Corrective Action Plans

Finding 1181371 (2025-001)

Material Weakness 2025

OH

Allowable Costs / Cost Principles Significant Deficiency Internal Control / Segregation of Duties

Recovery Services of Northwest Ohio, Inc. respectfully submits the following corrective action plan for the year ended June 30, 2025. Audit period: July 1, 2024-June 30, 2025 The findings from the schedule of findings and questioned costs are discussed below. The findings are numbered consistently w...

Recovery Services of Northwest Ohio, Inc. respectfully submits the following corrective action plan for the year ended June 30, 2025. Audit period: July 1, 2024-June 30, 2025 The findings from the schedule of findings and questioned costs are discussed below. The findings are numbered consistently with the numbers assigned in the schedule. 2025-001 Type of Finding: Significant deficiency identified: The organization is charging payroll costs to grants based on budgeted amounts rather than costs supported by time and effort documentation. Recommendation: Implementation of either a timekeeping system where timecards include documentation of time allocated to each grant or the implementation of a time study process with the lookback procedures to meet the time and effort documentation requirements in accordance with the Uniform Guidance. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The organization will implement time and effort documentation/time study for federal awards and charge grant staff costs based on such documentation. Name(s) of the contact person(s) responsible for corrective action: Jean Groves, CFO, Recovery Services of Northwest Ohio, Inc. 419-782-9920. Planned completion date for corrective action plan: March 15, 2026.

View Audit 392613

Finding 1181360 (2025-004)

Material Weakness 2025

Municipality of Toa Alta

PR

Subrecipient Monitoring Reporting Significant Deficiency § 200.302 § 200.328 § 200.329

MUNICIPALITY OF TOA ALTA CORRECTIVE ACTION PLAN SINGLE AUDIT REQUIREMENTS AS OF JUNE 30, 2025 FINDING NUMBER 2025-004 U.S. DEPARTMENT OF HOMELAND SECURITY DISASTER GRANTS – PUBLIC ASSISTANCE (PRESIDENTIALLY DECLARED DISASTERS) (ALN 97.036) PASS-THROUGH AGENCY CENTRAL OFFICE OF RECOVERY, RECONSTRUCTI...

MUNICIPALITY OF TOA ALTA CORRECTIVE ACTION PLAN SINGLE AUDIT REQUIREMENTS AS OF JUNE 30, 2025 FINDING NUMBER 2025-004 U.S. DEPARTMENT OF HOMELAND SECURITY DISASTER GRANTS – PUBLIC ASSISTANCE (PRESIDENTIALLY DECLARED DISASTERS) (ALN 97.036) PASS-THROUGH AGENCY CENTRAL OFFICE OF RECOVERY, RECONSTRUCTION AND RESILIENCY OF PUERTO RICO (COR3) FEDERAL EMERGENCY MANAGEMENT AGENCY (FEMA) REPORTING (L) SIGNIFICANT DEFICIENCY (SD) / NONCOMPLIANCE (NC) Corrective Action: The Municipality acknowledges the differences identified between the expenses reported in the Quarterly Progress Reports (QPRs) and the accounting records. To address this issue, the Municipality will implement a reconciliation process between the accounting records and the QPRs prior to their submission to the pass-through entity. Additionally, management will perform a supervisory review to ensure that the reported expenses agree with the accounting records and supporting documentation. Statement of Concurrence and Responsible Person: We concur with the auditors’ finding. Miguel Fonseca Federal Programs Director Implementation Date: Fiscal year 2026-2027

View Audit 392592

Finding 1181344 (2025-002)

Material Weakness 2025

Lake Erie College of Osteopathic Medicine

PA

Student Financial Aid Special Tests & Provisions Subrecipient Monitoring

Finding 2025-002 Student Status Changes Condition The College did not notify the National Student Loan Data System (NSLDS) with an accurate effective date for 9 students with status changes in our sample of 25 students. Additionally, the College did not notify the NSLDS in a timely manner for 1 stud...

Finding 2025-002 Student Status Changes Condition The College did not notify the National Student Loan Data System (NSLDS) with an accurate effective date for 9 students with status changes in our sample of 25 students. Additionally, the College did not notify the NSLDS in a timely manner for 1 student with status changes in our sample of 25 students. The sample was not a statistically valid sample. Corrective Action Plan All records for the students identified in the audit have been manually corrected in the NSC and NSLDS systems to match their actual graduation or last date of attendance. A comprehensive review was completed for all students graduating in June 2025. We are working with NSC to verify the changes we made to our reporting will resolve the issue. Name(s) of Contact Person(s) Responsible for Corrective Action: Mark Badarraco, Executive Director of Enrollment Services and Information Systems Thomas Camillo, Registrar Anticipated Completion Date: 6/30/26 Polices & Procedures update was completed during FY26 Software training for existing staff will continue through FY26

View Audit 392563

Finding 1181343 (2025-001)

Material Weakness 2025

Lake Erie College of Osteopathic Medicine

PA

Student Financial Aid Special Tests & Provisions Subrecipient Monitoring

Finding 2025-001 Disbursement Notification Condition 25 students in a sample of 25 were not given notifications that met the required criteria. Students were notified of awards throughout the academic year, but notifications did not meet the required criteria. Additionally, the required information ...

Finding 2025-001 Disbursement Notification Condition 25 students in a sample of 25 were not given notifications that met the required criteria. Students were notified of awards throughout the academic year, but notifications did not meet the required criteria. Additionally, the required information on the timing and procedures for canceling loans was made available to students on the College’s website and financial aid office. The sample was not a statistically valid sample. Corrective Action Plan Corrective Action Planned: Upon identification a permanent, automated daily notification process has been successfully developed, tested, and implemented. Name(s) of Contact Person(s) Responsible for Corrective Action: Mark Badarraco, Executive Director of Enrollment Services and Information Systems Kyle Armstrong, Director of Financial Aid Anticipated Completion Date: 11/14/25 Polices & Procedures update was completed during FY26 Software training for existing staff will continue through FY26

View Audit 392563

Finding 1181256 (2025-010)

Material Weakness 2025

Commonwealth of Pennsylvania

PA

Internal Control / Segregation of Duties Subrecipient Monitoring Cash Management

The MatrixCare SOC2 report for 2025 was received on Friday February 6, 2026 and was reviewed by the Agency’s Information Technology (IT) Executive. The Agency’s Information Technology Executive/designee will educate the Information Technology Project Manager to request from Matrixcare on an annual b...

The MatrixCare SOC2 report for 2025 was received on Friday February 6, 2026 and was reviewed by the Agency’s Information Technology (IT) Executive. The Agency’s Information Technology Executive/designee will educate the Information Technology Project Manager to request from Matrixcare on an annual basis the SOC2 report and will review compliance criteria such as data security and confidentiality. An Agency Information Technology Resource Account will be developed for the SOC2 report/s to be sent to for review. Future contracts will request the vendor to automatically send SOC2 reports to the established IT Resource Account. Matrixcare security templates for Healthcare Record access have been updated by the Change Management Committee and activated by the Nurse Administrator-Technical for all users to ensure appropriate access. The Agency’s Human Resources Field Operations Manager/designee will educate the State Veterans Home (SVH) Human Resources Assistants of their responsibilities for on-boarding and off-boarding documentation for employee hires, classification changes and separations and of the DMVA’s Onboarding and Offboarding User Guides. The SVH Human Resource Analyst/designee will provide to the SVH Privacy Officer/designee all employee actions monthly to review for appropriate Healthcare Record access, the Bureau of Veterans Homes (BVH) Healthcare Record Management protocol will be updated to reflect this audit. The Agency’s Privacy Officer/designee will review 25% of all employee actions annually during each State Veterans’ Homes’ Facility Performance Assessment (FPA) to verify appropriate Healthcare Record access, the BVH FPA Protocol will be updated to reflect this audit. Anticipated Completion Date: 04/15/2026 Contact Name: Barbara L. Raymond, Director, Bureau of Veterans Homes

View Audit 392533

Finding 1181251 (2025-006)

Material Weakness 2025

Commonwealth of Pennsylvania

PA

Subrecipient Monitoring Significant Deficiency

The Pennsylvania Department of Agriculture, Bureau of Food Assistance is in the process of developing a procedure to ensure that a report of review findings is submitted to each eligible agency after their review. This procedure will also ensure that, if the review resulted in findings that require ...

The Pennsylvania Department of Agriculture, Bureau of Food Assistance is in the process of developing a procedure to ensure that a report of review findings is submitted to each eligible agency after their review. This procedure will also ensure that, if the review resulted in findings that require implementation of corrective actions, additional monitoring is conducted until the eligible agency has successfully taken actions to mitigate the deficiencies. Anticipated Completion Date: 09/30/2026 Contact Name: Caryn Long Earl, Director, Bureau of Food Assistance

View Audit 392533

Finding 1180982 (2025-003)

Material Weakness 2025

Bergen Community College

NJ

Special Tests & Provisions Student Financial Aid Significant Deficiency

Views of Responsible Officials: The College acknowledges the audit finding that Return of Title IV (R2T4) calculations were not accurately completed for nine of the sixty students sampled, and that Title IV funds were not returned timely for fifteen of the sixty students sampled. During the audit pe...

Views of Responsible Officials: The College acknowledges the audit finding that Return of Title IV (R2T4) calculations were not accurately completed for nine of the sixty students sampled, and that Title IV funds were not returned timely for fifteen of the sixty students sampled. During the audit period, R2T4 tracking and oversight processes were in transition, which resulted in insufficient monitoring of calculation accuracy and timeliness. In addition, for several end-of-term cases involving unofficial withdrawals, the institution could not initiate R2T4 calculation until final grades were posted and an unofficial withdrawal determination was made based on non-passing (F) grades, in accordance with federal regulations governing unofficial withdrawals. The Fall 2024 semester ended on December 21st. The college was closed for the winter break and reopened January 2, 2025. Therefore, the Date of Determination (DOD) was not two days after the end of the semester but in January with the earliest available processing date being January 2, 2025. Corrective Action: The College has implemented enhanced internal controls to ensure compliance with Return of Title IV (R2T4) requirements. Responsibility for monitoring R2T4 calculations and timeliness has been assigned to the Director of Financial Aid and Compliance. A R2T4 tracking log has been established and is reviewed on a weekly basis to ensure that all official withdrawals are identified and processed within the required regulatory timeframe. For unofficial withdrawals, R2T4 calculations are initiated after the end of term once final grades are posted and an unofficial withdrawal date of determination (DOD) is made based on non-passing (F) grades, consistent with federal regulations. End-of-term R2T4 reviews for the fall semester are conducted upon return from winter break after the New Year to ensure complete and accurate academic records are available. Internal staff have received additional training on R2T4 regulatory requirements, timelines, and documentation standards. To ensure operational continuity, a senior specialist has been trained to manage R2T4 processing in the Director's absence. These corrective actions will strengthen internal controls and ensure accurate and timely processing of R2T4 calculations.

View Audit 392509

Finding 1180978 (2025-002)

Material Weakness 2025

Bergen Community College

NJ

Special Tests & Provisions Student Financial Aid Reporting

Views of Responsible Officials: After consultation with the College’s Information Technology department, management determined that the file was processed and submitted on time. However, the NSLDS discrepancy resulted from a data processing issue during the March 2025 enrollment status download. Spe...

Views of Responsible Officials: After consultation with the College’s Information Technology department, management determined that the file was processed and submitted on time. However, the NSLDS discrepancy resulted from a data processing issue during the March 2025 enrollment status download. Specifically, while the NSLDS file was being generated, staff from another office were simultaneously accessing the same student records. These concurrent activities caused the affected students’ enrollment statuses to default to data from a prior download, resulting in incorrect reporting for the two records of the sixty examined. Corrective action: The College has revised its NSLDS data reporting process to prevent a recurrence of concurrent access. A static, saved population list is now used to generate NSLDS enrollment status downloads, eliminating conflicts caused by concurrent system access. This change ensures that enrollment status data is not impacted and remains consistent at the time of submission. Management believes this corrective action adequately addresses the identified issue, strengthens controls, mitigate this issue for future status change reports, and allows for accurate submission within the required 60-day timeframe.

View Audit 392509

Finding 1180972 (2025-012)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Internal Control / Segregation of Duties Special Tests & Provisions Significant Deficiency § 200.303

Corrective action plan: Long Term Care Regulation will enhance existing internal controls to ensure timely completion and distribution of Form 2567 to the providers. Implementation date: March 31, 2026 Responsible person: Michelle Dionne-Vahalik, Associate Commissioner, Long Term Care Regulations

View Audit 392506

Finding 1180968 (2025-011)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Internal Control / Segregation of Duties Special Tests & Provisions Subrecipient Monitoring § 200.303

Corrective action plan: HHS Information Security: • Has implemented a centralized governance process to ensure completion of all required biennial risk assessments. • Will establish and maintain oversight, validation, and escalation procedures for overdue assessments to ensure sustained adherence to...

Corrective action plan: HHS Information Security: • Has implemented a centralized governance process to ensure completion of all required biennial risk assessments. • Will establish and maintain oversight, validation, and escalation procedures for overdue assessments to ensure sustained adherence to federal and state requirements. • Will establish an inventory of systems to ensure information owners and custodians are assigned. • Will create an automated compliance dashboard to facilitate monthly reporting to executive leadership. • Will prioritize high-risk Medicaid systems, targeting completion within three months and achieving full compliance with Texas Administrative Code (TAC) 202 requirements within twelve months. The Deputy Chief Information Officers (DCIO) and Chief Product Officers for System Applications, Public Health Applications, and Texas Integrated Eligibility Redesign System (TIERS)/Medicaid Enterprise Systems (MES) will provide support and assistance to the program areas in creating Plan of Actions and Milestones and completing risk assessments for all systems provided in the executive report for their respective areas related to the audit. Implementation date: February 28, 2027 Responsible persons: Anil Koindala, Chief Information Security Officer Leatha Marr, DCIO and Chief Product Officer, System Applications Madhavi Koganti, DCIO and Chief Product Officer, Public Health Applications James Huang, DCIO and Chief Product Officer, TIERS/MES

View Audit 392506

Finding 1180959 (2025-022)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Subrecipient Monitoring Eligibility Internal Control / Segregation of Duties § 200.303

Corrective action plan: FDCM/OI has developed a comprehensive action plan to modernize and increase our detection of fraud in the child care program. Part of this modernization will include increased and more “real-time” monitoring of Board collection efforts. FDCM/OI is partnering with our Informat...

Corrective action plan: FDCM/OI has developed a comprehensive action plan to modernize and increase our detection of fraud in the child care program. Part of this modernization will include increased and more “real-time” monitoring of Board collection efforts. FDCM/OI is partnering with our Information, Innovation, and Insight Division (I3) to develop new dashboards and reports based upon weekly uploaded PIRTS data. This will allow FDCM/OI to generate weekly reports of Board collection letter non-compliance. If a Board fails to issue collection letters in a timely fashion, FDCM/OI will send a report to the Board Executive Director notifying them of non-compliance. Boards are also now required to have a Fraud Point of Contact (POC) that will be FDCM/OI’s direct liaison with the Board for all fraud matters. Additionally, FDCM/OI is conducting weekly PIRTS trainings throughout February for Boards. Boards have been asked to submit up to 5 fact finders who will be responsible for fraud case entry and management. The Board POC is ultimately responsible for every case. FDCM/OI is also reviewing our collection letters as a part of this process and generating prosecution referrals for cases which meet our criteria. It is our belief this will underscore the seriousness of the collection letters and increase their effectiveness. Finally, FDCM/OI will ensure that all relevant controlling documents, e.g. a new Workforce Development Letter, and all previous guidance is updated with this information. Implementation date: February 27, 2026 Responsible person: Jason Stalinsky, Division Director, Division of Fraud Deterrence and Compliance Monitoring.

View Audit 392506

Finding 1180919 (2025-004)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Matching / Level of Effort / Earmarking Allowable Costs / Cost Principles Cash Management § 200.303

Corrective action plan: HHSC will run quarterly expenditure reports for this grant to monitor administrative earmarking thresholds. Implementation date: July 31, 2026 Responsible person: Roderick Swan, Associate Commissioner, Behavioral Health Services Operations

View Audit 392506

Finding 1180912 (2025-007)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Reporting Significant Deficiency § 200.303

Corrective action plan: HHSC implemented a final review by all agencies who receive SSBG funding and all HHSC staff. In the future, the federal funds office will coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196 report are consistent with the amount o...

Corrective action plan: HHSC implemented a final review by all agencies who receive SSBG funding and all HHSC staff. In the future, the federal funds office will coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196 report are consistent with the amount on the Post Expenditure Report. Implementation date: March 30, 2026 Responsible person: Racheal Kane, Director, Federal Funds Office

View Audit 392506

Finding 1180910 (2025-001)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Subrecipient Monitoring Allowable Costs / Cost Principles Internal Control / Segregation of Duties § 200.303

Corrective action plan: ITS will: • Work with HR and Security to analyze and validate the size and scope of the late submission of access termination requests for separated employees. Communicate the analysis results and recommendations on or before May 1, 2026. • Work with the Information Security ...

Corrective action plan: ITS will: • Work with HR and Security to analyze and validate the size and scope of the late submission of access termination requests for separated employees. Communicate the analysis results and recommendations on or before May 1, 2026. • Work with the Information Security Office for continuation of periodic reconciliation of HR data and network accounts. Schedule for reconciliation to be established on or before May 1, 2026. • Work with Human Resources to establish a schedule of periodic reconciliation for HR data and case management application accounts. Schedule for reconciliation to be established on or before May 1, 2026. • Review existing business process for offboarding separated employees and provided recommendations to HR for training and communication for staff. Recommendations to be provided by May 1, 2026. • Determine what technology solution may be needed by August 31, 2026, with consideration of effectiveness of mitigation actions, as noted above. Implementation dates: See Corrective action plan Responsible person: Angie Lindemann, Deputy Chief Information Officer

View Audit 392506

Finding 1180909 (2025-018)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Reporting Internal Control / Segregation of Duties Subrecipient Monitoring § 200.303

Corrective action plan: Program staff will ensure that a formal review by the Team Lead and the Manager of Fiscal and Reporting is completed prior to submission. The Team Lead will initiate the process by obtaining the obligation amount from the LIHEAP Contract Specialist and entering the amount int...

Corrective action plan: Program staff will ensure that a formal review by the Team Lead and the Manager of Fiscal and Reporting is completed prior to submission. The Team Lead will initiate the process by obtaining the obligation amount from the LIHEAP Contract Specialist and entering the amount into the quarterly report. The Manager of Fiscal and Reporting will review and confirm the amount to be submitted. Implementation date: April 30, 2026 Responsible persons: Michael De Young, Director of Community Affairs Cathy Jung, Senior Manager of Finance and Reporting

View Audit 392506

Finding 1180907 (2025-017)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Cash Management Significant Deficiency Internal Control / Segregation of Duties § 200.303

Corrective action plan: The Department will enhance current procedures for the compilation and review of the Period 1 clearance pattern calculation in accordance with the Cash Management Improvement Act (CMIA) and as required in the Texas-State Agreement. The Manager of Accounting will use the State...

Corrective action plan: The Department will enhance current procedures for the compilation and review of the Period 1 clearance pattern calculation in accordance with the Cash Management Improvement Act (CMIA) and as required in the Texas-State Agreement. The Manager of Accounting will use the State Auditor Office’s template spreadsheet provided to agencies to calculate their annual Period 1 calculation and retain the worksheet as supporting documentation. The Director of Financial Administration will review the spreadsheet and calculation prior to CMIA certification. Implementation date: August 2026 Responsible persons: Jose Guevara, Director of Financial Administration Cristina Ortega, Manager of Accounting.

View Audit 392506

Finding 1180905 (2025-021)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Reporting Special Tests & Provisions Significant Deficiency § 200.303

Corrective action plan: Vendor System Safeguards: TWC's I3 (Department of Analytics & Evaluation), IT (Information Technology), and WFA (Workforce Automation) resources will require our WorkInTexas.com vendor, Geographic Solutions Inc (GSI), to implement additional system safeguards to prevent the d...

Corrective action plan: Vendor System Safeguards: TWC's I3 (Department of Analytics & Evaluation), IT (Information Technology), and WFA (Workforce Automation) resources will require our WorkInTexas.com vendor, Geographic Solutions Inc (GSI), to implement additional system safeguards to prevent the duplication of hour entries when extracting data from the WIT system and creating files. TWC resources will maintain oversight of the implementation and ongoing effectiveness of these safeguards. Joint Anomaly Detection: TWC's I3 (Department of Analytics & Evaluation), IT (Information Technology), and WFA (Workforce Automation) resources will require our WorkInTexas.com vendor, Geographic Solutions Inc (GSI), to establish automated validation checks to identify anomalies such as duplicate lines, unexpected variances, and irregular hour totals prior to ingesting vendor files into TWC systems. TWC resources will maintain oversight of the implementation and ongoing effectiveness of these validation checks. TWC IT Data Reconciliation: TWC IT (Information Technology) will enhance supervisory review vendor procedures to reconcile data received from third-party vendors against source records, verifying completeness and accuracy before supplying to I3 (Department of Analytics & Evaluation) for inclusion in federal reporting. Implementation date: December 31, 2026 Responsible persons: Greg Waugh, Director, Workforce Automation (WFA), TWC Richard Yashewski, Director, IT Maintenance & Operations, TWC Geoffrey Miller, Director, Department of Analytics & Evaluation (I3), TWC

View Audit 392506

Finding 1180899 (2025-010)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Special Tests & Provisions Subrecipient Monitoring Eligibility § 200.303

Corrective action plan: HHSC will conduct an end-to-end review of the sanctions process to identify and implement any needed changes to the business process, training, or system. Implementation date: May 31, 2026 Responsible person: Carrie Robertson, Manager, Strategy and Innovation–Business Integra...

Corrective action plan: HHSC will conduct an end-to-end review of the sanctions process to identify and implement any needed changes to the business process, training, or system. Implementation date: May 31, 2026 Responsible person: Carrie Robertson, Manager, Strategy and Innovation–Business Integration and Support

View Audit 392506

Finding 1180893 (2025-008)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Reporting Significant Deficiency Internal Control / Segregation of Duties § 200.302 § 200.303 § 200.329

Corrective action plan: HHSC has taken steps to improve the consistency and reliability of financial reporting related to Maintenance of Effort (MOE) expenditures, specifically, amounts reported on the ACF 204, submitted by HHSC Budget and the ACF 196R, submitted by HHSC Federal Reporting (FR). To a...

Corrective action plan: HHSC has taken steps to improve the consistency and reliability of financial reporting related to Maintenance of Effort (MOE) expenditures, specifically, amounts reported on the ACF 204, submitted by HHSC Budget and the ACF 196R, submitted by HHSC Federal Reporting (FR). To address potential discrepancies and strengthen internal controls, HHSC Federal Reporting has implemented and documented a formal reconciliation process. This process involves the following key components: • Implementation and documentation of a formal reconciliation process that compares all MOE expenditures for HHSC, TEA, and TWC reported on the ACF 204 to those reported on the ACF 196R before report submission. The process outlines specific steps for data cross-referencing and validation to ensure completeness and accuracy. • Research, resolve, and correct any discrepancies identified during the reconciliation process before the reports are finalized and submitted for management review. • Reinforcement of management review and documentation of the reconciliation between the ACF-204 and ACF-196R will be incorporated into the approval process prior to report certification. Implementation date: February 28, 2026 Responsible person: Alan Flynn, Manager, Federal Reporting

View Audit 392506

Finding 1180876 (2025-002)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Allowable Costs / Cost Principles Internal Control / Segregation of Duties Subrecipient Monitoring § 200.303

Corrective action plan: ITS Management will establish a formal, documented user access review program applicable to both privileged and non-privileged network users. Key actions include: 1. Policy Updates: Revise information technology access control policies and procedures to re-quire periodic (at ...

Corrective action plan: ITS Management will establish a formal, documented user access review program applicable to both privileged and non-privileged network users. Key actions include: 1. Policy Updates: Revise information technology access control policies and procedures to re-quire periodic (at least annual) reviews of all network user access. 2. Standardized Process and Documentation: Implement a consistent, documented review process and maintain records in a centralized repository to ensure accountability and auditability. 3. Monitoring and Oversight: Implement oversight procedures to track completion of access re-views and remediation of identified issues, with reporting to IT and information security leadership to support governance. Implementation dates: 1. Policy and procedure updates: Expected completion by April 30, 2026 2. Standardized process and repository implementation: Expected completion by May 31, 2026 3. First completed annual review under the revised process: Expected completion by June 30, 2026 Responsible persons: Tara Mitchell, Director of IT Operations Sean Peterson, Chief Information Officer

View Audit 392506

Finding 1180872 (2025-016)

Material Weakness 2025

State of Texas C/o Comptroller of Public Accounts

TX

Procurement, Suspension & Debarment Subrecipient Monitoring Allowable Costs / Cost Principles § 200.303

Corrective action plan: • IT will coordinate with HR on strengthening the separation process, to include HR running separation reports quarterly and sending to IT to cross check. Will perform regular scheduled meetings to discuss the separation process/issues. • IT is testing automatic scripts that ...

Corrective action plan: • IT will coordinate with HR on strengthening the separation process, to include HR running separation reports quarterly and sending to IT to cross check. Will perform regular scheduled meetings to discuss the separation process/issues. • IT is testing automatic scripts that will aid in the process and will be implemented this year. • IT will document quarterly access reviews which are already done. • IT will work on enhancing automation and controls; Will utilize AI to assist. Implementation date: May 2026 Responsible person: Chris Bunton, CIO, Texas Department of Agriculture

View Audit 392506

Finding 1180855 (2025-001)

Material Weakness 2025

Catawba County, North Carolina

NC

Significant Deficiency Internal Control / Segregation of Duties

Finding: 2025-001 Name of Contact Person: Karen Harrington, DSS Director Corrective Action/Management’s Response: Agency agrees with finding. Corrective Action taken/to be taken below: Corrective Action: The Department will strengthen internal controls related to workstation security to prevent unat...

Finding: 2025-001 Name of Contact Person: Karen Harrington, DSS Director Corrective Action/Management’s Response: Agency agrees with finding. Corrective Action taken/to be taken below: Corrective Action: The Department will strengthen internal controls related to workstation security to prevent unattended access to state systems. Effective immediately, all DSS employees with access to state eligibility systems are required to lock their workstation when away from their desk or log out of the system entirely. Implementation Steps: 1. Policy Reinforcement: DSS management will reissue written guidance to all staff reminding them of the requirement to lock or log out of workstations when unattended, consistent with the DSS Fiscal Manual and county IT security standards. 2. Mandatory Staff Acknowledgment: All DSS employees with state system access will complete a brief acknowledgment confirming understanding of workstation security requirements. 3. IT Controls: In coordination with the County IT Department, automatic screen-lock settings will be verified on all DSS workstations accessing state systems. 4. Monitoring and Verification: Supervisors will conduct periodic unannounced walkthroughs to verify compliance with workstation security requirements. Results will be documented and reviewed by DSS management. 5. Corrective Follow-Up: Any noncompliance identified will be addressed promptly through retraining and, if necessary, progressive disciplinary action. Responsible Party: DSS Director, DSS Program Managers, and County DSS Staff Anticipated Completion Date: Immediately upon issuance of this CAP; monitoring will be ongoing. Plan to Prevent Recurrence: Ongoing supervisory monitoring, documented compliance checks, and annual refresher training will be used to ensure continued adherence to workstation security requirements.

View Audit 392499

Finding 1180736 (2025-002)

Material Weakness 2025

Westminster College

MO

Student Financial Aid Reporting Significant Deficiency

Westminster College Corrective Action Plan (CAP) Federal Program: SFA Cluster, Finding 2025-002: Policies and Procedures Related to Withdrawals (significant deficiency) In accordance with 34 CFR 668-22 Treatment of Title IV Funds When a Student Withdrawals, Westminster College has implemented the fo...

Westminster College Corrective Action Plan (CAP) Federal Program: SFA Cluster, Finding 2025-002: Policies and Procedures Related to Withdrawals (significant deficiency) In accordance with 34 CFR 668-22 Treatment of Title IV Funds When a Student Withdrawals, Westminster College has implemented the following Corrective Action Plan: Name of Contact Person: Dr. Annette Roberts, Assistant Dean of Institutional Research and Registrar Specific Corrective Action: Management has developed written policies and procedures to document the steps put in place to ensure that changes in student status are reported in a timely manner. A critical excerpt from that language is included below: After receiving post-notification from EIPC, the Registrar contacts faculty to confirm the student’s last date of attendance. Using this information, the Registrar determines the withdrawal date, exit date, and records these in Jenzabar. The Registrar then notifies Financial Aid, the Business Office, Institutional Research, Residence Life, Advancement, and IT/Help Desk. Institutional Research subsequently pulls the data from Jenzabar and cross references it with the notifications from these offices, once verified. Institutional Research submits the finalized data to the National Student Clearinghouse. Anticipated Completion Date: The Corrective Action Plan

View Audit 392416

Finding 1180710 (2025-002)

Material Weakness 2025

National University of Natural Medicine

OR

Student Financial Aid Subrecipient Monitoring Allowable Costs / Cost Principles § 200.516

Finding 2025-002 Reporting Department’s Response: Management agrees with this finding. Corrective Action: This issue arose during the onboarding of students admitted through a teach-out arrangement with a closing institution. Because these students entered under program structures that differed from...

Finding 2025-002 Reporting Department’s Response: Management agrees with this finding. Corrective Action: This issue arose during the onboarding of students admitted through a teach-out arrangement with a closing institution. Because these students entered under program structures that differed from NUNM’s standard enrollment models, some of the information initially received did not align with NUNM’s financial aid packaging assumptions. In two cases, cost of attendance calculations reflected full-time status when the program design required three-quarter-time treatment. While the situation was limited to a small number of students within a unique population, management recognizes that our internal coordination processes did not sufficiently account for the complexity of the teach-out transition. In particular, clearer confirmation of enrollment status and program structure should have occurred before aid was packaged and originated. Management is strengthening procedures for any future teach-out, transfer, or non-standard admissions cohorts to ensure accurate and compliant packaging from the outset. Going forward, NUNM will implement the following controls: • A standardized handoff process from Admissions to Financial Aid for special populations that documents program structure, term length, and expected enrollment level prior to packaging. • A secondary review requirement for initial aid awards for new program types or cohorts before loans are originated. • Regular cross-functional checkpoints between Admissions and Financial Aid during the setup of non-standard programs. Management views this experience as an opportunity to improve coordination and compliance during periods of institutional transition and is committed to maintaining strong controls over Title IV packaging and cost of attendance calculations. Contact: Jerry Bores Anticipated Completion Date: Immediately

View Audit 392354

Finding 1180655 (2025-003)

Material Weakness 2025

Ascentria Community Services, Inc.

MA

Significant Deficiency Internal Control / Segregation of Duties

U.S. Department of Health and Human Services U.S. Refugee Admissions Program - Assistance Listing No. 19.510 Recommendation: It is recommended that the Organization review controls in place to ensure payroll expenses are approved and maintain evidence of approval. Explanation of disagreement with au...

U.S. Department of Health and Human Services U.S. Refugee Admissions Program - Assistance Listing No. 19.510 Recommendation: It is recommended that the Organization review controls in place to ensure payroll expenses are approved and maintain evidence of approval. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Management is reviewing standard operating procedures with the program staff. All expenses will be supported with proper approvals. Management will perform periodic reviews to ensure expenses have evidence of approval. Name(s) of the contact person(s) responsible for corrective action: Christopher Paris, Senior Director of Finance Planned completion date for corrective action plan: June 30, 2025 and Ongoing

View Audit 392325

Corrective Action Plans

Filters