Corrective Action Plans

Browse how organizations respond to audit findings

Total CAPs
64,113
In database
Filtered Results
10,358
Matching current filters
Showing Page
72 of 415
25 per page

Filters

Clear
Active filters: § 200.303
Corrective Actions: • Reinforce expectations through additional training and support for employees and supervisors on the proper preparation and monthly submission of PAR forms. • Strengthen internal review procedures by assigning responsibility for confirming PARs are completed accurately, submitte...
Corrective Actions: • Reinforce expectations through additional training and support for employees and supervisors on the proper preparation and monthly submission of PAR forms. • Strengthen internal review procedures by assigning responsibility for confirming PARs are completed accurately, submitted on time, and signed by both the employee and the supervising administrator. • Ensure PAR documentation is consistently forwarded to Fiscal Services for timely review and any necessary adjustments so payroll charges align with the actual percentages of time worked on Title I activities. Responsible Department/Person: • Educational Services (Federal Programs/Title I) - Program Oversight • Human Resources/Payroll- Payroll Coding Support (as applicable) • Fiscal Services - Compliance Review and Adjustments • Primary Contacts: Siddhant Bhatta (Executive Director of Fiscal Services); Alma Quijas (Fiscal Compliance Manager) Anticipated Completion Date: March 31, 2026
1. Finance Administration will revise P/I 9.6 to incorporate program office requirement to: - Complete SAM.gov training requirement. - Conduct a mandatory verification step requiring Confirmation in SAM.gov that all vendors and purchases are free of debarment or suspension prior to initiating any ag...
1. Finance Administration will revise P/I 9.6 to incorporate program office requirement to: - Complete SAM.gov training requirement. - Conduct a mandatory verification step requiring Confirmation in SAM.gov that all vendors and purchases are free of debarment or suspension prior to initiating any agreement - Perform quality assurance including review of contracts to verify entities are not debarred or suspended 2. Finance Administration will distribute the updated P/I to all Metro employees to ensure organization wide awareness and adherence. 3. Finance Administration will identify a tutorial video to serve as a required training.
Responsible Person(s): Dale Batten, Deputy Commissioner Rehabilitative Services; Rob Perrine, Information Security Officer Corrective Action Planned: The DARS Information Security Office and the System/Data Owner will continue to remediate the audit findings noted in the IAD audit report on the case...
Responsible Person(s): Dale Batten, Deputy Commissioner Rehabilitative Services; Rob Perrine, Information Security Officer Corrective Action Planned: The DARS Information Security Office and the System/Data Owner will continue to remediate the audit findings noted in the IAD audit report on the case management system. In addition, the ISO and System/Data Owner will continue to meet quarterly with Internal Audit to review remediation progress, address implementation challenges, and ensure corrective actions are completed in a timely manner. Estimated Completion Date: 9/30/2026
Responsible Person(s): Chaye Neal-Jones, Director of Office of Enterprise Management Services; Eric Billings, Director of Grants Management Corrective Action Planned: Staff is working with DBHDS IT to ensure that ticketing workflow includes managerial approval. Additionally, system administrators ar...
Responsible Person(s): Chaye Neal-Jones, Director of Office of Enterprise Management Services; Eric Billings, Director of Grants Management Corrective Action Planned: Staff is working with DBHDS IT to ensure that ticketing workflow includes managerial approval. Additionally, system administrators are removing individuals from the system when they receive HR notification of their separation from the agency via email and the system automatically disables inactive accounts after 60 days. DBHDS is still working to develop a process for periodically reviewing the appropriateness of system users access and the activity of system administrators within the system. Estimated Completion Date: 7/1/2026
Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE ...
Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 6/15/2026
Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; David Carico, Business Operations Manager Corrective Action Planned: Below is the narrative for CR901 and CR902 Records Retention, including current production deployment timelines. CR901 establishes the datab...
Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; David Carico, Business Operations Manager Corrective Action Planned: Below is the narrative for CR901 and CR902 Records Retention, including current production deployment timelines. CR901 establishes the database infrastructure required to support compliant records retention within case management system. This includes partition creation across 75 plus high volume tables to enable structured aging and controlled purge activity aligned to retention thresholds. Production Deployment Timeline; scheduled as part of the February 2026 technical release. This phase is foundational and will be completed before purge logic can safely execute. CR902 Retention Logic and controlled execution; CR902 operationalizes the records retention policy by implementing controlled purge jobs leveraging the partitioning framework established in CR901. This Change Request moves the solution from infrastructure readiness to active lifecycle management. Phase 1 Database partition creation (February 2026 production release schedule) Phase 2 Controlled purge implementation (March 2026 release schedule) Phase 3 Validation, audit confirmation, and reporting controls (April 2026 release schedule) Phase 4 Reoccurring operational retention cycles with documented runbooks (ongoing/living) Estimated Completion Date: 4/30/2026
Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; Lunita Browder-Harris, Business Operation Specialist, Business Operations Corrective Action Planned: DSS has identified critical or conflicting roles in the management system. The roles in scope have the capab...
Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; Lunita Browder-Harris, Business Operation Specialist, Business Operations Corrective Action Planned: DSS has identified critical or conflicting roles in the management system. The roles in scope have the capability to perform all actions within the system, including inputting applications, determining eligibility, and authorizing benefits. DSS is in the process of implementing a procedure for reviewing and revoking conflicting roles ands privileges for all localities. DSS will work with APA to ensure adequate separation of duties is implemented within the eligibility system. Estimated Completion Date: 6/30/2026
Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS has contracted with two vendors to perform external IT Audits over sensitive systems. DSS is able to completed between 25-35 IT au...
Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS has contracted with two vendors to perform external IT Audits over sensitive systems. DSS is able to completed between 25-35 IT audits out of their 89 sensitive systems per year. DSS expects all IT systems will be audited by the end of 2027. A set of 31 IT Audits will be completed March 30, 2026. Estimated Completion Date: 12/31/2027
Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE ...
Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 5/29/2026
Responsible Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awardin...
Responsible Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 6/30/2026
Responsible Person(s): Barry Davis, Information Security Officer; Timothy Kelly, Innovation, Architecture and Governance Director; Steve McCauley, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS Information Security and Risk Management team will ensure risk...
Responsible Person(s): Barry Davis, Information Security Officer; Timothy Kelly, Innovation, Architecture and Governance Director; Steve McCauley, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS Information Security and Risk Management team will ensure risk and control assessments identify and evaluate IAM focused security controls. DSS will develop and define processes and practices to collect monitor and evaluate performance metrics to ensure IAM functions are following define agency service level agreements. DSS will identify different systems and classes for IAM functions. DSS will then create a process to ensure performance metrics are identified. DSS will then implement a procedure to monitor and evaluate the performance metrics. DSS has a documented separation and offboarding process published on its Fusion employee portal. This is a multi-step manual process. DSS is developing training for supervisors and managers to ensure that they know how to navigate through the process. In addition, DSS is developing manual and automated processes to ensure compliance with the process. Estimated Completion Date: 12/30/2026
Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS is establishing the processes and supporting system resources to ensure that DSS has an effective and compliant change management process. These ...
Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS is establishing the processes and supporting system resources to ensure that DSS has an effective and compliant change management process. These include: completion of migrating all application to a single repository which enables change tracking and version control in development projects; use of workflows in the system to enforce delivery of required artifacts prior to change submission; changes to the Change Advisory Board process, and post-change processes to validate meeting the acceptance criteria. Estimated Completion Date: 4/30/2026
Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE ...
Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 3/9/2026
Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk management Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective act...
Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk management Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 12/30/2028
Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management; Steve McCauley, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS Information Security and Risk Management is reconcili...
Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management; Steve McCauley, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS Information Security and Risk Management is reconciling the system to identify security roles for each sensitive system. Estimated Completion Date: 6/30/2026
Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS will follow the direction of the IAG Team to improve compliance with the security standard. IAG has created a new roadmap for remediation of rela...
Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS will follow the direction of the IAG Team to improve compliance with the security standard. IAG has created a new roadmap for remediation of related IT security and governance findings, and the IAG director is working with the CTO, CISO and TSD leadership on defining concrete plans for remediation of all related findings. The IAG director, the CTO and the TSD leadership continue to implement and refine the division-wide process to ensure sufficient resources are available and dedicated to prioritizing and implementing the planned IT governance structure changes. Roadmap review sessions are scheduled. Remediation working sessions are in process of being scheduled. Estimated Completion Date: 3/27/2026
Responsible Person(s): Steve Hanoka, Information Security Officer Corrective Action Planned: DMAS has started confirming the geographic location for sensitive data monthly and the vulnerability scans every 90 days for the one provider Medicaid management services IT Service provider. DMAS is taking ...
Responsible Person(s): Steve Hanoka, Information Security Officer Corrective Action Planned: DMAS has started confirming the geographic location for sensitive data monthly and the vulnerability scans every 90 days for the one provider Medicaid management services IT Service provider. DMAS is taking steps to ensure that this is completed for all of the service providers that are not under cloud oversight. Estimated Completion Date: 6/30/2026
Responsible Person(s): Ousman Kah - Subrecipient Monitoring Coordinator Corrective Action Planned: This item can be marked as completed as the findings audit period was June 30, 2025. While all recommendations and corrective actions were initiated as of July 1, 2025, and are currently in place. The ...
Responsible Person(s): Ousman Kah - Subrecipient Monitoring Coordinator Corrective Action Planned: This item can be marked as completed as the findings audit period was June 30, 2025. While all recommendations and corrective actions were initiated as of July 1, 2025, and are currently in place. The pending Executive summary was done as of December 30, 2025. Estimated Completion Date: 12/30/2025
Responsible Person(s): Ida Witherspoon, Chief Financial Officer; William Carter, Federal Reporting Manager Corrective Action Planned: Grants now uses a financial system created report to perform a perfunctory audit, matching submission data received from the various Program and Budget staff against ...
Responsible Person(s): Ida Witherspoon, Chief Financial Officer; William Carter, Federal Reporting Manager Corrective Action Planned: Grants now uses a financial system created report to perform a perfunctory audit, matching submission data received from the various Program and Budget staff against each individual upload into the federal system. Vendors are filtered by ALN by each analyst responsible for monitoring the various ALN's that make up the DSS portfolio. Once the lists are cross checked, DSS reaches out again to the sub awarding authority responsible within the agency to ask for additional FFATA information. Estimated Completion Date: 6/30/2026
Responsible Person(s): Ida Witherspoon, Chief Financial Officer; Ousman Kah, Subrecipient Monitoring Coordinator; James Pell, ARMICS Program Manager Corrective Action Planned: As part of the compliance review, an analysis will be conducted to identify divisions and associated service provider agenci...
Responsible Person(s): Ida Witherspoon, Chief Financial Officer; Ousman Kah, Subrecipient Monitoring Coordinator; James Pell, ARMICS Program Manager Corrective Action Planned: As part of the compliance review, an analysis will be conducted to identify divisions and associated service provider agencies that manage substantial fiscal responsibilities under federal or state funding streams. This includes mapping subrecipient institutions and other state agencies such as the Office of Community Services (OCS) that receive federal grant allocations. The objective is to ensure visibility into entities handling large-scale financial transactions, assess their internal controls, and confirm adherence to applicable federal and state requirements. This analysis will serve as the foundation for targeted monitoring and risk mitigation strategies. DSS receives federal funding, which is disbursed to state agencies as a pass-through transaction. These transactions are initiated by various divisions within DSS, based on agreements with subrecipients, and then sent to Finance for review/processing. The subrecipients receiving federal funding must carry out the mission of that specific federal program. Pass-through transactions are required to be summarized and submitted to DOA for year-end financial reporting by agency and ALN (Assistance Listing Number, i.e., 10.561 = SNAP). DSS needs to obtain confirmation that each agency receiving federal funding is using the federal funds appropriately and within the guidelines of the grant award. ARMICS team will work to obtain financial control assurances from identified significant fiscal recipients. Estimated Completion Date: 11/30/2026
Responsible Person(s): Monique Majeus, Economic Assistance and Employment; Christie Bruce, TANF Consultant Corrective Action Planned: Change Request submitted to fix and implement the changes requiring correction in 2025. Estimated Completion Date: 11/25/2025
Responsible Person(s): Monique Majeus, Economic Assistance and Employment; Christie Bruce, TANF Consultant Corrective Action Planned: Change Request submitted to fix and implement the changes requiring correction in 2025. Estimated Completion Date: 11/25/2025
Responsible Person(s): Fernanda Crandol, Chief Financial Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awa...
Responsible Person(s): Fernanda Crandol, Chief Financial Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 5/31/2026
Responsible Person(s): Darin Moore, Deputy Director of Administration and Outreach; Sarah Boggs, Accounting Manager for Planning and Finance; Suzanne Robinson; Tim Springer, Budget Manager for Planning and Finance Corrective Action Planned: Review the current DWR process and determine whether DWR sh...
Responsible Person(s): Darin Moore, Deputy Director of Administration and Outreach; Sarah Boggs, Accounting Manager for Planning and Finance; Suzanne Robinson; Tim Springer, Budget Manager for Planning and Finance Corrective Action Planned: Review the current DWR process and determine whether DWR should petition the Comptroller for an exception to CAPP Topic 20605 or modify the DWR process to the “split coding” method instead. This will include: 1.) Evaluation of grant program guidance to ensure no obstacles exist from the Federal Awarding Agency to changing DWR's current methodology; 2.) Meeting and discussing with other (like) state agencies for policy, procedure, and training examples for split coding grant eligible expenditures; 3.) Scheduling meetings with Department of Accounts and the previous APA Audit Team to discuss DWR's evaluation, decision, and next steps; 4.) Developing and implementing new DWR policies and training to ensure compliance with the approved methodology. (Estimated completion date: July 1, 2026) Update current policies and procedures to conform with CAPP Manual Topic 20405 and to enhance the agency's current supporting documentation for all journal entries. At a minimum, these new policies and procedures will require that Voucher ID/Expense Report IDs that are moved within a journal entry are documented in the journal reference line in the system to improve transparency, will add more detailed explanations to justify coding changes, will upload applicable documents into the system to assist in manager approval, and will maintain all documentation centrally in one location for easier access and review. (Estimated completion date: July 1, 2026) Publish and maintain a sustainable federal drawdown schedule, by: 1.) Evaluating DWR's current federal drawdown schedule in accordance with current policies, procedures, employee workload, cashflow, and Federal Awarding Agency's guidance; 2.) Developing specific controls, and revised job descriptions as needed to ensure the drawdown schedule can be consistently maintained; and 3.) Incorporating both the new schedule and controls into appropriate policies and procedures to ensure accountability. (Estimated completion date: June 1, 2026) Evaluate current policies, procedures, and practices pertaining to how DWR manages and records Program Income. Develop and update policies and procedures to ensure compliance with CAPP 20205. Provide training on new policies and procedures to employees within the Planning and Finance Division. (Estimated completion date: June 1, 2026) Review current internal procedures for reporting federal expenses on the SEFA and Attachment 15 and identify training gaps. Enlist training support from Department of Accounts and/or other state agencies to address training gaps. Develop new written policies and procedures, along with new supporting documentation requirements, to conform to SEFA and Attachment 15 guidelines and expectations. Provide training on new policies and procedures to employees within the Planning and Finance Division. (Estimated completion date: July 1, 2026) Review all other written policies and procedures for administering federal grants and contracts, and develop and update as necessary to address insufficient guidance and noncompliance. (Estimated completion date: August 31, 2025) Estimated Completion Date: 7/1/2026
Responsible Person(s): Liz Havenner, IT Administrative Director; Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director; John Vosper, Assistant Director ISRM; James Pell, ARMICS Manager; Paige Elswick, Controller; Ida Witherspoon, Chief Financial Officer...
Responsible Person(s): Liz Havenner, IT Administrative Director; Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director; John Vosper, Assistant Director ISRM; James Pell, ARMICS Manager; Paige Elswick, Controller; Ida Witherspoon, Chief Financial Officer; Michelle Skaggs, General Services Director; Adrienne Childress, Strategic Sourcing Procurement Manager, General Services, Procurement Corrective Action Planned: DSS is working to compile SOCs and train contract administrators through specific SOC related sessions. Procedures, training, questionnaire, and policy completed. DSS Finance and IT Administration has created draft Policy and Procedures for managing SOC 1 reports for third-party service providers, incorporating SOC 1 & SOC 2 requirements. The policy outlines steps for obtaining, reviewing, and documenting SOC reports, including timelines and responsibilities for contract administrators, TSD Business Managers, and the ARMICS program. It also addresses remediation processes for non-compliant or incomplete reports. The policy is designed to ensure compliance with relevant regulations and will be reviewed and updated annually by the DSS ISRM and Finance team. Training is being developed as well on the procedures to be followed for SOC 1 Type 2 review. Estimated Completion Date: 6/30/2026
Responsible Person(s): Office of Information Management and Othello Dixon, Office of Information Security Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 ...
Responsible Person(s): Office of Information Management and Othello Dixon, Office of Information Security Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 3/2/2026
« 1 70 71 73 74 415 »