Corrective Action Plans

Finding: The Department of Children, Youth, and Families did not have adequate internal controls over reporting requirements for the Foster Care program. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Department partially concurs with the finding. The Department acknowledges that errors were made in the crosswalks and quarterly reports submitted during the audit period. To address the auditor’s specific finding, the Department has: • Reviewed and updated all electronic versions of the quarterly crosswalks for accuracy. • Submitted corrections for the federal fiscal year 2023 Quarter 3 report. The conditions noted in this finding were previously reported in finding 2022-051. Completion Date: February 2024 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Children, Youth, and Families did not have adequate internal controls to ensure group care facility employees and adults residing in prospective caregivers’ households had cleared background checks before having unsupervised access to children. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Department partially concurs with the finding. The auditors identified two exceptions where fingerprint checks for two family foster home adults were completed two days later than the required timeline of 15 calendar days. The delay was due to the misspelling of one applicant’s last name in the system. Upon correction, the applicants subsequently completed the fingerprint checks and were determined eligible. As stated in the finding’s Cause of Condition, the Department developed a corrective action plan to address the internal control deficiencies in response to the prior year’s finding which had not been fully implemented within the current audit period. The Department is confident that all staff who work with children and youth have cleared background checks. As of April 1, 2023, the Department implemented a new process for processing background checks for group care facilities to strengthen internal controls, documentation, and clarification on the “effective date.” The updated process is outlined below: • A new form was created with clear instructions for the group care facilities to provide the applicant/employee information, including the background check confirmation code, directly to the Department’s Background Check Unit (BCU). • The BCU works with the applicant/employee through the fingerprint background check process. • The results are sent directly to the BCU, at which time they complete a child abuse/neglect history check and if needed a suitability assessment. The BCU documents the results in FamLink with the date the background check is completed. • The BCU emails the results to the group care facility and the Department’s Licensing Division (LD) group. If the applicant/employee is cleared and is not a renewal, LD staff adds the applicant/employee to the group care facility in FamLink with the clearance information attached. The conditions noted in this finding were previously reported in finding 2022-050. Completion Date: April 2023 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Children, Youth, and Families did not have adequate internal controls to ensure monthly foster care maintenance payments to children’s caregivers were adequate and accurate for the Foster Care program. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Amount $0 Status: Corrective action in progress Corrective Action: The Department is committed to strengthening internal controls and complying with grant requirements. As stated in the finding’s Cause of Condition, the Department utilizes FamLink as the case management system for the Foster Care program which, due to system limitations, did not have the reporting capabilities to track rate setting reviews during the audit period. To assist with tracking rate setting requirements, the Department: • Created a new report in FamLink to assist rate assessors in identifying six-month reviews that have not been performed timely. • Implemented monthly tracking by supervisors to assist with internal controls and compliance. In response to the auditor’s recommendations and to assist in compliance, the Department has submitted a request to the technical team for an update to the report to also show when the next rate assessment is due. Completion Date: Estimated June 2024 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Children, Youth, and Families did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Department is committed to strengthening internal controls and complying with grant requirements. As stated in the finding’s Cause of Condition, the Department was unable to fully implement the prior corrective action plan during the audit period. In April 2023, the Fiscal Integrity Unit collaborated with other divisions to implement the following internal controls: • Utilized algorithms in the Sprout system to identify reimbursement requests outside of a reasonable amount. • Required providers to submit additional documentation or explanation for those identified amounts. • Implemented a re-run process for prior billing periods to eliminate potential double billings by providers. • Trained headquarters and field office accounting staff to utilize the new algorithms and review additional documentation prior to processing payments. • Required program staff review and approval of all vendor invoices prior to release of payment for the Eastern Washington regions. In January 2024, the Fiscal Integrity Unit identified and implemented regional program approvals for Western Washington providers. The Contracts office has also taken the following actions: • In August 2023, filled one vacant staff position dedicated to reviewing child welfare contracts to include family time visit payments. • In November 2023, developed compliance audit plans for child welfare contracts and began fiscal monitoring of family time visit payments. • In December 2023, filled an additional vacant staff position dedicated to reviewing child welfare contracts. The conditions noted in this finding were previously reported in findings 2022-048 and 2021-040. Completion Date: January 2024 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Management Views and Corrective Action Plan Year Ending December 31, 2023 Finding 2023-002 - Untimely Return of Title IV Requirements Grantor: U.S. Department of Education Program: Student Financial Assistance Cluster Assistance Listing#: 84.268, 84.063 Award Titles: Federal Direct Student Loan Program, Federal Pell Grant Program Award Years: 7/2022 – 6/2024 Management agrees with the finding and proposes the following corrective action plan: Corrective Action Plan The College hired two new financial aid employees during the Fall 2023 semester. These employees will be responsible for monitoring student withdrawals and performing return of title IV fund calculations on a weekly basis to ensure all refunds transactions are processed timely and accurately. Additional training will be provided by Riley Niemand, Financial Aid Manager to ensure compliance with R2T4 regulations. Timing Riley Niemand is currently training these new employees on the return of title IV fund process. This training will be completed by September 1, 2024. Sincerely, S. Christopher Reitz Director of Financial Services and Controller creitz@ensign.edu 801-524-8109

Management Views and Corrective Action Plan Year Ending December 31, 2023 Finding 2023-001 - Inappropriate Amounts Included in Loan Notification Letters (Significant Deficiency) Grantor: U.S. Department of Education Program: Student Financial Assistance Cluster Assistance Listing #: 84.268 Award Title: Federal Direct Loan Program Award Years: 7/2022 – 6/2024 Management agrees with the finding and proposes the following corrective action plan: Corrective Action Plan The first instance where disbursement dates and amounts were not included in the communication because the system incorrectly captured the student’s name rather than the date and amount of disbursements was caused by a system update. When PeopleSoft system updates are installed, they sometimes affect the data tables where our notification letters pull from. In this instance an update changed a table referenced in the query used to compile loan notification letters. The letter for this student was sent out before the query could be updated to correct for this change. Because of this issue, management has decided to have all loan notification letters compiled manually, effective January 2024, until a consultant can be brought in to help address the issue. Once the system configuration is corrected, we will return to using automated letters, but will continue to review a sample of loan notification letters each semester as an additional control. The second instance where loan disbursement letters were not sent due to the system not being updated to reflect the new academic was the result of a training issue. During 2023, the College made system changes to address prior year audit findings. These changes were made during the 2022-23 academic year and when the 2023-24 academic year started the system settings were not updated. The financial aid staff responsible for setting up the new academic year in the system will receive additional system setup training to ensure this type of issue does not happen in future academic years. Timing Starting in May 2024, Riley Niemand, Financial Aid Manager will work with a consultant to correct the automated loan notification letter process and to implement a process to review loan notification letters after a system update. This process will be completed by August 31, 2024. In May 2024, Chris Reitz, Controller, will also implement a financial aid review process to ensure loan notifications are completely, accurately, and timely sent to the student and/or parent each semester. System setup training to individuals involved in the process of setting up the new academic year in the system will be completed by Chris Reitz and Riley Niemand in May 2024. Sincerely, S. Christopher Reitz Director of Financial Services and Controller creitz@ensign.edu 801-524-8109

Corrective Action The Office of the Registrar is aware that two separate reports need to be extracted from the Student Information System (SIS) to capture both withdrawal and graduation dates, so both are being reported in a timely manner. National Student Clearinghouse reporting date parameters are also being updated so the last date of attendance is pulled into the fields needing to be reported to NSLDS as the Effective Date. Enrollment reporting will be reviewed and submitted at the start of each term, subsequently within the term, and at the end of the term to ensure reporting timelines are met and that the withdrawal date and effective date match for reporting purposes. Timeline for Implementation of Corrective Action Plan: This corrective action plan was implemented in April 2024. Contact Person: Waqas Mirza, Registrar, waqas.mirza@urbancollege.edu

Corrective Action The Office of the Registrar is aware that two separate reports need to be extracted from the Student Information System (SIS) to capture both withdrawal and graduation dates, so both are being reported in a timely manner. National Student Clearinghouse reporting date parameters are also being updated so the last date of attendance is pulled into the fields needing to be reported to NSLDS as the Effective Date. Enrollment reporting will be reviewed and submitted at the start of each term, subsequently within the term, and at the end of the term to ensure reporting timelines are met and that the withdrawal date and effective date match for reporting purposes. Timeline for Implementation of Corrective Action Plan: This corrective action plan was implemented in April 2024. Contact Person: Waqas Mirza, Registrar, waqas.mirza@urbancollege.edu

Corrective Action The Office of the Registrar is aware that two separate reports need to be extracted from the Student Information System (SIS) to capture both withdrawal and graduation dates, so both are being reported in a timely manner. National Student Clearinghouse reporting date parameters are also being updated so the last date of attendance is pulled into the fields needing to be reported to NSLDS as the Effective Date. Enrollment reporting will be reviewed and submitted at the start of each term, subsequently within the term, and at the end of the term to ensure reporting timelines are met and that the withdrawal date and effective date match for reporting purposes. Timeline for Implementation of Corrective Action Plan: This corrective action plan was implemented in April 2024. Contact Person: Waqas Mirza, Registrar, waqas.mirza@urbancollege.edu

Corrective Action The Office of the Registrar is aware that two separate reports need to be extracted from the Student Information System (SIS) to capture both withdrawal and graduation dates, so both are being reported in a timely manner. National Student Clearinghouse reporting date parameters are also being updated so the last date of attendance is pulled into the fields needing to be reported to the National Student Loan Data System (NSLDS) as the Effective Date. Enrollment reporting will be reviewed and submitted at the start of each term, subsequently within the term, and at the end of the term to ensure reporting timelines are met and that the withdrawal date and effective date match for reporting purposes. Timeline for Implementation of Corrective Action Plan: This corrective action plan was implemented in April 2024. Contact Person: Waqas Mirza, Registrar, waqas.mirza@urbancollege.edu

Corrective Action Urban College of Boston (UCB) has contracted with Global Financial Aid Services (Global FAS) effective for the 2023/2024 Award Year. As part of the Global FAS process, any unearned Return to Title IV funding is processed through a negative disbursement check register. The Business Office will receive the calculated unearned portion of Title IV funding and post as a negative disbursement onto the student’s ledger/billing. The negative disbursement is auto processed through Global FAS back to COD. The Director of Financial Aid and Manager of the Business Office will review monthly to ensure all returns have been completed. Timeline for Implementation of Corrective Action Plan: This corrective action plan will be implemented by May 2024. Contact Person: Stacy Broadus, Director of Financial Aid, stacy.broadus@urbancollege.edu

Corrective Action Plan: Urban College of Boston (UCB) has contracted with Global Financial Aid Services (Global FAS) effective for the 2023/2024 Award Year. In addition, Urban College has hired a new Director of Financial Aid who started on January 1, 2024 who is familiar with the rules around calculating R2T4s. Going forward, Global FAS will be processing all Exits and Return to Title IV (R2T4) calculations as of the Fall semester of the 2023/2024 award year. The Director of Financial Aid at UCB has confirmed with Global FAS that our school profile is accurately, and the number of days being used in the R2T4 calculation is accurate based on the current Academic Calendar. Timeline for Implementation of Corrective Action Plan: The corrective action plan has been implemented as of September 2023. Contact Person: Stacy Broadus, Director of Financial Aid, stacy.broadus@urbancollege.edu

Corrective Action Plan: The Business Office will review uncashed checks every 30 days as part of the ledger/billing reconciliation process to ensure these are addressed prior to the 240-day regulation. This process is being updated in the Business Office Cash Management operating procedure. The Business Office and the Director of Financial Aid will review monthly any uncashed checks to ensure that UCB is meeting the required timeline. Timeline for Implementation of Corrective Action Plan: This corrective action plan will be implemented by May 2024. Contact Person: Karen Lucas, Manager of Business Office, karen.lucas@urbancollege.edu

Corrective Action Plan Urban College of Boston (UCB) has contracted with Global Financial Aid Services (Global FAS) effective for the 2023/2024 Award Year. Global FAS provides UCB with a monthly reconciliation report through our shared Secured File Transfer Protocol site (SFTP)and notifies us when one is ready to be reviewed. Once the file is received, the Business Office will conduct a secondary reconciliation using the Global FAS report. The Business Office will review the students ledger/billing and compare information with COD to ensure all disbursement information matches according to regulation. The Director of Financial Aid will also conduct a quarterly internal review of Global FAS reports against COD reporting. Timeline for Implementation of Corrective Action Plan: This corrective action plan will be implemented by May 2024. Contact Person: Stacy Broadus, Director of Financial Aid, stacy.broadus@urbancollege.edu

Corrective Action Urban College of Boston (UCB) has contracted with Global Financial Aid Services (Global FAS) effective for the 2023/2024 Award Year. Global FAS provides UCB with a daily check register report of all student disbursements. Through the Disbursement process, UCB must first process all check registers, reconcile student billing, and identify and process student credit balances before funds can be drawn down from the Common Origination and Disbursement System (COD). The UCB Business Office commits to processing check registers within 7 business days and providing the Cash Monitoring report to Global FAS so funds can be released and deposited into the Federal Funds Account. This will ensure student refunds are processed within the 14-day federal regulation. Timeline for Implementation of Corrective Action Plan: The corrective action plan has been implemented as of September 2023. Contact Person: Stacy Broadus, Director of Financial Aid, stacy.broadus@urbancollege.edu

Finding: 2023-071 - UAS had twenty-two stale Title IV checks greater than 240 days. Questioned Costs: None Assistance Listing Number: 84.007, 84.038, 84.063, 84.268, 84.379 Assistance Listing Title: Student Financial Assistance Cluster Views of Responsible Officials (state whether your agency agrees or disagrees with the finding; if you disagree, briefly explain why): Agree Corrective Action (corrective action planned): The UAS Bursar’s office, the Financial Aid Office are working with the Budget, Grants and Contract Office to send funds back to the Department of Education for the stale dated Title IV checks. A quarterly review will be performed to ensure future compliance. Completion Date (list anticipated completion date): November 2023 Agency Contact (name of person responsible for corrective action): Jonathan Lasinski, Vice Chancellor for Administrative Services, 907-796-6497

When the district bookkeeper submits the reports to ISBE, she will notify the superintendent that they are ready for her review and final aubmittal to avoid any delay and late filings. See full Corrective Action Plan on district letteread.

Finding 2023-001 - Return of Title IV Funds Management Response: Management concurs with the finding Views of Responsible Officials and Corrective Action Plan: Point Park University uses PowerFAIDS software to complete the Federal Return of Title IV calculation. The University reviewed the Return of Title IV process within PowerFAIDS and found that the days completed were not properly updated to exclude the days of the University's spring break from the numerator of the calculation. This resulted in an incorrect amount being returned. The University is in the process of returning the underpayment of $454 for the 2022-2023 academic year. The University is implementing an additional procedure to review each Return of Title IV calculation from PowerFAIDS prior to the issuance of the refund. A spreadsheet has been created to independently check each calculation based upon withdrawal dates, number of days in the semester, number of davs completed and factoring in break days as applicable. Anticipated Completion Date: April 30, 2024 Name of Responsible Person: George Santucci, Director of Financial Aid (412) 392-3498 gsantucci@pointpark.edu

Finding 2023-002 - Enrollment Reporting Management Response: Management concurs with the finding Views of Responsible Officials and Corrective Action Plan: Point Park University uses the National Student Clearinghouse (NSC) to transmit enrollment information to the National Student Loan Data System (NSLDS). The University has verified that the student status changes were correctly submitted to the NSC, however the campus and program level information was not properly reflected in NSLDS and did not appear on the error report. The University's Financial Aid Office in conjunction with Registrar's office will implement a 45-day report to verify that all student enrollment status changes are properly reported to NSLDS via the NSC. The discovery of any status changes did not reach NSLDS will be manually reported directly on the NSLDS platform. Anticipated Completion Date: May 31, 2024 Name of Responsible Person: George Santucci, Director of Financial Aid (412) 392-3498 gsantucci@pointpark.edu

Corrective Action The Foundation will ensure that policies and procedures are in place to both verify the correct program level effective dates and enrollment statuses are reported timely and are also reviewed by a second person to ensure the accuracy of the data as well as the timeliness of reporting the data. The initial reporting and the subsequent reviews will be documented with names of staff and dates of work/reviews.

THE COLLEGE HAS PROVIDED TRAINING TO EMPLOYEES AND IMPLEMENTED REVIEW PROCEDURES TO ENSURE ACCURACY OF REPORTING STUDENT STATUS FOR THE NEXT FISCAL YEAR.

I will ensure the Financial Aid Office works closely with the Accounts Payables department to monitor that all Title IV refund checks have been cashed after 30 days of issuance of the refund. If a check has not been cashed a new check will be reissued immediately. If, after 30 days of the reissuance, the check has not been cashed then the funds will be returned to the Department of Education within the mandated 45-day period.

We recently completed the transition and onboarding of departmental staff which would allow the University to fully enact its plan to ensure both the financial aid and the Registrar's office will perform prompt review of processing University withdrawals. The Registrar's office will develop process and procedures documentation as an internal control measuring tool to ensure that Administrative Withdrawals (AW) and Withdrawals for lack of attendance (WA) that affect student emollment are identified immediately. Staff in the Financial Aid and the Registrar's office will actively take part in training workshops and webinars provided by the Depatiment of Education and NASF AA for continuing education to stay abreast of new developments and best practices in the industry.

CORRECTIVE ACTION PLAN Federal Award Findings and Questioned Costs Finding 2023-001 Student Financial Aid Cluster: Assistance Listing #84.007 Federal Supplemental Educational Opportunity Grants Assistance Listing #84.033 Federal Work-Study Program Assistance Listing #84.063 Federal Pell Grant Program Assistance Listing #84.268 Federal Direct Student Loans Assistance Listing #93.364 Nursing Student Loans Federal agency – U.S. Department of Education Grant Period – Year ended August 31, 2023 Compliance Requirement: Special Tests and Provisions Criteria: The Gramm-Leach-Bliley Act (Public Law 106-102) (GLBA) requires the College, on an annual basis, to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer (student) information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, the GLBA risk assessment should include consideration of risk in each relevant area of operations, including: Employee training and management. Information systems, including network and software design, as well as information processing, storage, transmission, and disposal. Detecting, preventing, and responding to attacks, intrusions, or other system failures. Condition: During our testing, we noted the following: While the IT Systems Team is the assigned resource for information security matters, the College communicated that it does not have a single qualified individual designated with the responsibility for implementing and enforcing the College’s information security program. An annual IT risk assessment was not performed. A vendor management program is not in place. Mobile device management is not in place. Backup media is not encrypted. A full set of policies and procedures is not in place. Cause: The expected documentation supporting the required controls to adequately confirm compliance with GLBA safeguards was not complete. Effect: Without demonstrable, documented controls supporting compliance with the GLBA standards for safeguarding the protected data, compliance with the law and the requirements in the federal PPA may not be assured. Context: Inquiry and observation of the information received from the College related to compliance with GLBA. Recommendation: The College should review the GLBA safeguarding rules and as soon as practical implement and document the controls necessary for compliance with the rule, focusing on the completion of a documented, thorough, and standardized risk assessment and management reporting framework. The College should perform comprehensive risk assessments on a regular basis, which is suggested to be at least annually, and at any significant change in infrastructure or business process. Contact Person Responsible for Corrective Action Plan: Donna Rocap, Associate Vice President of Administration Corrective Action Plan: The College agrees with the findings and is in process of developing a corrective action plan to address. In addition, the College has made it a top priority to hire both a Chief Information Officer and a Chief Information Security Officer but has experienced difficulty getting a qualified pool of candidates. Timing of Planned Corrective Action: The College expects to resolve this finding during its August 31, 2024 fiscal year.

Institutional Comments on Findings and Recommendations: The institution agrees with the auditor on this finding in that there were (3) three cases where the enrollment status was not reported correctly. Although as was observed by the auditor, the enrollment status for the three students in question were corrected in the next enrollment report that was submitted. During the audit period, the institution was unable to update, submit or complete in a timely manner Enrollment reports for the period of July through December 2022. This was mainly due to problems with the implementation of a new format for enrollment reporting through the NSLDS Modernized Website. The institution has on file, multiple inquiries to the NSLDS Customer Support Center in relation to this issue. The Department of Education also posted various Electronic Announcements updating and giving continued guidance to institutions on this issue. The auditors were provided with copies of all of ED’s posting and updates as related to this issue. Nevertheless, during the subsequent months from January 2023 to June 2023 covered in this audit period, the institution was able to complete and report the current enrollment status of students to the NSLDS platform. Actions Taken or Planned: The matter as related to this finding has already been discussed with the Registrar who is responsible for the completion and submission of the Enrollment Reports to the Department of Education To continue to improve on the reporting to student’s enrollment status, the institution would continue to submit its Enrollment Reports monthly instead of every two months as schedule. Status of Corrective Actions on Prior Findings: The issue as related to this finding occurred in the past audit.