Corrective Action Plans

Corrective Action Plan: Atrium Health CMHA management, as part of the 2025 process and procedure consulting engagement, will develop a plan to ensure that the IT systems are changed such that notification letters can be retained, or a control exists whereby hard-copies of notification letters are maintained. Proposed Completion Date: By December of 2025, Atrium Health CMHA management will complete the corrective action.

Corrective Action Plan: Due to operational management turnover and restructuring experienced in 2024 and 2025, this corrective action plan has been delayed. Atrium Health CMHA management has engaged with outside consultants in the third quarter of 2025 to examine and redesign various processes and work flows. This project is expected to address the gap in SFA transactional review and approval internal controls that are arising due to the SFA program size, limited number of subject matter experts, and the management turn; and result in mitigating controls and policies being implemented to ensure the accuracy and completeness of all SFA transactions. Proposed Completion Date: By December of 2025, Atrium Health CMHA management will complete the corrective action.

Corrective Action Plan: Due to operational management turnover and restructuring experienced in 2024 and 2025, this corrective action plan has been delayed. Atrium Health CMHA management has engaged with outside consultants in the third quarter of 2025 to examine and redesign the reporting structures, process work flows, and procedures within the Student Financial Aid (SFA) office, the Business office, and Student Services specifically as those areas relate to student status and records. It is expected this engagement will ensure that the internal controls within the entire SFA office will improve, including that the SFA IT Systems are documented and tested and that any compensating controls identified as needed are implemented. Proposed Completion Date: By December of 2025, Atrium Health CMHA management will complete the corrective action plan. .

Corrective Action: The College has performed a full review of processes and controls related to credit-balance payments within 14-days to ensure accuracy moving forward and corrected the concern in the 2024 fall semester. Contact Person: Michael Hamilton, Dean of Student Success Anticipated Completion Date: completed

Corrective Action: A monthly reconciliation process was put into place (July 2024) to include control reporting of all status changes to ensure accuracy and timeliness of student status changes from the college’s student information system to National Student Clearinghouse to NSLDS. However, additional training for Registrar and Financial Aid staff is in progress to include a repeated review of processes and controls related to monthly Student Information System – Clearinghouse – NLSDS reconciliation. This review will include a review of how program start dates (semester and session) vs. course starts affect reporting, as well as how multiple student status changes to registration affect reporting. The College’s third-party servicer, National Student Clearinghouse, is assisting in this training as well as the update of policies, processes, and controls, as well as the maintenance of evidentiary documentation, to ensure accuracy moving forward. Contact Person: Lori Arnder, College Registrar and Enrollment Manager Anticipated Completion Date: October 1, 2025

Corrective Action: The College is in process to include a full review of processes and controls related to monthly COD/NLSDS reconciliation. The College’s third-party servicer, Global Financial Services, is assisting in this training as well as the update of policies, processes, and controls, as well as the maintenance of evidentiary documentation, to ensure accuracy moving forward. Contact Person: Michael Hamilton, Dean of Student Success Anticipated Completion Date: October 1, 2025

As of today, September 29, 2025, the organization has fully implemented procedures in Populi to update enrollments to actual final status within the required 30 days. This data will be reported to our third-party servicer RGM in real-time. The academic and administrative teams review these reports.

Over the past two months in August and September, the board has reviewed the budget and the organization has sharply reduced staff and facility costs at both the Austin and Berkeley campuses. This will ensure that the organization qualifies for at least a 1.0 on the composite score and qualify for a letter of credit alternative or provisional certification alternative to meet the fiscal responsibility requirements through the 2025 fiscal year audit. As of today, September 29, 2025, expense reductions have been implemented.

Sentara Health and Subsidiaries respectfully submits the following corrective action plan for the year ended December 31, 2024. Name and address of independent public accounting firm: PBMares, LLP 701 Town Center Drive, Suite 900 Newport News, VA 23606 Audit period: Year ended December 31, 2024 The finding from the year ended December 31, 2024 schedule of findings and questions costs is discussed below. The finding is numbered consistently with the number assigned in the schedule. FEDERAL AWARDS FINDING A. Significant Deficiency in Internal Control over Compliance Finding 2024-001: Student Financial Assistance Cluster - Federal Assistance Listing Number 84.268 - Significant Deficiency in Internal Control over Enrollment Reporting to National Student Loan Data System (NSLDS) Recommendation: Internal controls should be implemented to ensure that all enrollment status changes, including withdrawals occurring outside of standard roster cycles, are reported to NSLDS within the required timeframe. This should include submitting out-of-cycle enrollment updates to the Clearinghouse when necessary. This is not a repeat finding. Corrective Action Plan: 1. The Registrar will create a report that captures students who withdrew from the college to include all students in all program cycles. This report will capture withdrawal activity that occurs within and falls outside of each reporting period. 2. The report will be manually cross-referenced with enrollment data in the student information system. The responsible parties for ensuring this corrective action is employed are the Registrar and the Assistant Registrar of the College. They will be overseen by Cindy Mabie, Assistant Dean for Student Services. Timeline for Completion: The new process will go into effect October 1, 2025. If there are questions, please contact Cindy Mabie, Assistant Dean for Student Services at Cmabie@sentara.edu.

Actions Taken: The institution has implemented an automated process for Exit Counseling to ensure compliance with Title IV requirements. As of August 2025, the system has been configured to automatically send an exit counseling notification to students when they enter one of the following statuses: • Withdrawal • Graduation • Less than half-time enrollment System Workflow: When a student’s status changes, the system immediately generates and sends an email alert containing exit counseling instructions and the necessary links for completion. This ensures timely notification without requiring manual tracking by staff. Monitoring and Compliance: • Reports will be reviewed monthly to confirm that all required students received the exit counseling notifications. • Any discrepancies will be immediately investigated and resolved. Outcome: This automation eliminates the manual process previously in place, ensuring 100% notification compliance and greatly reducing the likelihood of future deficiencies in this area.

Actions Taken / Planned The institution recognizes the importance of timely processing of Title IV credit balances and refunds. To address the deficiencies identified: 1. Short-Term Action (Current Practice): Effective immediately, all staff are required to submit for processing refunds within 24 hours of identifying a credit balance. Staff will also promptly correct any errors discovered during the reconciliation process. o Monitoring: Supervisors will conduct weekly reviews to ensure compliance with this 24-hour policy. o Training: Refresher training on Title IV credit balance processing has been provided to all relevant staff as of September 2025. o Instead of one ‘check run’ per week, numerous ‘check runs’ may be necessary to ensure 14 day window is met. 2. Long-Term Action (System Integration and Automation): The institution is actively working to integrate QuickBooks into our Student Information System (SIS) to automate Title IV and refund documentation. o This integration will streamline the reconciliation process, reduce manual errors, and ensure consistent, timely processing of refunds. o Projected Completion Date: Implementation and full automation are expected to be completed within 9–12 months, with a target date of September 2026. Expected Outcome: These measures will ensure timely and accurate processing of Title IV credit balances, improve compliance, and reduce the risk of future findings.

We concur with this finding. The County of York has hired a Human Services Director of Finance to assist with improving systems and financial processes within the Human Services (HS) divisions. The HS Executive Director and Director of Finance are recommending engaging an expert Consultant to assist the County’s Children & Youth Fiscal team in getting caught up on internal system timelines, as well as delayed reporting. The Consulting company will also be working to adequately train the Children & Youth Fiscal team for development purposes.

We concur with this finding. Children, Youth and Families will explore ways to better track the State Fiscal Year and County’s Calendar Year side-by-side. The Children & Youth Fiscal team will work with the Director of Finance to implement reconciliation processes and will prioritize timeliness of reporting.

The County will ensure that procedures are in place to ensure support is provided for review and approval of eligibility determination.

The Children Service Department will seek legal advice on the implementation of a policy that meets the requirements set for in 2 CFR 200.302(b)(7) for determining the allowability of costs in accordance with Subpart E-Cost Principles.

Management’s Views and Corrective Action Plan 2024-002 – Non-compliance with Disbursements to or on behalf of students Grantor: U.S. Department of Education Program Name: Student Financial Assistance Cluster Award Names: Federal Supplemental Educational Opportunity Grants (FSEOG), Federal Pell Grant Program and Federal Direct Student Loans Award Year: 1/1/2024 - 12/31/2024 Award Number: Not applicable Assistance Listing Numbers: 84.007, 84.063 and 84.268 Management’s Response Management has sent disbursement notifications to students and tracked aspects of the notifications via the AHN Schools of Nursing’s (the “Schools”) student portal. Each notification was sent by email to the student, and an activity was logged in the student’s audit log and activity tracking with the student portal. From this process, management agrees that the Schools were unable to extract the exact disbursement details that were sent via the disbursement email. Additionally, the Schools could not replicate the disbursement email that is sent to the student. To ensure all reporting requirements are met, the Schools have ensured that a copy of the disbursement email will be sent to both the student and the institution. The Schools have already modified the disbursement notification process by adding a secondary email address to the disbursement notifications. A copy of each notification will be sent to campuscafesuperuser@ahn.org to ensure a copy of the notifications will be available for future audits. Management agrees that there was no receipt of affirmative confirmation for one student and no available signed attestation to verify voluntary consent to participate in electronic transactions for one student. The lack of receipt and documentation was due to a human clerical error. Management has communicated reminders of the related requirements, as well as the Schools policies and procedures to the personnel. In addition, management is in process of recruiting an additional Financial Aid Officer, who will act as an additional layer of review and cross-checks to ensure documentation is retained appropriately. Anticipated Completion Date As of the date of this report the above noted process has been updated and is current procedure. Management is actively recruiting for an additional Financial Aid Officer and is working to fill the open position as soon as possible. Responsible Parties • Amy Stoker, Director of AHN Schools of Nursing • Sarah Loomis, Director of Financial Aid of AHN Schools of Nursing • Rosanna Sarantinoudis, Student Accounts Associate and Registrar of West Penn Hospital School of Nursing • Natalia Wassel, Student Accounts Associate and Registrar of West Penn Hospital School of Nursing

Management’s Views and Corrective Action Plan 2024-001 – Non-compliance with Enrollment Reporting Requirements Grantor: U.S. Department of Education Program Name: Student Financial Assistance Cluster Award Names: Federal Pell Grant Program and Federal Direct Student Loans Award Year: 1/1/2024 - 12/31/2024 Award Number: Not applicable Assistance Listing Numbers: 84.063 and 84.268 Management’s Response Management agrees with the finding as it relates to the improper reporting to NSLDS of enrollment reporting for one student. The improper reporting was due to a human clerical error. As of the date of this report, management notes that the identified student’s enrollment status has been updated to NSLDS. Currently all financial aid aspects of the AHN Schools of Nursing are completed by one personnel. Management has communicated reminders of the student enrollment change requirements, as well as the AHN Schools of Nursing policies and procedures to the personnel to ensure that changes are reported accurately and timely. In addition, management is in process of recruiting an additional Financial Aid Officer, who will act as an additional layer of review and cross-checks to ensure that data is being reported for enrollments accurately and timely. Anticipated Completion Date As of the date of this report, the noted student’s enrollment status has been updated. Management is actively recruiting for an additional Financial Aid Officer and is working to fill the open position as soon as possible. Responsible Parties • Amy Stoker, Director of AHN Schools of Nursing • Sarah Loomis, Director of Financial Aid of AHN Schools of Nursing

Finding 2024-001: U.S. Department of Education (USDE), Title IV Student Financial Aid Programs (significant deficiency): Condition (per audit): Non-compliance with Title IV requirements, including missing reconciliations, inaccurate/untimely NSLDS reporting, incomplete Work-Study files, missing refund documentation, incomplete FAFSA verification records, and unavailable FISAP reconciliation documentation. Questioned Costs: $29,087 Corrective Actions (overseen by the President): 1. Monthly Title IV Reconciliations o Beginning August 2025, monthly reconciliations between the Business Office and Financial Aid Office will be conducted and logged in the new centralized electronic filing system in Populi for audit readiness and continuity during staff transitions. o To further strengthen the process, two additional staff members, a new Accounts Payable Manager and Comptroller, with extensive audit and business office management and grants management/reconciliation experience, and has been added to the Business Office. o Reconciliation logs will be retained in the centralized electronic filing system in Populi. o Responsible Official: Comptroller/ Business Office Staff 2. Electronic Filing System o To address missing FISAP, refund, and Work-Study documentation, SwCC implemented an organized electronic filing system in Populi by funding stream, year, and document type. o Includes FISAP, Work-Study timesheets, NSLDS reports, and refund documentation. o Responsible Official: Financial Aid Director and Business Office. 3. Enrollment Reporting to NSLDS o To address untimely/incorrect reporting, weekly enrollment status reports will be submitted through Populi and verified with the Registrar. o SwCC is finalizing its agreement with the National Student Clearinghouse to further improve accuracy. o Responsible Official: Registrar. 4. Work-Study Documentation o To address missing student files, all Work-Study records (award letters, timesheets, disbursement records) will be scanned and retained in each student’s electronic file. o Responsible Official: Financial Aid Director. 5. Refund Documentation o To address missing refund testing documentation, all refund calculations will be cross-verified by the Business Office and Financial Aid Office, and approved by the President before posting. o Records will be stored in the filing system. o Responsible Official: Comptroller/ Business Office and Financial Aid Office 6. FAFSA Verification o To address incomplete verification documentation, SwCC uses a standardized verification checklist. The Populi system does not allow disbursement of student files selected for verification. A manual override is required, and these overrides will continue to be managed within the Office of Financial Aid for disbursement. o Responsible Official: Financial Aid Director. 7. FISAP Retention o To address unavailable FISAP records, annual FISAP submissions will be stored in the electronic filing system for future testing and audit review. o Responsible Official: Comptroller/ Business Office and Financial Aid Office Completion Date: Initial corrective actions completed by August 31, 2025. Ongoing monitoring monthly/quarterly as required.

orrective Action Plan Name of Contact Person Responsible for Corrective Action: John Hunt Centra Health Corporate Director, Information Security and Disaster Recovery 561-613-7342 john.hunt@centrahealth.com Anticipated Completion date: December 31, 2025 Corrective Action: 2024-001 – Special tests and provisions: As part of our ongoing GLBA compliance efforts, we completed a comprehensive risk assessment on December 24th, 2024. The assessment identified and ranked risks based on likelihood and potential impact to sensitive financial and customer information. In alignment with GLBA’s requirement to safeguard non-public personal information, our program has prioritized remediation and monitoring efforts toward the highest-risk control items identified. Key focus areas include: • Implementing multi-factor authentication for all privileged access, including access to sensitive back-end IT equipment and web application access. • Implementing a vulnerability management program that includes a regular scan of all systems on the network and a programmatic review of the resulting list of vulnerabilities to ensure that systems are reconfigured and patched to address risk to the organization in order of criticality. • Developing a comprehensive Incident Response Plan that is tested and reviewed at least annually or whenever significant changes to procedures are introduced. • Updating Centra’s third-party risk management procedures to include periodic review of supplier performance, appropriateness of information security and data protection controls, and compliance with required controls. • Improving security awareness training with specialized training for specific higher risk roles to the organization. We continue to make progress on 314.4(d)–(g) controls: safeguards have been designed and implemented for high-risk areas, and ongoing testing, training, vendor oversight, and program evaluation are being conducted. Some lower-priority improvements remain in progress, consistent with our risk-based approach and remediation roadmap. These initiatives are tracked, resourced, and scheduled, ensuring that residual gaps are closed in alignment with GLBA requirements.

Corrective Action Plan Xavier complies with the loan disbursement notification rules. During the audit we learned that, while our system was sending the emails to each student with a loan disbursement, our process for copying each individual email to xufinaid was not functioning. Further, the notification report was being overwritten daily, causing us to lose the audit trail for these notifications. We have implemented two steps to be able to document each individual email. 1. The xufinaid@xavier.edu email address is copied on every disbursement notification and each notification email is delivered into the xufinaid inbox in Outlook. Every Wednesday those emails are moved by financial aid personnel into a folder in Outlook where they remain stored. This weekly review allows personnel to know in a timely manner if there are issues with the email delivery process. 2. A log file which saves a list of the disbursement notification emails is saved on a daily basis. It includes the content of each email.

Planned Corrective Action The University acknowledges the finding related to incomplete documentation of the formal risk assessment and the lack of monitoring over access levels to the financial aid system. We are currently developing a comprehensive, documented GLBA risk assessment that aligns with federal requirements, including the identification of internal and external risks, evaluation of current safeguards, and implementation of appropriate remediation measures. Additionally, the University is implementing a formalized review process whereby system access roles are reviewed quarterly in collaboration with department managers to ensure user access is consistent with current job responsibilities. This will include a standardized user access review form and documented management sign-off. Implementation Date -Risk Assessment Documentation: December 31, 2025 -Access Review Procedure Implementation: December 31, 2025 Responsible Personnel Marcus D Walton Deputy Chief Operating Officer & CIO

Condition In two instances, the amounts recorded in the General Ledger (GL) did not match the corresponding amounts recorded in the payroll system. Corrective Action Plan Corrective Action Planned: Efforts were taken to verify Dayforce is configured to allocate salary expenses to an employee’s home agency and department, regardless of where the employee assigns their hours in the timekeeping system. While the timesheet programmatic reflects the agency and department where hours and dollars are functionally charged, the payroll register aligns with the General Ledger based on home agency coding. As a result, the Payroll Register and General Ledger will reconcile with each other but may not align with programmatic reports, which are based on timesheet-level allocations. This system behavior is consistent with current configuration and financial reporting practices. The Payroll Department and the DHHS will meet in Q3 2025 to ensure grant/expense tracking activities are working as intended. Name(s) of Contact Person(s) Responsible for Corrective Action: Sue Drummond, Director Payroll & HRIS Interface Anticipated Completion Date: Completed January 2025.

CASEFILE REVIEW (2023-005) Recommendation: It is recommended the County review case files on a periodic basis throughout the year and document the reviews. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will continue to work at this area and internal controls to achieve the overall goal. Name of the contact person responsible for corrective action plan: Karen Anderson, Chief Financial Officer Planned completion date for corrective action plan: December 31, 2025

SSIS ACTIVITIES ALLOWED/ALLOWABLE COSTS (2023-009) Recommendation: It is recommended that the County implement procedures to document review of disbursements when not able to show an electronic approval in the SSIS system. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will implement procedures to document review for all SSIS disbursements. Name of the contact person responsible for corrective action plan: Karen Anderson, Chief Financial Officer Planned completion date for corrective action plan: December 31, 2025

FOSTER CARE REPORTING (2023-008) Recommendation: It is recommended that the County implement procedures to review the foster care report and retain evidence of the review on file. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will start printing a coversheet for the Fiscal Supervisor to sign and retain physical evidence of the review being done. Name of the contact person responsible for corrective action plan: Karen Anderson, Chief Financial Officer Planned completion date for corrective action plan: December 31, 2025