com 844-462-8587 ext. 193 Anticipated Completion Date: Implementation of this plan began in March 2023, focusing on infrastructure hardening. Formal written polices will be put in place no later than June 30, 2024.

Finding 2023-001 Sept. 26, 2023 Criteria: The College is responsible for designing, implementing, and maintaining internal control over compliance for special tests and provisions and for accurately reporting significant data elements under the Campus-Level and Program-Level records within the National Student Loan Data System (NSLDS) that Department of Education (DOE) considers high risk. Statement of Condition: Management's review of the enrollment reporting did not detect errors on certain student data elements. Certain student records within the NSLDS were identified with inaccurate data elements. Corrective Action Plan: • The College agrees and concurs with the audit finding. • The Registrar’s Office has reviewed and remediated all files that were not accurately reported data elements in NSLDS as of September 2023. • The Registrar’s Office will work with the Financial Aid Office to review and regularly monitor student campus and program level enrollment status, especially in the cases of those that have dropped below full time, and are no longer enrolled for various reasons. • The Registrar’s Office will monitor the NSC error report which states discrepancies between NSC and NSLDS. • The Registrar’s Office will work with NSC to remediate processing issues between NSC and NSLDS reports in order to ensure that NSLDS is receiving accurate information. Names of Contact Persons Responsible for Corrective Action Plan: Michele Wittler (Associate Dean of Faculty and Registrar), wittlerm@ripon.edu, 920-748-8119 Katy Crane (Assistant Registrar), cranek@ripon.edu, 920-748-8119 Linda Kinziger (Director of Financial Aid), kinzigerl@ripon.edu, 920-748-8358 Anticipated Completion Date: This plan has been implemented with corrections already made as of September 2023 by the Registrar’s Office. It will be finalized with the fiscal year June 30, 2024 year-end review of Enrollment Reporting.

2023-007: Special Tests & Provisions Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Matters Recommendation: ISU should implement procedures to ensure that enrollment data, changes in status and effective dates within NSLDS match the records of the intuition and are reported timely. We also recommend that the University implement a formal review procedure to document the review process. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: During our discussion, it became apparent that a significant portion of the findings pertaining to the Office of the Registrar stemmed from enrollment status change not being reported to NSLDS within 60 days. To remedy this, we have added three new automated enrollment uploads right after the upload of the graduation file respectively in Fall, Spring and Summer. The three automated enrollment uploads to be sent to NSLDS are scheduled as follows: 1. On February 16; 2. On June 3; 3. On September 1. Name(s) of the contact person(s) responsible for corrective action: Hala Abou Arraj, Registrar Planned completion date for corrective action plan: Implemented in February 2024

2023-005: Special Tests & Provisions Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Matters Recommendation: ISU should review the requirements and implement a monitoring control to monitor the checks throughout the year. In addition, for the checks outstanding greater than 240 days, the University should return the funding to the U.S. Department of Education. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: ISU reopened the prior financial aid years in COD and completed returns of federal aid funds via G5/6 from identified outstanding checks. ISU has implemented the following monitoring controls: At the beginning of each month finance runs check reissue forms for all checks that the check date is 180 days or older. These are mailed to the check recipient. Around the 15th of the month any checks containing Title IV funds that have not been reissued will be turned to the financial aid office. Financial Aid is provided with the date by which the funds need to be returned. Financial Aid attempts to work with the student to get the checks cashed if they are not successful will return funds before the 240-day limit. They will then notify Finance to cancel the original check. Name(s) of the contact person(s) responsible for corrective action: Lisa Leyshon, AVP Finance/Controller, James Martin, Director of Financial Aid Planned completion date for corrective action plan: Implemented in 2020.

2023-004: Suspension Debarment Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Matters Recommendation: ISU should evaluate its procedures and implement an additional control to insure verification checks are occurring prior to entering into contract with a vendor/subrecipient. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: ISU has implemented PaymentWorks, a third-party vendor processing system that does 24-7 sanction and debarment checking. This is conducted on all ISU vendors that onboard through PaymentWorks. All ISU contracts will be processed through Jaggaer, which requires a Banner ID#. All vendors will be imitated through PaymentWorks. Accounts Payable checks sanction alerts in PaymentWorks and follows up with issues. Name(s) of the contact person(s) responsible for corrective action: Lisa Leyshon, AVP Finance/Controller and Kirsten Broughton, Director Grant Accounting Planned completion date for corrective action plan: Implemented in April 2024.

2023-002: Cash Management-Subrecipient Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Type of Finding: Significant Deficiency in Internal Control over Compliance Other Matters Recommendation: ISU should evaluate its procedures and implement an additional control to review and approve the subrecipient reimbursements timely. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Grant accounting staff will follow payment requests through the system to make sure payments are made in a timely manner. Name(s) of the contact person(s) responsible for corrective action: Kirsten Broughton, Director Grant Accounting Planned completion date for corrective action plan: Implemented in FY24

DEPARTMENT OF HEALTH AND HUMAN SERVICES 2023-001: Reporting Federal Program Titles: Every Student Succeeds/Preschool Development Grants Primary Care Training and Enhancement Assistance Listing Number: 93.884 & 93.434 Type of Finding: Significant Deficiency in Internal Control over Compliance Recommendation: ISU should implement formal review procedures to document review and approvals over required reports. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: ISU had a formal review procedure in place, but due to personnel changes it was not being followed. Staff has been trained and procedures will be followed. Name(s) of the contact person(s) responsible for corrective action: Kirsten Broughton, Director Grant Accounting Planned completion date for corrective action plan: Implemented FY24

U.S. Department of Transportation 2023-004 Formula Grants for Rural Areas – Assistance Listing No. 20.509 Recommendation: We recommend the Organization properly document Sam.gov searches. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Organization will take the steps necessary to properly document that they have searched Sam.gov. Names of the contact persons responsible for corrective action: Rich Pavek, Executive Director, and Kris Burkey, Finance Manager Planned completion date for corrective action plan: December 31, 2024

U.S. Department of Transportation 2023-003 Formula Grants for Rural Areas – Assistance Listing No. 20.509 Recommendation: We recommend the Organization review its policy and implement a procedure for proper approval over all disbursements. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Organization will take the steps necessary to ensure that costs are appropriately approved. Names of the contact persons responsible for corrective action: Rich Pavek, Executive Director, and Kris Burkey, Finance Manager Planned completion date for corrective action plan: December 31, 2024

2023-002 Housing Trust Fund Program – Assistance Listing No. 14.275 Recommendation: CLA recommended that PHFA review their procedures around administrative expenses charged to the HTF program. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: PHFA will implement electronic time tracking, this will replace the current manual process of preparing timesheets that are entered into a database used to accumulate administrative expenses charged to federal programs. PHFA is currently in the process of implementing a Human Capital Management system that will allow employees to track the time they work on federal programs. Name of the contact person responsible for corrective action: Adrianne Trumpy, Director of Accounting Planned completion date for corrective action plan: July 1, 2024

U.S. Department of Housing and Urban Development 2023-001 Home Investment Partnerships Program – Assistance Listing No. 14.239 Recommendation: CLA recommended that PHFA review their procedures surrounding the division sign-off form utilized in the pre-commitment meeting. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: PHFA implemented a new process to ensure the required divisional signoffs are received after the completion of the pre-commitment meeting. The Lending Officer prepares an electronic approval listing in Microsoft Teams to capture the approvals after the pre-commitment meeting. The Lending Officer follows up with the requested signors to ensure that all outstanding questions have been answered and the signer can mark the Microsoft Teams’ listing approved. Name of the contact person responsible for corrective action: Jessica Perry, Director of Development The new Microsoft Teams approval system was implemented in August 2023. To date, approximately 20 developments have been approved via the new system.

Corrective Actions: *Conduct a thorough review of the policies and procedures related to withdrawals, specifically focusing on the calculation of students' percentages of completion during the payment period and the proper handling of breaks in the academic calendar. *Implement additoinal training sessions for staff members responsible for calculating students' completion percentages to ensure they understand the correct methodology, particularly in accounting for breaks of at least five consecutive days. *Utilize the newly implemented Ellucian Colleague software in order to monitor and identify students who withdraw and receive Title IV funds promptly. Establish a clear protocol for performing return calculations and issuing refunds within the required 45-day timeline as per federal regulations. *Enhance oversight and monitoring processes to ensure compliance with 34 CFR 668.22 and other relevant regulations. Regular audits should be conducted to verify the accuracy of calculations and the timely return of Title IV funds. *Communicate updated procedures to all relevant staff members and provide ongoing support to ensure proper implementation and adherence to the revised policies. By implementing these corrective actions, the college can address the identified deficiencies and enhance its compliance with federal regulations concerning withdrawals and the treatment of Title IV funds. All actions listed above have been completed as of 03/01/2024.