Corrective Action Plans

Finding 36074 (2022-005)

Material Weakness 2022

Central Noble Community School Corporation

IN

Questioned Costs School Nutrition Programs Allowable Costs / Cost Principles § 200.303

Contact Person Responsible for Corrective Action: Tyler C. Osenbaugh Contact Phone Number: 260-336-0217 Views of Responsible Official: Agree with the finding Description of Corrective Action Plan: The School Food Authority and Food Service Director (Chartwells? Director of Dining Services) review an...

Contact Person Responsible for Corrective Action: Tyler C. Osenbaugh Contact Phone Number: 260-336-0217 Views of Responsible Official: Agree with the finding Description of Corrective Action Plan: The School Food Authority and Food Service Director (Chartwells? Director of Dining Services) review and validate the supporting documentation for all food service-related purchases. The documentation, include payroll information and non-payroll expenditures, including vendor deliveries. Copies of the supporting data have been retained by the Business Manager to ensure records are available for audits. The review occurs prior to the SFA submitting for reimbursement into CNPWeb. These steps have been in place correcting the previous finding (2020-002). Future reviews will include supporting vendor (Gordon Food, Piazza, Prairie Farms) price lists in effect during the support period. The prices paid for commodities from these vendors will be compared to Chartwells Operations Ledger to ensure charges are consistent with the costs. Anticipated Completion Date: May 2023

View Audit 32815 Questioned Costs: $1

Finding 36063 (2022-001)

Material Weakness 2022

Hawaii Pacific University

HI

Allowable Costs / Cost Principles Student Financial Aid § 200.303

Views of Responsible Officials and Planned Corrective Action The HPU Financial Aid Office works hard to follow all federal regulations and guidance mandated for the Title IV Federal Student Aid programs. In regards to the distribution of the Federal HEERF fund to HPU students, the HPU Financial Aid...

Views of Responsible Officials and Planned Corrective Action The HPU Financial Aid Office works hard to follow all federal regulations and guidance mandated for the Title IV Federal Student Aid programs. In regards to the distribution of the Federal HEERF fund to HPU students, the HPU Financial Aid Director relied on reports from the SIS (Banner system), Institutional Research, and Accounts Receivable to determine students eligible for HEERF funds. The HPU Financial Aid Office and Office of Sponsored Projects worked hard, and diligently, to award funds to students and expend Institution portion based on the regulations that were provided at the time and not violating the intent of the program, as evidenced by there not being any non-compliance over allowability of costs charged to Federal HEERF fund. For future awards, the Principal Investigator with the assistance of the Office of Sponsored Projects will review diligently the expenditure to be sure the expenditures are within the allowability and terms and conditions of the federal awards. Both offices will work collaboratively so that the internal controls over allowability are strengthened and that the documentation will be strongly implemented and retained. For future programs, the HPU Financial Aid will work to strategically plan, organize, and disburse funds to students and expend Institution funds within the requirements mandated by the United States Department of Education, including strengthening our internal controls over compliance, and increasing the documentation and maintenance of documentation over our existing internal controls for compliance. Person Responsible: Manager, for Office of Sponsored Projects & Assistant VP for Office of Sponsored Projects, Director of Financial Aid Targeted Correction Date: June 30, 2023.

View Audit 34010

Finding 36039 (2022-001)

Significant Deficiency 2022

Parnassus Preparatory School

MN

Eligibility School Nutrition Programs Matching / Level of Effort / Earmarking § 200.303

Views of Responsible Officials and Planned Corrective Action: Management agrees with this finding. As noted, a turnover in staff happened right at the time when the verification for FY22 was due and the new staff member did not realize the required verification had not occurred. The School followed ...

Views of Responsible Officials and Planned Corrective Action: Management agrees with this finding. As noted, a turnover in staff happened right at the time when the verification for FY22 was due and the new staff member did not realize the required verification had not occurred. The School followed proper procedures each year prior to FY22. The School identified the FY22 error at the beginning of the 2022-2023 school year prior to the audit. Immediate action was taken to ensure this error would not reoccur in the future when the School experienced a staffing change. In so doing, the School implemented a step-by-step tutorial of procedures, including reporting dates and deadlines. Necessary staff members have attended, and will continue to attend, training for items related to the application of Educational Benefits. The verification process was checked by a supervisor to ensure proper processes were followed for the 2022-2023 school year and they were.

View Audit 33962

Finding 35993 (2022-004)

Material Weakness 2022

Young Women's Christian Association of Pueblo

CO

Allowable Costs / Cost Principles Cash Management Material Weakness § 200.303

January 5, 2023 RE: Finding 2022-004: Internal Control over Compliance The following is the Corrective Action Plan (CAP) related to the noted finding. Corrective Action Plan Agency: U.S. Department of Health and Human Services Audit Period: June 2022 Audit Finding number: 2022-004 Audit Finding ...

January 5, 2023 RE: Finding 2022-004: Internal Control over Compliance The following is the Corrective Action Plan (CAP) related to the noted finding. Corrective Action Plan Agency: U.S. Department of Health and Human Services Audit Period: June 2022 Audit Finding number: 2022-004 Audit Finding Title: Internal Control over Compliance Specific Steps to be Taken: The YWCA Pueblo?s financial management policies and procedures for cash disbursements will be followed diligently. Electronic systems will be put into place to ensure that cash disbursements are approved, and all supporting documents are available at time of approval. Anticipated Completion Date: February 2023 Name and title of contact person responsible for Corrective Action Plan: Name: Maureen White Title: Executive Director

View Audit 32656

Finding 35988 (2022-004)

Significant Deficiency 2022

University of Maine System

ME

Matching / Level of Effort / Earmarking Reporting Significant Deficiency § 200.303

Higher Education Emergency Relief Funds ? Assistance Listing No. 84.425 Recommendation: We recommend the universities review their reporting procedures to ensure all required steps are included as well as the supporting documentation to prepare the report is retained. University of Maine at Fort Ken...

Higher Education Emergency Relief Funds ? Assistance Listing No. 84.425 Recommendation: We recommend the universities review their reporting procedures to ensure all required steps are included as well as the supporting documentation to prepare the report is retained. University of Maine at Fort Kent (UMFK) Condition: Two quarterly student reports tested were missing a required disclosure item. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: UMFK has amended all quarterly reports (9/30/2021, 12/31/2021, and 3/31/2022) to include the missing required disclosure item related to eligible students. Supporting worksheets have been updated to include all relevant disclosure items and reported data is verified using queries from both the financial and student information systems to ensure report accuracy and completeness. A review process has been implemented whereby the Financial Analyst signs off on preparation and the Chief Business Officer performs a final review and approval prior to submission. Name(s) of the contact person(s) responsible for corrective action: Megan Desjardins, Financial Analyst for the University of Maine at Fort Kent Pamela Ashby, Chief Business Officer for the University of Maine at Fort Kent Planned completion date for corrective action plan: Completed March 3, 2023 University of Maine at Farmington (UMF) Condition: One annual report tested where the supporting documentation did not agree to what was included in the report. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: We realized the error during the next quarterly report cycle and corrected our internal data sheets, but the federal reporting portal was not open for corrections. Now that the federal reporting portal has reopened, we are in the process of correcting the 2021 annual report. In response to this finding, we have incorporated a verification of data in the spreadsheets used to prepare the annual report and now require a final review by the Chief Business Officer or his or her designee prior to submission. Name(s) of the contact person(s) responsible for corrective action: Christine Wilson, Vice President for Student Affairs and Enrollment Management at the University of Maine at Farmington Planned completion date for corrective action plan: March 31, 2023 University of Maine at Presque Isle (UMPI) Condition: One quarterly institutional report was not published timely. Two quarterly student reports tested where the supporting documentation did not agree to what was included in the report. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: As a result of a retirement in June 2022, we implemented additional internal controls for the timely compiling and review of required HEERF quarterly reports. The quarterly reports are now compiled by two staff members, and then reviewed and signed off by the Director of Financial Aid and the Controller?s Office the week prior to each deadline for the posting of the report to the institution?s website. As of July 1, 2022, with the updated quarterly report template and requirements from the Department of Education, we implemented a new, standardized process for gathering the appropriate student data for the reports, and new processes for documenting and retaining the data used in the reports. The reports in question were completed prior to this new process and amendments correcting the report information were made on September 6, 2022, and subsequently posted to the institution?s website. Name(s) of the contact person(s) responsible for corrective action: Connie Smith, Director of Financial Aid for the University of Maine at Presque Isle Planned completion date for corrective action plan: Completed September 6, 2022 University of Maine (UM) Condition: Two quarterly student reports tested where the supporting documentation did not agree to what was included in the report. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: As of July 1, 2022, with the updated quarterly report template and requirements from the Department of Education, we implemented a new, standardized process for gathering the appropriate student data for the reports, and new processes for documenting and retaining the data used in the reports. The reports in question were completed prior to this new process and amendments correcting the report information were made on January 27, 2023 and subsequently posted to the institution?s website. Name(s) of the contact person(s) responsible for corrective action: Connie Smith, Director of Financial Aid for the University of Maine Planned completion date for corrective action plan: Completed January 27, 2023

View Audit 36516

Finding 35965 (2022-003)

Material Weakness 2022

Lake Station Community Schools

IN

Subrecipient Monitoring Material Weakness Reporting § 200.302 § 200.303 § 200.328 § 200.329

FINDING 2022-003 Subject: COVID-19 ? Education Stabilization Fund - Reporting Person Responsible for Corrective Action: Tammy Whisenant ? 219-962-1159 Views of Responsible Official: We concur with the finding. I have viewed and acknowledge the discrepancies listed. However, as I am new to my positio...

FINDING 2022-003 Subject: COVID-19 ? Education Stabilization Fund - Reporting Person Responsible for Corrective Action: Tammy Whisenant ? 219-962-1159 Views of Responsible Official: We concur with the finding. I have viewed and acknowledge the discrepancies listed. However, as I am new to my position, I am unable to determine the cause of the discrepancies. Personnel responsible for these areas assumed responsibilities just prior to and/or after this audit period commenced. Description of Corrective Action Plan: The corrective action will include: 1) Assess current assignments and identify opportunities to implement multiple level of review and verification. 2) Continue improved training, education and professional development of personnel responsible for financial transactions and reporting relating to federal programs. 3) Improved use of technology-based financial systems to ensure effectiveness and accuracy of financial transactions and reporting for federal programs. Anticipated Completion Date: An assessment of actions, needs and a plan will be completed by April 30, 2023; with an implementation to occurring by June 30, 2023. ________________________________ Tammy Whisenant, Director of Finance/Treasurer Lake Station Community Schools February 28, 2023

View Audit 34526

Finding 35939 (2022-003)

Material Weakness 2022

Johnson County, Iowa

IA

Subrecipient Monitoring § 200.303 § 200.331 § 200.333

Finding: 2022-003 Material Weakness in Internal Control over Compliance and Material Noncompliance U.S. Department of Labor Federal Financial Assistance Listing 17.258/17.259/17.278 WIOA Cluster Subrecipient Monitoring Finding Summary: The County did not formally communicate the required informatio...

Finding: 2022-003 Material Weakness in Internal Control over Compliance and Material Noncompliance U.S. Department of Labor Federal Financial Assistance Listing 17.258/17.259/17.278 WIOA Cluster Subrecipient Monitoring Finding Summary: The County did not formally communicate the required information to the subrecipient. No subrecipient agreement was executed. In addition, no monitoring activities were documented. Responsible Individuals: Dana Aschenbrenner, Finance Director Corrective Action Plan: Johnson County disagrees with the underlying premises of this finding. This finding is due in part to the fiscal agent agreement with Iowa Workforce Development (?IWD?) which does not state that subrecipient monitoring has to be done. Recently, IWD received a finding from the Department of Labor stating that the template fiscal agent agreements imposed upon fiscal agents by IWD improperly placed liability of disallowed costs onto the fiscal agents. According to DOL, IWD?s form of fiscal agent contract was incorrect, i.e., the liability was to stay with the local CEOs. In the wake of the finding, IWD is reissuing the contracts out to the regions to create compliant subrecipient entities within each, and then new fiscal agent agreements will be issued. Additionally, Johnson County will be ending it fiscal agent agreement, and no longer continue to be the fiscal agent as of June 30, 2023. Anticipated Completion Date: Ongoing

View Audit 27011

Finding 35938 (2022-002)

Material Weakness 2022

Johnson County, Iowa

IA

Questioned Costs Procurement, Suspension & Debarment Allowable Costs / Cost Principles § 200.303 § 200.403

Finding: 2022-002 Material Weakness in Internal Control over Compliance and Material Noncompliance U.S. Department of Labor Federal Financial Assistance Listing 17.258/17.259/17.278 WIOA Cluster Activities Allowed or Unallowed Finding Summary: The County?s expenditures identified as eligible and cl...

Finding: 2022-002 Material Weakness in Internal Control over Compliance and Material Noncompliance U.S. Department of Labor Federal Financial Assistance Listing 17.258/17.259/17.278 WIOA Cluster Activities Allowed or Unallowed Finding Summary: The County?s expenditures identified as eligible and claimed under the WIOA Cluster program were disallowed by the United States Department of Labor due the lack of appropriate documentation justifying specific costs charged to the program related to one vendor ? Garcia Professional Services, LLC. Also, the contract entered into with Garcia Professional Solutions, LLC. did not adequately address the required contract terms as follows: 1. Total dollar value of the contract to justify procurement method utilized. 2. Terms for payment to ensure payments are only made for verified services received and adequately documented. 3. Contract provisions stipulated in Appendix II to Part 200 of the Uniform Guidance, including Equal Employment Opportunity, Rights to Inventions Made Under a Contract or Agreement, Debarment and Suspension, and Byrd Anti-Lobbying Amendment. Responsible Individuals: Dana Aschenbrenner, Finance Director Corrective Action Plan: Johnson County disagrees with the underlying premises of this finding. The expenditures referred to above were expenditures of the East Central Iowa Workforce Development Board (ECIWDB) and not direct expenses of the County. The ECIWDB contracted with Johnson County to provide fiscal agent services. The ECIWDB then entered into a contract with Garcia Professional Solutions, LLC (?GPS?) to provide administrative support services for the Board. Iowa Workforce Development did not provide adequate guidance to ECIWDB as to the DOL-required terms and the terms of that services contract between ECIWDB and GPS did not contain any standards of documentation which DOL later claimed applied to said contract. The County had no input into the contract between the ECIWDB and GPS, nor was the County a party to said contract. Any alleged deficiencies within that contract between the ECIWDB and GPS are solely the responsibility of the ECIWDB Board and/or Iowa Workforce Development. In our fiscal agent role, the County was obliged to honor payment requests submitted to the Board; in that regard we had to make payments to GPS provided those payment requests were invoiced to ECIWDB consistent with the ECIWDB-GPS contract, which they were. Anticipated Completion Date: Ongoing

View Audit 27011 Questioned Costs: $1

Finding 35901 (2022-002)

Significant Deficiency 2022

Atrium Health, Inc.

NC

Questioned Costs Subrecipient Monitoring Allowable Costs / Cost Principles § 200.303

Finding 2022-002: Allowability (COVID-19 ? Provider Relief Fund) Name of Contact Person: David Thomas, Group Vice President & Controller Corrective Action Plan: Atrium Health management believes that, while the Provider Relief Funds reporting was completed on a periodic basis throughout the pand...

Finding 2022-002: Allowability (COVID-19 ? Provider Relief Fund) Name of Contact Person: David Thomas, Group Vice President & Controller Corrective Action Plan: Atrium Health management believes that, while the Provider Relief Funds reporting was completed on a periodic basis throughout the pandemic, the intent from HRSA was to document the use of those funds for COVID-19 expenses and for lost revenues over the course of the entire pandemic. Because the PRF portal did not allow for previous periods to be restated in response to new information or corrections identified from previous reported periods, the only recourse available for health systems to restate COVID-19 expenses or lost revenues is through future PRF reporting or through the HRSA audit process. Management agrees that the control process in place during the initial reporting process for Wilkes Regional Medical Center did not yield the ultimate cost categorization that was corrected in the PRF reporting noted above; however, management?s interaction with HRSA throughout 2022 and the resulting clarification of COVID-19 expenses, is now incorporated into the overall PRF reporting control process. With respect to the identified questioned costs, management agrees that these costs should not have been included as COVID-19 related expenses for that period. However, management also recognizes that Wilkes Regional Medical Center has unused lost revenues more than this amount and as such, the questioned costs would not be subject to a return of the PRF proceeds. This position is supported by a similar finding in the 2021 Atrium Health Enterprise audit that was resolved with this conclusion and is documented in the Management Decision Letter issued by HRSA dated June 26, 2023. There are no additional PRF reporting periods required to be completed for Wilkes Regional Medical Center and Atrium Health management, when contacted, will provide HRSA auditors similar documentation to support the conclusion reached for these COVID-19 related expenses. Proposed Completion Date: Management will complete the corrective action plan upon request by HRSA.

View Audit 37993 Questioned Costs: $1

Finding 35900 (2022-001)

Significant Deficiency 2022

Atrium Health, Inc.

NC

Cash Management Reporting Matching / Level of Effort / Earmarking § 200.303

Finding 2022-001: Allowability (COVID-19 ? HRSA COVID-19 Uninsured Program) Name of Contact Person: David Thomas, Group Vice President & Controller Corrective Action Plan: Atrium Health CMHA currently has an insurance verification process for potentially uninsured patients meeting the criteria p...

Finding 2022-001: Allowability (COVID-19 ? HRSA COVID-19 Uninsured Program) Name of Contact Person: David Thomas, Group Vice President & Controller Corrective Action Plan: Atrium Health CMHA currently has an insurance verification process for potentially uninsured patients meeting the criteria prescribed by HRSA whereby identified accounts are sent nightly to Experian, a multinational consumer credit reporting company, who searches for insurance coverage. Negative confirmation documentation is inserted into the patient record. Management is aware of the importance of this process and has continued education efforts with applicable teammates to ensure this process is followed and documented with each patient. Additionally, the HRSA COVID-19 Uninsured Program ended in April of 2022. Proposed Completion Date: Management completed the 2021 corrective action plan by the end of September 2022. All findings were prior to this date.

View Audit 37993

Finding 35897 (2022-003)

Significant Deficiency 2022

Atrium Health, Inc.

NC

Questioned Costs Matching / Level of Effort / Earmarking Internal Control / Segregation of Duties § 200.300 § 200.303 § 200.408

Finding 2022-003: Allowability of Costs (Research & Development Cluster) Name of Contact Person: David Thomas, Group Vice President & Controller Corrective Action Plan: To address the current year finding, Academic Project Portfolio Management (PPM) Labor team has implemented internal control im...

Finding 2022-003: Allowability of Costs (Research & Development Cluster) Name of Contact Person: David Thomas, Group Vice President & Controller Corrective Action Plan: To address the current year finding, Academic Project Portfolio Management (PPM) Labor team has implemented internal control improvements to ensure all requirements that limit the salary cap allowability of costs are completed and documented appropriately including communication and education of salary cap requirements with the business administrator, plus additional review from the Academic PPM Labor team. Proposed Completion Date: Management will complete the corrective action plan by December 2023.

View Audit 37993 Questioned Costs: $1

Finding 35896 (2022-004)

Significant Deficiency 2022

Atrium Health, Inc.

NC

Matching / Level of Effort / Earmarking Internal Control / Segregation of Duties § 200.303

Finding 2022-004: Allowability of Costs (Research & Development Cluster) Name of Contact Person: David Thomas, Group Vice President & Controller Corrective Action Plan: To address the current year finding, Atrium Health has adopted the Wake Forest University Health Sciences Effort Policy which al...

Finding 2022-004: Allowability of Costs (Research & Development Cluster) Name of Contact Person: David Thomas, Group Vice President & Controller Corrective Action Plan: To address the current year finding, Atrium Health has adopted the Wake Forest University Health Sciences Effort Policy which allows for ?a degree of tolerance? within the effort certification process. Office of Sponsored Programs will review Huron Employee Compensation Compliance (ECC) system for discrepancies over the percentage of tolerance allowed in the policy of plus or minus 5%. Proposed Completion Date: Management completed the corrective action plan by July 2022.

View Audit 37993

Finding 35881 (2022-001)

Significant Deficiency 2022

Colgate University

NY

Reporting Matching / Level of Effort / Earmarking § 200.303 § 200.328 § 200.329

Responsible Official ? Kyle Dombrowski, Director of Tax and Financial Reporting During bi-weekly meetings with the grant office, we will ensure that we are aware of deadlines and that we will files reports in a complete, accurate, and timely manner. Anticipated Completion Date: 3/30/2023

View Audit 30185

Finding 35839 (2022-003)

Significant Deficiency 2022

Sioux Center Health

IA

Reporting Significant Deficiency Matching / Level of Effort / Earmarking § 200.303

Finding 2022-003 Federal Agency Name: Department of Agriculture Program Name: Community Facilities Loans and Grants CFDA # 10.766 Finding Summary: The Health Center?s FY2023 operating budget and prior year audited financial statements were not submitted to USDA within the submission timeframe. Res...

Finding 2022-003 Federal Agency Name: Department of Agriculture Program Name: Community Facilities Loans and Grants CFDA # 10.766 Finding Summary: The Health Center?s FY2023 operating budget and prior year audited financial statements were not submitted to USDA within the submission timeframe. Responsible Individuals: Crystal Richter, Chief Financial Officer Corrective Action Plan: Once the operating budget is approved by the Board of Directors at the June quarterly meeting, the approved budget will be submitted to USDA in a timely manner. Audited financial statements will be submitted to USDA in a timely manner after the audit is presented to the Board of Directors. Anticipated Completion Date: June 2023

View Audit 32272

Finding 35838 (2022-004)

Material Weakness 2022

Pipestone County Medical Center

MN

Special Tests & Provisions Subrecipient Monitoring Cash Management § 200.303

Finding 2022-004 Federal Agency Name: Department of Agriculture Program Name: Communities Facilities Loans and Grant Cluster Federal Financial Assistance Listing #10.766 Special Tests and Provisions: Material Weakness in Internal Control over Compliance Finding Summary: The Medical Center did not h...

Finding 2022-004 Federal Agency Name: Department of Agriculture Program Name: Communities Facilities Loans and Grant Cluster Federal Financial Assistance Listing #10.766 Special Tests and Provisions: Material Weakness in Internal Control over Compliance Finding Summary: The Medical Center did not have an internal control process in place to ensure a secondary level of review is being performed on the required minimum for the reserve account and financial covenants. Responsible Individuals: Sandra Schlechter, Chief Financial Officer, and Bradley Burris, Chief Executive Officer Corrective Action Plan: Within the monthly board packet, we will include the calculation of days on hand, the debt service covenant ratio, the balance of the reserve along with the required minimum requirements for each of these items. This packet is presented monthly to the board of directors for approval. Anticipated Completion Date: February 2023

View Audit 30519

Finding 35837 (2022-003)

Material Weakness 2022

Pipestone County Medical Center

MN

Material Weakness Reporting Matching / Level of Effort / Earmarking § 200.303

Finding 2022-003 Federal Agency Name: Department of Agriculture Program Name: Communities Facilities Loans and Grant Cluster Federal Financial Assistance Listing #10.766 Reporting: Material Weakness in Internal Control over Compliance and Material Noncompliance Finding Summary: The fiscal year 2021...

Finding 2022-003 Federal Agency Name: Department of Agriculture Program Name: Communities Facilities Loans and Grant Cluster Federal Financial Assistance Listing #10.766 Reporting: Material Weakness in Internal Control over Compliance and Material Noncompliance Finding Summary: The fiscal year 2021 audit report was either not submitted to USDA or submitted to USDA with no retained documentation to support when the report was submitted. The FY 2023 operating budget was not submitted to USDA during the period under audit. Responsible Individuals: Sandra Schlechter, Chief Financial Officer, and Bradley Burris, Chief Executive Officer Corrective Action Plan: There will be internal reminders set up in management?s yearly calendar for information to be sent to USDA for submission of the annual audited financial statements and operating budget for the next fiscal year. Anticipated Completion Date: February 2023

View Audit 30519

Finding 35629 (2022-001)

Significant Deficiency 2022

University of Massachusetts

MA

Matching / Level of Effort / Earmarking Student Financial Aid § 200.303

Management?s Views and Corrective Action Plan 2022-001 ? Loan Disbursement Notifications Award Information Cluster: Student Financial Assistance Grantor: Department of Education Award Name: Federal Direct Student Loans Award Year: July 1, 2021 ? June 30, 2022 AL Number: 84.268 The University of Mass...

Management?s Views and Corrective Action Plan 2022-001 ? Loan Disbursement Notifications Award Information Cluster: Student Financial Assistance Grantor: Department of Education Award Name: Federal Direct Student Loans Award Year: July 1, 2021 ? June 30, 2022 AL Number: 84.268 The University of Massachusetts acknowledges that some students did not receive their notifications informing them of the 30 day right-to-cancel for their Federal Direct Loans within the prescribed timeframe of no later than 30 days before, but no later than 7 days after the date of disbursement. The University has implemented an automated communication process with built in internal reviews that will ensure all borrowers are notified within the required timeframe. For further details regarding the corrective action plan, contact the Assistant Vice President and University Controller, Patrick Hitchcock, at phitchcock@umassp.edu.

View Audit 25222

Finding 35598 (2022-100)

Significant Deficiency 2022

Commonwealth of Virginia

VA

Subrecipient Monitoring Reporting Significant Deficiency § 200.303

Responsible Contact Person(s): Naveen Abraham, Chief of Core Infrastructure Services Corrective Action Planned: 1. VITA, working with VITA multi-sourcing services integrator (MSI), opened a multi-supplier project to reduce and eliminate unpremeditated vulnerabilities. 2. With respect to agency acce...

Responsible Contact Person(s): Naveen Abraham, Chief of Core Infrastructure Services Corrective Action Planned: 1. VITA, working with VITA multi-sourcing services integrator (MSI), opened a multi-supplier project to reduce and eliminate unpremeditated vulnerabilities. 2. With respect to agency access to security log information, all logs are being monitored. VITA intends to further enhance services during the remainder of calendar year 2023. VITA is also working on additional tools and implementation of zero trust. Security compliance of enterprise IT services overall is assessed on an ongoing basis through System Security Plan (SSP) submission and review. Estimated Completion Date: 9/30/2023

View Audit 36377

Finding 35597 (2022-090)

Significant Deficiency 2022

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Significant Deficiency § 200.303

Responsible Contact Person(s): Steve Hanoka, Chief Information Security Officer John Kissel, Deputy Director of Innovation and Technology Carla Bennett, Director of Procurement and Contract Management Susan Smith, Director of Internal Audit Corrective Action Planned: This finding was marked as FOIA ...

Responsible Contact Person(s): Steve Hanoka, Chief Information Security Officer John Kissel, Deputy Director of Innovation and Technology Carla Bennett, Director of Procurement and Contract Management Susan Smith, Director of Internal Audit Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under ?2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled ?Applicable Management Contacts for Findings and Questioned Costs? to request the corrective action planned from the applicable entity. Estimated Completion Date: 4/30/2023

View Audit 36377

Finding 35596 (2022-066)

Significant Deficiency 2022

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Mark McCreary, Director Centralized IT Security Audit Services Corrective Action Planned: 1. Regularly monitor audit workplan to ensure audit staff complete all IT security audits by the required deadlines; and, 2. Evaluate staffing levels and assess need to contract ...

Responsible Contact Person(s): Mark McCreary, Director Centralized IT Security Audit Services Corrective Action Planned: 1. Regularly monitor audit workplan to ensure audit staff complete all IT security audits by the required deadlines; and, 2. Evaluate staffing levels and assess need to contract with an outside audit firm to aid in completing IT security audits. Estimated Completion Date: 9/30/2023

View Audit 36377

Finding 35595 (2022-064)

Significant Deficiency 2022

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Kevin Platea, Deputy Chief Information Officer Stephen Schleck, Associate Director of Enterprise Business Solutions Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting correc...

Responsible Contact Person(s): Kevin Platea, Deputy Chief Information Officer Stephen Schleck, Associate Director of Enterprise Business Solutions Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under ?2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled ?Applicable Management Contacts for Findings and Questioned Costs? to request the corrective action planned from the applicable entity. Estimated Completion Date: 12/31/2024

View Audit 36377

Finding 35594 (2022-060)

Significant Deficiency 2022

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Kevin Platea, Deputy Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under ?2.2-3705.2 (9.) of the Code of Virginia...

Responsible Contact Person(s): Kevin Platea, Deputy Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under ?2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled ?Applicable Management Contacts for Findings and Questioned Costs? to request the corrective action planned from the applicable entity. Estimated Completion Date: 12/31/2024

View Audit 36377

Finding 35593 (2022-059)

Significant Deficiency 2022

Commonwealth of Virginia

VA

Subrecipient Monitoring Reporting Significant Deficiency § 200.303

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer Melinda Raines, Director of Human Resources Karen Holt, Human Resource Business Process Consultant Corrective Action Planned: An agency-wide work group will be established to determine the exact processes need to implemen...

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer Melinda Raines, Director of Human Resources Karen Holt, Human Resource Business Process Consultant Corrective Action Planned: An agency-wide work group will be established to determine the exact processes need to implement the controls necessary to address this finding. Estimated Completion Date: 6/30/2023

View Audit 36377

Finding 35592 (2022-057)

Significant Deficiency 2022

Commonwealth of Virginia

VA

Eligibility Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Steven Hanoka, Chief Information Security Officer John Kissel, Deputy Director of Innovation and Technology Sarah Haggie, Strategic Initiatives Advisor Mike Alston, HCD Division Director Cat Pelletier, Operations Lead for Finance Cindy Olson, Eligibility and Enrollment...

Responsible Contact Person(s): Steven Hanoka, Chief Information Security Officer John Kissel, Deputy Director of Innovation and Technology Sarah Haggie, Strategic Initiatives Advisor Mike Alston, HCD Division Director Cat Pelletier, Operations Lead for Finance Cindy Olson, Eligibility and Enrollment Director Corrective Action Planned: DMAS IT Access Control Policy was revised January 2023 to be compliant with the COV security standard. IM Security will revise security training to also reflect this change. Training and reminders will be provided to ensure the divisions and managers understand the importance of the system workflow and timely notification to initiate the process for disabling access. DMAS is in the process of updating the off-boarding system requirements to ensure system access is removed timely. Additional staff was requested to have system access removal rights to support the system access administration and resolve workload and staffing issues. Estimated Completion Date: 2/28/2023

View Audit 36377

Finding 35591 (2022-052)

Significant Deficiency 2022

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Kevin Platea, Deputy Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under ?2.2-3705.2 (9.) of the Code of Virginia...

Responsible Contact Person(s): Kevin Platea, Deputy Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under ?2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled ?Applicable Management Contacts for Findings and Questioned Costs? to request the corrective action planned from the applicable entity. Estimated Completion Date: 12/31/2023

View Audit 36377

Corrective Action Plans

Filters