Corrective Action Plans

November XX, 2023 Office of the Secretary of State Audits Division 255 Capitol St. NE, Suite #500 Salem, OR 97310 Plan of Action for Wheeler County, Oregon Wheeler County, Oregon respectfully submits the following corrective action plan in response to deficiencies reported in our audit of fiscal year ended June 30, 2023. The audit was completed by the independent auditing firm Solutions, CPAs PC, John Day, Oregon. The deficiencies are discussed below with the Action Plan listed for each. 1. Material Weakness – Financial Statement Preparation Criteria: The financial statements are the responsibility of the county’s management, including the prevention or detection of material misstatements in the presentation and disclosure of the financial statements. Non-attest services performed by the auditor in the preparation of the financial statements cannot be considered compensating controls. Condition: The county engages their auditors to provide non-attest services for the preparation of its financial statements. Although common for municipalities the size of the county, this condition represents a control deficiency over the financial reporting process that is required to be reported under professional standards as long as management makes all financial reporting decisions and accepts responsibility for the content of the financial statements. However, those activities performed by the auditor are not a substitute for, or extension of, internal controls over the preparation of the financial statements in accordance with generally accepted accounting principles (GAAP). Cause: The county’s accounting personnel do not possess the advanced training that would provide the expertise necessary to prepare the financial statements and related notes in accordance with GAAP, and therefore may not be able to prevent or detect a material misstatement in the preparation and disclosure of the financial statements. Misstatements in financial statements may include not only misstated financial amounts, but also the omission of disclosures required by GAAP. Effect: Material misstatement in the preparation and disclosure of the financial statements in accordance with GAAP may not be prevented or detected. Misstatements in financial statements include not only misstated dollar amounts, but also the omission of disclosures required under GAAP. Recommendations: We understand that it may not be practical to acquire or allocate the internal resources to perform all the controls necessary over financial reporting. However, management (including the County Court) should mitigate this deficiency by keeping informed about the county’s internal controls, performing supervisory reviews, studying the financial statements and related footnote disclosures, and understanding its responsibility for the financial statements as a whole. Action Plan: We understand the importance of risk management and the need to address risks in an informed, cost-beneficial way. As a result of our cost-benefit analysis we have determined the value of incurring the additional expense of hiring a staff person or another firm to prepare our financial statements does not justify the cost. We accept the auditor’s recommendations and will attempt to implement in a timely manner. 2. Material Weakness – Preparation of the Schedule of Expenditures of Federal Awards Criteria: The schedule of expenditures of federal awards (SEFA) is the responsibility of the county’s management, including the prevention or detection of material misstatements in the presentation and disclosures of SEFA. Services performed in reconciling the SEFA to the trial balance during the annual compliance audit cannot be considered compensating controls of the county. Condition: During our reconciliation of the SEFA to the financial statements, and testing of controls, we noted material omissions from program expenditures reported. Additionally, identification of funds passed-thru to subrecipients were omitted from the county drafted SEFA. Cause: The county’s system of controls over the SEFA is lacking effective controls over completeness. Effect: Material misstatement in the preparation and disclosure of the financial statements in accordance with GAAP may not be prevented or detected. Misstatements in financial statements include not only misstated dollar amounts, but also the omission of required disclosures. Recommendations: We recommend the county develop further control procedures over drafting the SEFA to address completeness. We recommend the county develop a system of tracking federal awards and related compliance requirements to assist in accumulating information to prepare the SEFA. This deficiency is related specifically to the preparation of the SEFA and does not reflect on controls over compliance or transactional controls. Action Plan: We understand the importance of risk management and the need to address risks in an informed, cost-beneficial way. We have addressed this finding with plans to develop controls over preparing the SEFA. Specifically, we intend to track compliance requirements for all grants in a database to address internal control issues over completeness. We also intend to implement review and approval controls over the county drafted SEFA. 3. Significant Deficiency – Internal Control over Compliance with Federal Program Requirements Criteria or specific requirement (including statutory, regulatory, or other citation): The Secure Rural Schools and Community Self-Determination Act of 2000 requires a county receiving funds under the Forest Service Schools and Roads Cluster to perform an allocation of funds between Title I, II, and II under based on county court certified allocations. In the current year, that allocation included a federal sequestration of funds that was also required to be allocated to Title I and Title III, which resulted in noncompliance with the requirements related to earmarking and with special tests and provisions. Annual certification of funds spent under Title III is also required. In the current year, that certification included funds that were included in previous certifications, which resulted in noncompliance with the requirements related to reporting. Condition and context: During our review of the allocation of 2023 funds received, we noted an error in the allocation performed by the county. Title I had an overallocation of funds by $2,203, and Title III was under allocated by the same $2,203. The reconciliation of the amounts included in the 2022 annual certification for Title III funding identified an over certification of $11,303 that had already been included in the 2021 annual certification. Questioned Costs: Actual questioned costs totaled $2,203 and consisted of amounts passed through to local schools and expended in the road department on otherwise compliant uses. Cause: There is a lack of internal control over earmarking, reporting, and special tests and provisions over allocation of Forest Service Schools and Roads funding and the annual certification. The county lacks review and approval controls over the allocation of funds and the annual certification. Effect: The effect is noncompliance with earmarking, reporting, and special tests and provisions requirements. Recommendations: It is recommended that the county implement review procedures over the annual receipt to verify amounts allocated are complete and accurate prior to posting to the general ledger. A recalculation of both the certification and a detailed review of amounts used in the annual reporting is recommended. Action Plan: The county understands and concurs with this finding. It is the intention of the county to implement a review process to be completed prior to making formal allocation and reporting of Forest Service Schools and Roads Cluster.

2023-003 Student Financial Assistance Cluster – Assistance Listing No. Various Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The IT Executive Director will review the completed risk assessment to identify specific shortcomings, so that safeguards can be documented in relation to those specific risks. Additionally, he will review the updated GBLA regulations and ensure the University is in compliance. Name of the contact person responsible for corrective action: Brandon Ray, Executive Director, Information Technology Planned completion date for corrective action plan: January 31, 2023.

Department of Education 2023-002 Student Financial Assistance Cluster – Assistance Listing No. Various Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The University will make the following changes: Awarding: The following are internal controls that the University already has in place to review awards for accuracy. • Financial aid worksheet: As part of the awarding process every award year, a financial aid worksheet is created to verify that the awards input in Colleague are accurate. The worksheet is updated each time there is a change to a student’s financial aid eligibility or status. • COD report monitoring: On a weekly basis, reports are processed to determine if there are any discrepancies between what has been awarded in Colleague and what is being reported/accepted in COD. Any discrepancies found are reviewed and corrected. • Monthly loan/grant reconciliation: The monthly loan/grant reconciliation monitors for any discrepancies between what is shown as disbursed in Colleague and the disbursements that have been accepted by COD. Any discrepancies found are reviewed and corrected. • Over award report: Processed at the beginning of each term, this report details if any students are awarded beyond unmet need and/or cost of attendance. Any discrepancies found are reviewed and corrected. • Enrollment level report: Processed before the start of each term and at the end of the add/drop period, this report evaluates awarded enrollment level against actual enrolled credits. Any discrepancies found are reviewed and corrected. • Disbursement processing rules: There are rules built into the Colleague system to limit disbursement of awards when actual enrollment status does not match awarded status. Any discrepancies found are reviewed and corrected. Beyond the internal controls already in place, the University will implement the following: • Secondary review of awards: For new Financial Aid Counselors, all awards will be reviewed for the first two months to ensure accuracy and commitment to proper training. Additionally, based on current staffing levels, a random selection of 10% of all awarded students will be reviewed to evaluate for awarding accuracy. • Grade level review: After the 10th day of each term, a review will be performed to compare the current class standing of each student to the grade level that was used for awarding. Any discrepancies found will be reviewed and corrected. Return to Title IV (R2T4) Calculations: The Colleague system is used to process R2T4 calculations. This system has been developed to correctly calculate the return formula based on limited information entered by the R2T4 processor. To ensure the correct information is entered, the University will implement a secondary review of all R2T4 calculations. The primary R2T4 processor will enter all required information in the R2T4 calculation screen within Colleague, and then print the screen for review by a secondary member before the return is referred for processing. The primary processor and secondary reviewer will be required to sign off on the printed calculation sheet, verifying the accuracy of the information. The items that will be included as part of the secondary review will be the date of determination, enrollment status, last date of attendance, and institutional charges. Professional Judgment: The University will implement a Professional Judgment Committee. The committee will consist of at least one Financial Aid Counselor and the Director of Financial Aid. The committee will collectively review all the documentation for each case to make a final determination. Name of the contact person responsible for corrective action: Dustin Kummrow, Director of Financial Aid Planned completion date for corrective action plan: November 1, 2023

Corrective Action Plan (Prepared by the Charter Holder) Finding 2023 – 001 Management has recognized the need for additional personnel to assist in ensuring compliance and accuracy with various reporting and compliance requirements. In September 2023, the Charter Holder posted a grant manager position to support the Chief Financial Officer with state and federal reporting, budgeting, and grant compliance. While the position is vacant, the Charter Holder’s business manager is reviewing financial and compliance reports for accuracy. Management has reached out to Texas Education Agency about the reporting error and is waiting for further instructions on how to correct the reporting error. Responsible Party: Marian Hamlett, CFO Implementation Date: Immediately

U.S. Department of Education 2023-001 Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Recommendation: We recommend that the University consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the stated criteria. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: As part of the University winding down operations, and no longer providing educational services, University management will consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the state criteria. Name(s) of the contact person(s) responsible for corrective action: Rachel Nielsen, Vice President of Finance and Administration Planned completion date for corrective action plan: July 31, 2024

School’s Response – The School concurs with this finding and will include Davis Bacon prevailing wage requirements in all future construction contracts that are being paid by federal funds.

The District will implement controls in its meal claim process to ensure that student meals claimed for reimbursement equal student meals served. The Food Service Supervisor and/or Food Service Administrative Assistant will create a summary meal count sheet each month totaling the number of student meals seved based on the electronic and manual meal count sheets prior to submitting the meal claim in the Michigan Nutrition Data System (MiND). The monthly meal claim submitted will be filed with the supporting documentation an dsigned by the individual submitting the claim attesting that the meals claimed match the meals counted.

#2023-003 Significant Deficiency in internal controls and noncompliance related to reporting: The District did not have adequate internal controls over meal claiming process and as a result, errors were made and not detected. Recommendation: Personnel need to be assigned to provide a second review of the meal counts. Ideally, software would be used to avoid human error in tallying. Action Taken: Since May of 2023, the Bandon School District has used Mealtime to avoid human error in tallying. The Food Services Director reviews these numbers monthly to ensure accuracy.

The Board of Directors is and will remain involved in the financial affairs of the Cooperative.

Name of Contact Person: Terry Alston, Chief Finance Officer Corrective Action Plan: Management will monitor Program Report Code expenditures on a monthly basis for compliance with the 10% federal requirement. Amendments will be submitted through the BUD system, as necessary, to ensure compliance with the 10% requirement. Proposed Completion Date: Immediately

Department of Education Bucknell University respectfully submits the following corrective action plan for the year ended June 30, 2023. Audit period: July 01, 2022 - June 30, 2023 The findings from the schedule of findings and questioned costs are discussed below. The findings are numbered consistently with the numbers assigned in the schedule. FINDINGS—FEDERAL AWARD PROGRAMS AUDITS Department of Education 2023-001 Federal Pell Grant Program – Assistance Listing No. 84.063 Federal Direct Student Loans – Assistance Listing No. 84.268 Recommendation: We recommend the University review procedures around sending correct information to the NSLDS. In addition, we recommend the University develop a process to help better oversee the submissions completed by the third-party servicer. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Bucknell is currently reviewing its existing process of reporting student enrollment data to the NSLDS. The University through its Registrar and Financial Aid Office will update current procedures to include a more thorough verification of third-party servicer submissions to the NSLDS. Name(s) of the contact person(s) responsible for corrective action: Tim Kracker, University Registrar and Erin Wolfe, Director, Financial Aid Planned completion date for corrective action plan: December 2023 If the Department of Education has questions regarding this plan, please call Elizabeth D. Stewart, Associate Vice President, Treasurer & Controller at 570-577-3108.

We concur with the auditor’s finding. We will be completing a full audit of remaining Perkins files to ensure that all necessary documentation is accounted for and properly filed. Contact Person Responsible for Corrective Action: Carol Summervill, VP for Finance Anticipated Completion Date: Corrective action was started in October and will be completed by December.

We concur with the auditor’s finding. We have reviewed our processes related to the enrollment reporting of withdrawing students. The financial aid department has added a column in the tracking document to record the effective withdrawal date from NSLDS. On a weekly basis, the withdrawal dates from NSLDS will be compared to the withdrawal dates per the financial aid records to ensure the two dates are the same. Contact Person Responsible for Corrective Action: Andy Olsen, Director of Financial Aid; Rhianna Reed, Assistant Registrar Anticipated Completion Date: Corrective action was completed in October.

2023-002 Student Financial Assistance Cluster – Assistance Listing No. Various Recommendation: We recommend the College work with their consulting firm to review their documentation and ensure that there are documented safeguards for identified risks and the required documentation and practices are implemented. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act (GLBA) regulations that were required to be implemented as of June 9, 2023. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The College engaged a consulting firm as our Virtual Chief Information Security Officer (vCISO) in 2022-23 to assist in compliance with the GLBA. The College’s work with our vCISO includes a comprehensive risk assessment of the College’s information security posture, a determination of identified risks, access to expert security resources to build an effective and measurable security program, and an evaluation of the controls protecting the external network. These action items began in the 2022-23 fiscal year and are ongoing in the 2023-24 fiscal year. The vCISO program includes virtual multi-year ongoing support. Name(s) of the contact person(s) responsible for corrective action: Harlan Jorgensen, Director of Computing Services Planned completion date for corrective action plan: June 30, 2024

2023-001 Student Financial Assistance Cluster – Assistance Listing No. Various Recommendation: We recommend the College review its reporting procedures to ensure that students’ statuses are accurately and timely reported to National Student Loan Data System (NSLDS) as required by regulations. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: After being alerted to the finding, the Registrar changed the submission dates to the National Student Clearinghouse (NSC) to allow more time for the NSC to timely report to the NSLDS. The Registrar’s Office will notify the Business Office when files have been submitted to the NSC. The Business Office will periodically monitor the NSLDS system and alert the Registrar of their observations. Name(s) of the contact person(s) responsible for corrective action: Austin Nyhof, Registrar Planned completion date for corrective action plan: June 30, 2024

Corrective Action Plan: AlaHA will accomplish the following: 1) Send guidance to hospital systems with multiple facilities reported on their 941s that they should retain general ledger detail reconciliations to support the funds received. 2) Request the hospital involved in the exception cited for not having submitted general ledger evidence submit additional support for the reconciliation they submitted. 3) Should a similar tranche of funds become available in the future, AlaHA will ensure disbursements are not made before receipt of general ledger evidence to support the amount reported by the hospital. Target Date: For items 1 & 2 in the corrective action plan, November 6, 2023.

Finding 2023-002: Federal Agency: U.S. Department of Housing and Urban Development Federal Program Titles: Emergency Housing Vouchers Assistance Listing Number: 14.EHV Noncompliance – E. Eligibility - Tenant Files Non Compliance Material to the Financial Statements: No Significant deficiency in Internal Control over Compliance for Eligibility Criteria: Tenant Files. The PHA must do the following: As a condition of admission or continued occupancy, require the tenant and other family member to provide necessary information, documentation, and releases for the PHA to verify income eligibility (24 CFR sections 5.230, 5.609, and 982.516). Condition: Based upon inspection of the Authority’s files and on discussions with management there were documents that were unavailable for examination at the time of audit. Context: Of a sample size of six (6) tenant files, the following information was unavailable for examination at the time of audit: • Annual 50058 form • Annual inspection form Our sample size is statistically valid. Known Questioned Costs: $1,775 Cause: There is a significant deficiency in internal controls over the compliance for the eligibility type of compliance related to the maintenance of tenant files. The Authority has not properly considered and designed a system of internal controls that reasonably assures the program is in compliance. Effect: The Emergency Housing Vouchers Program is in non-compliance with the eligibility type of compliance related to the maintenance of tenant files. Recommendation: We recommend the Authority design and implement internal control procedures that will reasonably assure compliance with the Uniform Guidance and the compliance supplement. Authority Response: We agree with the Auditor’s observations on the inspection of the tenant files and will implement internal control procedures that will assure tenant file compliance. Views of responsible officials and planned corrective action: The PHA has taken into consideration the Auditor’s recommendation in regards to Emergency Housing Vouchers (EHV) program. During the audit period, the staff assigned to the EHV program changed three times, resulting in program deficiencies. Currently a more skilled tenant interviewer is responsible for voucher processing, therefore program compliance will be in line with HUD requirement.

Management agrees with the finding. The Medical Center’s secondary review control will ensure allowable expenses are being claimed.

The College has created procedures to review outstanding checks monthly. Outstanding checks that are not resolved after several notifications to the student will be returned to the Department of Education. Checks will be returned within four months of the initial check issued date.

The Financial Aid Office worked with the Information Technology department to determine the issue with the exit conference report and had corrected it.

Lincoln Land Community College (LLCC) acknowledges and takes seriously the audit findings presented, highlighting areas where compliance requirements were not met. These findings are crucial in ensuring the ongoing enhancement of our Information Security Program. To address these concerns LLCC has proactively taken several measures. In June 2022, the College appointed an IT Security and Assurance Manager, tasked with overseeing the Information Security Program and ensuring compliance with the Gramm-Leach-Bliley Act (GLBA). The Manager has played a pivotal role in developing a comprehensive roadmap to guide the continued evolution of our Information Security Program. This roadmap specifically outlines the steps required to address the identified deficiencies, as detailed in the schedule of findings document received from the CLA. LLCC affirms its agreement with the details provided in the document and has prioritized these findings as top-level concerns in the roadmap. In the upcoming Fiscal Year 2024 (FY24), LLCC commits to diligently implementing the roadmap, with a focused emphasis on the following key areas: 1. Implementation and Periodic Review of Access Controls: The IT Security and Assurance Manager will lead efforts to establish robust access controls and ensure regular reviews to align with compliance requirements. 2. Encryption of Customer Information: Although informal procedures are in place, a comprehensive strategy for encrypting customer information both within the College’s system and during transit will be implemented to safeguard sensitive data. 3. Security Assessment of Applications: Rigorous evaluations, assessments, and testing procedures for applications transmitting sensitive information will be instituted to bolster the overall security posture. 4. Anticipation and Evaluation of System Changes: Proactive measures will be taken to anticipate and evaluate changes to the information system or network, ensuring a proactive stance against potential vulnerabilities, including the development of a formalized change management process. 5. Regular Testing and Monitoring: LLCC is committed to instituting regular testing, monitoring, and assessing protocols for established safeguards to ensure their ongoing effectiveness. 6. Implementation of Policies and Procedures: Policies and procedures will be refined and enforced to guarantee that personnel can effectively enact the information security program. 7. Monitoring Information System Service Providers: Development of a comprehensive approach to monitoring the College’s information system service providers has been initiated and will be established to ensure compliance with security standards. Lincoln Land Community College views this as an opportunity for continuous improvement and remains dedicated to upholding the highest standards of information security. The commitment to addressing these findings is integral to our ongoing efforts to safeguard sensitive information and maintain compliance with regulatory requirements.

Special Tests - Wage Rate Requirements Federal Program: Education Stabilization Fund (ALN 84.425D & 84.425U) Federal Agency: U.S. Department of Education Federal Award Year: 2022-2023 Individual responsible for corrective action: Rosemarie Gomez, Federal Programs Director Date corrective action will be implemented: September 20, 2023 Corrective Action Planned: Response: In FY 2021, our Valley View ISDs federal programs office prepared a required checklist to document certification of compliance with the state and federally funded purchases. This checklist had been in use for over 2 years and at no time were other requirements noted. Corrective Action: On September 20, 2023, when Valley View ISDs Federal Programs Department was notified that the Davis- Bacon wage compliance item was missing from the checklist, it was promptly added, and the district has required that all contractors or subcontractors provide documentation to support wage compliance.

Maintenance of Effort Federal Program: Title I, Part (ALN 84.010) Federal Agency: U.S. Department of Education Federal Award Year: 2021-2022 Type of Finding: Noncompliance and Significant Deficiency in Internal Control over Compliance Individual responsible for corrective action: Rosemarie Gomez, Federal Programs Director Date corrective action will be implemented: July 27, 2023 Corrective Action Planned: Response: In FY 2022, our Valley View ISDs financial support from ESSA was $8,792,444 below the required effort in FY 2021. That year, Valley View ISD experienced uncontrollable circumstances in student enrollment and teacher retention. This unforeseen decline of student enrollment resulted in funding loss due to average daily attendance. We had a loss in student enrollment due to newly opened and significantly expanded charter schools operating within our district's boundaries. In addition, the district did not hire staff to replace individuals who had separated from the school district through attrition. Another factor included the use of ESSER funds to support projects normally paid for with local funds. Corrective Action: Valley View ISD has always used a detection and prevention measure. The ESSA LEA MOE Calculation Tool provided by the Texas Education Agency is used to facilitate and plan for the determination of compliance with the maintenance of effort requirement. Valley View ISD will continue to use this template each pay period to determine and monitor this grant requirement. Staff will be reclassified accordingly.

The District will require those personnel that are subject to federal award requirements to complete a personnel activity report (PAR) or semi-annual certification. The person responsible for the corrective action is Irene Byrne, the CFO. The anticipated completion date of the corrective action plan is immediate. The plan for monitoring adherence is for the CFO to monitor federal employees and review the completed documents for all employees.

This finding is caused by Human error in transcribing amounts from the general ledger to the proper Activities and Objects on the Final Expenditure Report. The completion date for the corrective action plan is immediate. The person responsible for the corrective action is Tina Mills, the Business Manager. The plan for monitoring adherence is the business manager will double check reports before submitting them to the State of Michigan.