Corrective Action Plans

Finding 386772 (2023-001)

None 2023

Big Brothers Big Sisters of Central Ohio, Inc. & Subsidiaries

OH

Subrecipient Monitoring Cash Management Reporting

Finding Number: 2023-001 Condition: The Organization failed to submit monthly reimbursement requests to the Franklin County Department of Job and Family Services by their due dates during the year ended June 30, 2023. Planned Corrective Action: The Organization will ensure that an appropriate staf...

Finding Number: 2023-001 Condition: The Organization failed to submit monthly reimbursement requests to the Franklin County Department of Job and Family Services by their due dates during the year ended June 30, 2023. Planned Corrective Action: The Organization will ensure that an appropriate staffing level and sufficient training will be achieved and maintained. The Organization will also implement system and process improvements to ensure timely submission. Contact Person Responsible for Corrective Action: Elizabeth Martinez, President and CEO Anticipated Completion Date: April 30, 2024

View Audit 299048

Finding 386721 (2023-001)

Significant Deficiency 2023

Maine Maritime Academy

ME

Questioned Costs Subrecipient Monitoring Eligibility

Finding 2023-001: Student Financial Assistance Cluster – Eligibility – Award Limits Name of Contact Person: Alice Herrick, Director of Fiscal Operations; Ryan French, Director of Financial Aid Corrective Action Plan Introduction: This Corrective Action Plan addresses the significant deficienc...

Finding 2023-001: Student Financial Assistance Cluster – Eligibility – Award Limits Name of Contact Person: Alice Herrick, Director of Fiscal Operations; Ryan French, Director of Financial Aid Corrective Action Plan Introduction: This Corrective Action Plan addresses the significant deficiency identified in the audit regarding the review of student enrollment data prior to loan approval. The deficiency resulted in one noted student receiving a federal loan disbursement above their annual eligibility limit, and two students who each received a federal loan disbursement below their annual eligibility limit. We acknowledge the issue and have implemented immediate corrective measures to rectify the situation and prevent recurrence. Root Causes Analysis: The deficiency stemmed from two main factors: a. Limitations of PowerFAIDS: The software lacks automated quality control mechanisms to prevent overawarding or overdisbursement. Additionally, the software’s database design poses a challenge due to the “one-to-many” relationship of Periods of Enrollment (POE), making automated packaging algorithms which address this deficiency impossible. b. Staff Awareness: Financial aid staff were unaware of PowerFAIDS' limitations and lacked clear guidance on necessary quality control procedures. Immediate Corrective Actions Implemented: In response to the deficiency, the following actions have been taken: a. Manual Quality Control Procedure: A manual review process has been established prior to each semester's disbursement date. This process includes verifying student enrollment data and identifying discrepancies between self-reported class levels (PF: "F-YR-SCHOOL") and official class progression (PC: "academic_class_level", PF: "POE-YR-SCHL"). b. Repackaging and Communication: Students with verified discrepancies in class levels are repackaged accordingly and updated financial aid offer letters/emails are sent to notify students of changes and request their consideration. Confirmation of Effectiveness: A thorough review of the 2023-2024 academic year data confirms that no current students have been awarded or disbursed above their annual eligibility limit, validating the effectiveness of the implemented quality control procedure. Future Mitigation Strategies: To further mitigate the risk of noncompliance and reduce manual review time, the following strategies will be implemented: a. Dynamic Custom Field in PowerFAIDS: Proposing the creation of a dynamic custom field (e.g., “PC_ACL_Progression”) that updates student class levels via API integration with PowerCampus. b. Automated Packaging Rule: Developing an automated packaging rule within PowerFAIDS based on the dynamic custom field to identify Year In School (YIS) mismatches and trigger necessary repackaging. This rule will incorporate the YIS Mismatch quality control function and algorithm, reducing the time commitment necessary for manual review. Timeline for Implementation: While a current manual process is in place, the proposed future mitigation is forthcoming. a. Manual Quality Control Procedure: This procedure was put into effect by Financial Aid staff on November 16th, 2023, and was successfully implemented prior to Spring 2024 disbursement. All current disbursements of Federal TitleIV aid have been made in accordance with U.S. Department of Education criteria. b. Future Mitigation: The proposed dynamic custom field and automated packaging rule will be developed and implemented within the next academic year to streamline the quality control process and enhance compliance measures. Conclusion: Maine Maritime Academy is committed to ensuring compliance with U.S. Department of Education regulations and providing accurate and appropriate financial aid awards to students. The corrective actions outlined in this plan address the deficiencies identified in the Uniform Guidance audit and aim to prevent similar issues in the future. We appreciate the audit findings and remain dedicated to continuous improvement in our financial aid procedures. Name of Contact Person: Alice Herrick, Director of Fiscal Operations; Ryan French, Director of Financial Aid Corrective Action Plan: The Academy will review current procedures related to awarding Unsubsidized and Subsidized loans and implement additional review procedures to ensure awards to students are appropriately within limits set by the Department of Education. Planned Completion Date: June 2024

View Audit 299012 Questioned Costs: $1

Finding 386713 (2023-008)

Material Weakness 2023

City of Peabody

MA

Subrecipient Monitoring Material Weakness Reporting

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Treasury The City of Peabody, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Qu...

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Treasury The City of Peabody, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Quannapowitt Parkway, Suite 101 Wakefield, MA 01880 Audit period: July 1, 2022 through June 30, 2023 The finding from the June 30, 2023, schedule of findings and questioned costs is discussed below. The finding is numbered consistently with the number assigned in the schedule. FINDINGS—FEDERAL AWARD PROGRAMS AUDITS U.S. DEPARTMENT OF EDUCATION Passed through Massachusetts Department of Elementary and Secondary Education Education Stabilization Fund Education Stabilization Fund Federal Assistance Listing No. 84.425D, 84.425U and 84.425W 2023-008: Reporting to the State Compliance Requirement: Reporting Type of Finding: Compliance and Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement: Grantees must comply with reporting requirements established by the Massachusetts Department of Elementary and Secondary Education, the City’s Pass-Through Grantor (State). In order for the State to comply with federal reporting requirements, the City is required to submit complete and accurate “Recipient Data Collection Forms” to the State. Condition: The City was unable to provide copies of the Recipient Data Collection Forms submitted to the State. Context: The City did not maintain sufficient documentation to demonstrate compliance with grant reporting requirements. Effect: The City has not complied with the grant requirements. Cause: Management has not established guidelines and procedures to ensure and demonstrate that required reporting is completed, retained, and available upon request. Questioned Costs: None reported. Recommendation: The City should implement internal control procedures to ensure compliance with all grant requirements including the completion and retention of all required reports. The documentation should be filed in an organized manner and readily available upon request. Views of Responsible Officials and Planned Corrective Actions: The School District will implement internal control procedures to ensure that the required reporting is completed, retained and maintained in an organized manner. Management plans to implement these procedures in 2024. If the Oversight Agency has questions regarding this plan, please call Samuel Rippin, School Business Manager, at 978-536-6520. Sincerely yours, Samuel Rippin School Business Manager City of Peabody

View Audit 299007

Finding 386705 (2023-007)

Material Weakness 2023

City of Peabody

MA

Questioned Costs Equipment & Real Property Management Procurement, Suspension & Debarment

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Treasury The City of Peabody, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Qu...

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Treasury The City of Peabody, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Quannapowitt Parkway, Suite 101 Wakefield, MA 01880 Audit period: July 1, 2022 through June 30, 2023 The finding from the June 30, 2023, schedule of findings and questioned costs is discussed below. The finding is numbered consistently with the number assigned in the schedule. FINDINGS—FEDERAL AWARD PROGRAMS AUDITS U.S. DEPARTMENT OF EDUCATION Passed through Massachusetts Department of Elementary and Secondary Education Education Stabilization Fund Education Stabilization Fund Federal Assistance Listing No. 84.425D, 84.425U and 84.425W 2023-007: Controls for the Purchase of Capital Equipment Compliance Requirement: Equipment/Real Property Management Type of Finding: Compliance and Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement: Grantees must obtain prior approval from the pass-through entity for capital expenditures related to general and special purpose equipment purchases. Condition: The City was required to obtain prior approval from the pass-through entity for capital expenditures related to general or special purpose equipment. The City purchased security camera equipment and was unable to provide evidence that prior approval was obtained. Context: The City did not maintain sufficient documentation to demonstrate that approval was obtained prior to the purchase of capital equipment. Effect: The City has not complied with the grant requirements. Cause: Management has not established guidelines and procedures to ensure that approval is obtained prior to the purchase of capital equipment and that documentation of the approval is retained. Questioned Costs: The City expended a total of $4,564,014 in Education Stabilization Funds in 2023, of which $619,967 was charged to a contract services account. Of the total charged to the contract services account, $302,687 was selected for testing and $73,629 was spent on the purchase of security camera equipment without prior approval from the pass-through entity. Recommendation: The City should implement internal control procedures to ensure compliance with all grant requirements including the need to obtain prior approval from the pass-through entity for capital expenditures paid from the Education Stabilization Funds grants. The documentation should be filed in an organized manner and readily available upon request. Views of Responsible Officials and Planned Corrective Actions: The School District will implement internal control procedures to ensure that the required approvals are obtained and the documentation is maintained in an organized manner. Management plans to implement these procedures in 2024. If the Oversight Agency has questions regarding this plan, please call Samuel Rippin, School Business Manager, at 978-536-6520. Sincerely yours, Samuel Rippin School Business Manager City of Peabody

View Audit 299007 Questioned Costs: $1

Finding 386697 (2023-006)

Material Weakness 2023

City of Peabody

MA

Questioned Costs Allowable Costs / Cost Principles Subrecipient Monitoring

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Treasury The City of Peabody, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Qu...

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Treasury The City of Peabody, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Quannapowitt Parkway, Suite 101 Wakefield, MA 01880 Audit period: July 1, 2022 through June 30, 2023 The finding from the June 30, 2023, schedule of findings and questioned costs is discussed below. The finding is numbered consistently with the number assigned in the schedule. FINDINGS—FEDERAL AWARD PROGRAMS AUDITS U.S. DEPARTMENT OF EDUCATION Passed through Massachusetts Department of Elementary and Secondary Education Education Stabilization Fund Education Stabilization Fund Federal Assistance Listing No. 84.425D, 84.425U and 84.425W 2023-006: Controls for Monitoring Payroll Charged to the Grant Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Compliance and Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement: Grantees must provide reasonable assurance that Federal Awards are expended only for allowable activities and that the costs of goods and services charged to Federal awards are allowable and in accordance with applicable cost principles. Condition: Payroll expenditures charged to the Education Stabilization Fund grant are required to be supported with documentation (i.e., semi-annual certifications and personnel activity reports) substantiating that the employees are eligible to be charged to the grant and that the payroll charged relates to time spent accomplishing grant objectives. The City utilizes semi-annual time and effort certification forms to document the eligibility of the employees paid out of the grant. These forms, however, were not completed for each employee charged out of the grant. Context: The City did not maintain sufficient documentation to demonstrate compliance with federal and state time and effort reporting requirements in accordance with the provisions of Title 2 U.S. Code of Federal Regulations Part 225 Cost Principals for State, Local, and Indian Tribal Governments. Effect: The City has not complied with the federal and state time and effort reporting requirements. Cause: Management has not established written guidelines and procedures outlining the time and effort reporting and documentation requirements that department heads must adhere with to ensure compliance with federal and state time and effort reporting requirements. Such guidelines and procedures should indicate under what circumstances semi-annual certifications and personnel activity reports (PARS) are required. Management also has not adopted and implemented standardized forms that include all data as required by federal and state guidelines to demonstrate compliance with these requirements. Questioned Costs: Total payroll costs charged to the grant in 2023 totaled $3,487,658, which was paid on a bi-weekly basis throughout the year. Three of the pay periods were selected for testing, which totaled $440,173 for 83 employees paid out of the grant during those pay periods. From the pay periods selected for testing, $440,173 of known questioned costs were identified. Repeat Finding: This matter was reported as a finding in the previous year as finding 2022-003. Recommendation: The City should establish written policies and procedures outlining the time and effort reporting and documentation requirements that must be adhered with to ensure compliance with federal and state time and effort reporting requirements. Management should adopt and implement standardized forms that include all data required by federal and state guidelines and provide training to ensure that program personnel understand the time and effort reporting requirements. Views of Responsible Officials and Planned Corrective Actions: The School District will immediately begin reissuing and recollecting the forms for the education stabilization grant for 2024, as well as into future periods. If the Oversight Agency has questions regarding this plan, please call Samuel Rippin, School Business Manager, at 978-536-6520. Sincerely yours, Samuel Rippin School Business Manager City of Peabody

View Audit 299007 Questioned Costs: $1

Finding 386685 (2023-003)

Material Weakness 2023

City of Peabody

MA

Questioned Costs Allowable Costs / Cost Principles Subrecipient Monitoring

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Treasury The City of Peabody, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Qu...

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Treasury The City of Peabody, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Quannapowitt Parkway, Suite 101 Wakefield, MA 01880 Audit period: July 1, 2022 through June 30, 2023 The finding from the June 30, 2023, schedule of findings and questioned costs is discussed below. The finding is numbered consistently with the number assigned in the schedule. FINDINGS—FEDERAL AWARD PROGRAMS AUDITS U.S. DEPARTMENT OF EDUCATION Passed through Massachusetts Department of Elementary and Secondary Education Title I Grants to Local Educational Agencies Title I Grants to Local Educational Agencies Federal Assistance Listing No. 84.010 2023-003: Controls for Monitoring Payroll Charged to the Grant Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Compliance and Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement: Grantees must provide reasonable assurance that Federal Awards are expended only for allowable activities and that the costs of goods and services charged to Federal awards are allowable and in accordance with applicable cost principles. Condition: Payroll expenditures charged to the Title I grant are required to be supported with documentation (i.e., semi-annual certifications and personnel activity reports) substantiating that the employees are eligible to be charged to the grant and that the payroll charged relates to time spent accomplishing grant objectives. The City utilizes semi-annual time and effort certification forms to document the eligibility of the employees paid out of the grant. These forms, however, were not completed for each employee charged out of the grant. Context: The City did not maintain sufficient documentation to demonstrate compliance with federal and state time and effort reporting requirements in accordance with the provisions of Title 2 U.S. Code of Federal Regulations Part 225 Cost Principals for State, Local, and Indian Tribal Governments. Effect: The City has not complied with the federal and state time and effort reporting requirements. Cause: Management has not established written guidelines and procedures outlining the time and effort reporting and documentation requirements that department heads must adhere with to ensure compliance with federal and state time and effort reporting requirements. Such guidelines and procedures should indicate under what circumstances semi-annual certifications and personnel activity reports (PARS) are required. Management also has not adopted and implemented standardized forms that include all data as required by federal and state guidelines to demonstrate compliance with these requirements. Questioned Costs: Total payroll costs charged to the grant in 2023 totaled $919,109, which was paid on a bi-weekly basis throughout the year. Three of the pay periods were selected for testing, which totaled $110,714 for 28 employees paid out of the grant during those pay periods. From the pay periods selected for testing, $110,714 of known questioned costs were identified. Repeat Finding: This matter was reported as a finding in the previous year as finding 2022-002. Recommendation: The City should establish written policies and procedures outlining the time and effort reporting and documentation requirements that must be adhered with to ensure compliance with federal and state time and effort reporting requirements. Management should adopt and implement standardized forms that include all data required by federal and state guidelines, and provide training to ensure that program personnel understand the time and effort reporting requirements. Views of Responsible Officials and Planned Corrective Actions: The School District will immediately begin reissuing and recollecting the forms for the Title I grant for 2024, as well as into future periods. If the Oversight Agency has questions regarding this plan, please call Samuel Rippin, School Business Manager, at 978-536-6520. Sincerely yours, Samuel Rippin School Business Manager City of Peabody

View Audit 299007 Questioned Costs: $1

Finding 386679 (2023-002)

Material Weakness 2023

City of Peabody

MA

Questioned Costs Allowable Costs / Cost Principles Subrecipient Monitoring

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Treasury The City of Peabody, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Qu...

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Treasury The City of Peabody, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Quannapowitt Parkway, Suite 101 Wakefield, MA 01880 Audit period: July 1, 2022 through June 30, 2023 The finding from the June 30, 2023, schedule of findings and questioned costs is discussed below. The finding is numbered consistently with the number assigned in the schedule. FINDINGS—FEDERAL AWARD PROGRAMS AUDITS U.S. DEPARTMENT OF EDUCATION Passed through Massachusetts Department of Elementary and Secondary Education Special Education Cluster Special Education Grants to States Federal Assistance Listing No. 84.027 Special Education Preschool Grants Federal Assistance Listing No. 84.173 2023-002: Controls for Monitoring Payroll Charged to the Grant Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Compliance and Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement: Grantees must provide reasonable assurance that Federal Awards are expended only for allowable activities and that the costs of goods and services charged to Federal awards are allowable and in accordance with applicable cost principles. Condition: Payroll expenditures charged to the Special Education Cluster grant are required to be supported with documentation (i.e., semi-annual certifications and personnel activity reports) substantiating that the employees are eligible to be charged to the grant and that the payroll charged relates to time spent accomplishing grant objectives. The City utilizes semi-annual time and effort certification forms to document the eligibility of the employees paid out of the grant. These forms, however, were not completed for each employee charged out of the grant. Context: The City did not maintain sufficient documentation to demonstrate compliance with federal and state time and effort reporting requirements in accordance with the provisions of Title 2 U.S. Code of Federal Regulations Part 225 Cost Principals for State, Local, and Indian Tribal Governments. Effect: The City has not complied with the federal and state time and effort reporting requirements. Cause: Management has not established written guidelines and procedures outlining the time and effort reporting and documentation requirements that department heads must adhere with to ensure compliance with federal and state time and effort reporting requirements. Such guidelines and procedures should indicate under what circumstances semi-annual certifications and personnel activity reports (PARS) are required. Management also has not adopted and implemented standardized forms that include all data as required by federal and state guidelines to demonstrate compliance with these requirements. Questioned Costs: Total payroll costs charged to the grant in 2023 totaled $1,794,406, which was paid on a bi-weekly basis throughout the year. Three of the pay periods were selected for testing, which totaled $156,211 for 65 employees paid out of the grant during those pay periods. From the pay periods selected for testing, $156,211 of known questioned costs were identified. Repeat Finding: This matter was reported as a finding in the previous year as finding 2022-001. Recommendation: The City should establish written policies and procedures outlining the time and effort reporting and documentation requirements that must be adhered with to ensure compliance with federal and state time and effort reporting requirements. Management should adopt and implement standardized forms that include all data required by federal and state guidelines and provide training to ensure that program personnel understand the time and effort reporting requirements. Views of Responsible Officials and Planned Corrective Actions: The School District will immediately begin reissuing and recollecting the forms for the special education grant for 2024, as well as into future periods. If the Oversight Agency has questions regarding this plan, please call Samuel Rippin, School Business Manager, at 978-536-6520. Sincerely yours, Samuel Rippin School Business Manager City of Peabody

View Audit 299007 Questioned Costs: $1

Finding 386676 (2023-001)

Significant Deficiency 2023

City/county Association of Governments of San Mateo County

CA

Subrecipient Monitoring Reporting § 200.332 § 200.501

To improve the communication of the nature of the federal funding and associated requirements, C/CAG will ensure that future federal pass-through grant agreements include the following information and language: (1) The specific portion of funding that is federal funds, the Federal Awarding Agency, f...

To improve the communication of the nature of the federal funding and associated requirements, C/CAG will ensure that future federal pass-through grant agreements include the following information and language: (1) The specific portion of funding that is federal funds, the Federal Awarding Agency, full funding amount and applicable Federal Project Number, listing number and title. (2) A portion of the funds included are federal funds, and the recipient is responsible for compliance with all relevant Federal requirements, including, but not limited to § 200.501 Audit requirements and 2 CFR § 200.332 Requirements for pass-through entities.

View Audit 298992

Finding 386667 (2023-002)

Material Weakness 2023

Villa of Hope

NY

Procurement, Suspension & Debarment Subrecipient Monitoring Allowable Costs / Cost Principles

Views of Responsible Officials and Planned Corrective Actions: The Organization has reviewed its invoice approval process, and has notified staff of the requirement to approve and code invoices for payment. The Accounts Payable Specialist is monitoring compliance, and forwarding invoices for appro...

Views of Responsible Officials and Planned Corrective Actions: The Organization has reviewed its invoice approval process, and has notified staff of the requirement to approve and code invoices for payment. The Accounts Payable Specialist is monitoring compliance, and forwarding invoices for approval where necessary. Invoices pertaining to recurring expenses are approved either via the credit card expense report or invoice approval processes.

View Audit 298985

Finding 386661 (2023-002)

Significant Deficiency 2023

Palmdale School District

CA

Subrecipient Monitoring Reporting Significant Deficiency

With the COVID-19 health pandemic came significant response and relief federal revenues in the General Fund. These funds included reporting requirements that had vague instructions and little subsequent clarifying information. The first GEER and ESSER Annual Report that was submitted on January 29, ...

With the COVID-19 health pandemic came significant response and relief federal revenues in the General Fund. These funds included reporting requirements that had vague instructions and little subsequent clarifying information. The first GEER and ESSER Annual Report that was submitted on January 29, 2021, requested Full-Time Equivalent (FTE) position data for four different historical dates (9/30/2018, 9/30/2019, 3/13/2020, and 9/30/2020). The District has documentation that agreed and supports three of the four figures reported to the California Department of Education (CDE); however, the supporting documentation for the 9/30/2019 FTE figure did not agree to the figure reported. The report contained the FTE of 1,714.00, but the supporting documentation maintained by the District had an FTE of 2,177.96. Unfortunately, the Fiscal Services Administrator who completed the calculation and submitted the report left employment with the District in June of 2021, so we are unable to determine why a different FTE figure was submitted than showed on the supporting backup documentation maintained by the District. Upon inquiry of the supporting documentation by the external auditors, the District recalculated the position FTE figures for the same period and the District has concluded that the 1,714.00 FTE figure submitted was incorrect.

View Audit 298972

Finding 386631 (2023-003)

Significant Deficiency 2023

The Colorado College and Subsidiaries

CO

Subrecipient Monitoring

Condition: During testing we noted the following exceptions: • The College does not have a written risk management section in their IT policies. • Safeguards were not clearly linked in their policy. It was not documented that the College conducts a periodic inventory of data, noting where it's colle...

Condition: During testing we noted the following exceptions: • The College does not have a written risk management section in their IT policies. • Safeguards were not clearly linked in their policy. It was not documented that the College conducts a periodic inventory of data, noting where it's collected, stored, or transmitted. There was no written policy regarding program development and software practices in relation to sensitive information. There was no evidence indicating a discussion to standardize the use of MFA for end users. • The College does not have a written policy that identifies continuous monitoring or control testing that takes place periodically. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action in Response to Finding: Colorado College has established a continuous monitoring of IT systems through agents deployed by OculusIT (Cyber Security consultants). The College will document these and develop a policy for monitoring and regular control testing. The policy will detail the frequency and responsibilities of these activities. Name of the contact person responsible for corrective action: Tulio Wolford, Deputy CIO Planned completion date for corrective action plan: May 31, 2024

View Audit 298956

Finding 386620 (2023-001)

Significant Deficiency 2023

Town of Gilbert, Arizona

AZ

Subrecipient Monitoring Reporting Significant Deficiency § 200.303

Finding Number: 2023‐001 Program Name/Assistance Listing Title: CDBG – Entitlement Grants Cluster Assistance Listing Number: 14.218 Contact Person: Linda Ayres, Community Resource Program Supervisor Anticipated Completion Date: March 2024 Planned Corrective Action: Management will strength...

Finding Number: 2023‐001 Program Name/Assistance Listing Title: CDBG – Entitlement Grants Cluster Assistance Listing Number: 14.218 Contact Person: Linda Ayres, Community Resource Program Supervisor Anticipated Completion Date: March 2024 Planned Corrective Action: Management will strengthen the Town’s system of internal procedures by providing additional reporting measures for first‐tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). As of the date of this report, management has submitted reports for current subcontracts greater than $30,000 and will submit reports moving forward by the end of the month following the month in which subawards greater than $30,000 are awarded.

View Audit 298939

Finding 386618 (2023-002)

Material Weakness 2023

Department of Transportation - Airports Division, State of Hawaii

HI

Subrecipient Monitoring Matching / Level of Effort / Earmarking Material Weakness

Condition: During the audit, it was determined that there is no control function in place by the Airports staff to ensure that wage rate compliance with weekly certified payrolls is occurring. Planned Corrective Action: Certified payroll registers that are uploaded in the Airport web-based databases...

Condition: During the audit, it was determined that there is no control function in place by the Airports staff to ensure that wage rate compliance with weekly certified payrolls is occurring. Planned Corrective Action: Certified payroll registers that are uploaded in the Airport web-based databases will be checked monthly by HDOT staff, to detect and correct matters related to wage rate requirements. Non-compliance notices will be issued to the third party consultants when missing information or errors are identified. Contact person responsible for corrective action: Karen Honda, Acting Fiscal Management Officer Anticipated Completion Date: June 30, 2024

View Audit 298935

Finding 386607 (2023-004)

Significant Deficiency 2023

Municipality of Coamo

PR

Subrecipient Monitoring Reporting Significant Deficiency § 200.332

COMMONWEALTH OF PUERTO RICO MUNICIPALITY OF COAMO Corrective Action Plan For the Fiscal Year Ended June 30, 2023 _____________________________________________________________________________________________________________________ Audit Report: Reports on Compliance and Internal Control in Acc...

COMMONWEALTH OF PUERTO RICO MUNICIPALITY OF COAMO Corrective Action Plan For the Fiscal Year Ended June 30, 2023 _____________________________________________________________________________________________________________________ Audit Report: Reports on Compliance and Internal Control in Accordance with Government Auditing Standards and OMB Super Circular Uniform Guidance Audit Period: July 1, 2022 – June 30, 2023 Fiscal Year: 2022-2023 Principal Executive: Hon. Juan C. García Padilla, Mayor Contact Person: Mrs. Miraisa David Esparra, Finance and Budget Director Phone: (787) 825-1150 Original Finding Number: 2023-004 Statement of Concurrence or Non concurrence: We concur with the finding. Corrective Action: The Program Director is aware about the compliance requirement. We gave instructions to the Program Director to maintain a dateline control sheet to ascertain that required reports were submitted within the due date. Implementation Date: March 21, 2024 Responsible Person: Mr. Héctor R. Sanjurjo Rodríguez Federal Programs Director

View Audit 298919

Finding 386592 (2023-001)

Significant Deficiency 2023

Tohono O'Odham Community College

AZ

Student Financial Aid Special Tests & Provisions Subrecipient Monitoring

TOCC RESPONSE TO 2023-001 (Significant Deficiency) Tohono O'odham Community College’s written information security program will be amended immediately to require multi-factor authentication for Jenzabar, the College’s data management system, and for PowerFAIDS, the student financial aid software. M...

TOCC RESPONSE TO 2023-001 (Significant Deficiency) Tohono O'odham Community College’s written information security program will be amended immediately to require multi-factor authentication for Jenzabar, the College’s data management system, and for PowerFAIDS, the student financial aid software. Multi-Factor Authentication, now available through Jenzabar’s “Jenzabar 1” upgrade, which is in the cloud, and which TOCC transitioned to in January and February 2024, will be implemented by June 30, 2024. Multi-factor authentication for Jenzabar will be set up using the Microsoft Hybrid Identity Services within the Microsoft Azure Cloud Architecture. In addition, not later than June 30, 2024, PowerFAIDS software, currently the “desktop” edition, will be transitioned to the cloud-based product that accommodates MFA. Dean for Sustainability Dr. Mario Montes-Helu, is responsible for implementation of this plan.

View Audit 298877

Finding 386580 (2023-013)

Significant Deficiency 2023

State of Mississippi Institutions of Higher Learning

MS

Subrecipient Monitoring Significant Deficiency § 200.303

Department of Education 2023-013 The Gramm-Leach-Bliley Act (GLBA)Compliance (ASU) Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Auditors’ Recommendation: The Institution is required to perform Safeguards that address the required areas noted in GLBA 16 CFR 31...

Department of Education 2023-013 The Gramm-Leach-Bliley Act (GLBA)Compliance (ASU) Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Auditors’ Recommendation: The Institution is required to perform Safeguards that address the required areas noted in GLBA 16 CFR 314.4, which are (1) the Institution designated a Qualified Individual responsible for implementing and monitoring the Institution’s information security program, (2) the Institution’s written information security program addresses the required minimum seven elements. CLA identified that the organization does not meet compliance requirements outlined in the GLBA Safeguards Rule. The institution’s policy identifies a qualified individual (such as a CIO, ISO, CISO) responsible for the Information Security program. In addition, the written information security program (WISP) did not address certain required elements. CLA recommends that the safeguards are updated/performed per GLBA requirements. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Center for Information Technology Services is moving towards completion of the GLBA 16 CFR 314.4 requirements: a) Fully Compliant b) Fully Compliant c) Partially Compliant d) Fully Compliant e) Fully Compliant f) Vendor Management policy and program in design g) Fully Compliant h) IR Plan in draft i) Not Completed To address “Qualified Individual”, the university has retained vCISO services of Pileum, reporting to the CIO. Pileum is providing annual risk assessments and assisting with authoring/auditing required controls, policy, procedures, and security program documentation. All in-progress requirements and the published university statement of compliance will be completed by May 31, 2024 Name(s) of the contact person(s) responsible for corrective action: Desmond L. Stewart, Interim Chief Information Officer Planned completion date for corrective action plan: May 31, 2024 If the U.S. Department of Education has questions regarding these plans, please call Juanita Edwards at 601-877-6672. 2023-013 The Gramm-Leach-Bliley Act (GLBA) Compliance (MVSU) Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Auditors’ Recommendation: The Institution is required to perform Safeguards that address the required areas noted in GLBA 16 CFR 314.4, which are (1) the Institution designated a Qualified Individual responsible for implementing and monitoring the Institution’s information security program, (2) the Institution’s written information security program addresses the required minimum seven elements. CLA identified that the organization does not meet the following compliance requirements outlined in the GLBA Safeguards Rule. (b.1b) The institution has been approved by the individual leading the information security program (b.3) The institution’s written information security program and verify the implementation of safeguards b.3.1 to b.3.8. (b.3.5) the institution's written information security program identifies the use of multi-factor authentication for individuals accessing sensitive information across systems. (b.3.7) the institution’s written information security program includes an adopted change management policy with procedures documented accordingly. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: We have engaged with Pileum Corporation, who have given us a Cybersecurity Scorecard. This scorecard evaluated on five NIST controls: 1. Identify, 2. Protect, 3. Detect, 4. Respond, and 5. Recover. The scorecard tells us what is: 1. Effectively controlled, 2. Gaps identified, and 3. Not implemented. According to this report, there are 60% of the items listed that are not yet implemented. One of the main points of interest is the lack of a comprehensive plan which fully addresses: 1. Information systems, including network and software design, as well as information processing, storage, transmission, and disposal and 2. Detecting, preventing and responding to attacks, intrusion, or other systems failures. We are making this a priority to complete by the end of December 2024. Name of the contact person responsible for corrective action: Dameon A. Shaw, Vice President for University Advancement, External Relations and Information Security. Planned completion date for corrective action plan: December 2024. If the Department of Education has any questions regarding this plan, please call Dameon Shaw at 662-254-3790.

View Audit 298874

Finding 386538 (2023-007)

Material Weakness 2023

Metropolitan School District of Warren County

IN

Special Tests & Provisions Subrecipient Monitoring Material Weakness § 200.303

Finding 2023-007 – Education Stabilization Fund – Special Tests and Provisions - Wage Rate Requirements Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur with the finding. Description of Corrective ...

Finding 2023-007 – Education Stabilization Fund – Special Tests and Provisions - Wage Rate Requirements Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: MSD Warren has construction projects at two sites payable out of ARP. MSD Warren’s contracts for those projects contain Davis-Bacon provisions. MSD Warren will collect payroll data to verify compliance with Davis-Bacon. Anticipated Completion Date: 12/15/24

View Audit 298830

Finding 386537 (2023-006)

Significant Deficiency 2023

Metropolitan School District of Warren County

IN

Internal Control / Segregation of Duties Reporting Significant Deficiency § 200.302 § 200.303 § 200.328

Finding 2023-006 – Education Stabilization Fund – Reporting Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: MSD Warren will submit a revis...

Finding 2023-006 – Education Stabilization Fund – Reporting Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: MSD Warren will submit a revised ESSER data report to DOE. Anticipated Completion Date: Completed as of the date of this report.

View Audit 298830

Finding 386533 (2023-004)

Significant Deficiency 2023

Metropolitan School District of Warren County

IN

Internal Control / Segregation of Duties Significant Deficiency Matching / Level of Effort / Earmarking

Finding 2023-004 – Title I Grants to Local Educational Agencies - Special Test and Provisions – Annual Report Card, High School Graduation Rate Audit Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur...

Finding 2023-004 – Title I Grants to Local Educational Agencies - Special Test and Provisions – Annual Report Card, High School Graduation Rate Audit Contact Person Responsible for Corrective Action: Matthew Parkinson, CFO Contact Phone Number: 317-869-4364 Views of Responsible Official: We concur with the finding. Description of Corrective Action Plan: The CFO and Associate Superintendent will send a memo to principals and registrars defining documentation that must be maintained for mobility purposes. Anticipated Completion Date: 6/30/24

View Audit 298830

Finding 386511 (2023-001)

Material Weakness 2023

Arts and Humanities Council of Montgomery County, Inc.

MD

Subrecipient Monitoring § 200.332

Views of Responsible Officials: AHCMC acknowledges that it does not have a formal documented subrecipient policy that complies with all requirements of the Uniform Guidance. AHCMC will correct this deficiency by ensuring that every subaward is clearly identified to the subrecipient as a Federal pass...

Views of Responsible Officials: AHCMC acknowledges that it does not have a formal documented subrecipient policy that complies with all requirements of the Uniform Guidance. AHCMC will correct this deficiency by ensuring that every subaward is clearly identified to the subrecipient as a Federal pass-through subaward and that the agreement includes the Assistance Listing Number. AHCMC will also assign a risk level to each subrecipient and use monitoring tools to ensure that subrecipients are spending the funds appropriately. AHCMC will also ensure that subrecipients have a single audit if required.

View Audit 298805

Finding 386498 (2023-001)

None 2023

City of Methuen

MA

Questioned Costs Allowable Costs / Cost Principles Subrecipient Monitoring

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Education The City of Methuen, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Q...

CORRECTIVE ACTION PLAN Oversight Agency for Audit: U.S. Department of Education The City of Methuen, Massachusetts respectfully submits the following corrective action plan for the year ended June 30, 2023. Name and address of independent public accounting firm: Powers & Sullivan, LLC 100 Quannapowitt Parkway, Suite 101 Wakefield, MA 01880 Audit period: July 1, 2022, through June 30, 2023 The finding from the June 30, 2023, schedule of findings and questioned costs is discussed below. The finding is numbered consistently with the number assigned in the schedule. FINDINGS—FEDERAL AWARD PROGRAMS AUDITS U.S. DEPARTMENT OF EDUCATION Passed through Massachusetts Department of Elementary and Secondary Education Special Education Cluster #84.027, 84.173 Title I #84.010 Education Stabilization Fund #84.425 2023-001: Controls for Monitoring Payroll Charged to the Grant Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Compliance and Internal Control Over Compliance – Other Matter Criteria or Specific Requirement: Grantees must provide reasonable assurance that Federal Awards are expended only for allowable activities and that the costs of goods and services charged to Federal awards are allowable and in accordance with applicable cost principles. Condition: Payroll expenditures charged to the grants are required to be supported with documentation (i.e., semi-annual certifications and personnel activity reports) substantiating that the employees are eligible to be charged to the grant and that the payroll charged relates to time spent accomplishing grant objectives. The City utilizes semi-annual time and effort certification forms to document the eligibility of the employees paid out of the grant. These forms, however, were not completed for each employee charged out of the grant for fiscal year 2023. Context: The City did not maintain sufficient documentation to demonstrate compliance with federal and state time and effort reporting requirements in accordance with the provisions of Title 2 U.S. Code of Federal Regulations Part 225 Cost Principals for State, Local, and Indian Tribal Governments. Effect: The City has not complied with the federal and state time and effort reporting requirements. Cause: Turnover in the grant manager role led to time and effort documentation not being completed for fiscal year 2023. Management should follow their written guidelines and procedures outlining the time and effort reporting and documentation requirements that department heads must adhere with to ensure compliance with federal and state time and effort reporting requirements. Such guidelines and procedures should indicate under what circumstances semi-annual certifications and personnel activity reports (PARS) are required. Questioned Costs: Total payroll costs charged to the grants in 2023 is as follows: Recommendation: The City should follow their written policies and procedures outlining the time and effort reporting and documentation requirements that must be adhered with to ensure compliance with federal and state time and effort reporting requirements. Management should ensure the standardized forms are approved by the individual in charge of the grant and overseen by grant management personnel. This will ensure compliance is not impacted by employee turnover in the future. Views of Responsible Officials and Planned Corrective Actions: The School District will immediately begin reissuing and recollecting the time and effort documentation for the impacted grants for 2023, as well as into future periods. If the Oversight Agency has questions regarding this plan, please call Ian Gosselin, Assistant Superintendent of Finance and Operations, at 978-722-6018. Sincerely, Ian Gosselin Assistant Superintendent of Finance and Operations City of Methuen, Massachusetts

View Audit 298802 Questioned Costs: $1

Finding 386496 (2023-032)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Eligibility § 200.303 § 200.516

Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work sear...

Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work search were adjusted in order to protect employees and claimants. Before the pandemic, all claimants were required to come to the local office to verify their identity. Removing these process controls resulted in several consequences as itemized below: • By waiving the waiting week, the claimant was able to receive payment the following week. For example, a fraudster could file a claim on Friday, then receive payment on Sunday, removing the typical week that an employer would respond to validate the separation from employment. • The information mailed to the employer and claimant were not received before payments were made due to the lack of waiting week. • Businesses were closed at that time and did not respond to the unemployment paperwork timely to report fraudulent claims. • Identity theft fraudsters often changed the address of the individuals for which they had filed claims in order to prevent the victims from being notified and reporting the fraud. In 2020, the work search requirement was reinstated. In 2021, all claimants had to verify their identity in-person at the local office before the claim was opened for a regular unemployment claim. The UIdentify program was utilized for identity verification for the PUA claims filed after January 1, 2021. The waiting week was reinstated in January 2021, which lengthened the time period for employers to respond before payment was issued. In addition, Internal Audit created the Fraud Investigation Unit and hired additional staff to focus on investigating the identity theft fraud claims. When the perpetrator is identified, a determination is issued and an overpayment is established in the perpetrator’s name/SSN for collection. The NASWA Integrity Data Hub (IDH) crossmatch was implemented in July 2020 as well in an effort to identify additional fraudulent claims for investigation. ADWS was the first UI program to implement 2 projects with the Department of Labor for identity verification. One is using Login.gov and the other involves the United States Postal Service where they verify the identity of claimants for using multifactor authentication and in person presentation of ID. The Login.gov pilot started in 2022 and the USPS pilot project started in 2023. 1. The Login.gov project uses the current system that Federal agencies use to verify identity and went into service in Arkansas as of March 2022. A link is given to the claimant, when they select verify ID through login.gov and go through the steps to verify their identity through the federal government system. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. 2. The United States Postal Service project, implements in Arkansas March 2023, offers the claimant the same link as Login.gov, but grants the additional option to verify their identity at any US Post Office in the country. A barcode is created and must be taken with a valid government-issued ID (they are given examples) along with proof of current address to the post office in person. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. Anticipated Completion Date: Corrective action was taken for the ALA staff recommendations. Contact Person: Name: Sheri Rooney Title: Program Administrator Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3382 Email Address: Sheri.Rooney@arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386495 (2023-031)

Material Weakness 2023

State of Arkansas

AR

Special Tests & Provisions Subrecipient Monitoring Material Weakness

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will request that CMS grant a full exemption from the requirement that a state enter a contract with a Medicaid Recovery Audit Contractor. Anticipated Completion Date: 5/31/2024 Contact Person: ...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency will request that CMS grant a full exemption from the requirement that a state enter a contract with a Medicaid Recovery Audit Contractor. Anticipated Completion Date: 5/31/2024 Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801

Finding 386494 (2023-030)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Eligibility Special Tests & Provisions

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visit...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. Effective May 31, 2019, DMS established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider application documents, provider revalidation, site visits and fingerprint background requirements. The deficiency noted for the provider referenced in sample item 21 relates to non-compliance with site visit requirements pre-dating May 31, 2019 and CMS’s approval of the agency’s corrective action plan. A site visit was performed for this provider on 8/31/2023. The agency has created system controls that require site visits before a moderate or high-risk provider may enroll with Arkansas Medicaid. The provider noted in sample item 29 began the revalidation process in December of 2019 and their application was set to terminate at the end of February 2020. The provider was not terminated before beginning of the Public Health Emergency (PHE) with their revalidation date being reset to 9/5/2023 when the CMS 1135 waiver flexibilities were implemented. The provider has since timely completed the revalidation process. The provider noted in sample item 32 did not keep its certification up to date for the audit period. During the PHE, many licensing and certification agencies were not processing new requests or renewals for extended periods of time. A review of this provider’s information revealed that it is likely that they would have been able to maintain continued certification. The agency has automated its certification verification process to terminate providers if a certification lapses for any reason. Anticipated Completion Date: Complete Contact Person: Name: Elizabeth Pitman Title: Director, Division of Medical Services Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-244-3944 Email Address: Elizabeth.Pitman@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386493 (2023-029)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Eligibility

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency is in the process of developing an MMIS change that will automatically update member profiles to accurately reflect incarceration dates. This will ensure capitated payments are paused and reinstat...

Views of Responsible Officials and Planned Corrective Action: DHS concurs with the finding. The agency is in the process of developing an MMIS change that will automatically update member profiles to accurately reflect incarceration dates. This will ensure capitated payments are paused and reinstated in a timely manner and that recoupments and repayments are subsequently processed. The agency is conducting an ARIES system review to determine the root cause of the incorrect eligibility determinations and will identify and implement any needed updates to the automatic renewal process. Anticipated Completion Date: 6/30/2024 Contact Person: Name: Mary Franklin Title: Director, Division of County Operations Agency: Department of Human Services Address: 700 Main Street City, State, Zip: Little Rock, AR 72201 Phone Number: 501-681-8377 Email Address: Mary.Franklin@dhs.arkansas.gov

View Audit 298801 Questioned Costs: $1

Corrective Action Plans

Filters