Corrective Action Plans

Management’s Views and Corrective Action Plan 2024-001 – Non-compliance with Enrollment Reporting Requirements Grantor: U.S. Department of Education Program Name: Student Financial Assistance Cluster Award Names: Federal Pell Grant Program and Federal Direct Student Loans Award Year: 1/1/2024 - 12/31/2024 Award Number: Not applicable Assistance Listing Numbers: 84.063 and 84.268 Management’s Response Management agrees with the finding as it relates to the improper reporting to NSLDS of enrollment reporting for one student. The improper reporting was due to a human clerical error. As of the date of this report, management notes that the identified student’s enrollment status has been updated to NSLDS. Currently all financial aid aspects of the AHN Schools of Nursing are completed by one personnel. Management has communicated reminders of the student enrollment change requirements, as well as the AHN Schools of Nursing policies and procedures to the personnel to ensure that changes are reported accurately and timely. In addition, management is in process of recruiting an additional Financial Aid Officer, who will act as an additional layer of review and cross-checks to ensure that data is being reported for enrollments accurately and timely. Anticipated Completion Date As of the date of this report, the noted student’s enrollment status has been updated. Management is actively recruiting for an additional Financial Aid Officer and is working to fill the open position as soon as possible. Responsible Parties • Amy Stoker, Director of AHN Schools of Nursing • Sarah Loomis, Director of Financial Aid of AHN Schools of Nursing

Finding 2024-001: U.S. Department of Education (USDE), Title IV Student Financial Aid Programs (significant deficiency): Condition (per audit): Non-compliance with Title IV requirements, including missing reconciliations, inaccurate/untimely NSLDS reporting, incomplete Work-Study files, missing refund documentation, incomplete FAFSA verification records, and unavailable FISAP reconciliation documentation. Questioned Costs: $29,087 Corrective Actions (overseen by the President): 1. Monthly Title IV Reconciliations o Beginning August 2025, monthly reconciliations between the Business Office and Financial Aid Office will be conducted and logged in the new centralized electronic filing system in Populi for audit readiness and continuity during staff transitions. o To further strengthen the process, two additional staff members, a new Accounts Payable Manager and Comptroller, with extensive audit and business office management and grants management/reconciliation experience, and has been added to the Business Office. o Reconciliation logs will be retained in the centralized electronic filing system in Populi. o Responsible Official: Comptroller/ Business Office Staff 2. Electronic Filing System o To address missing FISAP, refund, and Work-Study documentation, SwCC implemented an organized electronic filing system in Populi by funding stream, year, and document type. o Includes FISAP, Work-Study timesheets, NSLDS reports, and refund documentation. o Responsible Official: Financial Aid Director and Business Office. 3. Enrollment Reporting to NSLDS o To address untimely/incorrect reporting, weekly enrollment status reports will be submitted through Populi and verified with the Registrar. o SwCC is finalizing its agreement with the National Student Clearinghouse to further improve accuracy. o Responsible Official: Registrar. 4. Work-Study Documentation o To address missing student files, all Work-Study records (award letters, timesheets, disbursement records) will be scanned and retained in each student’s electronic file. o Responsible Official: Financial Aid Director. 5. Refund Documentation o To address missing refund testing documentation, all refund calculations will be cross-verified by the Business Office and Financial Aid Office, and approved by the President before posting. o Records will be stored in the filing system. o Responsible Official: Comptroller/ Business Office and Financial Aid Office 6. FAFSA Verification o To address incomplete verification documentation, SwCC uses a standardized verification checklist. The Populi system does not allow disbursement of student files selected for verification. A manual override is required, and these overrides will continue to be managed within the Office of Financial Aid for disbursement. o Responsible Official: Financial Aid Director. 7. FISAP Retention o To address unavailable FISAP records, annual FISAP submissions will be stored in the electronic filing system for future testing and audit review. o Responsible Official: Comptroller/ Business Office and Financial Aid Office Completion Date: Initial corrective actions completed by August 31, 2025. Ongoing monitoring monthly/quarterly as required.

orrective Action Plan Name of Contact Person Responsible for Corrective Action: John Hunt Centra Health Corporate Director, Information Security and Disaster Recovery 561-613-7342 john.hunt@centrahealth.com Anticipated Completion date: December 31, 2025 Corrective Action: 2024-001 – Special tests and provisions: As part of our ongoing GLBA compliance efforts, we completed a comprehensive risk assessment on December 24th, 2024. The assessment identified and ranked risks based on likelihood and potential impact to sensitive financial and customer information. In alignment with GLBA’s requirement to safeguard non-public personal information, our program has prioritized remediation and monitoring efforts toward the highest-risk control items identified. Key focus areas include: • Implementing multi-factor authentication for all privileged access, including access to sensitive back-end IT equipment and web application access. • Implementing a vulnerability management program that includes a regular scan of all systems on the network and a programmatic review of the resulting list of vulnerabilities to ensure that systems are reconfigured and patched to address risk to the organization in order of criticality. • Developing a comprehensive Incident Response Plan that is tested and reviewed at least annually or whenever significant changes to procedures are introduced. • Updating Centra’s third-party risk management procedures to include periodic review of supplier performance, appropriateness of information security and data protection controls, and compliance with required controls. • Improving security awareness training with specialized training for specific higher risk roles to the organization. We continue to make progress on 314.4(d)–(g) controls: safeguards have been designed and implemented for high-risk areas, and ongoing testing, training, vendor oversight, and program evaluation are being conducted. Some lower-priority improvements remain in progress, consistent with our risk-based approach and remediation roadmap. These initiatives are tracked, resourced, and scheduled, ensuring that residual gaps are closed in alignment with GLBA requirements.

Corrective Action Plan Xavier complies with the loan disbursement notification rules. During the audit we learned that, while our system was sending the emails to each student with a loan disbursement, our process for copying each individual email to xufinaid was not functioning. Further, the notification report was being overwritten daily, causing us to lose the audit trail for these notifications. We have implemented two steps to be able to document each individual email. 1. The xufinaid@xavier.edu email address is copied on every disbursement notification and each notification email is delivered into the xufinaid inbox in Outlook. Every Wednesday those emails are moved by financial aid personnel into a folder in Outlook where they remain stored. This weekly review allows personnel to know in a timely manner if there are issues with the email delivery process. 2. A log file which saves a list of the disbursement notification emails is saved on a daily basis. It includes the content of each email.

Planned Corrective Action The University acknowledges the finding related to incomplete documentation of the formal risk assessment and the lack of monitoring over access levels to the financial aid system. We are currently developing a comprehensive, documented GLBA risk assessment that aligns with federal requirements, including the identification of internal and external risks, evaluation of current safeguards, and implementation of appropriate remediation measures. Additionally, the University is implementing a formalized review process whereby system access roles are reviewed quarterly in collaboration with department managers to ensure user access is consistent with current job responsibilities. This will include a standardized user access review form and documented management sign-off. Implementation Date -Risk Assessment Documentation: December 31, 2025 -Access Review Procedure Implementation: December 31, 2025 Responsible Personnel Marcus D Walton Deputy Chief Operating Officer & CIO

Condition In two instances, the amounts recorded in the General Ledger (GL) did not match the corresponding amounts recorded in the payroll system. Corrective Action Plan Corrective Action Planned: Efforts were taken to verify Dayforce is configured to allocate salary expenses to an employee’s home agency and department, regardless of where the employee assigns their hours in the timekeeping system. While the timesheet programmatic reflects the agency and department where hours and dollars are functionally charged, the payroll register aligns with the General Ledger based on home agency coding. As a result, the Payroll Register and General Ledger will reconcile with each other but may not align with programmatic reports, which are based on timesheet-level allocations. This system behavior is consistent with current configuration and financial reporting practices. The Payroll Department and the DHHS will meet in Q3 2025 to ensure grant/expense tracking activities are working as intended. Name(s) of Contact Person(s) Responsible for Corrective Action: Sue Drummond, Director Payroll & HRIS Interface Anticipated Completion Date: Completed January 2025.

CASEFILE REVIEW (2023-005) Recommendation: It is recommended the County review case files on a periodic basis throughout the year and document the reviews. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will continue to work at this area and internal controls to achieve the overall goal. Name of the contact person responsible for corrective action plan: Karen Anderson, Chief Financial Officer Planned completion date for corrective action plan: December 31, 2025

SSIS ACTIVITIES ALLOWED/ALLOWABLE COSTS (2023-009) Recommendation: It is recommended that the County implement procedures to document review of disbursements when not able to show an electronic approval in the SSIS system. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will implement procedures to document review for all SSIS disbursements. Name of the contact person responsible for corrective action plan: Karen Anderson, Chief Financial Officer Planned completion date for corrective action plan: December 31, 2025

FOSTER CARE REPORTING (2023-008) Recommendation: It is recommended that the County implement procedures to review the foster care report and retain evidence of the review on file. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will start printing a coversheet for the Fiscal Supervisor to sign and retain physical evidence of the review being done. Name of the contact person responsible for corrective action plan: Karen Anderson, Chief Financial Officer Planned completion date for corrective action plan: December 31, 2025

The Methodist College Registrar has been working with NSC to get the college relinked to the correct college in their system, which was fixed 11/2023. The registrar redeveloped database query to pull the old data that had been deleted by NSC due to FERPA and began sending accurate file submissions to NSC in June 2024. Files generated and submitted under the College’s new processes are taking roughly one week to process from initial submission, through error correction, and finalization.

Corrective Action Plan for Finding 2024-003 (Foster Care) Finding 2024-003: The County’s current policies and procedures are not operating effectively to ensure that only eligible recipients are receiving payments. Specifically, the following deficiencies in internal control over compliance were identified: 5 of 40 cases tested, the LDSS-4810 re-determination checklist was not completed. 4 of 40 cases tested, the LDSS-4810 re-determination checklist in the selected case file was completed but not signed off by both the case worker and supervisor. This is a repeat of the finding in the prior fiscal year's audit report, 2023-002. Corrective Action Plan: The Department of Children and Family Services will reeducate staff on how to properly complete the LDS-48009 and LDSS-4810 forms so that they can be provided upon request. Please see below for specific department plan: The Department of Children and Family Services will conduct a review of current forms to ensure that they are being completed and filed correctly. This will be complete by January 31, 2026. Management’s Response: The department agrees with the findings and will reinforce existing policies and procedures within the Department to ensure that all documents are properly retained and signed.

Corrective Action Plan for Finding 2024-002 (Adoption Assistance) Finding 2024-002: The following instances of noncompliance with Uniform Guidance were identified: In 5 of 40 cases tested, subsidy payments were not supported by adequate documentation in the case file. Specifically, the files did not contain documentation related to the continuation of assistance until age 21, as a result of a disability. The County’s current policies and procedures are not operating effectively to ensure only eligible recipients are receiving payments. This is a repeat of the finding in the prior fiscal year's audit report, 2023-001. Corrective Action Plan: The Department of Children and Family Services will update our IVE Adoption Subsidy Process to ensure compliance. Please see below for specific department plan: The Department of Children and Family Services will reeducate staff on existing policies and procedures and update the IV-E Adoption Subsidy Determination process to ensure compliance. Contact person responsible for the corrective action plan: Megan Rooney Anticipated completion date of corrective action: March 31, 2026 Management’s Response: The Department agrees with the findings and will make the necessary updates in our processes and procedures to ensure compliance.

Responsible Official’s Response and Corrective Action Planned: We agree with the finding and recommendations. Thomas University has upgraded its student information system from CAMS to Jenzabar. Thomas University Financial Aid office has an add and drop Report process that runs every day to identify changes in enrollment. Jenzabar has intergraded process that updates the R2T4 withdraw date based on the date input by the Registrar as the Last Date of Attendance according to the Withdraw Record. All Withdraw Records are shared with Financial Aid and the dates are reviewed for accuracy prior to completing calculation. Students are identified as Online or On-Campus students determined by Site. Based on the students’ Site, the number of break days are entered. Jenzabar automatically adjusts any award determined by the calculation process built in Jenzabar. Planned Implementation Date of Corrective Action: This process was created and implemented February 5, 2025. Person Responsible for Corrective Action: Derek Haskins, Director of Financial Aid

Responsible Official’s Response and Corrective Action Planned: We agree with the finding and recommendations. Thomas University has upgraded its student information system from CAMS to Jenzabar. The Financial Aid module Jenzabar Financial Aid has been configured by the Director of Financial Aid with a group process to identify enrollment level changes. This process is programmed to adjust the student scheduled Pell to reflect the updated Pell amount based on the Pell table. This process will reduce the Pell amount if the hours adjust down even when the Pell has already disbursed. This process will also increase the Pell when the hours increase. This process is on a scheduler that runs daily. Planned Implementation Date of Corrective Action: This process was created and implemented 10/01/2024. Person Responsible for Corrective Action: Derek Haskins, Director of Financial Aid

The School will put additional resources in place to ensure monthly reconciliation going forward. Anticiapted date of completion by November 2025

Corrective Action Plan (CAP) Institution: Westchester Community College New York Program Audited: Assistance Listing Number & Title: 84.063 – Federal Pell Grant Prepared for: Submission to Single Audit reporting package through the Federal Audit Clearinghouse (FAC) and Aid, Director, Financial Management Group – Federal Student Aid Date: August 27, 2025 1. Finding Reference • Audit Report Section: [Insert Finding Number/Reference] Finding 2024-001: Refunds of Title IV Funds Calculation and Disbursement Errors (Significant Deficiency - Special Tests and Provisions) • Description of Finding: Summarize the audit finding clearly as stated in the audit report. During the Fall 2023-2024 semester, 125 Pell Grant refund checks totaling $144,576 were issued incorrectly due to failures in the newly implemented student financial aid reporting system. • Errors Identified: 1. 10 checks totaling $11,087 were cashed, with only $1,233 returned to the college. The remaining $9,854 is considered questioned costs. 2. 51 checks totaling $56,263 were cashed, and accounts were later adjusted with student cooperation. 3. 64 checks totaling $77,226 were stopped before payment. 2. Root Cause Analysis • Cause of Noncompliance: Explain why the issue occurred (e.g., lack of internal controls, insufficient training, system error). System and operational failures due to inadequacy of the new student financial aid reporting system. • Contributing Factors: List any secondary factors (e.g., staff turnover, policy misinterpretation). 1. Data integrity issues – Automatic updates resulted in unauthorized entries and inaccurate data. 2. Communication failures – Early reports by staff of system errors were not addressed in a timely manner, resulting in delayed communication. 3. Disbursement errors – Scheduled disbursement dates canceled and rescheduled as a result of system’s inability to package students correctly. 4. SFP processing was inconsistent with US DOE COD system data. 5. Compliance date reporting errors due to SFP processing. 6. Training on the new SFP system was insufficiently provided by the vendor. In-person and self-paced training modules also not provided by the vendor. 7. SFP system contributed to incorrect financial aid packaging, requiring manual reprocessing 8. The SFP system was not aligned with unique community college scheduling features (e.g. parts of term such as winter session, 8-week semesters). 3. Corrective Action Plan Planned Corrective Measures: Detail the specific steps WCC management will take to correct the deficiency. To mitigate further damage, WCC reinstated the prior software system in April 2024, however, since the ISIRs were already determined, manual adjustments were made to students. This required additional corrective action steps: • Manual Data Corrections – Financial aid counselors manually reviewed data on approximately 6400 students and made corrections, student by student. • Reconciliation with G5 Data – Financial aid data had to be manually reconciled with G5, the federal payment system. • Compliance Adjustments – Transaction dates for compliance reporting were corrected. • Award Authorization – Student award amounts required manual verification, authorization, and approval. • Bursar’s Office Delays – Due to system errors, Bursar’s Office delayed processing refunds to prevent further financial discrepancies. • Parallel setup of on-prem financial aid system in March 2024 to prepare for the 2024-25 academic year. • Extraction of 2023-24 academic year financial aid data from SFP system and import into on-prem financial aid system. • Discontinue use of SFP on approximately 7/1/2025. • Responsible Party: Name/Title of the person(s) responsible for implementing corrective action. Garrett McAlister, Vice President of Information Technology; Dawn Gillins, Acting Vice President of Administrative Services/CFO; Dr. Erik Fortune, Assistant Vice President of Administration; Dr. Sandra Ramsey, Director of Enrollment Services; Nicola Howard-Brown, Acting Director of Financial Aid; Richard Cruz, Manager of Fiscal Operations; Garth Walcott, Program Administrator- Bursar Operations; Brian Murphy, former VP of Administrative Services/CFO; Dante Cantu, VP of Student Affairs; Anita Cook, former Director of Financial Aid. • Resources Required: Identify resources such as additional staff, training, IT system upgrades. Additional financial aid professional staff, IT/SFP system consultants. • Timeline: Expected completion date(s) for each corrective measure. Financial aid system remediation and awarding is complete. 2023-24 student financial aid data extraction/import for future reference in process. 4. Monitoring & Follow-Up • Ongoing Oversight - Describe how WCC will monitor to ensure corrective actions remain effective: WCC has a fully documented academic year financial aid project plan that is followed to ensure the timely implementation of tasks. • Internal Review Mechanisms: WCC will include periodic reviews aligned with standard DOE reporting timelines. Increase reconciliation frequency between G5 and COD. Increase periodic reviews, reports to leadership, and internal audit spot checks. 5. Evidence of Implementation • Documentation: List the types of evidence that will be maintained (e.g., revised policies, training logs, updated system reports). Project plan to revert back to previous system, training schedules, policy updates as they occur, and relevant updated system reports. • Retention: Confirm that documentation will be retained in accordance with federal regulations. WCC confirms that documentation will be retained in accordance with federal regulations. 6. Management Certification I certify that the corrective actions described above will be implemented as stated and monitored to ensure full compliance with federal requirements. Signed: Belinda S. Miles Name: Belinda S. Miles, Ed. D. Title: President Date: August 29, 2025

Contact Person: Travis Mickey, Registrar Views of Responsible Officials and Planned Corrective Action: There is no disagreement with the audit finding. The College will collaborate with NSC to evaluate the errors in the file transmissions and to develop procedures to minimize further errors in the future. More specifically, the College will review the reporting procedures for withdrawn and graduating students to ensure the correct information is transmitted to NSLDS. Anticipated Completion Date: 6/30/2025

Cambria County has continued with the following actions which include: maintaining a list of reporting due dates for all fiscal and administrative staff; engagement of external consultants and temporary fiscal staff to support reporting functions if there is staff departure; retain and support existing County staff to maintain institutional knowledge until a dedicated competent Fiscal Officer who is invested in child welfare and county government employment is identified. The department will continue to ensure audit components are included for submissions. The department maintained and will continue communication with oversight entities to ensure transparency regarding reporting timelines, submission delays, fiscal status and corrective actions taken to uphold integrity. These delays were not due to negligence, but rather a strategic and collaborative effort to ensure accuracy and completeness of all required documentation. The department prioritized the integrity of submissions to meet federal audit standards and reimbursement eligibility. These submissions were completed to ensure compliance and to position the CYS department for improved timeliness in the 2025 audit year. The department

Cambria County has continued with the following actions which include: maintaining a list of reporting due dates for all fiscal and administrative staff; engagement of external consultants and temporary fiscal staff to support reporting functions if there is staff departure; retain and support existing County staff to maintain institutional knowledge until a dedicated competent Fiscal Officer who is invested in child welfare and county government employment is identified. The department will continue to ensure audit components are included for submissions. The department maintained and will continue communication with oversight entities to ensure transparency regarding reporting timelines, submission delays, fiscal status and corrective actions taken to uphold integrity. These delays were not due to negligence, but rather a strategic and collaborative effort to ensure accuracy and completeness of all required documentation. The department prioritized the integrity of submissions to meet federal audit standards and reimbursement eligibility. These submissions were completed to ensure compliance and to position the CYS department for improved timeliness in the 2025 audit year. The department prioritized accuracy and completeness, ensuring required audit components were included.

Finding 2024-001: Non-compliance with Special Tests and Provisions: Disbursements Condition For 3 of 25 students selected for testing, the disbursement dates did not agree between the student’s institutional account and the data reported to COD. Each student had disbursements that were later partially or fully refunded. The sample was not a statistically valid sample. Recommendation It is recommended that policies, procedures and effective controls are put in place to verify that the disbursement dates for federal funds are matching between the student account detail and the COD system. Corrective Action The Foundation will ensure that policies, procedures and effective controls are in place to verify the matching of the disbursement dates for federal funds between the student account detail and the COD system. Anticipated completion date of implementing the corrective action plan will be immediate.

Finding #2024-001 – Significant Deficiency and Other Noncompliance. Applicable federal program: U. S. Department of Education, Student Financial Assistance Programs Cluster, Assistance Listing #84.063, Federal Pell Grant Program, Assistance Listing #84.268, Federal Direct Student Loans, Contracts #003556 and G03556, Contract years: 05/05/21 – 12/31/26. Recommendation: Emphasize the importance of accurately reporting enrollment status. Planned corrective action: Management agrees with audit finding #2024-001. The Financial Aid Coordinator is responsible for reporting enrollment status changes, certifying enrollment every 60 days, and responding to NSLDS Roster files within 15 days, all through the NSLDSFAP website. To enhance the accuracy of these enrollment reports, the Institute is implementing a new double-check process. Henceforth, the Financial Aid Coordinator will print all enrollment status changes or enrollment report rosters prior to making any online updates or certifications. These printed reports will then be given to the Director of Operations for verification. Only after this verification will the Financial Aid Coordinator proceed with the necessary changes or certifications on the NSLDSFAP website. All printed reports will be retained by the Financial Aid Coordinator for documentation. Responsible officer: Cody Lopasky, President. Estimated completion date: June 1, 2025.

The Department will enforce policies and procedures to ensure that compliance with the requirements. New internal controls are expected to be implemented to address these findings.

The Department will enforce policies and procedures to ensure that compliance with the requirements. New internal controls are expected to be implemented to address these findings.

The Department will enforce policies and procedures to ensure that compliance with the requirements. New internal controls are expected to be implemented to address these findings.

The Department will enforce policies and procedures to ensure that compliance with the requirements. New internal controls are expected to be implemented to address these findings.