Corrective Action Plans

Corrective Action Plan Year Ended June 30, 2023 Finding 2023-001: Procurement: Suspension and Debarment Condition Found: In the auditor’s testing over suspension and debarment, they identified two covered transactions, both with the same vendor, in a sample of 40 procurement transactions for which the University was unable to provide supporting documentation that they verified the vendor was not suspended or debarred prior to entering into the procurement transaction with the vendor. It was determined that the related vendor was not suspended or debarred. Recommendation: The auditors recommend the University enhance its internal control over compliance with the federal regulations related to suspension and debarment to ensure covered transactions are not entered into with parties that have been suspended or debarred. University of Delaware Corrective Action Plan: The University agrees with the finding. The University has taken additional measures to ensure a clause with suspension and debarment language is included within the contracts of all new covered transactions entered into on or after July 1, 2023. The finding relates to a legacy contract and has prompted a review of open purchase orders to address suspension/debarment requirements. Additionally, the University will begin utilizing a third-party verification software to screen existing and potential vendors against the System for Award Management (SAM.gov) Exclusions list daily, with an expected implementation by June 30, 2024. Anticipated Completion Date: Suspension and Debarment: Contract Clause – July 1, 2023 Suspension and Debarment: SAM.gov Verification – June 30, 2024 Contact Persons: Jeff Friedland, Associate Vice President for Research David Fenkel, Associate Vice President & Chief Procurement Officer

Federal Award Findings and Questioned Costs Reference Number: 2023‐001 Federal Agency Name: U.S. Department of Housing and Urban Development Program Name: Continuum of Care Program Federal Financial Assistance Listing: 14.267 Finding Summary: Program Income Significant Deficiency in Internal Control over Compliance Contact: Jillian Patterson, Deputy Director 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: There was not a documented review by a separate individual outside of the preparer of the program income calculations. The Housing Authority had a review process in place over program income calculations. However, the review process was not documented. Corrective Action Plan: It is important to note that while we do have a process in place for program income calculations, we recognize that it was not adequately documented. To remedy this and ensure compliance with federal regulations, we have developed the following corrective action plan: Implementation of Controls Configure Yardi Voyager PHA software to enforce controls and workflows that ensure consistency and documentation of the review process. This may include setting up automated notifications for review assignments, establishing approval hierarchies, and creating standardized templates for documentation. Designation of Reviewer Utilize Yardi Voyager PHA software to assign designated reviewers for program income calculations, ensuring separation from the preparer. The software will facilitate clear identification of reviewers, their roles, and responsibilities within the review process. Documentation of Review Process Utilize Yardi Voyager PHA software to streamline and document the review process for program income calculations. The software will be configured to include a dedicated workflow specifically for documenting and tracking reviews conducted by separate individuals outside of the preparer. Periodic Monitoring and Evaluation Utilize the reporting and analytics features to monitor and evaluate the effectiveness of the review process. Generate regular reports to assess compliance with established procedures and identify any areas for improvement. Ongoing Compliance Monitoring Utilize Yardi Voyager PHA software to conduct ongoing compliance monitoring of internal controls and processes related to program income calculations. Set up automated alerts and notifications to flag any potential non‐compliance issues for timely resolution. By leveraging the capabilities of Yardi Voyager PHA software, the Housing Authority will enhance its ability to document, track, and monitor the review process for program income calculations, thereby strengthening internal controls and ensuring compliance with 2 CFR 200.303(a).

Finding Summary: The Center was unable to provide records to support amounts reported for 2021 Total Revenue / Net Patient Charges, a part of the lost revenue calculation on PRF required reporting. The Reporting Period 4 PRF Report did not contain evidence of proper review and approval prior to submission. Responsible Individuals: Becki Mangum, Chief Financial Officer Corrective Action Plan: Management will ensure the following evidence is maintained for all required reports: review of all reports prior to submission, and documents to support all reported amounts. Anticipated Completion Date: Ongoing

FINDING 2023-001 Finding Subject: Research and Development Cluster – Subrecipient Monitoring Summary of Finding: Audit Finding 2023-001 states that Indiana State University did not have an effective internal control system in place in order to ensure that subrecipient Federal Audit Clearinghouse reports are reviewed in a timely manner for the Research & Development Cluster. Contact Person Responsible for Corrective Action: Hope Waldbieser, Executive Director of Finance Contact Phone Number and Email Address: 812-237-3524 - hope.waldbieser@indstate.edu Views of Responsible Officials: We concur with the finding that Indiana State University should have completed the Federal Audit Clearinghouse review in a more timely manner. Indiana State University conducted the required review, but it was completed later than allowed by the excerpt of 2 CFR 200.521(d) below. 2 CFR 200.521(d) states in part: “The federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. . . . “ Indiana State University did have other aspects of subrecipient monitoring in place related to the review of financial and programmatic reports for the subrecipients. Explanation and Reasons for Disagreement: Description of Corrective Action Plan: Effective January 2024, Indiana State University will update its Subrecipient Monitoring procedures in the following ways to ensure the Federal Audit Clearinghouse is reviewed in a timely manner and that appropriate documentation is maintained. 1. Subrecipient Federal Audit Clearinghouse reviews for prior fiscal year audits will be completed quarterly (July, October, January & April) during each fiscal year. The final Subrecipient Federal Audit Clearinghouse review for prior fiscal year audits will be completed in July after all current fiscal year payments have been made. 2. In order to ensure there is a segregation of duties the Office of Contracts & Grants Director will provide the Executive Director of Finance a report of the completed review each quarter including INDIANA STATE BOARD OF ACCOUNTS 20 the final review in July for their review and approval. The Executive Director of Finance will confirm the following: a. There is adequate documentation to support each quarterly review. b. Any deficiencies pertaining to the subrecipients Federal Audit Clearinghouse findings related to an award from Indiana State University are addressed in a timely manner. 3. Any identified issues during these reviews will be appropriately addressed by management as required by 2 CFR 200.332 and 2 CFR 200.521(d). Anticipated Completion Date: Indiana State University will ensure that the revised timeline for these procedures is in place during January 2024.

The City agrees with the finding. The Grant Administrator will work with City departments with construction contracts subject to wage rate requirements to ensure policies and procedures are documented and that a monitoring process is implemented to ensure adherence to established policies and grantor requirements. This will be complete by June 30, 2024.

The City agrees with the finding. The City's Grant Administrator will provide training to each City department which currently oversees subrecipients, ensuring that all department staff understand general and ARPA-specific subrecipient requirements. Additionally, the Grant Administrator will review City departments' subrecipient management checklists to ensure all required documentation is obtained from subrecipients and reviewed as required. This will be complete by June 30, 2024.

The City agrees with the finding. The Treasury Portal automatically fills in the amounts for revenue loss for 2022 with amounts reported in 2020. The Treasury portal has many flaws that would cause errors in reporting. In addition, the portal has changed every quarter, which makes it challenging to report accurately. The City will implement controls to ensure that a second review is completed prior to certification of the report. Additionally, the Grant Administrator will work with department staff responsible for reporting and ensure that each report's supporting documentation is complete and ties to underlying subrecipient reports, the general ledger and grantor reports. All supporting documentation, along with a copy of the submitted report, will be stored in a central location to ensure that they are available for subsequent reviews and audits. This will be completed by June 30, 2024.

The City agrees with the finding. The City will ensure that the federal report preparers reconcile all entries to program limitations prior to having the report submitted for final certification. This will be complete by June 30, 2024.

Finding 2023-004 Internal control deficiency and noncompliance over Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Reporting related to expenses attributable to coronavirus reported in the provider relief fund reports. The entity has excess lost revenues to cover all payments received (excluding the expenses submitted). Therefore, no refund is required for any payments received. Since the program has ended, the management has implemented the following procedures for future grants: 1) An education session occurred on February 15, 2024, with the relevant parties across Huntington Health entities to formally implement a review process whereby the Controller will review the support files prior to filings being made related to grant applications/programs across any of Huntington’s entities. Documentation of this review will be retained in the central file repository. These steps and controls will be updated and documented in the departmental policy. 2) A central folder on the Huntington Hospital’s main accounting drive has been created. This folder will be populated with all support for filed figures related to grant applications/programs across the hospital’s various entities. The support will be validated as having been placed into this folder as part of the reporting out process by the accounting manager and Controller handling the reporting. Files will be retained in this central drive for a minimum of 7 years. These steps and controls will be updated and documented in the departmental policy. Contact Person: Byron Davis, Controller and Steven Mohr, Senior Vice President and Chief Financial Officer, Huntington Hospital Anticipated Completion Date: Completed

Finding 2023-002 Internal control deficiency and noncompliance over Equipment and Real Property Management related to the physical inventory of property. In response to this finding management will implement the following: An education session occurred on February 7, 2024, with the relevant parties across the Cedars-Sinai Research Facilities department. The session focused on the uniform guidance, more specifically the requirements to perform a physical inventory of property at least once every two years as set forth in CFR 200.313 (d) (2). We will schedule follow up sessions in March 2024 (first session scheduled for March 1st, second session TBD) to review and update existing policies and procedures to ensure future transfer of knowledge, as well as finalize a plan of action in order to complete a physical inventory of research equipment by the end of the fiscal year period, June 2024. Contact Person: Nicole Anderson Leonard, Vice President, Research and Vice Dean Anticipated Completion Date: June 30, 2024

06/30/2023 Corrective Action Plan Reference Number: 2023-001 Program Information: Student Financial Assistance Cluster – Federal Direct Loan Program, Federal Pell Grant Program Contact Person: Donna Lane Anticipated Completion: 08/30/2024 Fiscal year in which finding occurred: 2023 Condition Certain students with enrollment changes were not timely transmitted to National Student Loan Data System (“NSLDS’). Management View Management recognizes the importance of reporting enrollment status changes in a timely manner for lenders and servicers of student loans to determine in-school status, deferments, grace periods, and repayment schedules, as well as the federal government’s payment of interest subsidies. Corrective Action The University has taken the following steps to improve the accuracy and timeliness of enrollment reporting with respect to federal requirements: • In addition to the National Student Clearinghouse’s implementation of new password reset requirements, the University will verify the staff representatives on the NSC FTP-site communication list are current. The NSC Enrollment Reporting procedures have been updated to include the FTP communication list and the steps to add or remove members if there are staff changes in the future. • For students who initiate a withdrawal prior to the end of the spring term, the Registrar’s Office will maintain a list to submit manual updates after the final spring enrollment file has been processed. This will ensure timely reporting of the withdrawal without overwriting the spring enrollment submission. • Summer withdrawals will now be reported directly to NSC at the time of withdrawal, ensuring timely and accurate reporting. The Registrar's Office will submit a manual enrollment status change to NSC.

We categorically reject the assessment that our county “did not establish and maintain effective internal controls over compliance with coronavirus State and Local Recovery Fund requirement”. The transactions cited happened before state auditors finally clarified how they believed interfund transfers of those funds should have been handled. Before that moment, there had been little to no clear, written guidance from the state on the proper procedure for utilizing these funds for other needs within our budgets (in our case, fixing roads). Our staff spent weeks combing through and attempting to understand federal documents issued with spending rules that changed often and continue to change today. We have traced and will track every penny of those monies were spend and account for them in any way we are required. I believe it is not fair to our county to suggest otherwise in this finding, but we will certainly follow your instructions on interfund transfers, now that we finally know what those are.

ALLOWABLE COSTS AND COST PRINCIPLES Department of Health and Human Resources (DHHR) Assistance Listing Number 97.036, COVID-19 97.036 The DHHR analyzed this finding and hereby offers more details into the condition and cause of the finding. Although the DHHR concurs with the condition statement in the finding, in that certain invoices were paid to one vendor without verifying their accuracy, the DHHR does not concur with the cause statement, which proclaims a lack of proper controls within the DHHR. While no set of internal controls can prevent unseemly or otherwise improper payment activities with absolute assurance, the DHHR does indeed have proper internal controls in place to provide reasonable assurance that invoices are verified for accuracy prior to payment. The DHHR is a large state agency with many spending units, divisions, and levels of oversight and approval. Accordingly, when paying invoices, the process includes a separation of duties. Authorization to approve cash payments begins with the DHHR spending unit, which was a programmatic unit in this case since the vendor in question was required to provide nasal swab diagnostic testing for COVID-19 and upload the test results immediately, as the tests were for specific DHHR programs and initiatives that were an absolute priority at the time. For these and other types of billings, the spending unit receives the invoice from the vendor, conducts an initial review for completeness and accuracy, and approves [or denies] the invoice for payment pursuant to the internal specifications at the spending unit level. If approved for payment, the invoice must be certified by the spending unit. Per the Code of State Rules, Title 155, Series 1, Standards for Requisition for Payment Issued by State Officers on the Auditor, the term “certify” means, “To verify that pertinent information is true and accurate by affixation of a manual signature by an authorized person.” To comply with the verification requirement, 155CSR1-3.1.3 requires the invoice to be stamped with the following certification: “I hereby certify that the items or services contained in the foregoing have been received and approved for payment.” Within the DHHR, the certification must be dated and signed by an authorized representative at the spending unit level with authority to approve such payments. The spending unit then enters the information into wvOASIS, which is the statewide accounting system, and forwards the related documentation to the DHHR central finance office. The central finance office performs a secondary review for completeness and accuracy pursuant to the specifications at the DHHR central level and, if acceptable, approves the documents within the wvOASIS workflow to the WV State Auditor’s Office for final review, approval, and processing of the payment pursuant to the specifications at the statewide level. For the invoices in question, the person authorized to certify the invoices and approve the payments was an upper-level supervisor, and his duties in that position had included reviewing and verifying the accuracy of certain invoices submitted to the DHHR by vendors supplying the aforementioned COVID-19 testing and mitigation services prior to certifying the invoices for payment. The supervisor originally proclaimed that he certified the invoices only after two individuals working with the program verified the invoices. The supervisor subsequently admitted that he certified the invoices without actually making any effort to verify their accuracy. The supervisor is no longer employed by the DHHR. It is important to note that although the supervisor certified the invoices without making any effort to verify their accuracy, it has yet to be determined if the vendor’s invoices were correct or erroneous. Currently, there are several internal and external organizations investigating the vendor and the overall condition that led to this finding. Those investigations began prior to the period of the audit. Once complete, the investigations will disclose additional details surrounding the validity of the invoices and the costs in question.

INTERNAL CONTROLS OVER ALLOWABILITY West Virginia Military Authority (the Authority) Assistance Listing Number 97.036, COVID-19 97.036 The Authority is working internally to establish appropriate internal controls to document the review and approval of all West Virginia National Guard members’ timecard records to ensure that the members’ time is accurately reported and entered into the Oasis payroll system at the correct pay rates and amounts. The new internal controls will be implemented by April 1, 2024.

SUBRECIPIENT MONITORING School Building Authority (SBA) Assistance Listing Number 97.036, COVID-19 97.036 The SBA will ensure and review audits of all subrecipients yearly effective February 2024. The SBA will implement policies and procedures to monitor all subrecipients to ensure compliance with federal requirements. This will include, but is not limited to, performing a yearly risk assessment as required by 2 CFR 200.303. This assessment will take into consideration results from the yearly audit of each subrecipient as well as other criteria listed in 2CFR 200.303 paragraphs (b), (d) & (e).

INTERNAL CONTROLS OVER TRANSPARENCY ACT REPORTING Division of Emergency Management (DEM) Assistance Listing Number 97.036, COVID-19 97.036 To correct the finding, DEM met with federal partners in February 2023 to ensure understanding of what was to be reported, and ensured all staff managing grants with reportable awards knew the requirements. In March 2023, DEM implemented an internal control review between the Program Manager and the Section Chief for FFATA reporting. To ensure this finding is resolved, DEM will continue to utilize the internal control review that has been put in place.

SPECIAL TESTS AND PROVISIONS – ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 The Condition section within prior year finding 2022-037 recognized that the DHHR has policies and procedures in place for performing periodic risk assessments and security reviews over the Recipient Automated Payment and Information Data System (RAPIDS), which is an internal system; however, the Condition section also proclaimed that the DHHR does not have policies and procedures to perform periodic risk assessments and security reviews over the Medicaid Management Information System (MMIS). The first sentence of the corrective action plan for prior year finding 2022-037 indicates that the MMIS is designed, developed, implemented, and operated by an external service organization. Within the last two paragraphs of the corrective action plan for prior year finding 2022-037, the DHHR opined that it was in compliance with 45 CFR 95.621 since it receives the SOC 1 Type 2 report from the MMIS service organization and since the report documents that the service organization establishes and maintains a program for conducting periodic risk analyses to ensure appropriate, cost effective safeguards are incorporated into new and existing systems or whenever significant system changes occur, as required per 45 CFR 95.621. However, the DHHR also recognized the underlying concern expressed within the finding, in that the DHHR does not include the SOC 1 Type 2 report as part of its own policies and procedures for ADP security over the MMIS. To enhance its controls, the DHHR Bureau for Medical Services (BMS) was going to develop a policy and procedures to document MMIS compliance with 45 CFR 95.621. The procedures were to include but not be limited to a requirement to review and approve the SOC 1 Type 2 report from the MMIS service organization and document the review and approval process (e.g., for such matters as the service organization’s assertions, descriptions of its systems and controls, control objectives, and related controls, and the service auditor’s description of tests of controls and results). Although the DHHR BMS has not developed a comprehensive policy or any written procedures to date, they have developed a form to document internal review of the SOC 1 Type 2 report for such matters as the control environment, systems development and maintenance, logical security, physical access, computer operations, and input controls. The BMS has also discussed this issue with an independent consulting firm that is under contract with the BMS for Medicaid expertise and performs existing services related to information technology and security; modernization and planning for the overall Medicaid Enterprise Systems (MES); organization development, including alignment strategies; project management; and data architecture and governance, which includes managing the availability, usability, integrity, and security of data with comprehensive standards and policies. The BMS and its independent consulting firm will work together to develop a statement of work for an independent review of the existing control environment, if deemed necessary, and any additional services that might need performed in order to ensure the DHHR maintains full compliance with 45 CFR 95.621 and can document compliance for future HHS reviewers, independent auditors, or other authorized officials.

SPECIAL TESTS AND PROVISIONS – FRAUD DETECTION AND REPAYMENT West Virginia Department of Health and Human Resources (DHHR) Assistance Listing Number 93.575, 93.596, COVID-19 93.575 Per 45 CFR 98.68(b)(2), there is no requirement for lead agencies to recoup Child Care and Development Fund overpayments, except in instances of fraud as defined by the lead agency. Within the State of West Virginia, the lead agency is the DHHR. As indicated in Section 8.1.6 of the CCDF [State] Plan for West Virginia for Federal fiscal years 2022-2024, the DHHR Office of Inspector General (OIG) is responsible for pursuing fraud and overpayments. As indicated in Section 1.1.2 of the CCDF [State] Plan, the Division of Early Care and Education within the DHHR Bureau for Family Assistance (BFA) administers the CCDF program. Accordingly, the OIG and BFA strive to work as a unified team within the DHHR and State as a whole to identify and prevent fraud or intentional program violations; to identify and recover misspent funds as a result of fraud; and to otherwise fight fraud and ensure program integrity. As the lead agency, and as necessary to ensure program integrity, the DHHR has policies and procedures in place to define fraud and to identify and recover payments resulting from fraud, as the auditors indicated within the condition and recommendation sections of this finding and to track referrals and determinations from beginning to end (i.e., beginning in the year of identification and continuing through resolution or the establishment and enforcement of repayment agreements). The policies and procedures are specifically referenced in Chapter 8 of the BFA’s “Child Care Subsidy Policy and Procedures Manual.” Chapter 8 of the manual is titled, “Improper Payments: Prevention, Identification, Measurement and Recoupment.” Improper Payments Per Chapter 8 of the manual, an improper payment occurs when the funds go to the wrong recipient, the recipient receives the incorrect amount of funds, or the recipient obtains or uses the funds in an improper manner. Improper payments include 1) worker error in determining eligibility, authorizing care, or paying for care; 2) misrepresentation on the part of the parent or provider; and 3) programmatic infractions by parents or providers. 1. Worker Error – Improper payments due to worker error are defined as payments that should not have been made or that were made in an incorrect amount due to an error in determining and verifying eligibility, calculating the benefit, or entering the data into the eligibility system. Repayment of an improper payment due to worker error is not mandatory regardless of the amount. 2. Misrepresentation – Misrepresentation (i.e., fraud) occurs when a specific section of the child care policy is violated as a result of the information not having been reported by the client or provider or reported falsely. Improper payments made as a result of mis-interpretation must be referred to the OIG when the amount exceeds $1,000.00. If the amount does not exceed $1,000.00, the BFA must initiate repayment procedures. A willfully false statement is one that is deliberately given, with the intent that it be accepted as true, with the knowledge that it is false. It is an essential element in a misrepresentation charge that the client or provider knew the statement was false. 3. Programmatic Infraction – There are times when it is difficult to discern whether an improper payment occurred due to willful misrepresentation or is simply the result of a client or provider’s genuine confusion over subsidy program rules and responsibilities. When the case manager believes that improper payments were the result of the client or provider’s failure to understand, it is considered to be a programmatic infraction; it is the BFA’s responsibility to collect the improper payment in this instance, regardless of the amount. If the case manager is in doubt as to whether an improper payment is a programmatic infraction or is the result of misrepresentation by the client or provider, and the improper payment is less than $1,000.00, the case manager discusses the case with the supervisor and the supervisor subsequently consults with the program director; together, they make the decision whether to pursue repayment. Referrals from the Bureau for Family Assistance to the Office of Inspector General If the overpayment is $1,000.00 or greater and is due to misrepresentation by the client or provider, the case manager prepares a memo explaining the circumstances, the time period, and an estimate of the amount involved; indicates the person(s) who can verify the information within the memo; attaches a copy of all applicable documentation including, but not limited to, the payment form and attendance sheets that help support the complaint; states what corrective actions the case manager has taken on the case; and sends a copy of the memo and supporting documents to the Office of Inspector General, Division of Investigations and Fraud Management. Recovery of Improper Payments Resulting from Misrepresentation (i.e., Fraud) The supervisors within the BFA are responsible for negotiating repayment schedules with providers and clients and completing a Child Care Benefit Repayment Agreement to include the amount to be recovered, the period of recovery, the monthly recovery amount, and the procedure for repayment. If the provider or client is active, the case manager attempts to collect the payment in full; if this is not feasible, the case manager requests that the client or provider be asked to repay the amount in monthly installment payments of approximately 10% of the amount due. If a payment is more than 45 days late (15 days past the due date), the entire unpaid balance becomes due and must be paid in full. Failure to repay the requested amount results in case closure for clients or denial of participation in the certificate system for child care providers. Client services will not be reinstated until full payment is received. There are no policies or procedures to pursue repayments or collection beyond that point. There is no method to recoup overpayments from ongoing benefits, and the CCDF is not subject to the Treasury Offset Program, as other Federal programs are. Corrective Action Plan As previously stated, the OIG and BFA strive to work as a unified team within the DHHR to identify and prevent fraud or intentional program violations; to identify and recover misspent funds as a result of fraud; and to otherwise fight fraud and ensure program integrity. In response to the auditor’s recommendation for this finding, the OIG and BFA will revisit existing policies and procedures over fraud detection and repayment and will attempt to enhance the controls related thereto, particularly in relation to ensuring that all efforts concerning fraud detection and repayment are sufficiently documented, thus demonstrating full compliance with 45 CFR 98.60. Maintaining documentation of the decision-making process, the activities performed, and the results of those activities is of paramount importance in achieving that objective. A high level of documentation is necessary to support that the DHHR has policies and procedures in place and is following those policies and procedures. Maintaining adequate records and other documentary evidence will resolve this audit finding, prevent the occurrence of future audit findings, and provide a means to corroborate statements and assurances provided to regulatory agencies and other authorized individuals with regards to the DHHR’s overall compliance with 45 CFR 98.60. It is not enough to perform the activities; there must be an adequate audit trail to show the “who, what, when, where, and how” of the activities performed. As such, the OIG and BFA will also develop and maintain an appropriate system for categorizing their files and organizing their records, reports, and documents in a systematic and orderly manner to ensure, among other purposes, that they can substantiate their efforts when audited, reviewed, or evaluated by internal staff or authorized external organizations.

ALLOWABILITY AND ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 For the one payment out of 40 whereby the provider requested and was paid for 13 non-traditional days although records indicated that only 11 of the days were non-traditional, the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), agrees that the condition resulted in an overpayment of $12.00. The BFA Case Manager entered 13 non-traditional days in the Family and Children Tracking System (FACTS), but the record indicated that only 11 days were non-traditional days. Per WV Child Care Policy and Procedures: 8.3.1. Worker Error Improper payments due to worker error are defined as payments that should not have been made, or that were made in an incorrect amount due to worker error in determining and verifying eligibility, and/or calculation and input of information into the Family and Children’s Tracking System (FACTS). Incorrect amounts include overpayments, underpayments and inappropriate denials of payment. 8.3.1.1. Examples of worker error: A. The child care regulatory specialist enables the “accreditation” box, allowing the provider to receive an extra $4 per day, when the provider has not achieved accreditation, and is not entitled to the enhanced rate. B. The case manager enters an incorrect number of days when entering information from the payment form into FACTS. C. The case manager enters more time on the child care assessment than the client’s work or school schedule supports. D. The case manager fails to verify income, school enrollment, or special needs status. 8.3.1.2. Repayment of an improper payment due to CCR&R worker error is not mandatory regardless of the amount. The BFA Division of Early Care and Education employs Child Care Policy Specialists who visit contracted Resource and Referral Agencies to monitor and audit both electronic and hard records. Training and coaching also takes place during these visits. These visits continued throughout the reporting period. The BFA will evaluate the effectiveness of the current training programs for the use of the FACTS system (and subsequently for the West Virginia People's Access to Help (PATH) system) for CCDF payments. Furthermore, the BFA will follow established policies and procedures to ensure client information is appropriately obtained and maintained and that all data is input accurately. For the payment whereby the $3.00 daily supplement was not included in the calculation or paid, although the documentation in the eligibility system indicated that the child was covered under a CPS Safety Plan, this was not in fact a CPS Safety Plan case. The CPS Safety Plan was being used as a temporary means to address an executive order regarding COVID-19 and grant eligibility to essential workers who would otherwise not have qualified for the child care subsidy assistance due to their monthly income being above the Federal Poverty Level but below 85% of the State Median Income. The payment in question was in March 2023. Via a case assessment on November 1, 2023, this case [and other similar cases] were approved in the eligibility system as formalized Policy Exceptions rather than being selected as part of a CPS Safety Plan.

TRANSPARENCY ACT REPORTING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 The DHHR concurs with the Condition section of the finding, in that one report was not submitted timely; however, the DHHR does not agree with the Cause section of the finding, which indicates a lack of oversight and adequate review of the FFATA reporting by DHHR Management. The DHHR hereby notes that the report was due on October 31, 2022 but was not submitted until November 1, 2022 (i.e., one day late). Submitting a report one day late is not an indication of a lack of oversight or adequate review of the FFATA reporting requirement. In this case, the report was submitted one day late because the person responsible for submitting the report was working remotely on October 31, 2022 and lost internet connection until November 1, 2022. Although the DHHR strives for perfection, such a condition cannot always be achieved, especially from the perspective of information technology within the rural state of West Virginia. Nonetheless, if the situation repeats in the future, the person responsible for submitting the report will be encouraged to find a location that has an adequate [and secure] internet connection.

INTERNAL CONTROLS OVER CHILD CARE PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Department of Health & Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 All funds resulting from the American Rescue Plan Act (ARPA) were expended and all related programs ended on or before September 30, 2023. The West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), Division of Early Care and Education, employs Child Care Policy Specialists who visit contracted Resource and Referral Agencies to monitor and audit both electronic and hard records. Training and coaching also takes place during these visits. These visits continued throughout the reporting period. The BFA will evaluate the effectiveness of the current training programs for the collection and storing of eligibility records. Furthermore, the BFA will follow established policies and procedures to ensure provider information and documentation is appropriately obtained, reviewed, and retained.

SUBRECIPIENT CASH MANAGEMENT Department of Health and Human Resources (DHHR) Assistance Listing Number 93.788 The West Virginia Department of Health and Human Resources, Bureau for Behavioral Health (BBH), analyzed this finding and hereby offers more details into the condition and cause of the finding. For the first noted exception, the grant was finalized on March 20, 2023. The BBH received the subrecipient’s first request for payment on April 12, 2023, at which point the reconciliation indicated that the subrecipient had incurred expenses of $118,186.21 to date. Although the reconciliation was not reviewed and approved by the BBH timely, it indicated that the subrecipient had not been reimbursed at all; therefore, the subrecipient had no cash on hand at the time of the request for payment. For the second noted exception, the BBH received the reconciliation on June 2, 2023. Although the reconciliation was not reviewed and signed by the BBH timely, it indicated $41,296.14 of cash on hand, which was under the 10% threshold established by the BBH when monitoring cash management for subrecipients of the Opioid program. For the third noted exception, the BBH received the reconciliation on March 14, 2023. Although the reconciliation was not reviewed and signed by the BBH timely, it indicated expenditures of $63,839.08 and cash on hand of only $18,070.92, which was less than the 10% threshold established by the BBH when monitoring cash management for subrecipients of the Opioid program. For the fourth noted exception, a processing error within the BBH caused the subrecipient to receive a payment that should have been held due to the subrecipient having sufficient cash on hand at the time of the payment. Nonetheless, after the period of performance, the subrecipient did not have excess cash on hand, or any cash on hand for that matter. The subrecipient returned $218,290.74 to the BPH on November 14, 2023 and $2,317.10 on November 29, 2023 in accordance with the closeout procedures referenced in 2 CFR 200.344(d). The total amount of $220,607.84 constituted the balance of unobligated cash that the BPH paid the subrecipient in advance and was not authorized to be retained by the subrecipient for use in other projects. In an effort to enhance internal controls, the BBH’s central level managers continue to work with internal and external parties to improve everyone’s understanding of the federal rules and regulations and the BBH’s existing policies, procedures, and overall expectations concerning subrecipient cash management.

ALLOWABILITY OF EXPENDITURES, SPECIAL TEST AND PROVISIONS – PROVIDER ENROLLMENT & SPECIAL TEST AND PROVISIONS: PROVIDER HEALTH AND SAFETY STANDARDS (MEDICAID ONLY) Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778 The West Virginia Department of Health and Human Resources, Bureau for Medical Services (BMS), has developed a form to document internal review of the service organization’s SOC 1 Type 2 report for such matters as the control environment, system development and maintenance, logical security, physical access, computer operations, and input controls. The form also has dedicated sections for exceptions within the SOC 1 Type 2 report as noted by the reviewer(s) and for questions/comments that the reviewer(s) might have. As of the date of this writing, the BMS is still working on the instructions for completing the form and processing the form to the next level within the BMS as may be necessary (e.g., answering any questions or comments that the initial reviewer denoted on the form; evaluating whether any exceptions noted within the SOC 1 Type 2 report could have a negative effect on the MMIS or the Medicaid program in general; and eventually closing the SOC 1 Type 2 report and documenting the review, the overall effect, the resulting actions, and any pending actions within the appropriate system files).

ALLOWABILITY AND ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.659 The issues identified in the finding were due to a broad number of child welfare workers having access to select “Non-Recurring Adoption Expense” (NRAE) when issuing a demand payment through the eligibility system, causing the incorrect funding to be used. Two of the payments identified were manually entered to replace lost payments. The initial payments covered multiple children, but the replacement payment only identified one child’s name. For the Adoption Program, the DHHR phased in a new information technology system for determining eligibility, making payments, maintaining documentation, etc. during the State Fiscal Year 2023. The name of the new system is PATH (People & Access to Help). The PATH system replaced the Family and Children & Tracking System (FACTS). The PATH system will have additional controls and levels of review as compared with the FACTS system. For example, as specific to this finding, the ability to select NRAE when issuing a demand through PATH has been localized to adoption subsidy unit staff within the central office of the DHHR Bureau for Social Services.

ALLOWABILITY AND ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.658 As indicated in the Condition section of the finding, although the documentation related to safety considerations at child care institutions was not initially maintained in the official licensing files for 10 of the 40 cases tested for eligibility, the documentation was eventually provided to the auditors for eight of those 10 cases. For one of the remaining two cases, the child care institution is an out-of-state institution that is no longer in business. For the other case, the child care institution provided documentation, but the documentation did not include the dates of the institution’s safety checks. In an effort to enhance internal controls over the safety considerations at child care institutions, the West Virginia Department of Health and Human Resources, Bureau for Social Services (BSS), is continuing to analyze the condition that led to this finding and is considering a number of steps, including but not limited to the following as an immediate plan of action: • Transmit a copy of 2 CFR 1356.30(f) to all licensing personnel, supervisors, and other applicable staff within the BSS and oblige them to acknowledge that they have read and understand the requirements referenced therein. • Implement a formalized policy and develop written procedures for ensuring the licensing files for child care institutions contain documentation which verifies that safety considerations with respect to the staff of the institutions have been addressed. • Develop overall standards for the maintenance of documentation within licensing files (e.g., a consistent naming convention for the documents, which would improve internal tracking and ensure that requests from independent auditors are addressed efficiently and fully; personnel who have read-only access to documents versus those who can add, replace, and delete documents; record retention requirements; etc.). • Establish a formalized process for monitoring. Such a process would include a strategy for conducting internal reviews of all licensing files on a recurring basis, reporting the results of those reviews to appropriate officials internal and external to the DHHR, following up with those officials as may be necessary, and documenting the overall results accordingly. For example, if the results of a monitoring review indicated noncompliance [or potential noncompliance] on the part of a child care institution, the BSS would inform the institution, request a copy of the institution’s written policies and procedures regarding safety considerations, discuss it with the institution, and provide technical assistance to the maximum extent practicable. Once the BSS drafts the aforementioned policies and procedures and related monitoring process, or otherwise enhances their internal controls over the safety considerations at child care institutions, the BSS will discuss the matter with their regular programmatic contacts at the U.S. Department of Health and Human Services, Administration for Children and Families, and will ask the ACF if the BSS’s planned controls are aligned with the ACF’s universal expectations surrounding 2 CFR 1356.30(f).