Corrective Action Plans

Recommendation We recommend that the Center consistently enforce its internal controls over payroll to ensure that the timesheet and payrates are reviewed and approved by the appropriate supervisor. Additionally, we recommend that the Center consistently enforce its internal controls over nonpayroll expenditures to ensure all expenditures are approved by the appropriate supervisor. Repeat Finding No Action Taken Island Health Care will take the following actions to address this recommendation: Timesheet and Payrate Review and Approval: • Standardize timesheet submission and approval process • Utilize an electronic timesheet system to document the verification of employee payrates and ensure there is a detailed audit trail that records all submissions, reviews, and approvals by supervisors. • Conduct regular audits to verify timesheets and payrates are reviewed and approved by supervisors NonPayroll Expenditures: • Evaluate and improve upon existing processes to ensure internal controls over nonpayroll expenditures are working. This includes enforcement of approval policies with mandatory documentation and regular monitoring throughout the process for a clear audit trail. • Conduct regular audits to verify nonpayroll expenditures have been reviewed and approved by supervisors.

Finding: 2020-002 - Allowable Costs & Period of Performance Material Weakness in Internal Controls Over Compliance and Instances of Noncompliance Recommendation: The Organization should implement controls to ensure accurate recordkeeping and document retention to substantiate expenditures allocated to grants. Corrective Action Plan: In working with HighPoint CPA, the WWBC has implemented the online accounting system DEXT: all invoices, receipts, bank statements and deposits are loaded in the program and the Executive Director is responsible for categorizing the data, ensuring proper fiscal grant management and is reviewed by the HighPoint CPA team and is reconciled with QuickBooks. The finance committee, which meets the 2nd Tuesday of every month reviews the past month’s financials to ensure compliance. Paper copies are also printed out and filed. Anticipated Completion: January 2021 Responsible Party: Executive Director

We concur with this finding and have implemented measures to mitigate the repetition or additional occurrences. In 2020, we implemented an electronic system to more efficiently collect and store expenditures and supporting documentation, eliminating a paper filing system. We updated our fiscal policies and procedures in 2022 to document a standardized process for documenting expenditures and retaining receipts. For instance, invoices cannot be processed without adequate documentation. Additionally, credit card holders are responsible for submitting electronic credit card receipts to the fiscal office monthly. In 2022, an updated credit card policy was provided to all employees. The adherence to the credit card policy is monitored by the Fiscal Office and CEO. Responsible person(s): Jemea Dorsey, CEO and Jeanetta Johnson, Fiscal Manager Anticipated Completion Date: FY 2022

The fiscal coding system implemented in the accounting software includes specific codes for subrecipient expenditures, enabling clear tracking and reconciliation of subaward amounts. The new bookkeeping firm with ensure subrecipient expenditures are reconciled to reimbursement request amounts by February 28, 2026. Implement a standardized reconciliation process and maintain supporting documentation in a centralized location, including detailed reconciliation worksheets by March 31, 2026. Train staff involved in subrecipient monitoring and reimbursement submissions on Uniform Guidance requirements, including 2 CFR 200.332 pass-through entity responsibilities by April 30, 2026. Perform periodic internal reviews to ensure compliance and documentation completeness, with monthly reconciliation reviews during active subaward periods beginning May 2026. Develop comprehensive subrecipient monitoring procedures manual documenting all required monitoring activities, reporting requirements, and documentation standards by June 30, 2026. Establish annual risk assessments of subrecipients and implement risk-based monitoring approaches, including site visits for high-risk subrecipients by July 31, 2026.