Corrective Action Plans

Finding 386469 (2023-012)

Material Weakness 2023

State of Arkansas

AR

Subrecipient Monitoring Questioned Costs Matching / Level of Effort / Earmarking § 200.302

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. The ADE Finance unit utilized data extracted from the statewide Local Educational Agencies (LEAs) system, APSCN, for the majority of parameters reported. However, APSCN does not h...

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. The ADE Finance unit utilized data extracted from the statewide Local Educational Agencies (LEAs) system, APSCN, for the majority of parameters reported. However, APSCN does not have the ability to cross-reference financial expenses with Local Educational Agency’s (LEAs) personnel data, which led to the creation of the survey. LEAs were expected to report data during a subsequent school year post COVID-19 Pandemic. ADE gathered state total expenses for requested categories from the system compiled with the requested breakdowns by position type obtained in the manual survey. The two data sets did not align, thus seen in Questioned Costs which reflects the difference between the two datasets. LEA actual expenses, associated drawdowns, and disbursements were not affected by the amounts reported in the annual ESSER data. ADE Finance is currently working with APSCN personnel to explore options for assembling data without manual input from LEAs. When implemented, discrepancies in the state data reported to federal systems and LEAs data should not exist. ADE has the goal of utilizing this method for FY23 reporting in May 2024. Anticipated Completion Date: ADE Finance will revise its uploaded FY22 ESSER data template during the allowable period of July 29, 2024, through August 15, 2024. Contact Person: Name: Amy Thomas Title: Accounting Operations Manager Agency: Arkansas Department of Education Address: Four Capitol Mall, Room 204 City, State, Zip: Little Rock, AR, 72201 Phone Number: 501-682-3636 Email Address: Amy.Thomas@ade.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386468 (2023-011)

Material Weakness 2023

State of Arkansas

AR

Subrecipient Monitoring Questioned Costs Matching / Level of Effort / Earmarking § 200.302

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. ADE Finance completed the named report which contained a subtotal error that overstated the totals when provided to Legislative Auditors. However, logic verifications built into t...

Views of Responsible Officials and Planned Corrective Action: Arkansas Department of Education recognizes this finding. ADE Finance completed the named report which contained a subtotal error that overstated the totals when provided to Legislative Auditors. However, logic verifications built into the Federal System disallowed the items mentioned to be submitted. Therefore, the data reflected in Federal reporting for Arkansas was not overstated nor actual expenses and associated drawdowns completed erroneously. This information was confirmed with the U.S. Department of Education (ED) on February 21, 2024. ADE Finance assures that revisions to the FY23 ESSER data template will be made and uploaded to the Federal Reporting System during the allowable period of July 29, 2024, and August 15, 2024. Anticipated Completion Date: Data was effectively corrected at the time of reporting within the Federal System. ADE Finance will revise its uploaded FY23 ESSER data template during the allowable period of July 29, 2024, through August 15, 2024. Contact Person: Name: Amy Thomas Title: Accounting Operations Manager Agency: Arkansas Department of Education Address: Four Capitol Mall, Room 204 City, State, Zip: Little Rock, AR, 72201 Phone Number: 501-682-3636 Email Address: Amy.Thomas@ade.arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386464 (2023-010)

Significant Deficiency 2023

State of Arkansas

AR

Subrecipient Monitoring Student Financial Aid Special Tests & Provisions

Views of Responsible Officials and Planned Corrective Action: We agree with the auditor’s finding and recommendations, and the following corrective action will be taken to improve the situation: • The Director of Computing Services will oversee the review subsections of 16 CFR 314 to ensure complian...

Views of Responsible Officials and Planned Corrective Action: We agree with the auditor’s finding and recommendations, and the following corrective action will be taken to improve the situation: • The Director of Computing Services will oversee the review subsections of 16 CFR 314 to ensure compliance with requirements. o Perform a more thorough GLBA Risk Assessment, which will be used to improve the institution’s security policy and posture. This is outlined in 16 CFR 314(b). o Improve safeguards and more frequent testing to improve system security and threat transparency will be added, including email security and log file monitoring, in addition to other controls as outlined in 16 CFR 314(c) and (d). Several quotes have been acquired and are in the process of being reviewed. o Conduct a review of policies and training, as outlined in 16 CFR 314(e), and mitigate deficiencies in awareness training and policies. o Improve documentation around third-party service providers to ensure compliance with 16 CFR 314(f). o All response plans are to be reviewed and improved as needed because of the Risk Assessment and other monitoring activities to ensure appropriate activities are included and tested at regular intervals. o The institution will develop a compliance document to record efforts according to each section of 16 CFR 314, including those areas that are already compliant. It is the goal of SEARK College to remain in a state of continuous improvement and in compliance with required regulations. The Director of Computing Services will work with the Senior Leadership Team to ensure that appropriate resources are made available, and that activities occur in a timely manner. Anticipated Completion Date: The indicated reviews and assessments are already in progress, with a goal of June 30, 2024, to have fully integrated the stated improvements into our systems and procedures. Contact Person: Name: JoAnn Dupra Title: Director of Computing Services Agency: Southeast Arkansas College Address: 1900 Hazel St City, State, Zip: Pine Bluff, AR 71603 Phone Number: (870) 543-5993 Email Address: jdupra@seark.edu

View Audit 298801

Finding 386459 (2023-009)

Significant Deficiency 2023

State of Arkansas

AR

Student Financial Aid Subrecipient Monitoring Special Tests & Provisions

Views of Responsible Officials and Planned Corrective Action: Management understands the recommendations provided in the finding. We are planning on updating our 2021 Risk Assessment with our campus community in the near future. In accordance with ALA's recommendation, we will focus on GLBA 16 CFR...

Views of Responsible Officials and Planned Corrective Action: Management understands the recommendations provided in the finding. We are planning on updating our 2021 Risk Assessment with our campus community in the near future. In accordance with ALA's recommendation, we will focus on GLBA 16 CFR 314 elements and financial aid data. As with our 2021 Risk Assessment, our plan will be reviewed and accepted by our Chancellor. We intend to have the Risk Assessment updated and reviewed by June 30, 2024. We will also coordinate the risks identified with the extensive list of controls and policies that currently protect student’s financial aid information. These include: Acceptable Use Policy_V7_3.pdf Antivirus and Malware Policy_V2_1.pdf Cloud Services Policy_V1_2.pdf Confluence Screenshots Of Contact Information For Critical Systems (1).pdf Data Classification Policy_V1_2.pdf Data Encryption Policy_V7_1.pdf Data Management Use Protection Policy_V7_2.pdf Data Protection Policy_V7_2 Data Protection Policy_V7_2.pdf Disaster Recovery Business Continuity System Recovery Prioritization List_V1_2.pdf Disaster Recovery Procedure_V1_5.pdf Drive Data Deletion Policy_V7_2.pdf E-Learning Policies_V7_1.pdf Email and Digital Communication Policy_V8_2.pdf Email and Digital Communication Policy_V8_2.pdf Employee Data Deletion Policy_V7_2.pdf Encryption of Sensitive Data on Transmission Policy_V7_2.pdf Faculty Senate Legislation Reference_V6.1.pdf Firewall Blacklist and Whitelist Policy_V7_2.pdf Firewall Management Procedure_V7_2.pdf GLBA Risk assessment.docx Incident Response and Forensic Analysis Procedures_V7_5.pdf IT Employee Departure Procedures_V7_2.pdf IT Security Awareness and Competencies Policy_V1_5.pdf IT Services System Administration Privileged Access Management Policy_V7_2.pdf IT System Backup Procedures_V7_2.pdf IT System Patching Process_V7_3.pdf Lab / Classroom Administrative Rights Exception Request_V6_1.pdf Local Firewall Procedures for Workstations and Mobile Devices_V7_2.pdf Log Review Policy_V2_1.pdf Mobile Device Security - Remote Email Destruction Process_V1_1.pdf Mobile Device Security Policy_V2_1.pdf Multi-factor Authentication - Information Technology Services - UA Little Rock.pdf Network Patching Process_V1_1.pdf PCI Compliance _ Training Policy_V7_2.pdf Physical Security Policy_V1_3.pdf Retention of Records Policies_V7_2.pdf Security and Incident Response Team Policy_V1_3.pdf Security and IT System Access Policy_V1_2.pdf Student Account Deletion Policy_V7_2.pdf System Log Requirements_V8_2.pdf UALR Change Management Policy 2.2.pdf Vendor Remote Access Policy_V1_1.pdf Vulnerability Scan Policy_V7_2.pdf Wireless Network Guest Security Policy_V1_1.pdf Wireless Security Policy_V1_2.pdf Workstation Administrative Rights Exception Request_V6_1.pdf Anticipated Completion Date: June 30, 2024 Contact Person: Name: Gerald J. Ganz, Jr. Title: Vice Chancellor for Finance & Administration Agency: University of Arkansas at Little Rock Address: 2801 S. University Avenue City, State, Zip: Little Rock, AR, 72204 Phone Number: 501-916-5622 Email Address: GJGanz@ualr.edu

View Audit 298801

Finding 386458 (2023-008)

Material Weakness 2023

State of Arkansas

AR

Subrecipient Monitoring § 200.332

Views of Responsible Officials and Planned Corrective Action: ASBO has developed a Notice of Subgrant Award Information Form providing required information to each subrecipient. We have already sent this form out for CPF grants as an amendment to the current grant award. This form will be part of ...

Views of Responsible Officials and Planned Corrective Action: ASBO has developed a Notice of Subgrant Award Information Form providing required information to each subrecipient. We have already sent this form out for CPF grants as an amendment to the current grant award. This form will be part of the subawards that will be issued for the upcoming BEAD subgrants. We are currently developing this form for all SLFRF grants to be sent out as an amendment. It is currently being reviewed for changes. Our goal is to have this form out as an amendment to all SLFRF subgrantees by June 1, 2024. Anticipated Completion Date: June 1, 2024 Contact Person: Name: Glen Howie Title: Director Agency: Department of Commerce, Arkansas State Broadband Office Address: 1 Commerce Way, Suite 601 City, State, Zip: Little Rock, AR 72202 Phone Number: 501-682-1123 Email Address: Glen.howie@arkansasEDC.com

View Audit 298801

Finding 386457 (2023-007)

Material Weakness 2023

State of Arkansas

AR

Procurement, Suspension & Debarment Subrecipient Monitoring § 200.214 § 200.302 § 200.303

Views of Responsible Officials and Planned Corrective Action: ASBO has made the registration at Sam.gov part of the application process that will be handled through the subgrant portal being developed with our new grants monitoring contractor. This will now be an electronic field that will be entere...

Views of Responsible Officials and Planned Corrective Action: ASBO has made the registration at Sam.gov part of the application process that will be handled through the subgrant portal being developed with our new grants monitoring contractor. This will now be an electronic field that will be entered by the subgrantee. The 3rd party administrator will be responsible for verifying the subgrant applicant Sam.gov registration is valid and active. Anticipated Completion Date: System anticipated go live Date: April 26, 2024 Contact Person: Name: Glen Howie Title: Director Agency: Department of Commerce, Arkansas State Broadband Office Address: 1 Commerce Way, Suite 601 City, State, Zip: Little Rock, AR 72202 Phone Number: 501-682-1123 Email Address: Glen.howie@arkansasEDC.com

View Audit 298801

Finding 386456 (2023-006)

Material Weakness 2023

State of Arkansas

AR

Questioned Costs Procurement, Suspension & Debarment Subrecipient Monitoring § 200.303 § 200.403

Views of Responsible Officials and Planned Corrective Action: ASBO has entered a contract with a new 3rd party administrator to provide oversight for all subgrant awardees. This contact is active now. We developed our contract to ensure improved monitoring for expenditures and verification of receip...

Views of Responsible Officials and Planned Corrective Action: ASBO has entered a contract with a new 3rd party administrator to provide oversight for all subgrant awardees. This contact is active now. We developed our contract to ensure improved monitoring for expenditures and verification of receipts. Also, we are in the process of developing a portal which will allow this contractor and ASBO to have full access to all documents from subgrantees. Our new vendor does have prior experience with subgrants management. In addition, ASBO commits internally to the following: • We will monitor all capital purchases when the invoices are received at our office. • We will pull a random sample of five invoices per month and conduct our own review of expenses. Views of Responsible Officials and Planned Corrective Action (Continued): Highlights for the Baker contract: ASBO’s broadband grant program management vendor-partner, Michael Baker International (MBI), is contracted for the following activities and deliverables: • Developing the workflow, process, and online forms that facilitate project monitoring and expense reimbursement. • Responsible for pursuing and documenting additional information required for project monitoring and reimbursement activities. These activities shall be completed within the framework of the Broadband Grants Project Monitoring and Reimbursement System (see below for details) and not through external email or other document exchange system. • Develop and apply standardized naming conventions for all project documents that will be maintained throughout the life of the project. Documents shall be stored in a manner that promotes transparency and facilities ease of use by auditors. • Take all reasonable measures to ensure grant activities are implemented in a manner that ensures transparency, accountability, and oversight sufficient to (1) minimize the opportunity for waste, fraud, and abuse; (2) ensure that subrecipients use funds to further the objectives of Federal programs and the Arkansas State Broadband Office; and (3) allow the public to understand and monitor subgrants awarded under the program. • Ensuring all reimbursement activity complies with Federal requirements, including Section 60102 of the Infrastructure Act, 2 C.F.R. Part 200 and any supplemental guidance issued by the Federal government. • Responsible for knowing what constitutes eligible and ineligible expenses under both state and Federal rules. • Provide education and guidance to subrecipients and the ASBO on key oversight and compliance requirements. • Ensure payment activities follow all state and Federal policies and procedures. Contractor acknowledges policies may change over the life of the contract. • Identify policies the ASBO is required to adopt and assist in drafting those policies to ensure ASBO compliance with Federal regulations. • Assist the Arkansas State Broadband Office in enforcing program rules and laws and imposing penalties for nonperformance, failure to meet statutory obligations, or wasteful, fraudulent, or abusive expenditure of funds. Such penalties include, but are not limited to, imposition of additional award conditions, payment suspension, award suspension, grant termination, de-obligation/clawback of funds, and debarment of organizations and/or personnel. Views of Responsible Officials and Planned Corrective Action (Continued): • Conduct audits of subrecipients as are necessary and appropriate. Contractor shall report the results of any audits it conducts to the Arkansas State Broadband Office. • Develop a template contract for subrecipients, specifying key terms including contract length, performance standards, construction and service rollout schedules, competitive access requirements, regulatory compliance requirements, environmental controls, grant reporting and data sharing requirements, monitoring and oversight procedures, and penalties for non-compliance. • Retain and provide to the Arkansas State Broadband Office upon request all records, documents, and communications of any kind that relates in any manner to grant awards and project procurement, performance, and reimbursement. This data shall be labeled and stored in a manner that promotes transparency and facilitates ease of use by auditors. Additionally, MBI is building two new systems for ASBO and subgrantee use: 1. Broadband Grants Project Monitoring and Reimbursement System 2. Grant Application Submission, Evaluation, Award, and Appeal System These systems will have the following features: • Facilitate inputs, responses, data gathering, analysis, and adjudication decision recommendations and subsequent documentation of payment decisions for the Arkansas State Broadband Office’s final approval. • Provide a secure mechanism for grant applications and safeguard protected, proprietary, and other confidential information. • Assign a unique identifier to each application and each project. Contractor shall develop and apply a standardized naming convention to all applications and associated documents that will be maintained throughout award, technical review, project monitoring, and project closing. Documents shall be named and stored in a manner that facilitates ease of use by auditors. • System shall exhibit built-in quality controls, such as pre-screening, that assist applicants in submitting applications that meet all minimal requirements for consideration (such as requiring a SAM number). • MBI shall be responsible for pursuing and documenting additional information required for clarification of submitted applications, technical reviews of applications, and project monitoring Views of Responsible Officials and Planned Corrective Action (Continued): • and reimbursement activities. These activities shall be completed within the framework of the Grant Application Submission, Evaluation, Award, and Appeal System or the Broadband Grants Project Monitoring and Reimbursement System and not through external email or other document exchange systems. Anticipated Completion Date: System anticipated go live Date: April 26, 2024 Contact Person: Name: Glen Howie Title: Director Agency: Department of Commerce, Arkansas State Broadband Office Address: 1 Commerce Way, Suite 601 City, State, Zip: Little Rock, AR 72202 Phone Number: 501-682-1123 Email Address: Glen.howie@arkansasEDC.com

View Audit 298801 Questioned Costs: $1

Finding 386455 (2023-005)

Significant Deficiency 2023

State of Arkansas

AR

Questioned Costs Subrecipient Monitoring Eligibility § 200.303 § 200.516

Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work sear...

Views of Responsible Officials and Planned Corrective Action: Due to the health concerns of the pandemic as well as unprecedented claims volume, claimants were not required to come into a local office for identity verification, the waiting week was waived for 2020, and the requirements for work search were adjusted in order to protect employees and claimants. Before the pandemic, all claimants were required to come to the local office to verify their identity. Removing these process controls resulted in several consequences as itemized below: • By waiving the waiting week, the claimant was able to receive payment the following week. For example, a fraudster could file a claim on Friday, then receive payment on Sunday, removing the typical week that an employer would respond to validate the separation from employment. • The information mailed to the employer and claimant were not received before payments were made due to the lack of waiting week. • Businesses were closed at that time and did not respond to the unemployment paperwork timely to report fraudulent claims. • Identity theft fraudsters often changed the address of the individuals for which they had filed claims in order to prevent the victims from being notified and reporting the fraud. In 2020, the work search requirement was reinstated. In 2021, all claimants had to verify their identity in-person at the local office before the claim was opened for a regular unemployment claim. The UIdentify program was utilized for identity verification for the PUA claims filed after January 1, 2021. The waiting week was reinstated in January 2021, which lengthened the time period for employers to respond before payment was issued. In addition, Internal Audit created the Fraud Investigation Unit and hired additional staff to focus on investigating the identity theft fraud claims. When the perpetrator is identified, a determination is issued and an overpayment is established in the perpetrator’s name/SSN for collection. The NASWA Integrity Data Hub (IDH) crossmatch was implemented in July 2020 as well in an effort to identify additional fraudulent claims for investigation. ADWS was the first UI program to implement 2 projects with the Department of Labor for identity verification. One is using Login.gov and the other involves the United States Postal Service where they verify the identity of claimants for using multifactor authentication and in person presentation of ID. The Login.gov pilot started in 2022 and the USPS pilot project started in 2023. 1. The Login.gov project uses the current system that Federal agencies use to verify identity and went into service in Arkansas as of March 2022. A link is given to the claimant, when they select verify ID through login.gov and go through the steps to verify their identity through the federal government system. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. 2. The United States Postal Service project, implements in Arkansas March 2023, offers the claimant the same link as Login.gov, but grants the additional option to verify their identity at any US Post Office in the country. A barcode is created and must be taken with a valid government-issued ID (they are given examples) along with proof of current address to the post office in person. If they are approved, we are sent an IA2 verification to the UI processing system to allow staff to match back to the claim to prove ID verification. Anticipated Completion Date: Corrective action was taken for the controls the ALA staff recommended. Contact Person: Name: Sheri Rooney Title: Program Administrator Agency: Division of Workforce Services Address: 2 Capitol Mall City, State, Zip: Little Rock, AR 72201 Phone Number: 501-682-3382 Email Address: Sheri.Rooney@arkansas.gov

View Audit 298801 Questioned Costs: $1

Finding 386454 (2023-004)

Material Weakness 2023

State of Arkansas

AR

Procurement, Suspension & Debarment Subrecipient Monitoring Matching / Level of Effort / Earmarking § 200.214 § 200.303

Views of Responsible Officials and Planned Corrective Action: Department of Human Services Response DHS concurs with the finding. The SNP database has been updated to reflect that a National Disqualified List (NDL) search was run on the 15 providers that were reviewed. The Health and Nutrition Uni...

Views of Responsible Officials and Planned Corrective Action: Department of Human Services Response DHS concurs with the finding. The SNP database has been updated to reflect that a National Disqualified List (NDL) search was run on the 15 providers that were reviewed. The Health and Nutrition Unit for the Office of Early Childhood conducted a staff training on the written application procedure with an emphasis on performing and documenting NDL searches prior to approval of the application. (Note: Effective August 1, 2023, DHS DCCECE has transitioned to Arkansas Department of Education.) Arkansas Department of Education Response Arkansas Department of Education’s Office of Early Childhood, Health and Nutrition unit conducted training December 2023 and continues to maintain staff training on the written application procedure to ensure providers are reviewed against the National Disqualified List (NDL) database and prior to approval. Anticipated Completion Date: Department of Human Services Response Complete Arkansas Department of Education Response Continuous Contact Person: Name: Pamela Burton Title: Director, Health and Nutrition Unit, Division of Elementary and Secondary Education Agency: Arkansas Department of Education Address: 700 Main Street, Room 1216 City, State, Zip: Little Rock, AR, 72203 Phone Number: 501-320-8978 Email Address: Pamela.Burton@ade.arkansas.gov

View Audit 298801

Finding 386440 (2023-004)

Significant Deficiency 2023

T.a. Lawson State Community College

AL

Questioned Costs Subrecipient Monitoring Reporting § 200.328

Management’s Response: The College will strengthen its policies and procedures to ensure documentation of review and approvals for reporting to ensure reporting compliance. Anticipated Completion Date: February 28, 2024

View Audit 298782

Finding 386400 (2023-002)

None 2023

Galva Community Unit School District No. 224

IL

Questioned Costs Subrecipient Monitoring Cash Management § 200.305

Condition - The District's expenditure report filed for June 30, 2023 included expenditures that were not disbursed as of June 30, 2023. These amounts were not reported as committed or obligated and were not liquidated within 90 days of the end of the fiscal year. Plan - Management will monitor exp...

Condition - The District's expenditure report filed for June 30, 2023 included expenditures that were not disbursed as of June 30, 2023. These amounts were not reported as committed or obligated and were not liquidated within 90 days of the end of the fiscal year. Plan - Management will monitor expenditure reports to ensure that amounts claimed have been disbursed prior to submitting the report or included them as obligated. Anticipated Date of Completion - June 30, 2024. Management Response - There is no disagreement with this finding and management will monitor all future federal reimbursement requests. Committed or obligated expenditures will be reported appropriately, and will be liquidated within 90 days of the end of the fiscal year.

View Audit 298743 Questioned Costs: $1

Finding 386396 (2023-001)

Material Weakness 2023

Galva Community Unit School District No. 224

IL

Questioned Costs Subrecipient Monitoring Matching / Level of Effort / Earmarking § 200.305

Condition - The District does not have internal controls in place to prevent expenditure reports being submitted that include expenditures that have not been spent, committed, or obligated. Plan - Management will implement internal controls to ensure proper expenditure reports are being submitted. ...

Condition - The District does not have internal controls in place to prevent expenditure reports being submitted that include expenditures that have not been spent, committed, or obligated. Plan - Management will implement internal controls to ensure proper expenditure reports are being submitted. Anticipated date of Completion - June 30, 2024. Name of Contact Person - Jerry Becker, Superintendent. Management Response - There is no disagreement. The District will implement internal controls to ensure expenditure reports are being submitted accurately.

View Audit 298743

Finding 386320 (2023-002)

Material Weakness 2023

Grand Valley State University

MI

Questioned Costs Subrecipient Monitoring Material Weakness

When the University is unable to access the FFATA system, University staff will capture a screen snip of the error message and save it to the secure shared drive and follow-up with an email to the system’s help desk prior to the 30-day reporting requirement.

View Audit 298711

Finding 386303 (2023-002)

Significant Deficiency 2023

Marymount University

VA

Questioned Costs Student Financial Aid Subrecipient Monitoring

Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Explanation of disagreement with audit finding: There is no disagreement wi...

Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Acquired Isora GRC, a software tool to facilitate and document compliance with GLBA requirements and the corresponding NIST 800-171 information security framework. Management has also created an Enterprise Risk Management Committee which will incorporate compliance with GLBA as a top priority. Name(s) of the contact person(s) responsible for corrective action: Carl Whitman, Associate Vice President and Chief Information Officer (703-526-6901) Planned completion date for corrective action plan: Action plan by June 1, 2024, including decision regarding use of a third party or in-house resources to perform the risk assessment. Completion of 90% of action plan items within one year.

View Audit 298705

Finding 386302 (2023-002)

Significant Deficiency 2023

Calaveras County Water District

CA

Subrecipient Monitoring Period of Performance Reporting § 200.344

Finding 2023-002 – Significant Deficiency Assistance List Number: 97.039 – Hazzard Mitigation Grant Pass-through Agency: California Governor’s Office of Emergency Services, FEMA-4344-DR-CA. Compliance Requirement: Reporting. Condition: The District did not provide project closeout materials to th...

Finding 2023-002 – Significant Deficiency Assistance List Number: 97.039 – Hazzard Mitigation Grant Pass-through Agency: California Governor’s Office of Emergency Services, FEMA-4344-DR-CA. Compliance Requirement: Reporting. Condition: The District did not provide project closeout materials to the pass-through agency within 90 days of the end of the period of performance so the pass-through agency could prepare the closeout reporting within 120 days of the end of the period of performance. Criteria: The Notice of Funding Opportunity indicates: “In addition, pass-through entities are responsible for closing out their subawards as described in 2 C.F.R. § 200.344; subrecipients are still required to submit closeout materials within 90 calendar days of the period of performance end date. When a subrecipient completes all closeout requirements, pass-through entities must promptly complete all closeout actions for subawards in time for the recipient to submit all necessary documentation and information to FEMA during the closeout of the prime award.” Cause: The District’s staff were waiting for a requested extension for the period of performance from the pass-through agency and assumed the closeout reporting would not be necessary. Effect: The District is not in compliance with the terms and conditions of the federal award. Recommendation: We understand the District provided the information necessary to complete the closeout reporting to the pass-through agency on November 30, 2023. Views of Responsible Officials and Planned Corrective Actions: As indicated in the recommendation, the District provided the information necessary to complete the closeout reporting to the pass-through agency on November 30, 2023. Furthermore, on March 22, 2024, the District heard from the pass-through agency that FEMA received the requested extension, and it is in the queue for final approval and signature. The corrective action has been completed.

View Audit 298704

Finding 386296 (2023-001)

Significant Deficiency 2023

Fullerton Joint Union High School District

CA

Allowable Costs / Cost Principles Equipment & Real Property Management Questioned Costs § 200.303 § 200.439

Recommendation: We recommend the District design procedures and controls to ensure adequate prior approval of construction related expenditures charged to the Education Stabilization Fund program. Explanation of disagreement with audit findings: There isno disagreement with the audit finding. Distri...

Recommendation: We recommend the District design procedures and controls to ensure adequate prior approval of construction related expenditures charged to the Education Stabilization Fund program. Explanation of disagreement with audit findings: There isno disagreement with the audit finding. District Response: Name of the contact person responsible for corrective action: Ruben Hernandez, Assistant Superintendent, Business Services. Planned completion date for corrective action plan: Immediate.

View Audit 298701 Questioned Costs: $1

Finding 386267 (2023-002)

Significant Deficiency 2023

Hugo Public School District No. I-39, Choctaw County, Ok

OK

Subrecipient Monitoring Internal Control / Segregation of Duties Questioned Costs

Hugo Schools will communicate to and require that construction contracts provide proof of compliance such as payroll documents or other certifying records. Hugo schools administration will ensure that construction companies under contract will abide by all rules mandated by the Davis Bacon Act

View Audit 298674

Finding 386244 (2023-004)

Material Weakness 2023

Lansing Housing Commission

MI

Subrecipient Monitoring Questioned Costs HUD Housing Programs § 200.334

Condition: The Commission did have required written policies in place during the year under audit or retained copies of grant agreements once they became the direct recipient of the grants. Planned Corrective Action: Management agrees with the finding as reported. To correct this finding, the Commis...

Condition: The Commission did have required written policies in place during the year under audit or retained copies of grant agreements once they became the direct recipient of the grants. Planned Corrective Action: Management agrees with the finding as reported. To correct this finding, the Commission reviewed its policies and procedures and revised as needed to comply with federal regulations. The policies were presented and approved at the August 2023 board meeting. The Commission has sent revised policies to HUD for their review and approval. Contact person responsible for corrective action: Steve Raiche Anticipated Completion Date: 6/30/2024

View Audit 298666

Finding 386243 (2023-003)

Material Weakness 2023

Lansing Housing Commission

MI

Matching / Level of Effort / Earmarking Questioned Costs Subrecipient Monitoring § 200.306

Condition: The Commission was unable to provide adequate source documentation to support that the match requirement was met. Planned Corrective Action: Management agrees that match requirements for Continuum of Care awards have not been maintained as required by the Uniform Guidance. In July 2023, m...

Condition: The Commission was unable to provide adequate source documentation to support that the match requirement was met. Planned Corrective Action: Management agrees that match requirements for Continuum of Care awards have not been maintained as required by the Uniform Guidance. In July 2023, management was notified by HUD after completion of an on-site monitoring visit that the Commission's claimed matching expenses that were not adequately supported by source documentation. In response, management has placed in service additional controls to ensure the compliance requirements are being monitored and in place for the new program. Contact person responsible for corrective action: Steve Raiche Anticipated Completion Date: 6/30/2024

View Audit 298666 Questioned Costs: $1

Finding 386239 (2023-001)

None 2023

Upper Iowa University

IA

Questioned Costs Subrecipient Monitoring

UIU has acknowledged the issues presented and will be working with Columbia Advisory group to address them. This contract began January of 2024, UIU commits to having the Executive Director of Information Technology Systems monitor requirements.

View Audit 298663

Finding 386233 (2023-001)

Significant Deficiency 2023

Ecological Society of America, INC

DC

Procurement, Suspension & Debarment Subrecipient Monitoring

Views of Responsible Officials and Corrective Action: Vendors who are paid for grant funded activities will be checked on the SAM website to be sure they are not disbarred from doing business with the Federal government. A copy of the SAM check will be submitted as part of the check request process....

Views of Responsible Officials and Corrective Action: Vendors who are paid for grant funded activities will be checked on the SAM website to be sure they are not disbarred from doing business with the Federal government. A copy of the SAM check will be submitted as part of the check request process. No payments will be approved unless the paperwork includes a SAM verification check. This applies to vendors, subcontractors, hotels and other partners. It does not apply to travel reimbursements to individuals participating in workshops or other grant funded activities under the participant support line item.Program directors will complete the SAM check and submit the proof with each check request. The CFO and Executive Director will not approve or process check requests that do not include the SAM check. This has been added to the ESA Grant Accounting Policy and Procedures document.

View Audit 298659

Finding 386223 (2023-001)

Significant Deficiency 2023

Rockingham Nutrition and Meals on Wheels Program

NH

Subrecipient Monitoring Reporting Significant Deficiency § 200.328 § 200.329

Audit Finding Reference: 2023-001 Improve Controls Over Reporting Planned Corrective Action: 1. Request a list from DHHS of definitions of income types by program in the Quarterly Reports. Ensure that this list provides clarity on how to report income that is not explicitly tied to a single progr...

Audit Finding Reference: 2023-001 Improve Controls Over Reporting Planned Corrective Action: 1. Request a list from DHHS of definitions of income types by program in the Quarterly Reports. Ensure that this list provides clarity on how to report income that is not explicitly tied to a single program. 2. Review AFY23 and AFY24-to-date reports against these criteria (once received), and re-submit any reports which may need to be modified to comply with the guidance. 3. Going forward, the Quarterly Reports will be generated differently. The Client Services Manager will prepare actuals by program for number of clients and units. The Director of Administration will prepare actuals by program for income and expense. The Executive Director will compile the final report, which will not be submitted until both the Client Services Manager and Director of Administration have both checked the reports and electronically signed them. In the absence of specific guidance from DHHS to the contrary, any non-program-specific income will be allocated to programs by share of service units delivered. Planned Implementation Date of Corrective Action: 1. 3/29/24. 2. 6/30/24. 3. 4/15/24. Person Responsible for Corrective Action: Tim Diaz, Executive Director

View Audit 298652

Finding 386211 (2023-001)

Significant Deficiency 2023

Puerto Rico Traffic Safety Commission

PR

Subrecipient Monitoring Reporting

SEE THE AUDIT FINDING FOR CHART/TABLE

View Audit 298638

Finding 386210 (2023-002)

None 2023

Lebanon Valley College

PA

Student Financial Aid Matching / Level of Effort / Earmarking Subrecipient Monitoring

Finding 2023-002 – Enrollment Reporting Condition: The College did not notify the National Student Loan Data System (NSLDS) in a timely manner for 1 student with a status change out of a sample of 25 tested. Management Response: Management concurs with the finding. Views of Responsible Officials and...

Finding 2023-002 – Enrollment Reporting Condition: The College did not notify the National Student Loan Data System (NSLDS) in a timely manner for 1 student with a status change out of a sample of 25 tested. Management Response: Management concurs with the finding. Views of Responsible Officials and Corrective Action Plan: Lebanon Valley College uses the National Student Clearinghouse (NSC) to transmit enrollment information to the National Student Loan Data System (NSLDS). The College has verified that the student status changes were correctly submitted to the NSC, however the campus and program level information was not properly reflected in NSLDS and did not appear on the error report. This appears to be connected to the outages experienced by NSLDS. The College’s Financial Aid Office, along with the Registrar’s office will begin verifying the number of students on the NSLDS student roster each semester. The roster number will be compared to the number of students expected to be on the roster per Financial Aid data. Any discrepancies in this number will be researched and the discovery of any that did not reach NSLDS will be corrected in conjunction with the NSC and NSLDS. Anticipate Completion Date: April 1, 2024 Name of Responsible Person: Christopher Hanlon, Director of Financial Aid chanlon@lvc.edu

View Audit 298636

Finding 386208 (2023-001)

Significant Deficiency 2023

Lincoln County Board of Education

GA

Subrecipient Monitoring Reporting Special Tests & Provisions § 200.303

FA 2023-001 Strengthen Controls over Wage Rate Requirements Compliance Requirement: Special Tests and Provisions Internal Control Impact: Significant Deficiency Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of Education Pass-Through Entity: Georgia Departmen...

FA 2023-001 Strengthen Controls over Wage Rate Requirements Compliance Requirement: Special Tests and Provisions Internal Control Impact: Significant Deficiency Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of Education Pass-Through Entity: Georgia Department of Education Assistance Listing Number and Title: COVID-19 - 84.425U - American Rescue Plan Elementary and Secondary School Emergency Relief Fund Federal Award Number: S425U210012 (Year: 2021) Questioned Costs: None Identified Prior Year Finding: Not Applicable Description: A review of construction-related expenditures charged to the Elementary and Secondary School Emergency Relief Fund programs revealed that the School District's internal control procedures were not operating to ensure that Wage Rage Requirements were followed properly. Corrective Action Plans: The School District will review and update the current procedures to ensure that the Wage Rate requirements are met. Estimated Completion Date: June 30, 2024 Contact Person: Dr. Samuel P. Light, Superintendent Telephone: (706) 359-3742 Email: slight@lcboe.us

View Audit 298629

Corrective Action Plans

Filters