Corrective Action Plans

INTERNAL CONTROLS OVER TRANSPARENCY ACT REPORTING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 To correct the finding, DEM met with federal partners in February 2023 to ensure understanding of what was to be reported, and ensured all staff managing grants with reportable awards knew the requirements. In March 2023, DEM implemented an internal control review between the Program Manager and the Section Chief for FFATA reporting. To ensure this finding is resolved, DEM will continue to utilize the internal control review that has been put in place.

SPECIAL TESTS AND PROVISIONS – ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 The Condition section within prior year finding 2022-037 recognized that the DHHR has policies and procedures in place for performing periodic risk assessments and security reviews over the Recipient Automated Payment and Information Data System (RAPIDS), which is an internal system; however, the Condition section also proclaimed that the DHHR does not have policies and procedures to perform periodic risk assessments and security reviews over the Medicaid Management Information System (MMIS). The first sentence of the corrective action plan for prior year finding 2022-037 indicates that the MMIS is designed, developed, implemented, and operated by an external service organization. Within the last two paragraphs of the corrective action plan for prior year finding 2022-037, the DHHR opined that it was in compliance with 45 CFR 95.621 since it receives the SOC 1 Type 2 report from the MMIS service organization and since the report documents that the service organization establishes and maintains a program for conducting periodic risk analyses to ensure appropriate, cost effective safeguards are incorporated into new and existing systems or whenever significant system changes occur, as required per 45 CFR 95.621. However, the DHHR also recognized the underlying concern expressed within the finding, in that the DHHR does not include the SOC 1 Type 2 report as part of its own policies and procedures for ADP security over the MMIS. To enhance its controls, the DHHR Bureau for Medical Services (BMS) was going to develop a policy and procedures to document MMIS compliance with 45 CFR 95.621. The procedures were to include but not be limited to a requirement to review and approve the SOC 1 Type 2 report from the MMIS service organization and document the review and approval process (e.g., for such matters as the service organization’s assertions, descriptions of its systems and controls, control objectives, and related controls, and the service auditor’s description of tests of controls and results). Although the DHHR BMS has not developed a comprehensive policy or any written procedures to date, they have developed a form to document internal review of the SOC 1 Type 2 report for such matters as the control environment, systems development and maintenance, logical security, physical access, computer operations, and input controls. The BMS has also discussed this issue with an independent consulting firm that is under contract with the BMS for Medicaid expertise and performs existing services related to information technology and security; modernization and planning for the overall Medicaid Enterprise Systems (MES); organization development, including alignment strategies; project management; and data architecture and governance, which includes managing the availability, usability, integrity, and security of data with comprehensive standards and policies. The BMS and its independent consulting firm will work together to develop a statement of work for an independent review of the existing control environment, if deemed necessary, and any additional services that might need performed in order to ensure the DHHR maintains full compliance with 45 CFR 95.621 and can document compliance for future HHS reviewers, independent auditors, or other authorized officials.

SPECIAL TESTS AND PROVISIONS – FRAUD DETECTION AND REPAYMENT West Virginia Department of Health and Human Resources (DHHR) Assistance Listing Number 93.575, 93.596, COVID-19 93.575 Per 45 CFR 98.68(b)(2), there is no requirement for lead agencies to recoup Child Care and Development Fund overpayments, except in instances of fraud as defined by the lead agency. Within the State of West Virginia, the lead agency is the DHHR. As indicated in Section 8.1.6 of the CCDF [State] Plan for West Virginia for Federal fiscal years 2022-2024, the DHHR Office of Inspector General (OIG) is responsible for pursuing fraud and overpayments. As indicated in Section 1.1.2 of the CCDF [State] Plan, the Division of Early Care and Education within the DHHR Bureau for Family Assistance (BFA) administers the CCDF program. Accordingly, the OIG and BFA strive to work as a unified team within the DHHR and State as a whole to identify and prevent fraud or intentional program violations; to identify and recover misspent funds as a result of fraud; and to otherwise fight fraud and ensure program integrity. As the lead agency, and as necessary to ensure program integrity, the DHHR has policies and procedures in place to define fraud and to identify and recover payments resulting from fraud, as the auditors indicated within the condition and recommendation sections of this finding and to track referrals and determinations from beginning to end (i.e., beginning in the year of identification and continuing through resolution or the establishment and enforcement of repayment agreements). The policies and procedures are specifically referenced in Chapter 8 of the BFA’s “Child Care Subsidy Policy and Procedures Manual.” Chapter 8 of the manual is titled, “Improper Payments: Prevention, Identification, Measurement and Recoupment.” Improper Payments Per Chapter 8 of the manual, an improper payment occurs when the funds go to the wrong recipient, the recipient receives the incorrect amount of funds, or the recipient obtains or uses the funds in an improper manner. Improper payments include 1) worker error in determining eligibility, authorizing care, or paying for care; 2) misrepresentation on the part of the parent or provider; and 3) programmatic infractions by parents or providers. 1. Worker Error – Improper payments due to worker error are defined as payments that should not have been made or that were made in an incorrect amount due to an error in determining and verifying eligibility, calculating the benefit, or entering the data into the eligibility system. Repayment of an improper payment due to worker error is not mandatory regardless of the amount. 2. Misrepresentation – Misrepresentation (i.e., fraud) occurs when a specific section of the child care policy is violated as a result of the information not having been reported by the client or provider or reported falsely. Improper payments made as a result of mis-interpretation must be referred to the OIG when the amount exceeds $1,000.00. If the amount does not exceed $1,000.00, the BFA must initiate repayment procedures. A willfully false statement is one that is deliberately given, with the intent that it be accepted as true, with the knowledge that it is false. It is an essential element in a misrepresentation charge that the client or provider knew the statement was false. 3. Programmatic Infraction – There are times when it is difficult to discern whether an improper payment occurred due to willful misrepresentation or is simply the result of a client or provider’s genuine confusion over subsidy program rules and responsibilities. When the case manager believes that improper payments were the result of the client or provider’s failure to understand, it is considered to be a programmatic infraction; it is the BFA’s responsibility to collect the improper payment in this instance, regardless of the amount. If the case manager is in doubt as to whether an improper payment is a programmatic infraction or is the result of misrepresentation by the client or provider, and the improper payment is less than $1,000.00, the case manager discusses the case with the supervisor and the supervisor subsequently consults with the program director; together, they make the decision whether to pursue repayment. Referrals from the Bureau for Family Assistance to the Office of Inspector General If the overpayment is $1,000.00 or greater and is due to misrepresentation by the client or provider, the case manager prepares a memo explaining the circumstances, the time period, and an estimate of the amount involved; indicates the person(s) who can verify the information within the memo; attaches a copy of all applicable documentation including, but not limited to, the payment form and attendance sheets that help support the complaint; states what corrective actions the case manager has taken on the case; and sends a copy of the memo and supporting documents to the Office of Inspector General, Division of Investigations and Fraud Management. Recovery of Improper Payments Resulting from Misrepresentation (i.e., Fraud) The supervisors within the BFA are responsible for negotiating repayment schedules with providers and clients and completing a Child Care Benefit Repayment Agreement to include the amount to be recovered, the period of recovery, the monthly recovery amount, and the procedure for repayment. If the provider or client is active, the case manager attempts to collect the payment in full; if this is not feasible, the case manager requests that the client or provider be asked to repay the amount in monthly installment payments of approximately 10% of the amount due. If a payment is more than 45 days late (15 days past the due date), the entire unpaid balance becomes due and must be paid in full. Failure to repay the requested amount results in case closure for clients or denial of participation in the certificate system for child care providers. Client services will not be reinstated until full payment is received. There are no policies or procedures to pursue repayments or collection beyond that point. There is no method to recoup overpayments from ongoing benefits, and the CCDF is not subject to the Treasury Offset Program, as other Federal programs are. Corrective Action Plan As previously stated, the OIG and BFA strive to work as a unified team within the DHHR to identify and prevent fraud or intentional program violations; to identify and recover misspent funds as a result of fraud; and to otherwise fight fraud and ensure program integrity. In response to the auditor’s recommendation for this finding, the OIG and BFA will revisit existing policies and procedures over fraud detection and repayment and will attempt to enhance the controls related thereto, particularly in relation to ensuring that all efforts concerning fraud detection and repayment are sufficiently documented, thus demonstrating full compliance with 45 CFR 98.60. Maintaining documentation of the decision-making process, the activities performed, and the results of those activities is of paramount importance in achieving that objective. A high level of documentation is necessary to support that the DHHR has policies and procedures in place and is following those policies and procedures. Maintaining adequate records and other documentary evidence will resolve this audit finding, prevent the occurrence of future audit findings, and provide a means to corroborate statements and assurances provided to regulatory agencies and other authorized individuals with regards to the DHHR’s overall compliance with 45 CFR 98.60. It is not enough to perform the activities; there must be an adequate audit trail to show the “who, what, when, where, and how” of the activities performed. As such, the OIG and BFA will also develop and maintain an appropriate system for categorizing their files and organizing their records, reports, and documents in a systematic and orderly manner to ensure, among other purposes, that they can substantiate their efforts when audited, reviewed, or evaluated by internal staff or authorized external organizations.

ALLOWABILITY AND ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 For the one payment out of 40 whereby the provider requested and was paid for 13 non-traditional days although records indicated that only 11 of the days were non-traditional, the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), agrees that the condition resulted in an overpayment of $12.00. The BFA Case Manager entered 13 non-traditional days in the Family and Children Tracking System (FACTS), but the record indicated that only 11 days were non-traditional days. Per WV Child Care Policy and Procedures: 8.3.1. Worker Error Improper payments due to worker error are defined as payments that should not have been made, or that were made in an incorrect amount due to worker error in determining and verifying eligibility, and/or calculation and input of information into the Family and Children’s Tracking System (FACTS). Incorrect amounts include overpayments, underpayments and inappropriate denials of payment. 8.3.1.1. Examples of worker error: A. The child care regulatory specialist enables the “accreditation” box, allowing the provider to receive an extra $4 per day, when the provider has not achieved accreditation, and is not entitled to the enhanced rate. B. The case manager enters an incorrect number of days when entering information from the payment form into FACTS. C. The case manager enters more time on the child care assessment than the client’s work or school schedule supports. D. The case manager fails to verify income, school enrollment, or special needs status. 8.3.1.2. Repayment of an improper payment due to CCR&R worker error is not mandatory regardless of the amount. The BFA Division of Early Care and Education employs Child Care Policy Specialists who visit contracted Resource and Referral Agencies to monitor and audit both electronic and hard records. Training and coaching also takes place during these visits. These visits continued throughout the reporting period. The BFA will evaluate the effectiveness of the current training programs for the use of the FACTS system (and subsequently for the West Virginia People's Access to Help (PATH) system) for CCDF payments. Furthermore, the BFA will follow established policies and procedures to ensure client information is appropriately obtained and maintained and that all data is input accurately. For the payment whereby the $3.00 daily supplement was not included in the calculation or paid, although the documentation in the eligibility system indicated that the child was covered under a CPS Safety Plan, this was not in fact a CPS Safety Plan case. The CPS Safety Plan was being used as a temporary means to address an executive order regarding COVID-19 and grant eligibility to essential workers who would otherwise not have qualified for the child care subsidy assistance due to their monthly income being above the Federal Poverty Level but below 85% of the State Median Income. The payment in question was in March 2023. Via a case assessment on November 1, 2023, this case [and other similar cases] were approved in the eligibility system as formalized Policy Exceptions rather than being selected as part of a CPS Safety Plan.

TRANSPARENCY ACT REPORTING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 The DHHR concurs with the Condition section of the finding, in that one report was not submitted timely; however, the DHHR does not agree with the Cause section of the finding, which indicates a lack of oversight and adequate review of the FFATA reporting by DHHR Management. The DHHR hereby notes that the report was due on October 31, 2022 but was not submitted until November 1, 2022 (i.e., one day late). Submitting a report one day late is not an indication of a lack of oversight or adequate review of the FFATA reporting requirement. In this case, the report was submitted one day late because the person responsible for submitting the report was working remotely on October 31, 2022 and lost internet connection until November 1, 2022. Although the DHHR strives for perfection, such a condition cannot always be achieved, especially from the perspective of information technology within the rural state of West Virginia. Nonetheless, if the situation repeats in the future, the person responsible for submitting the report will be encouraged to find a location that has an adequate [and secure] internet connection.

INTERNAL CONTROLS OVER CHILD CARE PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Department of Health & Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 All funds resulting from the American Rescue Plan Act (ARPA) were expended and all related programs ended on or before September 30, 2023. The West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), Division of Early Care and Education, employs Child Care Policy Specialists who visit contracted Resource and Referral Agencies to monitor and audit both electronic and hard records. Training and coaching also takes place during these visits. These visits continued throughout the reporting period. The BFA will evaluate the effectiveness of the current training programs for the collection and storing of eligibility records. Furthermore, the BFA will follow established policies and procedures to ensure provider information and documentation is appropriately obtained, reviewed, and retained.

SUBRECIPIENT CASH MANAGEMENT Department of Health and Human Resources (DHHR) Assistance Listing Number 93.788 The West Virginia Department of Health and Human Resources, Bureau for Behavioral Health (BBH), analyzed this finding and hereby offers more details into the condition and cause of the finding. For the first noted exception, the grant was finalized on March 20, 2023. The BBH received the subrecipient’s first request for payment on April 12, 2023, at which point the reconciliation indicated that the subrecipient had incurred expenses of $118,186.21 to date. Although the reconciliation was not reviewed and approved by the BBH timely, it indicated that the subrecipient had not been reimbursed at all; therefore, the subrecipient had no cash on hand at the time of the request for payment. For the second noted exception, the BBH received the reconciliation on June 2, 2023. Although the reconciliation was not reviewed and signed by the BBH timely, it indicated $41,296.14 of cash on hand, which was under the 10% threshold established by the BBH when monitoring cash management for subrecipients of the Opioid program. For the third noted exception, the BBH received the reconciliation on March 14, 2023. Although the reconciliation was not reviewed and signed by the BBH timely, it indicated expenditures of $63,839.08 and cash on hand of only $18,070.92, which was less than the 10% threshold established by the BBH when monitoring cash management for subrecipients of the Opioid program. For the fourth noted exception, a processing error within the BBH caused the subrecipient to receive a payment that should have been held due to the subrecipient having sufficient cash on hand at the time of the payment. Nonetheless, after the period of performance, the subrecipient did not have excess cash on hand, or any cash on hand for that matter. The subrecipient returned $218,290.74 to the BPH on November 14, 2023 and $2,317.10 on November 29, 2023 in accordance with the closeout procedures referenced in 2 CFR 200.344(d). The total amount of $220,607.84 constituted the balance of unobligated cash that the BPH paid the subrecipient in advance and was not authorized to be retained by the subrecipient for use in other projects. In an effort to enhance internal controls, the BBH’s central level managers continue to work with internal and external parties to improve everyone’s understanding of the federal rules and regulations and the BBH’s existing policies, procedures, and overall expectations concerning subrecipient cash management.

ALLOWABILITY OF EXPENDITURES, SPECIAL TEST AND PROVISIONS – PROVIDER ENROLLMENT & SPECIAL TEST AND PROVISIONS: PROVIDER HEALTH AND SAFETY STANDARDS (MEDICAID ONLY) Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778 The West Virginia Department of Health and Human Resources, Bureau for Medical Services (BMS), has developed a form to document internal review of the service organization’s SOC 1 Type 2 report for such matters as the control environment, system development and maintenance, logical security, physical access, computer operations, and input controls. The form also has dedicated sections for exceptions within the SOC 1 Type 2 report as noted by the reviewer(s) and for questions/comments that the reviewer(s) might have. As of the date of this writing, the BMS is still working on the instructions for completing the form and processing the form to the next level within the BMS as may be necessary (e.g., answering any questions or comments that the initial reviewer denoted on the form; evaluating whether any exceptions noted within the SOC 1 Type 2 report could have a negative effect on the MMIS or the Medicaid program in general; and eventually closing the SOC 1 Type 2 report and documenting the review, the overall effect, the resulting actions, and any pending actions within the appropriate system files).

ALLOWABILITY AND ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.659 The issues identified in the finding were due to a broad number of child welfare workers having access to select “Non-Recurring Adoption Expense” (NRAE) when issuing a demand payment through the eligibility system, causing the incorrect funding to be used. Two of the payments identified were manually entered to replace lost payments. The initial payments covered multiple children, but the replacement payment only identified one child’s name. For the Adoption Program, the DHHR phased in a new information technology system for determining eligibility, making payments, maintaining documentation, etc. during the State Fiscal Year 2023. The name of the new system is PATH (People & Access to Help). The PATH system replaced the Family and Children & Tracking System (FACTS). The PATH system will have additional controls and levels of review as compared with the FACTS system. For example, as specific to this finding, the ability to select NRAE when issuing a demand through PATH has been localized to adoption subsidy unit staff within the central office of the DHHR Bureau for Social Services.

ALLOWABILITY AND ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.658 As indicated in the Condition section of the finding, although the documentation related to safety considerations at child care institutions was not initially maintained in the official licensing files for 10 of the 40 cases tested for eligibility, the documentation was eventually provided to the auditors for eight of those 10 cases. For one of the remaining two cases, the child care institution is an out-of-state institution that is no longer in business. For the other case, the child care institution provided documentation, but the documentation did not include the dates of the institution’s safety checks. In an effort to enhance internal controls over the safety considerations at child care institutions, the West Virginia Department of Health and Human Resources, Bureau for Social Services (BSS), is continuing to analyze the condition that led to this finding and is considering a number of steps, including but not limited to the following as an immediate plan of action: • Transmit a copy of 2 CFR 1356.30(f) to all licensing personnel, supervisors, and other applicable staff within the BSS and oblige them to acknowledge that they have read and understand the requirements referenced therein. • Implement a formalized policy and develop written procedures for ensuring the licensing files for child care institutions contain documentation which verifies that safety considerations with respect to the staff of the institutions have been addressed. • Develop overall standards for the maintenance of documentation within licensing files (e.g., a consistent naming convention for the documents, which would improve internal tracking and ensure that requests from independent auditors are addressed efficiently and fully; personnel who have read-only access to documents versus those who can add, replace, and delete documents; record retention requirements; etc.). • Establish a formalized process for monitoring. Such a process would include a strategy for conducting internal reviews of all licensing files on a recurring basis, reporting the results of those reviews to appropriate officials internal and external to the DHHR, following up with those officials as may be necessary, and documenting the overall results accordingly. For example, if the results of a monitoring review indicated noncompliance [or potential noncompliance] on the part of a child care institution, the BSS would inform the institution, request a copy of the institution’s written policies and procedures regarding safety considerations, discuss it with the institution, and provide technical assistance to the maximum extent practicable. Once the BSS drafts the aforementioned policies and procedures and related monitoring process, or otherwise enhances their internal controls over the safety considerations at child care institutions, the BSS will discuss the matter with their regular programmatic contacts at the U.S. Department of Health and Human Services, Administration for Children and Families, and will ask the ACF if the BSS’s planned controls are aligned with the ACF’s universal expectations surrounding 2 CFR 1356.30(f).

INFORMATION TECHNOLOGY GENERAL CONTROLS – WVPATH Department of Health and Human Resources (DHHR) Assistance Listing Number 93.658, 93.659 The DHHR, Office of Management Information Services (OMIS), analyzed this finding and hereby offers more details into the condition and cause of the finding. The information technology system in question is named WVPATH, which stands for, “West Virginia People’s Access to Help.” WVPATH is a comprehensive social services/child welfare information system, allowing employees to more efficiently track and view data, streamline services, and ultimately improve the manner by which the State determines eligibility for programs and provides for the delivery of services. With respect to the Foster Care and Adoption programs, the WVPATH system replaced the “Family and Children’s Tracking System” (FACTS). The DHHR transitioned from FACTS to WVPATH in January 2023, which was approximately six months into fiscal year 2023. Fieldwork for the information technology portion of the West Virginia Single Audit began in June 2023. During fieldwork, the auditors inquired about the information technology general controls (ITGCs) within the WVPATH system. In particular, the auditors requested a description of the controls along with a copy of the policies, procedures, system generated listings, screenprints, and other documentation related to information security and access administration, change management, and backup recovery and restoration. Although the OMIS is of the opinion that the State of West Virginia indeed implemented all logical access and change management controls to support effective ITGCs over the WVPATH system, the OMIS did not address the auditor’s request in a timely manner during fieldwork. Therefore, the auditors were unable to determine whether the controls were designed sufficiently, nor were they able to conduct the requisite testing to confirm that the controls were in place and operating effectively during the applicable months of the audit period.   Upon receiving this finding, the OMIS conferred with the State’s third-party software vendor for the WVPATH system; prepared a description of controls; collected the documentation related to information security and access administration, change management, and backup recovery and restoration within the WVPATH system; and submitted the description of controls and related documentation to the auditors. On February 14, 2024, a meeting was held between the auditors, the OMIS, the third-party software vendor, and one of the audit coordinators from the DHHR central finance level. The purpose of the meeting was to discuss this finding and determine whether the documentation collected by the OMIS after fieldwork would have averted the finding in the first place. During the meeting, the auditors indicated that the description of controls is very detailed and appears to support the OMIS’s assertion that the controls are designed sufficiently. However, since the documentation was submitted to the auditors after fieldwork was complete, there was not enough time for the auditors to conduct the requisite testing to determine whether the processes and controls were in place and operating effectively during the applicable months of the audit period. In terms of a corrective action plan for this finding, the OMIS now has a greater understanding of the auditor’s objectives and procedures surrounding ITGCs. During fieldwork for the [forthcoming] West Virginia Single Audit for the year ended June 30, 2024, when the auditors are ready to test the required logical access and change management controls that are required to be in place to support effective ITGCs for the WVPATH system, the OMIS will undoubtedly be prepared to provide the auditors with a description of the controls along with a copy of all documentation related to information security and access administration, change management, and backup recovery and restoration within the WVPATH system.

SUBRECIPIENT MONITORING West Virginia Community Advancement and Development (WV CAD) Assistance Listing Number 93.568, COVID-19 93.568 Between the years 2022 and 2023, the Weatherization Assistance Program (WAP) experienced a significant turnover in its staff. As a result of this turnover, the proper adherence to the requirement of 2 CFR 200.332(f) for verifying subrecipients was not followed during the auditing process. To ensure that this requirement is met in the future, WV CAD has taken measures to document the policies and procedures related to the financial audit requirements of 2 CFR 200.332(f) in the current WAP State Plan. A designated team member has been assigned the responsibility of maintaining a comprehensive tracking list, which includes the due dates of audits, their review dates, any necessary subrecipient corrective action plans, the dates of letter correspondence, and the uploading of all relevant documents into the divisions Shared Drive. Additionally, this team member is also responsible for downloading the audits from the Federal Audit Clearinghouse and submitting the information to the Fiscal Monitor for a thorough accounting review. These measures aim to ensure proper compliance and accountability within the Weatherization Assistance Program. This action will be implemented in February 2024.

ELIGIBILITY West Virginia Department of Health and Human Resources (DHHR) Assistance Listing Number 93.568, COVID-19 93.568 The LIHEAP policy staff within the DHHR, Bureau for Family Assistance (BFA), have worked with the Recipient Automated Payment and Information Data System (RAPIDS) team to confirm that the benefit table has been accurately entered into the RAPIDS system for fiscal year 2024. The LIHEAP policy staff will continue to review the work of the RAPIDS team to ensure that the benefit table has been accurately entered prior to the opening of LIHEAP application intake annually.

TRANSPARENCY ACT REPORTING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558, 93.568, COVID-19 93.568 The DHHR enhanced its controls over Transparency Act reporting for LIHEAP during State Fiscal Year 2023 and met with various staff members internal and external to the DHHR (e.g., at other State agencies) to ensure everyone was aware and understood their roles in ensuring compliance on behalf of the State. Although those controls are in full effect for fiscal year 2024, the DHHR will revisit and enhance the controls to the maximum extent possible. Furthermore, the DHHR will reopen its previous submissions to the FSRS and revise the data elements to those assigned by the other State agency to their subrecipients; considering the need to consult with the DHHR spending unit and the other State agency, the anticipated date for completion is April 1, 2024.

SPECIAL TESTS AND PROVISIONS – PENALTY FOR FAILURE TO COMPLY WITH WORK VERFICATION PLAN Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558 For each data element quarter of the calendar year, the new component entry deadline and the participation hours entry deadline are established by the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA). For the first data element quarter (January, February, March), the new component entry deadline is April 30, and the participation hours entry deadline is May 5. For the second data element quarter (April, May, June), the new component entry deadline is July 31, and the participation hours entry deadline is August 5. For the third data element quarter (July, August, September), the new component entry deadline is October 31, and the participation hours entry deadline is November 5. For the fourth data element quarter (October, November, December), the new component entry deadline is January 31, and the participation hours entry deadline is February 5. To resolve the condition that led to this finding, the BFA will work with the Recipient Automated Payment and Information Data System (RAPIDS) Data Team. The BFA will request joint meetings with the RAPIDS Data Team to review sample cases and the components and hours related thereto to ensure they have been entered into the data system correctly. The meetings will take place quarterly, within five days after the participation hours entry deadlines, and will be documented accordingly.

SUBRECIPIENT MONITORING Department of Education (DOE) Assistance Listing Number 93.558, COVID-19 93.558 Program management will implement policies and procedures to ensure that the subrecipient monitoring is updated to “ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the passthrough entity must provide the best information available to describe the federal award and subaward.” The timeline for the development and initiation of the process is tentatively set for February 1, 2024.

SPECIAL TESTS AND PROVISIONS – INCOME ELIGIBILITY AND VERIFICATION SYSTEM Department of Health & Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 The Division of Family Support within the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), will send the current desk guides to all WV WORKS (TANF) staff, which includes the Data Exchange desk guide and the Viewing Data Exchanges by Exchange Type desk guide. The BFA Division of Family Support will also work with the BFA Division of Professional Development to create a blackboard course for supervisors and community service managers [who supervise WV WORKS (TANF) staff] to assist the supervisors and management in identifying deficiencies regarding the IEVS system.

SPECIAL TESTS AND PROVISIONS – PENALTY FOR REFUSAL TO WORK Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 The TANF policy staff within the West Virginia Department of Health and Human Resources, Bureau for Family Assistance, will work with Optum, the State’s eligibility system vendor, and the Recipient Automated Payment and Information Data System (RAPIDS) team to ensure that the criteria for the population for penalty for refusal to work are interpreted and applied correctly. Policy staff will also conduct monthly reviews of a random sample of cases to which the penalty for refusal to work is applicable in order to ensure that it is being applied appropriately.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE Department of Health & Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 In August of 2023, the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), Division of Professional Development, released a mandatory Blackboard course on Sanctions (Course ID: BFA-ITT-WV-400-2023). All staff completed the training by September 21, 2023. The BFA will repeat this mandatory training on an annual basis for all staff that have the capability to impose, approve, or remove a sanction. Reminders and desk guides will also continue to be distributed to field staff. The BFA Policy Unit will also continue its monthly reviews of RAPIDS Management reports regarding 3rd level sanctions that are being sent to the unit for review and approval.

EQUIPMENT AND REAL PROPERTY MANAGEMENT Department of Health and Human Resources (DHHR) Assistance Listing Number 93.323, COVID-19 93.323 Due to the number of administrative and programmatic offices within the DHHR and the fact that those offices are located throughout the State, the DHHR does not conduct a mass physical inventory whereby one office or person at the central level views all of the reportable assets under the DHHR’s jurisdiction. Instead, the DHHR Office of Operational Administration compiles inventory reports for each office using the fixed asset module within wvOASIS, which is the statewide accounting system. The inventory reports indicate all tagged and entered assets under each office’s location code within the DHHR. Once the reports are compiled, the Office of Operational Administration sends a report to each applicable office within the DHHR and asks the offices to locate and verify the assets in the report. The lack of documentation indicated by the auditors is due to the fact that some DHHR offices throughout the state do not return the verification to the Office of Operational Management. For the next physical inventory of fixed assets within the DHHR, which will be for the year ended June 30, 2024, the Office of Operational Administration will monitor and regulate each office more stringently and will increase its efforts to ensure that each office completes the verification and returns it to the Office of Operational Administration in a timely manner. For offices that do not respond within a timeframe deemed reasonable by the Office of Operational Administration, they will inform and request assistance from a higher level of authority within the DHHR, such as the Executive Director of Operations.

SUBRECIPIENT CASH MANAGEMENT Department of Health and Human Resources (DHHR) Assistance Listing Number 93.323, COVID-19 93.323 The West Virginia Department of Health and Human Resources, Bureau for Public Health (BPH), will analyze the condition that led to this finding in an effort to determine if the subrecipient has any excess cash on hand to date. In an effort to enhance internal controls, the BPH has initiated mandatory retraining for all staff members who are responsible for reviewing subrecipient expenditure reports and processing invoices. The retraining effort has already begun and will be conducted on a monthly basis for existing employees and at the start of employment for new staff members. The BPH has also developed and implemented a Subrecipient Grant Expenditure Checklist and Subrecipient Grant Invoice Checklist. The checklists outline the steps to take when reviewing subrecipient expenditures and invoices; provide a means to verify whether the grantee is under the 10% threshold established by the BPH when monitoring cash management for subrecipients of the Epidemiology program, including a means to compare expenditures between reporting periods; and require the staff member to certify that the reviews were completed.

INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.788, 93.323, COVID-19 93.323, 93.575, 93.596, COVID-19 93.575, 93.558, COVID-19 93.558 This finding is a repeat of prior year finding 2022-041. As related to the first paragraph of the corrective action plan for 2022-041, the new risk assessment form and related processes are still under review within the DHHR. Regarding the second paragraph of that corrective action plan, the DHHR developed a series of certifications that will replace the mandatory monitoring checklist currently in use within the DHHR. The certifications will be part of the workflow within the DHHR's subrecipient Grants Management Solution system (CRM). One of the certifications will be based on the requirements for pass-through entities within the Code of Federal Regulations at 2 CFR 200.332(b) and will require DHHR spending units to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate level of monitoring to apply to the award. The level of monitoring applied to a particular subrecipient for an individual grant award will depend on multiple factors, such as the subrecipient's prior experience with the same or similar grant awards or programs; the subrecipient's prior experience with any type of grant award or program; the results of previous external audits or internal reviews, including whether or not the subrecipient receives a Single Audit in accordance with 2 CFR 200 Subpart F ("Audit Requirements"); and whether the subrecipient has new personnel or new or substantially changed systems. When a DHHR spending unit considers these [and other] factors prior to awarding a grant, they are in essence evaluating the subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the grant award. If an evaluation of such factors proves that the subrecipient's risk of noncompliance is high, the award will still be made to address a programmatic need, and special conditions that correspond to the degree of risk may be applied to the award. In other words, the DHHR spending unit may adjust or impose specific and additional award conditions upon a subrecipient if the evaluation proves that such additional conditions are appropriate. Special conditions would include but not be limited to requiring payments as reimbursements rather than advance payments; withholding authority to process to the next phase until receipt of evidence of acceptable performance within a given performance period; requiring additional, more detailed financial reports; requiring additional project monitoring; requiring the subrecipient to obtain technical or management assistance; and establishing additional prior approvals. Although none of these requirements are new within the DHHR, adding a certification directly within the CRM workflow to address such matters will provide the DHHR with an ability to embed various controls directly within the system, provide a higher level of assurance over the risk assessment and monitoring process, increase accountability on the part of the spending units, and provide a more effective audit trail. Given these expanded goals and the need to work with a contractor on adding these additional controls within the CRM system, the DHHR plans to implement the controls via a manual process first, with a desired date for completion of May 31, 2024.

MAINTENANCE OF EFFORT Department of Education (DOE) Assistance Listing Number 84.425, COVID-19 84.425 The Maintenance of Effort (MOE) calculation is in process. A waiver was requested and approved for the FY 2023 MOE data. The MOE will be completed by March 15, 2024.

INTERNAL CONTROLS OVER ALLOWABLE COSTS AND COST PRINCIPLES West Virginia State University (WVSU) Assistance Listing Number COVID-19 84.425J In accordance with the wvOASIS/Kronos procedural guidance, WVSU will immediately implement measures within the payroll administration office to send reminders, to employees and supervisor/manager, in the sequence of three days prior to deadline and two days prior to deadline to approve all timecards. In the event an employee timecard has not received approval, employee and supervisor/manager understand that pay will be withheld for that pay period until approval is received. Further, WVSU will develop, document, and communicate a written procedure for Time and Leave by March 31, 2024 that includes proper internal controls for timesheet approval. This procedure will be communicated and reinforced through campus wide emails and via Supervisor/Manager trainings hosted by University Human Resources Office.

ALLOWABILITY West Liberty University (WLU) Assistance Listing Number COVID-19 84.425F, 84.425M WLU’s CFO and Controller will have the Student Accounts Manager print and save documentation from the Banner System as evidence of supporting future calculations. WLU’s CFO and Controller will also review all invoices for proper approvals before payments are made and changed to HEERF or any other future programs that arise will be dealt with accordingly.