Corrective Action Plans

Finding 46424 (2022-003)

Significant Deficiency 2022

City of Toledo

OH

Subrecipient Monitoring

The City will enhance its internal controls over reporting and review federal guidance for reporting under FFATA requirements. 9-30-2023 Melanie Campbell, Interim Finance Director.

View Audit 46466

Finding 46401 (2022-006)

Material Weakness 2022

New Mexico Department of Homeland Security & Emergency Management

NM

Subrecipient Monitoring § 200.332 § 200.521

SUBRECIPIENT MONITORING Recommendation: We recognize the agency has established a policy over sub-grant recipient files effective June 29, 2017. We recommend the policy begin to be enforced in fiscal year 2023. Also, we recommend any updating to the policy for implementation of effective interna...

SUBRECIPIENT MONITORING Recommendation: We recognize the agency has established a policy over sub-grant recipient files effective June 29, 2017. We recommend the policy begin to be enforced in fiscal year 2023. Also, we recommend any updating to the policy for implementation of effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable federal laws, regulations, and compliance requirements of various federal grants. Corrective Action: The Department understands this issue. Administrative Services Bureau does complete subrecipient monitoring via desktop review and uses a monitoring checklist housed in the subgrant files. The Department has onboarded a Grants Unit Manager to include oversight of the subrecipient monitoring process. The process is currently being reviewed, modified, and implemented. Now that COVID restrictions have been lifted significantly, the Sub Grant Analysts will include physical monitoring visits as well as desk monitoring reviews as part of their job duties in FY23. Due Date of Completion: June 30, 2023 Responsible Person(s): Chief Financial Officer, Grants Unit Manager

View Audit 40971

Finding 46399 (2022-004)

Material Weakness 2022

New Mexico Department of Homeland Security & Emergency Management

NM

Cash Management Subrecipient Monitoring Material Weakness § 200.303

CASH MANAGEMENT Recommendation: We realize the Department continues to have staff turnover. We recommend the Department review its process and implement effective policies, procedures, and controls to ensure the accounting records appropriately reflect the activity of the grant. The Department sh...

CASH MANAGEMENT Recommendation: We realize the Department continues to have staff turnover. We recommend the Department review its process and implement effective policies, procedures, and controls to ensure the accounting records appropriately reflect the activity of the grant. The Department should consider efficiencies to make the process less cumbersome. While the Department has existing processes at the federal program level, there appears to be a need for higher level monitoring and reconciliation of federal program activity to ensure the completeness of federal program-level reconciliations and reimbursements. The Department should consider further contracting with an outside third party to aid in the process of performing reconciliations and billings. The deficit fund balance in the Federal Grants Fund (40280) should be reviewed and addressed. The Department should evaluate the need to obtain a deficiency appropriation or some other funding to cover this deficit. Corrective Action: The Department partially understands the issue. The Department will internally audit our expenditures to ensure that all transactions include an operating unit. The Department will also establish a checklist to include that all signatures are collected and that applicable documentation is received for reimbursement purposes. As part of our Sub Grant recipient review for Assistance Listings 97.036 and 97.067, we cannot reimburse the subrecipient until they submit applicable receipts for reimbursement and answer all requests for information as required by FEMA. Due Date of Completion: June 30, 2023 Responsible Person(s): Chief Financial Officer, Grants Unit Manager

View Audit 40971

Finding 46396 (2022-043)

Material Weakness 2022

State of West Virginia

WV

Subrecipient Monitoring § 200.303 § 200.332

SUBRECIPIENT MONITORING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 A new grant monitor has been hired for the recovery grants managed by DEM. The monitor has reviewed and updated the agency policies related to subrecipient monitoring and is conducting t...

SUBRECIPIENT MONITORING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 A new grant monitor has been hired for the recovery grants managed by DEM. The monitor has reviewed and updated the agency policies related to subrecipient monitoring and is conducting training with other program staff to ensure understanding. The Public Assistance (PA) Program in DEM has completed the Risk Assessment for 2022 using the risk assessment tool and identified the highest risk project worksheets. DEM is reviewing the municipal audits conducted by the State Auditor?s office for PA sub-recipients. DEM has developed a Monitoring Plan for the coming year and completed a calendar of upcoming monitoring visits. DEM is using the FEMA approved monitoring protocol and the subrecipient monitoring standards outlined in 2 CFR 200.303, and it is our belief that we are complying with all applicable regulations and requirements.

View Audit 40967

Finding 46395 (2022-042)

Material Weakness 2022

State of West Virginia

WV

Procurement, Suspension & Debarment Subrecipient Monitoring Reporting § 200.303

REPORTING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 To resolve the finding and refine our processes through our new understanding of the requirements, DEM will re-evaluate all Federal Funding Accountability and Transparency Act (FFATA) reports that hav...

REPORTING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 To resolve the finding and refine our processes through our new understanding of the requirements, DEM will re-evaluate all Federal Funding Accountability and Transparency Act (FFATA) reports that have already been submitted in the FFATA Subaward Reporting System (FSRS) this year for accuracy and adherence to the requirements. Upon review, any needed corrections will be made, and the reports will be re-submitted. Further, DEM met with Public Assistance and other grant program leads to relay the newly understood expectations and to review the finding for further input and resolution. DEM will implement a procedural checkpoint between program staff and internal auditing staff to ensure that the information submitted is correct and complete. All FFATA reporting will continue to be based upon obligations and not payments, original subaward obligations will be reported within 45 days of obligation, any additional subaward obligation amendment will be reported within 45 days of obligation, all subawards reported will include a project description, and all submitted reports will have a review requiring the signature of the person submitting the report as well as one additional staff member that audits the report against the available information. These updates are expected to be completed and implemented by May 2023.

View Audit 40967

Finding 46374 (2022-037)

Material Weakness 2022

State of West Virginia

WV

Special Tests & Provisions Subrecipient Monitoring Matching / Level of Effort / Earmarking § 200.303

SPECIAL TEST AND PROVISIONS - ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 The DHHR utilizes an external service organization for the design, development, implementation, an...

SPECIAL TEST AND PROVISIONS - ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 The DHHR utilizes an external service organization for the design, development, implementation, and operation of the West Virginia Medicaid Management Information System (MMIS). The system furnishes the core MMIS functionality to support the State's Medicaid program, including maintaining provider, member/recipient, and reference/procedure code data, as well as processing and adjudication rules for claims, encounters, and prior authorizations. The system also provides configuration and system management tools to govern access to data, user security, and communications. The system is an object-oriented, rules-based software program that is designed to manage multiple lines of health care business. The system employs a unified relational database that enables efficient use of data and consistent information throughout all applications. The system includes functionality for claims processing and adjudication, provider administration, benefit plan and policy administration, member administration, and medical service authorization management. The service organization has developed a variety of policies and procedures including related control activities to help ensure their objectives are carried out and risks are mitigated. The control environment includes control objectives related to claims input (hard copy/paper claims and electronic claims); claims processing; claims payment; file maintenance (provider master file, recipient master file, and procedure codes); logical access (passwords and authentication, adding and modifying user access, terminating user access, access to privileged functions, and access review monitoring); change management; production scheduling; and backup procedures. Control activities are performed at a variety of levels throughout the organization and at various stages during the relevant business or information technology process. As expected, controls may be preventive or detective in nature and may encompass a range of manual and automated controls, including authorizations, reconciliations, and information technology controls. The service organization has a formal program in place to review and update the service organization's policies and procedures on at least an annual basis. Any changes to the policies and procedures are reviewed and approved by the service organization?s management and communicated to its employees. As indicated in the Condition section of this finding, the DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report from its service organization on an annual basis. For the period ended June 30, 2022, although the DHHR did not formally document its review of the service organization?s SOC 1 Type 2 report, the DHHR did indeed review it and can hereby confirm that the service organization provided an assertion about the fairness of the presentation of the description and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives stated in the description. The service organization was responsible for preparing the description and assertion, including the completeness, accuracy, and method of presentation of the description and assertion; providing the services covered by the description; specifying the control objectives and stating them in the description; identifying the risks that threaten the achievement of the control objectives; selecting the criteria stated in the assertion; and designing, implementing, and documenting controls that are suitably designed and operating effectively to achieve the related control objectives stated in the description. The DHHR can also hereby confirm that the service organization?s service auditor conducted the examination in accordance with attestation standards established by the American Institute of Certified Public Accountants. Those standards required the service auditor to plan and perform the examination to obtain reasonable assurance about whether, in all material respects, based on the criteria in the service organization?s assertion, the description is fairly presented, and the controls were suitably designed and operating effectively to achieve the related control objectives stated in the description throughout the specified period. Finally, the DHHR can hereby confirm that in the service auditor?s opinion, in all material respects, based on the criteria described in the service organization?s assertion: 1) the description fairly presented the West Virginia MMIS that was designed and implemented throughout the period July 1, 2021 to June 30, 2022; 2) the controls related to the control objectives stated in the description were suitably designed to provide reasonable assurance that the control objectives would be achieved if the controls operated effectively throughout the period July 1, 2021 to June 30, 2022 and the subservice organizations and the user entity applied the complementary controls assumed in the design of the service organization?s controls throughout the period July 1, 2021 to June 30, 2022; and 3) the controls operated effectively to provide reasonable assurance that the control objectives stated in the description were achieved throughout the period July 1, 2021 to June 30, 2022 if the complementary subservice organizations and the user entity controls assumed in the design of the service organization?s controls operated effectively throughout the period July 1, 2021 to June 30, 2022. The DHHR is of the opinion that it is in compliance with 45 CFR 95.621 since it receives and reviews the SOC 1 Type 2 report from the service organization and since the report documents that the service organization establishes and maintains a program for conducting periodic risk analyses to ensure appropriate, cost-effective safeguards are incorporated into new and existing systems or whenever significant system changes occur. However, the DHHR recognizes the concern expressed within this finding, in that the DHHR does not include the SOC 1 Type 2 report as part of its own policies and procedures for ADP security over the MMIS. To enhance its controls, the DHHR will implement a policy and related procedures to document MMIS compliance with 45 CFR 95.621. The procedures will include but not be limited to a requirement to review and approve the SOC 1 Type 2 report from the MMIS service organization and document the review and approval process (e.g., for such matters as the service organization?s assertions, descriptions of its systems and controls, control objectives, and related controls, and the service auditor?s description of tests of controls and results). The anticipated date for implementation of the policy and related procedures is September 30, 2023, which is prior to the anticipated date for receipt of the next SOC 1 Type 2 report from the service organization.

View Audit 40967

Finding 46358 (2022-039)

Material Weakness 2022

State of West Virginia

WV

Internal Control / Segregation of Duties Subrecipient Monitoring Reporting § 200.303

TRANSPARENCY ACT REPORTING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.788 For the one report that had an incorrect subaward amount, the subrecipient?s DUNS number was mistakenly keyed into the FSRS system as the subaward amount. For the one report that was not sub...

TRANSPARENCY ACT REPORTING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.788 For the one report that had an incorrect subaward amount, the subrecipient?s DUNS number was mistakenly keyed into the FSRS system as the subaward amount. For the one report that was not submitted timely, the DHHR awarded the grant to the subrecipient on December 5, 2021. The amount of the subaward was $220,000. The identifying information for the subaward was submitted to FSRS.gov on January 30, 2022, which was timely. On June 2, 2022, the DHHR approved a change order to the subaward, which increased the amount of the subaward to $502,131. Accordingly, the FSRS report was reopened on July 29, 2022, whereby the subaward amount was increased to $502,131. However, the report was not actually submitted within the FSRS system until November 8, 2022. Both of these instances were due to human error and were passed on to the appropriate offices within the DHHR. The staff member in charge of the FFATA reporting for the DHHR was made aware of the instances in an effort to improve controls and has corrected the reports in FSRS.

View Audit 40967

Finding 46335 (2022-029)

Material Weakness 2022

State of West Virginia

WV

Subrecipient Monitoring Reporting § 200.303

TRANSPARENCY ACT REPORTING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558, 93.568, COVID-19 93.568 The Office of Grants Management, Division of Grant Administration and Reporting, is responsible for submitting the FFATA reports for the DHHR. The FF...

TRANSPARENCY ACT REPORTING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558, 93.568, COVID-19 93.568 The Office of Grants Management, Division of Grant Administration and Reporting, is responsible for submitting the FFATA reports for the DHHR. The FFATA reports are available for all newly issued subawards and change orders throughout the DHHR each month. The source for these FFATA reports is the DHHR's subrecipient Grants Management Solution system (CRM) and an interface with the state accounting system (wvOASIS). Grants Management reviews each federal Notice of Grant Award to determine if reporting is required. Notes are input on the FFATA reports for each subaward as to whether that subaward is being reported or not. Grants Management then uploads and reviews the required data elements onto FSRS.gov before the reports are electronically submitted. For prior DHHR grant awards (e.g., fiscal year 2021), even if the DHHR passed through a portion of the award to other components of the State of West Virginia (i.e., other non-federal entities that are governmental agencies of the state but are external to the DHHR), the DHHR considered those other governmental agencies to be subrecipients of the DHHR instead of being part of the state's prime recipient tier. This viewpoint proved to be incorrect because transfers of federal awards to another component of the same auditee under 2 CFR 200, Subpart F, do not constitute a subrecipient or contractor relationship; furthermore, a grant agreement is the only means by which the DHHR can pass through a portion of the federal award to state agencies that are external to the DHHR. During fiscal year 2022, the DHHR revised its practice when awarding funds to agencies of the state that are external to the DHHR. The DHHR began considering those other governmental agencies to be part of the state?s prime recipient tier instead of being first tier subrecipients of the DHHR. Accordingly, when transferring federal awards to another state agency, the DHHR Office of Grants Management and DHHR Spending Units started working together as necessary to ensure that all subawardee information for the state is complete and accurate. During fiscal year 2022, the DHHR also revisited its standard grant agreement template in relation to other state agencies. Although changes to the main body of the grant agreement were not necessary, the DHHR made a revision to Exhibit G (?Required Reports?) of the agreement. When a ?grant? was provided to another state agency using federal funds as the source of the grant, in whole or in part, the Office of Grants Management instructed the spending unit to review the detailed line-item budget and conduct other pre-award procedures as may be necessary (e.g., inquiring of the other state agency) to determine if the other state agency planned to subgrant a portion of the funds. If the other state agency planned to subgrant a portion of the funds, the Office of Grants Management required the spending unit to include a clause within Exhibit G of the grant agreement that required the other state agency to provide the FFATA data to the spending unit on a monthly basis (due 15 days after the end of each month). Upon receiving the FFATA data from the other state agency, the spending unit was then required to submit the information to the DHHR Office of Grants Management for purposes of timely FFATA reporting to FSRS.gov. Prior to October 5, 2022, this process was accomplished via informal discussions (e.g., emails to and from other state agencies, monitoring calls, meetings held between the Office of Grants Management and spending units on a regular basis, etc.). Effective October 5, 2022, the DHHR formalized this process via a system directive from DHHR Finance to all users of the DHHR's subrecipient Grants Management Solution system (CRM). These additional controls should resolve the condition that led to the LIHEAP portion of the finding. For the TANF portion, the Context section of the finding references subawards from the West Virginia Department of Education (DOE). As additional context, when issuing their subawards, it should be noted that the DOE utilized TANF monies that it had received from the DHHR. When passing through the money to the DOE, the DHHR utilized a grant agreement since such an agreement is the only means by which the DHHR could pass through a portion of the award to another state agency. During fieldwork for the West Virginia Single Audit, the DOE informed the State?s independent auditors that the DOE subgranted a portion of the TANF funds to five different subrecipients; the State?s independent auditors then informed the DHHR. This was unbeknownst to the DHHR at the time. From a general regulatory perspective, the DHHR grant agreement required the DOE to obtain prior written approval from the DHHR before entering into any subgrant agreements with the funds. From a budgetary perspective, the DOE was required to contact the DHHR spending unit for prior approval and specific instructions regarding the subgranting of DHHR awards; provide the names of each organization that would receive subgrants, when known; and provide an overall narrative stating the purpose of each subgrant. From the FFATA perspective, the DHHR spending unit was required to utilize the DOE?s budgetary narrative, add a related reporting requirement within Exhibit G of the grant agreement, and utilize the resulting disclosures when submitting data to the DHHR Office of Grants Management for purposes of accurate FFATA reporting to FSRS.gov. The breakdown in controls happened because the DOE did not obtain prior written approval from the DHHR spending unit prior to entering into the subgrant agreements and did not indicate any subgrant expenditures within their quarterly financial reports and reconciliations of payments received and actual expenditures incurred, all of which are required per the terms and conditions of the DHHR grant. To enhance the controls, the DHHR spending unit will increase the level of risk associated with the DOE and will impose additional award conditions upon the DOE, such as requiring the DOE to submit certifications or written representations regarding subawards in the future, as are authorized per 2 CFR 200.209 (?Certifications and representations?).

View Audit 40967

Finding 46314 (2022-041)

Material Weakness 2022

State of West Virginia

WV

Subrecipient Monitoring § 200.303

INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.788, 93.575, COVID-19 93.575, 93.596, 93.558, COVID-19 93.558, 93.323, COVID-19 93.323 In an effort to enhance the manner by which it documents the assessment of risk, DHHR Fi...

INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.788, 93.575, COVID-19 93.575, 93.596, 93.558, COVID-19 93.558, 93.323, COVID-19 93.323 In an effort to enhance the manner by which it documents the assessment of risk, DHHR Finance has developed a Risk Assessment Form and Certification for the Award and Monitoring of Grants. Prior to submitting a draft grant agreement to DHHR Finance for processing, the spending unit will be required to complete the risk assessment form, affix any supporting documentation if desired or deemed necessary for proper disclosure, and upload a copy of the package to the Document Manager section of DHHR's subrecipient Grants Management Solution system (CRM). As part of their review of the draft grant agreement, the Office of Grants Management will check the Document Manager section of CRM to ensure the form is uploaded, completed in full, and signed by the Spending Unit. If the form is not in the Document Manager section of CRM or is incomplete, the Office of Grants Management will return the grant agreement to the Spending Unit via the standard workflow process. To ensure these additional controls surrounding Grantee evaluations and monitoring are working as intended, the Office of Internal Control and Policy Development will select a sample of forms to review on an intermittent basis; discuss the forms, the process for completing the forms, and the backup documentation with the Spending Unit if deemed necessary; and report the results to the DHHR Chief Financial Officer for further action or instructions. The risk assessment form and process are currently in draft form and under internal review. If approved, the form and process will be effective for all grant awards with a start date beginning on or after July 1, 2023. To enhance the manner by which the DHHR documents the level of monitoring during various stages of the grant, the DHHR still plans to break out the mandatory monitoring checklist (i.e., the certifications required within the checklist) into multiple parts, which will include documenting subrecipient risk and the monitoring activities that are performed throughout the life cycle of the grant. Although the formal corrective action plan in the prior year indicated that the estimated date for completion was September 30, 2022, the estimated date for completion at this stage is July 1, 2023.

View Audit 40967

Finding 46287 (2022-025)

Significant Deficiency 2022

State of West Virginia

WV

Subrecipient Monitoring Allowable Costs / Cost Principles Reporting § 200.303

TRANSPARENCY ACT REPORTING Department of Education (DOE) Assistance Listing Number 84.425C, 84.425D, 84.425R, 84.425U Program management will implement policies and procedures to ensure that Transparency Act Reporting is conducted with proper reviews. In order to comply with the Federal Funding Acc...

TRANSPARENCY ACT REPORTING Department of Education (DOE) Assistance Listing Number 84.425C, 84.425D, 84.425R, 84.425U Program management will implement policies and procedures to ensure that Transparency Act Reporting is conducted with proper reviews. In order to comply with the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act), as amended by Section 6202(a) of the Government Funding Transparency Act of 2008 (Pub. L. No. 111-252), that relate to sub-award reporting, the DOE Office of Internal Operations will work with each awarding office to ensure the sub-awards have been thoroughly reviewed and signed before reporting each month. This will comply with 2 CFR 200.303 which requires an entity to "maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award". The timeline for the development and initiation of this process (barring any unforeseen system limitations) is tentatively set for July 1, 2023.

View Audit 40967

Finding 46261 (2022-020)

Significant Deficiency 2022

State of West Virginia

WV

Subrecipient Monitoring Reporting Matching / Level of Effort / Earmarking § 200.302 § 200.303 § 200.328 § 200.329

REPORTING West Virginia Division of Rehabilitation Services (WVDRS) Assistance Listing Number 84.126 WVDRS will review current RSA-17 approval procedures by April 2023 and make appropriate modifications as necessary to ensure all evidence of report approval is maintained within our records.

View Audit 40967

Finding 46234 (2022-017)

Significant Deficiency 2022

State of West Virginia

WV

Special Tests & Provisions Subrecipient Monitoring Matching / Level of Effort / Earmarking § 200.303

SPECIAL TESTS AND PROVISIONS ? GRAMM-LEACH-BLILEY ACT ? STUDENT INFORMATION SECURITY Fairmont State University and Pierpont Community and Technical College Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 84.408, 93.264, 93.342, 93.364, 93.925 Fairmont State University (FSU...

SPECIAL TESTS AND PROVISIONS ? GRAMM-LEACH-BLILEY ACT ? STUDENT INFORMATION SECURITY Fairmont State University and Pierpont Community and Technical College Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 84.408, 93.264, 93.342, 93.364, 93.925 Fairmont State University (FSU) response FSU entered into a contract with Wolf & Company to perform an external risk assessment for our systems in 2021 but was not completed due to staffing changes until 2022. The external risk assessment was received from Wolf in June 2022. The report and its suggestions were immediately reviewed and approved. This action will be implemented in January 2023 for fiscal year 2023 and will be implemented each July, starting with July 2023, hereafter. It was not understood that annual reviews needed to occur at the beginning of each fiscal year until this finding was received. Pierpont Community and Technical College (PCTC) response In December 2022 and January 2023, PTCT developed the following policies and procedures, which also detail internal controls, relative to the Gramm-Leach-Bliley Act and student information security. ? Access to Security Controlled Spaces Policy ? Anti-Virus Policy ? Backup and Recovery Policy ? Change Management Policy ? Computer Disposal Policy ? Computer Security Policy ? Data Security Policy ? IT Firewall Policy ? IT Incident Response Policy ? System Update Policy ? Mobile Device Use Policy ? Remote Access Policy ? Risk Assessment Policy ? Banner Document Procedure ? Banner Security Procedure ? Argos Access Procedure ? Active Directory Security and User Creation ? National Student Loan Clearinghouse Enrollment Submission Procedure ? National Student Loan Clearinghouse Graduate Only Submission Procedure ? Nelnet Refunds Procedure ? Risk Assessment Procedure Risk assessments will now be performed two times a year and will follow the Risk Assessment Procedure. This procedure also incorporates all policies, procedures, and internal controls as the framework for the ensuring of student information security.

View Audit 40967

Finding 46225 (2022-008)

Material Weakness 2022

State of West Virginia

WV

Subrecipient Monitoring Matching / Level of Effort / Earmarking Internal Control / Segregation of Duties § 200.303

INTERNAL CONTROLS OVER INFORMATION TECHNOLOGY Workforce West Virginia (WWV) Assistance Listing Number 17.225, COVID-19 17.225 As of November 2022, WWV began and will continue to develop the processes for periodic review of user accounts for ABPS, UC Tax, and wvOASIS. Processes will include documen...

INTERNAL CONTROLS OVER INFORMATION TECHNOLOGY Workforce West Virginia (WWV) Assistance Listing Number 17.225, COVID-19 17.225 As of November 2022, WWV began and will continue to develop the processes for periodic review of user accounts for ABPS, UC Tax, and wvOASIS. Processes will include documenting termination of employees timely to the West Virginia Office of Technology (WVOT) to remove network access or within the organization to remove access to IT systems at the time of exit. WVOT will be adding features to Ivanti (WVOT service portal) so that WWV may download account management activity for validation, tracking, and review. WWV participates in Disaster Recovery operations when the WVOT holds them. Since WWV is covered by WVOT, WWV cannot reasonably procure a separate process for disaster recovery testing without the assistance and involvement of WVOT.

View Audit 40967

Finding 46221 (2022-005)

Material Weakness 2022

State of West Virginia

WV

Internal Control / Segregation of Duties Subrecipient Monitoring Reporting § 200.303

Community Development Block Grant Program (CDBG) Assistance Listing Number 14.228, COVID-19 14.228 Since the COVID pandemic occurred, the West Virginia Community Advance and Development office (CAD) experienced a high personnel turnover rate. As a result, CAD experienced a delay in implementing th...

Community Development Block Grant Program (CDBG) Assistance Listing Number 14.228, COVID-19 14.228 Since the COVID pandemic occurred, the West Virginia Community Advance and Development office (CAD) experienced a high personnel turnover rate. As a result, CAD experienced a delay in implementing the corrective action plan related to this finding. During the last 30 days, CAD has completed Federal Funding Accountability and Transparency Act (FFATA) training and has designated the personnel to the FFATA reporting process. Additionally, CAD has developed a checklist related to these grant awards which includes the FFATA system entry submission. These policies and procedures were implemented February 1, 2023.

View Audit 40967

Finding 46216 (2022-004)

Material Weakness 2022

State of West Virginia

WV

Subrecipient Monitoring Reporting School Nutrition Programs § 200.303

Department of Education (DOE) Assistance Listing Number 10.553, 10.555, 10.556, 10.559, 10.582 Program Management will implement policies and procedures to ensure Transparency Act reporting is conducted with proper reviews and timely submissions. In order to comply with the Federal Funding Account...

Department of Education (DOE) Assistance Listing Number 10.553, 10.555, 10.556, 10.559, 10.582 Program Management will implement policies and procedures to ensure Transparency Act reporting is conducted with proper reviews and timely submissions. In order to comply with the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act), as amended by Section 6202(a) of the Government Funding Transparency Act of 2008 (Pub. L. No. 111-252), that relate to sub-award reporting, DOE is working with the Child Nutrition Claiming Software vendor to create a report that will be run on the first of each month. Staff from the Office of Internal Operations and Office of Child Nutrition will be assigned to generate, enter, and submit data as required by the Transparency Act. To meet the timelines for reporting as established by the Transparency Act, the report will pull all activity for the prior month including all original reimbursement claims, as well as amendments that occur in that month to reimbursement claims that were previously reported. Prior to submission of the data, a report of its contents will be reviewed and approved by either the Child Nutrition Program Director or the Director of Internal Operations. Once the data is approved, it will be submitted. The timeline for development and initiation of this reporting process (barring any unforeseen system limitations) is tentatively set for July 1, 2023.

View Audit 40967

Finding 46195 (2022-001)

Material Weakness 2022

Chehalis School District No. 302

WA

Subrecipient Monitoring Internal Control / Segregation of Duties Special Tests & Provisions

Finding ref number: 2022-001 Finding caption: The District did not have adequate internal controls for ensuring compliance with wage rate requirements. Name, address, and telephone of School District contact person: Heather C. Pinkerton 310 SW 16th St Chehalis, WA 98532 360-807-7207 Corrective actio...

Finding ref number: 2022-001 Finding caption: The District did not have adequate internal controls for ensuring compliance with wage rate requirements. Name, address, and telephone of School District contact person: Heather C. Pinkerton 310 SW 16th St Chehalis, WA 98532 360-807-7207 Corrective action the auditee plans to take in response to the finding: It is highly unusual for the district to utilize federal funds for construction projects; the Covid-19 Education Stabilization Funds were an anomaly. The District?s Director of Business and Operations was unaware that prevailing wage clauses are required to be included in all public works contracts over $2,000 that are paid with federal funds. She was aware that prevailing wages need to be paid. The audit finding does not dispute that prevailing wages were paid appropriately, just that the clauses were not included in the contracts. To be very clear, this finding is for not having required language in contracts. The District is now aware that inclusion of the clauses is a compliance requirement. Going forward, it is unlikely that federal funds will be used for construction projects; however, when federal funds are utilized for construction projects, the District will either include the required prevailing wage rate clauses in its contracts or will obtain a separate signed clause with the required prevailing wage rate information. Anticipated date to complete the corrective action: Immediately

View Audit 40903

Finding 46194 (2022-002)

Material Weakness 2022

Chehalis School District No. 302

WA

Questioned Costs Allowable Costs / Cost Principles Subrecipient Monitoring

Finding ref number: 2022-002 Finding caption: The District did not have adequate internal controls for ensuring compliance with allowable activities and costs and restricted purpose requirements. Name, address, and telephone of School District contact person: Heather C. Pinkerton 310 SW 16th St Cheh...

Finding ref number: 2022-002 Finding caption: The District did not have adequate internal controls for ensuring compliance with allowable activities and costs and restricted purpose requirements. Name, address, and telephone of School District contact person: Heather C. Pinkerton 310 SW 16th St Chehalis, WA 98532 360-807-7207 Corrective action the auditee plans to take in response to the finding: The Chehalis School District does not concur with the finding or the questioned costs. The State Auditor?s Office (SAO) reviewed various types of documentation and did not accept documentation presented by the District to reduce or eliminate questioned costs. The standard of documentation required by SAO to satisfy ?unmet need? would have been hard to meet even if the District hadn?t been in the midst of a pandemic. The District has internal controls over asset inventory and provided equipment only to students and staff with unmet needs, and all costs were allowable, reasonable and necessary. We continue to communicate with other agencies with the ultimate goal of helping the Federal Communications Commission (FCC) understand that they should not seek any recovery of funds resulting from ?documentation? issues considering the massive public health response, deployment logistics, vague federal guidance, and the effective return to in-person learning. Along with countless other districts across the State of Washington, we look forward to working with the FCC to resolve this finding. We appreciate the guidance that was provided by the FCC, as noted below. Guidance from the FCC Devices for remote learning could also be used at school. During the pandemic in Washington State we experienced times when classrooms, schools and or districts were closed by health department and state regulations because of outbreaks. Districts had to be prepared to support remote learning each day with constantly changing guidance on who was allowed to be in person. The following guidance from the Federal Communications Commission, titled ?Emergency Connectivity Fund Common Misconceptions?, ?Misconception #2: If schools have returned to in-class instruction for the upcoming school year, they are not eligible to participate. Answer: This is false. Equipment and services provided to students or school staff who would otherwise lack sufficient access to connected devices, and/or broadband internet access connection while off campus are eligible for Emergency Connectivity Fund Support.? From the Federal Communications Commission Order FCC-CIRC21-93-043021, question 77: ?We think schools are in the best position to determine whether their students and staff have devices and broadband services sufficient to meet their remote learning needs, and we recognize that they are making such decisions in the midst of a pandemic. We, therefore, will not impose any specific metrics or process requirements on those determinations.? And from question 53: ??we are sensitive to the need to provide some flexibility during this uncertain time. If those connected devices were purchased for the purpose of providing students?with devices for off-campus use consistent with the rules we adopt today, we will not prohibit such on-campus use.? Corrective action the auditee plans to take in response to the finding: The Chehalis School District does not concur with the finding or the questioned costs. The State Auditor?s Office (SAO) reviewed various types of documentation and did not accept documentation presented by the District to reduce or eliminate questioned costs. The standard of documentation required by SAO to satisfy ?unmet need? would have been hard to meet even if the District hadn?t been in the midst of a pandemic. The District has internal controls over asset inventory and provided equipment only to students and staff with unmet needs, and all costs were allowable, reasonable and necessary. We continue to communicate with other agencies with the ultimate goal of helping the Federal Communications Commission (FCC) understand that they should not seek any recovery of funds resulting from ?documentation? issues considering the massive public health response, deployment logistics, vague federal guidance, and the effective return to in-person learning. Along with countless other districts across the State of Washington, we look forward to working with the FCC to resolve this finding. We appreciate the guidance that was provided by the FCC, as noted below. Guidance from the FCC Devices for remote learning could also be used at school. During the pandemic in Washington State we experienced times when classrooms, schools and or districts were closed by health department and state regulations because of outbreaks. Districts had to be prepared to support remote learning each day with constantly changing guidance on who was allowed to be in person. The following guidance from the Federal Communications Commission, titled ?Emergency Connectivity Fund Common Misconceptions?, ?Misconception #2: If schools have returned to in-class instruction for the upcoming school year, they are not eligible to participate. Answer: This is false. Equipment and services provided to students or school staff who would otherwise lack sufficient access to connected devices, and/or broadband internet access connection while off campus are eligible for Emergency Connectivity Fund Support.? From the Federal Communications Commission Order FCC-CIRC21-93-043021, question 77: ?We think schools are in the best position to determine whether their students and staff have devices and broadband services sufficient to meet their remote learning needs, and we recognize that they are making such decisions in the midst of a pandemic. We, therefore, will not impose any specific metrics or process requirements on those determinations.? And from question 53: ??we are sensitive to the need to provide some flexibility during this uncertain time. If those connected devices were purchased for the purpose of providing students?with devices for off-campus use consistent with the rules we adopt today, we will not prohibit such on-campus use.? Anticipated date to complete the corrective action: We will work with the FCC to resolve this issue according to their timeline.

View Audit 40903 Questioned Costs: $1

Finding 46192 (2022-002)

Significant Deficiency 2022

Town of Westport, Conencticut

CT

Procurement, Suspension & Debarment Subrecipient Monitoring

FINDING - FEDERAL AWARD PROGRAMS AUDIT United States Department of the Treasury 2022-002 COVID-19 American Rescue Plan Act Local Fiscal Recovery ? AL No. 21.027 Recommendation: We recommend that the policies be updated to include that vendors will be reviewed to ensure they are not suspended and ...

FINDING - FEDERAL AWARD PROGRAMS AUDIT United States Department of the Treasury 2022-002 COVID-19 American Rescue Plan Act Local Fiscal Recovery ? AL No. 21.027 Recommendation: We recommend that the policies be updated to include that vendors will be reviewed to ensure they are not suspended and debarred. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Management agrees with this finding. Management further notes that it will review all vendors through the Sam website to verify that the vendor has not been debarred or ineligible from receiving Federal Government funds. Name of the contact person responsible for corrective action: Sheila Carey Planned completion date for corrective action plan: March 30, 2023.

View Audit 40828

Finding 46182 (2022-002)

Significant Deficiency 2022

Cle Elum-Roslyn School District No. 404

WA

Questioned Costs Subrecipient Monitoring Internal Control / Segregation of Duties

The District concurs and will review current year?s indirect rates for ESSER reimbursements.

View Audit 41236 Questioned Costs: $1

Finding 46168 (2022-001)

Significant Deficiency 2022

Community Medical Centers, Inc.

CA

Subrecipient Monitoring Internal Control / Segregation of Duties

Name of Contact Person(s) Responsible for Corrective Action: Jaime Allen, Chief Financial Officer Training: Retrain staff on sliding fee policy procedures to ensure (1) income is properly verified, adequately documented and retained and (2) the sliding fee discount is properly determined and applied...

Name of Contact Person(s) Responsible for Corrective Action: Jaime Allen, Chief Financial Officer Training: Retrain staff on sliding fee policy procedures to ensure (1) income is properly verified, adequately documented and retained and (2) the sliding fee discount is properly determined and applied. All new Front Office staff will receive sliding fee program training as part of their 4-day front office training during onboarding. By Feb 28, 2022, the Front Office Trainer will review documentation requirements around sliding fee scale for patients, including checking applications for completion and making sure the sliding fee applied is being correctly calculated by all Front Office Leads, Supervisors and Center Managers. By Mar 2, 2022, the Front Office Trainer will help create a front office compliance checklist to review front office procedures around documentation, insurance, sliding fees and other programs. Sliding Fee Annual Update: The Revenue Cycle Director will notify the Applications Team and Front Office trainer each year when the sliding fee scale has been updated. The Applications Team will update the UDS table and map to the calculator in the EHR. The Front Officer trainer will review sliding fee updates on an annual basis update trainings with front office staff and within thirty days of notification of any sliding fee policy revisions. Internal Audit: An additional level of review will be added to the process to ensure program compliance. The Revenue Cycle Director will create and document a sliding fee scale internal audit process that will be performed monthly. When the audit is performed, findings will be reported to the following: General Counsel & Compliance Officer, Chief Financial Officer, Chief Operating Officer, Front Officer Trainer, Center Manager, and lead/supervisors. Front Office Trainers will work closely with Center Managers, Leads and Supervisors to ensure that ongoing compliance on sliding fees are met based on internal audit findings. Refresher trainings to staff will be provided based on patterns determined by internal audit findings. This process was implemented on March 2, 2022. Anticipated Completion Date: March 2, 2022

View Audit 41173

Finding 46155 (2022-002)

Significant Deficiency 2022

Pickaway County

OH

Subrecipient Monitoring Reporting

We will correct our reporting issues with the next required report. July 31, 2023 County Administrator 740-474-6093

View Audit 40211

Finding 46118 (2022-001)

Material Weakness 2022

Lubbock Christian University

TX

Student Financial Aid Matching / Level of Effort / Earmarking Subrecipient Monitoring

Finding 2022-001 Enrollment Reporting Views of Responsible Officials The University agrees with the auditor?s findings and recommendations. Corrective Action Plan The University has implemented additional training for this compliance requirement to ensure that changes in enrollment status are record...

Finding 2022-001 Enrollment Reporting Views of Responsible Officials The University agrees with the auditor?s findings and recommendations. Corrective Action Plan The University has implemented additional training for this compliance requirement to ensure that changes in enrollment status are recorded correctly in the system and reported accurately. Additionally, the University will resolve status change discrepancies and review status change reporting output monthly to ensure that changes are reported accurately. Implementation Date Immediate Individual(s) Responsible Yvonne Harwood, Vice President of Institutional Effectiveness and Becky Wilson, Assistance Vice President of Financial Assistance

View Audit 41496

Finding 46085 (2022-004)

Significant Deficiency 2022

Wayne Public Schools

NE

Subrecipient Monitoring Reporting Internal Control / Segregation of Duties

Finding: 2022-004 Name of Contact Person: Dr. Mark Lenihan, Superintendent Corrective Action: The District relies on the auditor to propose adjustments necessary to prepare the schedule of expenditures of federal awards including the related note disclosures. The District reviews the schedule o...

Finding: 2022-004 Name of Contact Person: Dr. Mark Lenihan, Superintendent Corrective Action: The District relies on the auditor to propose adjustments necessary to prepare the schedule of expenditures of federal awards including the related note disclosures. The District reviews the schedule of expenditures of federal awards and approves all adjustments. Proposed Completion Date: Immediately

View Audit 41359

Finding 46072 (2022-002)

Significant Deficiency 2022

Southeast Mental Health Services

CO

Reporting Subrecipient Monitoring Significant Deficiency

View of Responsible Official and Planned Corrective Action: Training has been completed with the individual responsible for the SEFA and notes have been made for future single audit preparation.

View Audit 40000

Finding 46061 (2022-003)

Significant Deficiency 2022

Johnstown-Cambria County Airport Authority

PA

Subrecipient Monitoring Allowable Costs / Cost Principles Cash Management

Airport Improvement Program (AIP) Award 3-42-0045-055-2020 ? CFDA No. 20.106 Name of contact person ? Heather Tomasko, Assistant Manager Internal Controls over Compliance: Significant Deficiency: See Finding #2022-002

View Audit 40645

Corrective Action Plans

Filters