Corrective Action Plans

Finding 1179216 (2025-001)

Material Weakness 2025

Local Area of the Workforce Development in the Northeast

PR

Matching / Level of Effort / Earmarking Subrecipient Monitoring Period of Performance

VIEWS OF RESPONSIBLE OFFICIALS As part of our outreach initiatives, we have partnered with other agencies and organizations while creating events that maximize our resources. On February 12, 2026, the Local Area held a regional youth-centered fair that took place at the Tomás Dones Coliseaum, impact...

VIEWS OF RESPONSIBLE OFFICIALS As part of our outreach initiatives, we have partnered with other agencies and organizations while creating events that maximize our resources. On February 12, 2026, the Local Area held a regional youth-centered fair that took place at the Tomás Dones Coliseaum, impacting over 600 individuals, both in school and out of school. Our Local Board, as part of their efforts, also approved the implementation of smaller educational fairs brought to every town focused on their in school and out school individuals and their specific needs and challenges. IMPLEMENTATION DATE June 2027 RESPONSIBLE PERSONS Executive Director Director of Programmatic Services Title I-B Director

View Audit 391604

Finding 1179213 (2025-001)

Material Weakness 2025

Show Low Unified School District No. 10

AZ

Cash Management Reporting School Nutrition Programs § 200.303

The District acknowledges the finding regarding inaccuracies in meal counts reported for the Child Nutrition Program reimbursement claims. To address this issue, the District will strengthen internal controls over the meal count reporting and claim preparation process. The food service department wi...

The District acknowledges the finding regarding inaccuracies in meal counts reported for the Child Nutrition Program reimbursement claims. To address this issue, the District will strengthen internal controls over the meal count reporting and claim preparation process. The food service department will ensure that daily meal count documentation is properly maintained and reconciled to the monthly claim totals prior to submission. In addition, the Director of Business Operations will implement a formal management review process prior to submission of each monthly claim for reimbursement to the Arizona Department of Education. This review will include verification that reported meal counts agree to supporting documentation and that all reconciliations have been completed and documented. Any discrepancies identified during the review will be investigated and corrected before the claim is submitted. These procedures will provide additional oversight and help ensure the District maintains compliance with federal regulations and the reporting requirements of the Child Nutrition Program. The Director of Business Operations is responsible for implementing and monitoring this correction action, which will be completed at the end of the next fiscal year.

View Audit 391596

Finding 1179165 (2025-003)

Material Weakness 2025

Edcouch-Elsa Independent School District

TX

Allowable Costs / Cost Principles Cash Management Significant Deficiency § 200.403

Finding 2025-003 Duplicate expenditures charged to same grant Recommendation: We recommend the District establish and maintain proper review procedures for expenditures charged to grants prior to submission for reimbursement. Management’s View: The District will strengthen internal controls over pay...

Finding 2025-003 Duplicate expenditures charged to same grant Recommendation: We recommend the District establish and maintain proper review procedures for expenditures charged to grants prior to submission for reimbursement. Management’s View: The District will strengthen internal controls over payroll expenditures charged to federal grants by implementing a standard operating procedure that will be conducted by the Payroll Specialist of verifying payroll distribution reports, funding codes, and supporting documentation prior to submission for payment. Before each payroll is finalized, the payroll specialist will run a payroll report that will be generated and sorted by employee to verify that no duplicate charges have been applied to the same grant within the same payroll period. This review will ensure that all costs charged to federal grants during the pay period are accurate, allowable, properly coded, and not duplicated. No payroll adjustments will be keyed until timesheets have been verified against previously submitted timesheets and that they are reviewed to confirm that prior entries have not already been charged to the same grant. Additionally, a secondary review by the accountant will be conducted prior to finalizing grant-related payrolls. Effective March 1, 2026, the Payroll Accountant and Chief Financial Officer will review grant-related payroll transactions to ensure accuracy, proper funding allocation, and compliance with applicable federal requirements. Effective Date: March 1, 2026 Contact Person: Sylvia Garza, Chief Financial Officer, Edcouch-Elsa Independent School District

View Audit 391552

Finding 1179163 (2025-003)

Material Weakness 2025

Southern California University of Health Sciences

CA

Student Financial Aid Eligibility Significant Deficiency

Eligibility Student Financial Assistance Cluster – Assistance Listing No. 84.063, 84.033, 84.268, 84.007 Recommendation: We recommend the University review its procedures to ensure that title IV funds is awarded correctly. Explanation of disagreement with audit finding: There is no disagreement with...

Eligibility Student Financial Assistance Cluster – Assistance Listing No. 84.063, 84.033, 84.268, 84.007 Recommendation: We recommend the University review its procedures to ensure that title IV funds is awarded correctly. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Pell Grant awards are reviewed prior to each disbursement. SCU has strengthened this control to ensure award amounts are adjusted to accurately reflect each student’s enrollment intensity at the time of disbursement. This review is documented and completed by the Director of Financial Aid before funds are released to ensure compliance with federal requirements. Name(s) of the contact person(s) responsible for corrective action: Laney Morales, Director of Financial Aid Planned completion date for corrective action plan: 12/1/2025

View Audit 391545

Finding 1179159 (2025-002)

Material Weakness 2025

Southern California University of Health Sciences

CA

Student Financial Aid Significant Deficiency Internal Control / Segregation of Duties

Return of Title IV (R2T4) Returning of Funds Student Financial Assistance Cluster – Assistance Listing No. 84.063, 84.033, 84.268, 84.007 Recommendation: We recommend the University review its procedures to ensure that title IV funds required to be returned are done within 45 days after the date of ...

Return of Title IV (R2T4) Returning of Funds Student Financial Assistance Cluster – Assistance Listing No. 84.063, 84.033, 84.268, 84.007 Recommendation: We recommend the University review its procedures to ensure that title IV funds required to be returned are done within 45 days after the date of the institution's determination that the student withdrew. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The existing Return of Title IV (R2T4) process was evaluated, and an additional oversight control was implemented to ensure timely returns of funds. All R2T4 calculations are reviewed weekly by the Assistant Director of Financial Aid. During this standing review, the return process is initiated through Jenzabar Financial Aid and confirmed on Common Origination and Disbursement (COD). This control provides documented oversight and ensures returns are completed within required timeframes, mitigating the risk of delays or batch processing errors. Name(s) of the contact person(s) responsible for corrective action: Janeth Chaidez, Assistant Director of Financial Aid. Planned completion date for corrective action plan: 12/1/2025

View Audit 391545

Finding 1179155 (2025-001)

Material Weakness 2025

Southern California University of Health Sciences

CA

Student Financial Aid Reporting Significant Deficiency

NSLDS Enrollment Reporting Student Financial Assistance Cluster – Assistance Listing No. 84.063, 84.033, 84.268, 84.007 Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulat...

NSLDS Enrollment Reporting Student Financial Assistance Cluster – Assistance Listing No. 84.063, 84.033, 84.268, 84.007 Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: A complete review of CIP code usage will be reviewed and ensure that there is alignment across academics, registrar, and financial aid. The last review was done in 2024 but with changes alignment fell out of sync. We are also working with our SIS vendor, Jenzabar, to continue to identify areas where the SIS is out of sync with compliance and how best to e􀆯ectively address them if it is a data issue or an issue with internal SIS logic. We are also actively engaging with the National Student Clearinghouse to identify issues and clean them up proactively. Registrar updated internal processes to ensure enrollment status reporting aligns with NSLDS guidance by using the Date of Determination (DOD), rather than the graduation or term end date, as the exit date for graduates. This approach is consistent with federal guidance and has been implemented. Name(s) of the contact person(s) responsible for corrective action: Robert Boggs, EdD, University Registrar Planned completion date for corrective action plan: 3/6/2026 for the CIP audit; 8/31/2026 for SIS and NSC; internal process changes are complete.

View Audit 391545

Finding 1179060 (2025-001)

Material Weakness 2025

New Jersey Association on Correction and Morrow Holding Corporation

NJ

HUD Housing Programs Reporting Significant Deficiency

Finding Description: Per the VOCA contract, the grantee is required to submit quarterly fiscal and programmatic reports by the 15th calendar day of the month following the end of the quarter to the State of NJ. Testing of the compliance requirement indicated that several reports were not submitted t...

Finding Description: Per the VOCA contract, the grantee is required to submit quarterly fiscal and programmatic reports by the 15th calendar day of the month following the end of the quarter to the State of NJ. Testing of the compliance requirement indicated that several reports were not submitted timely. Corrective Action and Method of Implementation: The Organization is currently in a transition phase and plans to reorganize job duties and adjust staffing within the Finance Department to support the preparation and timely submission of quarterly fiscal and programmatic reports. These delays resulted from postponed contract approvals by the contracting entity, as well as staff turnover, which affected the timely filing of complete and accurate reports. Name of Responsible Person: Diane Hobbs, Chief Financial Officer Anticipated Completion Date: June 2026

View Audit 391493

Finding 1179021 (2025-001)

Material Weakness 2025

Heading Home

NM

Allowable Costs / Cost Principles Reporting Significant Deficiency

Heading Home management is in agreement with this finding. After years of turnover in key management positions steps have been taken to address staffing challenges and these positions have been successfully staffed with high-quality individuals who bring extensive knowledge and expertise to their ro...

Heading Home management is in agreement with this finding. After years of turnover in key management positions steps have been taken to address staffing challenges and these positions have been successfully staffed with high-quality individuals who bring extensive knowledge and expertise to their roles. These positions include a new Chief Executive Officer, Director of Operations, Chief Financial Officer, and Director of Human Resources. To address challenges in accounting and finance Heading Home had contracted with a local CPA firm specializing in nonprofit accounting and financial reporting to assist the CFO with daily accounting tasks, the monthly close, financial reporting to management and the board of directors, and to facilitate and ensure audits are completed timely each year. The new management group is committed to maintaining a skilled and competent team in key financial roles. Due to the backlog of billings at the opening of FY24, the quarterly reports for the first quarter were submitted late. With the new staff and assistance, these billings and quarterly reports were brought current as quickly as possible. They are now current and being submitted in a timely manner. Management’s corrective action plan was fully implemented by June 30, 2025, and anticipate that there will be no further issues. Personnel responsible for ensuring implementation include Connie Chavez, Chief Executive Officer, and Debbie Brickman, Chief Financial Officer.

View Audit 391445

Finding 1179008 (2025-005)

Material Weakness 2025

Howard Community College

MD

Special Tests & Provisions Student Financial Aid Reporting § 200.303

U.S. Department of Education 2025-005: Special Tests and Provisions - NSLDS Enrollment Reporting Student Financial Aid Cluster -Assistance Listing No. 84.063, 84.268 Condition: Enrollment status changes were either not reported to NSLDS within 60 days or did not match the College's records for a por...

U.S. Department of Education 2025-005: Special Tests and Provisions - NSLDS Enrollment Reporting Student Financial Aid Cluster -Assistance Listing No. 84.063, 84.268 Condition: Enrollment status changes were either not reported to NSLDS within 60 days or did not match the College's records for a portion of the sampled students. Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Explanation of disagreement with audit finding : There is no disagreement with the audit finding. The Institution acknowledges that while reporting was completed within a timely manner by HCC, NSC did not update within the time allotted to be compliant. HCC remains committed to continuous improvement and compliance. Action taken in response to finding: As noted in the prior year's response, the College committed to full implementation of corrective actions by June 30, 2026, aligned with the conclusion of the 2025-2026 academic year. The institution is currently and actively working on the corrective action plan previously submitted. Actions underway or in progress include: Formal clarification of interdepartmental roles and responsibilities, establishing the Records, Registration and Veteran's Affairs (RRVA) as the primary enrollment reporting authority, with defined review and compliance support from Financial Aid Services. Enhanced reconciliation and quality control procedures, including routine cross-checks between RRVA and Financial Aid Services records prior to each enrollment reporting submission. Standardized review protocols for program-level enrollment changes, including graduates, withdrawals, and subsequent reenrollments in different academic programs. Ongoing monitoring and documentation of NSC errors and warning reports, with timely resolution and escalation when discrepancies appear to originate outside of the College's student information systems. Targeted training for RRVA and Financial Aid staff on enrollment reporting regulations, NSLDS requirements, and audit-risk mitigation. The College believes these actions, coupled with existing reporting practices, sufficiently address the concerns raised and will further strengthen enrollment reporting accuracy and documentation. Full implementation of the corrective action plan remains on schedule for completion by June 30, 2026, as originally committed. Name(s) of the contact person(s) responsible for corrective action: Detra Hooper, Financial Aid Director and Jessica Peterson, Registrar Planned completion date for corrective action plan: June 30, 2026 If the U.S. Department of Education has questions regarding this plan, please call Detra Hooper, Financial Aid Servies Director at 443-518-4776.

View Audit 391418

Finding 1177932 (2025-002)

Material Weakness 2025

Ravalli Head Start, Inc.

UT

Procurement, Suspension & Debarment Significant Deficiency

Regarding 2025-002 Transaction Approvals, CFO Jill Hansen and Executive Director Michele Craig submitted corrective action in last year’s response to the significant deficiency Expense Approval Documentation 2024-002 on 1/22/25, which included an internal audit of all financial transactions and an e...

Regarding 2025-002 Transaction Approvals, CFO Jill Hansen and Executive Director Michele Craig submitted corrective action in last year’s response to the significant deficiency Expense Approval Documentation 2024-002 on 1/22/25, which included an internal audit of all financial transactions and an evaluation of the reasonableness of the approvals in the current policy. At the time of the audit and proposed corrective action, we were already 5 months into the new fiscal year, and those transactions had already occurred so we were aware of potential findings. The specific 2025 findings include the timeliness of supervisor approval, the lack of supervisor approval, and the timeliness of the executive director approval of journal entries. For the timeliness of supervisor approval these systems are already in place based on last year’s corrective action. Regarding the lack of supervisor approval, managers and fiscal staff will have refresher training on the approvals needed for credit card claims which will be addressed at our next Managers’ Meeting on March 31, 2026. Additionally, the CFO now reconciles the credit card statements and reviews all associated claim forms. Regarding the executive director approval of journal entries, the CFO will obtain executive director approval and signatures on all journal entries before publishing financial statements. This step has been added to the month-end checklist. All corrective action will be implemented by April 30, 2026. The Executive Director, Michele Craig will be responsible for implementing the corrective action.

View Audit 391315

Finding 1177931 (2025-001)

Material Weakness 2025

Ravalli Head Start, Inc.

UT

Reporting Significant Deficiency

Re: 2025-001 Filing and Accuracy of the SF-425 & 2025-002 Transaction Approvals The senior management team including the Executive Director Michele Craig, CFO Jill Hansen, and the Finance Committee of the Governing Board have reviewed and agree with the audit findings. Regarding the 2025-001 Filing ...

Re: 2025-001 Filing and Accuracy of the SF-425 & 2025-002 Transaction Approvals The senior management team including the Executive Director Michele Craig, CFO Jill Hansen, and the Finance Committee of the Governing Board have reviewed and agree with the audit findings. Regarding the 2025-001 Filing and Accuracy of the SF 425, in order to file the semi-annual SF 425 that was due on 1/30/25 for the period of 7/1/24-12/31/24 we needed to have closed accounting periods with accurate financial statements. When our CFO Jill Hansen began in early December 2024, the last month that had been closed was September 2024 due to the resignation of both the accounting tech and the CFO. It took several months to accurately close and update financial records. We now have a checklist of month-end tasks that ensures the generation of accurate and on time financial statements. These tasks and deadlines are incorporated in the fiscal calendar that will be reviewed with the Finance Committee each month. We successfully submitted the most recent semiannual SF 425 on time and will meet the next SF 425 deadline, October, 2026. The above corrective actions have been incorporated and this issue has been corrected.

View Audit 391315

Finding 1177913 (2025-094)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Subrecipient Monitoring Significant Deficiency § 200.303

Responsible Person(s): Chaye Neal-Jones, Director of Office of Enterprise Management Services; Eric Billings, Director of Grants Management Corrective Action Planned: Staff is working with DBHDS IT to ensure that ticketing workflow includes managerial approval. Additionally, system administrators ar...

Responsible Person(s): Chaye Neal-Jones, Director of Office of Enterprise Management Services; Eric Billings, Director of Grants Management Corrective Action Planned: Staff is working with DBHDS IT to ensure that ticketing workflow includes managerial approval. Additionally, system administrators are removing individuals from the system when they receive HR notification of their separation from the agency via email and the system automatically disables inactive accounts after 60 days. DBHDS is still working to develop a process for periodically reviewing the appropriateness of system users access and the activity of system administrators within the system. Estimated Completion Date: 7/1/2026

View Audit 391258

Finding 1177912 (2025-026)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Subrecipient Monitoring Reporting

Responsible Person(s): Eric Billings, Director of Grants Management; Chaye Neal-Jones, Director of Office of Enterprise Management Services Corrective Action Planned: DBHDS identified that CSB subaward information was not being captured within the system's reports. Responsible staff are now entering...

Responsible Person(s): Eric Billings, Director of Grants Management; Chaye Neal-Jones, Director of Office of Enterprise Management Services Corrective Action Planned: DBHDS identified that CSB subaward information was not being captured within the system's reports. Responsible staff are now entering the executed date for CSB subawards which is being picked up by the report. Documents with an inception date of July 1, 2025, within the system have been updated to reflect the correct executed date. DBHDS staff are still working with the vendor to ensure that the report is working correctly. Estimated Completion Date: 4/1/2026

View Audit 391258

Finding 1177909 (2025-101)

Material Weakness 2025

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE ...

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 6/15/2026

View Audit 391258

Finding 1177908 (2025-100)

Material Weakness 2025

Commonwealth of Virginia

VA

Eligibility Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; David Carico, Business Operations Manager Corrective Action Planned: Below is the narrative for CR901 and CR902 Records Retention, including current production deployment timelines. CR901 establishes the datab...

Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; David Carico, Business Operations Manager Corrective Action Planned: Below is the narrative for CR901 and CR902 Records Retention, including current production deployment timelines. CR901 establishes the database infrastructure required to support compliant records retention within case management system. This includes partition creation across 75 plus high volume tables to enable structured aging and controlled purge activity aligned to retention thresholds. Production Deployment Timeline; scheduled as part of the February 2026 technical release. This phase is foundational and will be completed before purge logic can safely execute. CR902 Retention Logic and controlled execution; CR902 operationalizes the records retention policy by implementing controlled purge jobs leveraging the partitioning framework established in CR901. This Change Request moves the solution from infrastructure readiness to active lifecycle management. Phase 1 Database partition creation (February 2026 production release schedule) Phase 2 Controlled purge implementation (March 2026 release schedule) Phase 3 Validation, audit confirmation, and reporting controls (April 2026 release schedule) Phase 4 Reoccurring operational retention cycles with documented runbooks (ongoing/living) Estimated Completion Date: 4/30/2026

View Audit 391258

Finding 1177907 (2025-093)

Material Weakness 2025

Commonwealth of Virginia

VA

Eligibility Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; Lunita Browder-Harris, Business Operation Specialist, Business Operations Corrective Action Planned: DSS has identified critical or conflicting roles in the management system. The roles in scope have the capab...

Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; Lunita Browder-Harris, Business Operation Specialist, Business Operations Corrective Action Planned: DSS has identified critical or conflicting roles in the management system. The roles in scope have the capability to perform all actions within the system, including inputting applications, determining eligibility, and authorizing benefits. DSS is in the process of implementing a procedure for reviewing and revoking conflicting roles ands privileges for all localities. DSS will work with APA to ensure adequate separation of duties is implemented within the eligibility system. Estimated Completion Date: 6/30/2026

View Audit 391258

Finding 1177906 (2025-085)

Material Weakness 2025

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS has contracted with two vendors to perform external IT Audits over sensitive systems. DSS is able to completed between 25-35 IT au...

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS has contracted with two vendors to perform external IT Audits over sensitive systems. DSS is able to completed between 25-35 IT audits out of their 89 sensitive systems per year. DSS expects all IT systems will be audited by the end of 2027. A set of 31 IT Audits will be completed March 30, 2026. Estimated Completion Date: 12/31/2027

View Audit 391258

Finding 1177905 (2025-084)

Material Weakness 2025

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE ...

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 5/29/2026

View Audit 391258

Finding 1177904 (2025-068)

Material Weakness 2025

Commonwealth of Virginia

VA

Reporting Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awardin...

Responsible Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 6/30/2026

View Audit 391258

Finding 1177902 (2025-052)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Significant Deficiency § 200.303

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS is establishing the processes and supporting system resources to ensure that DSS has an effective and compliant change management process. These ...

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS is establishing the processes and supporting system resources to ensure that DSS has an effective and compliant change management process. These include: completion of migrating all application to a single repository which enables change tracking and version control in development projects; use of workflows in the system to enforce delivery of required artifacts prior to change submission; changes to the Change Advisory Board process, and post-change processes to validate meeting the acceptance criteria. Estimated Completion Date: 4/30/2026

View Audit 391258

Finding 1177901 (2025-051)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Significant Deficiency § 200.303

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE ...

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 3/9/2026

View Audit 391258

Finding 1177900 (2025-050)

Material Weakness 2025

Commonwealth of Virginia

VA

Subrecipient Monitoring Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk management Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective act...

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk management Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 12/30/2028

View Audit 391258

Finding 1177899 (2025-049)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Significant Deficiency § 200.303

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management; Steve McCauley, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS Information Security and Risk Management is reconcili...

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management; Steve McCauley, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS Information Security and Risk Management is reconciling the system to identify security roles for each sensitive system. Estimated Completion Date: 6/30/2026

View Audit 391258

Finding 1177898 (2025-048)

Material Weakness 2025

Commonwealth of Virginia

VA

Reporting Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS will follow the direction of the IAG Team to improve compliance with the security standard. IAG has created a new roadmap for remediation of rela...

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS will follow the direction of the IAG Team to improve compliance with the security standard. IAG has created a new roadmap for remediation of related IT security and governance findings, and the IAG director is working with the CTO, CISO and TSD leadership on defining concrete plans for remediation of all related findings. The IAG director, the CTO and the TSD leadership continue to implement and refine the division-wide process to ensure sufficient resources are available and dedicated to prioritizing and implementing the planned IT governance structure changes. Roadmap review sessions are scheduled. Remediation working sessions are in process of being scheduled. Estimated Completion Date: 3/27/2026

View Audit 391258

Finding 1177897 (2025-043)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Subrecipient Monitoring Reporting § 200.303

Responsible Person(s): Steve Hanoka, Information Security Officer Corrective Action Planned: DMAS has started confirming the geographic location for sensitive data monthly and the vulnerability scans every 90 days for the one provider Medicaid management services IT Service provider. DMAS is taking ...

Responsible Person(s): Steve Hanoka, Information Security Officer Corrective Action Planned: DMAS has started confirming the geographic location for sensitive data monthly and the vulnerability scans every 90 days for the one provider Medicaid management services IT Service provider. DMAS is taking steps to ensure that this is completed for all of the service providers that are not under cloud oversight. Estimated Completion Date: 6/30/2026

View Audit 391258

Corrective Action Plans

Filters