Corrective Action Plans

Finding 2024-046 Temporary Assistance for Needy Families, ALN 93.558 - Inappropriate TANF- Funded Emergency Foster Care Assistance Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS redetermined the Foster Care Title IV-E (Title IV-E) program eligibility after the birth certificate was identified and the youth was determined to be Title IV-E eligible. MDHHS will reclassify the funds to the appropriate funding source, allowing the department to claim Title IV-E for the eligible placement. For those cases in which Title IV-E funding is denied initially based on lack of a birth certificate or other documentation of citizenship, the Child Welfare Funding Specialists will continue to monitor the case for updated documentation in order to complete a redetermination of funding. Child Welfare Funding Specialists will be reminded to monitor cases for updated documentation during a Child Welfare Funding conference call in June 2025. Anticipated Completion Date June 30, 2025 Responsible Individual(s) Nancy Berger, MDHHS

Finding 2024-045 Temporary Assistance for Needy Families, ALN 93.558 - Non-Financial Eligibility Documentation Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS ESA policy staff will work with the MDHHS Bridges technical team to determine the reason for the incomplete application by September 30, 2025, and implement a solution to correct the issue, if needed. If potential system modifications are needed, MDHHS will follow the Departmental Work Intake Process for prioritization and determine an anticipated completion date for implementation. MDHHS will also send a memo and template of the application to the local offices to highlight the required questions on the application to help ensure all required questions are appropriately answered. Anticipated Completion Date MDHHS has not yet determined an anticipated completion date because the date is dependent on the potential solution identified. Responsible Individual(s) Bethany Cabanaw, MDHHS Kenton Schulze, MDHHS Brian Sanborn, MDHHS

Finding 2024-042 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 - Ineligible Home Help Assistance Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS added the Electronic Document Management system (EDM) to MiAIMS in March 2023 and issued an Adult Services Notification to adult services staff, communicating that medical needs forms should be uploaded into EDM. MDHHS issued an Adult Services Notification to adult services staff during May 2025 to communicate the exceptions identified and remind them of the medical needs form requirements. MDHHS will develop a procedure to monitor the expiration of medical needs forms using the MiAIMS Plan of Care by August 2025. In addition, MDHHS will research potential options to automate monitoring of the medical needs forms in MiAIMS and determine if any necessary system changes are needed by December 2026. Anticipated Completion Date December 2026 Responsible Individual(s) Elaina Brown, MDHHS

Finding 2024-041 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 - Ineligible HHP Payments Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS generates a monthly hospitalization report and distributes to adult services workers as part of the post-payment review process. MDHHS enhanced the report query to improve the data used to identify overlaps in services and timely recover payments. MDHHS implemented the updated query during June 2025. Also, MDHHS issued an Adult Services Notification to managers and directors during February 2025, informing them of the audit finding and reminding local office management of the expectation to thoroughly monitor and review the hospitalization reports to ensure timely and accurate action is taken by adult services workers. In addition, MDHHS reissued the Home Help Recoupment Process training and procedural resources during February 2025 to adult services workers who manage Home Help cases to ensure process steps are consistently followed. Anticipated Completion Date Completed Responsible Individual(s) Elaina Brown, MDHHS Michelle Martin, MDHHS

Finding 2024-040 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 - Payments on Behalf of Ineligible Beneficiaries Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS continues to work with DTMB on the underlying issues in Bridges causing these overpayment issues, as well as developing mitigation strategies to temporarily address the overpayment concerns while the more permanent system solutions are developed. MDHHS expects all remaining synchronization issues to be resolved once the remaining larger system changes are implemented in December 2025. Anticipated Completion Date December 31, 2025 Responsible Individual(s) Jamy Hengesbach, MDHHS

Finding 2024-012 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children’s Health Insurance Program, ALN 93.767 - Beneficiary Eligibility Management Views MDHHS agrees with the identified exceptions for parts a. and c. of the finding. However, MDHHS disagrees that 3 Medicaid cases and 20 Children’s Health Insurance Program (CHIP) cases with MAGI determinations cited in part b. did not have case file documentation supporting the beneficiary eligibility determination. The Centers for Medicare and Medicaid Services (CMS) has determined that a reasonable compatibility indicator can be used for CMS audit purposes to determine if the attested income information was electronically verified for MAGI cases and MDHHS disagrees that documentation was not maintained to support the eligibility determination. The SOM MiIntegrate system communicates with various State and federal electronic trusted data sources and sends the information from these sources, along with the beneficiaries’ attested income, to the SOM MAGI Rules Engine where the MAGI eligibility determination is made. As part of the MAGI eligibility determination, a reasonable compatibility test is completed to determine if beneficiary/applicant attested income is within a specified percentage of the electronic trusted data sources or if the attested and verified income are below the threshold for the applicable program. The results of the MAGI eligibility determination are sent back to MiIntegrate using an Account Transfer (AT) packet that contains the results. MiIntegrate then communicates the results to the SOM MAGI Viewer and Bridges using an AT packet and Bridges stores the AT packet number only that can be used to view the details of the AT packet within the SOM MAGI Viewer. The version of the AT packet within the MAGI Viewer also contains a reasonable compatibility indicator that documents the outcome of the reasonable compatibility test and supports the SOM MAGI Rules Engine eligibility decision. MDHHS stores the AT packet information, including facts essential to the eligibility determination, within MiIntegrate and the MAGI Viewer instead of Bridges to help protect and secure the federal income tax data and unemployment data used for the determination. The AT packet for each individual determination can be retrieved from the MAGI Viewer using the AT packet number stored in each beneficiary’s case file within Bridges. MDHHS is not aware of any federal regulations that preclude MDHHS from storing this information in a separate system to help secure the data and restrict access as required by federal and state law. Planned Corrective Action To address the exceptions identified that are not related to MAGI-based income verification results, MDHHS has developed mandatory training protocols for eligibility workers and expects to have the first Medicaid audit focused mandatory training implemented by July 2025. MDHHS will continue to determine where additional training or enhancements to training are needed to ensure eligibility is accurately determined and documentation is properly maintained within the electronic case file. MDHHS disagrees it did not maintain case file documentation that supports the beneficiary eligibility determination for MAGI cases and does not intend to take further action. Anticipated Completion Date MDHHS will implement the first Medicaid audit focused training by July 2025. Responsible Individual(s) Logan Dreasky, MDHHS Mariah Schaefer, MDHHS

Finding 2024-033 CCDF Cluster, ALN 93.575 and 93.596 - Client Eligibility Management Views MiLEAP and MDHHS agree with the finding. Planned Corrective Action MiLEAP and MDHHS ESA will continue to work together to help ensure compliance with client eligibility requirements by providing guidance on updated policies, processes, and noted trends to local office and BSC staff. On October 1, 2024, MDHHS ESA distributed an ESA memo to BSCs and local offices requiring a Child Development and Care eligibility checklist to be completed and uploaded to the electronic case file at the time of each Child Development and Care application and redetermination to help ensure the authorized hours of care in Bridges does not exceed the client's documented need for hours of childcare services. The ESA memo also requires local offices that have not yet achieved compliance to review a sample of cases monthly and ensure the Child Development and Care eligibility checklist is properly uploaded to the electronic case file. The BSCs receive the monthly results from the local offices and also monitor progress to help ensure compliance. Anticipated Completion Date Ongoing Responsible Individual(s) Lisa Brewer-Walraven, MiLEAP Mariah Schaefer, MDHHS Gayle Vail, MDHHS

Planned Corrective Action: Housing Compliance team will immediately train staff on the requirement to ensure that retainages are paid prior to draws from the HOME Treasury account. Retainage reimbursements will require additional verification in AMS to ensure payments are processed. Responsible Party: Cynthia Rogers-Ellickson, Director – Housing & Community Development Planned Implementation Date: June 13, 2025

Corrective Actions Taken Commons has taken the following actions to protect against such fraudulent incidents in the future: • Engaged a firm to assist with managing the incident; • Opened a new bank account; • Added account verification services with our banking partner, which will be utilized to verify account updates; • Limited the amount of per vendor/subrecipient daily payments to our insurance limits, with verifications prior to releasing additional funds when the total payment exceeds the insurance limits; • Subrecipient payment receipt is verified by both the subrecipient and the Commons grants team; • Updated our policy and procedures to direct our subrecipients to request banking changes through our procurement system and not through email; and • Expanded implementation of our Kissflow procurement system across the organization, which includes new vendor process as well as a change of vendor information module. Vendor changes would be approved first by the program/department that works with the vendor prior to Finance approval. Completion Date With the exception of implementing the change of vendor information module in Kissflow, the above actions have all been completed by the date of this report. The projected completion date for Kissflow change of vendor information module is April 30, 2025. Responsible Party Dana Thomas, Chief Financial Officer Angela Allen, Vice President of Finance

Recommendation: The county staff and management should review roles and responsibilities related to the annual reporting requirements and develop controls to ensure that regardless of position turnover, the required reporting is able to be submitted in a timely manner. This may include ensuring multiple county personnel are aware of deadlines and required reporting. Views of Responsible Officials and Planned Corrective Actions: The county understands and concurs with this finding. The county will employ a system to ensure timely reporting that includes additional oversite of the program by the County administration. The position responsible for reporting has also undergone turnover and the new employee responsible for such reporting will be informed of the required deadlines.

Views of Responsible Officials: All Astraea staff members are required to complete timesheets. Astraea’s internal processes were reviewed and overhauled in December 2021 (midway through FY2022) with department heads determining how their direct reports would spend time on various Astraea work streams and projects. This information is detailed in a level of effort (LOE) spreadsheet tracked against timesheets and budgets regularly. However, the processes for instituting regular updates to the LOE spreadsheet and timesheet allocations remained time-consuming and highly manual in FY2023 – which we believe resulted in misallocations. Astraea is currently reviewing internal processes to ensure, 1) that review and revision of the LOE spreadsheet and timesheet allocations can happen in a timely manner with less administrative burden, and 2) allowance of a more detailed review of the payroll allocation approval and entry process. As of January 1, 2025, a new finance system was implemented allowing for greater sophistication, consistency and automation of these processes. We do not expect to see this finding upon completion of our FY25 audit.

Pursuant to federal SNAP regulations at 7 CFR 272.4(g) and corresponding state regulations, the Department is required to establish and operate a fraud detection unit, which is responsible for the detection and investigation of SNAP fraud. The Office of Internal Audit (OIA) at the Department of Administration, Office of Management and Budget, through a Memorandum of Understanding (MOU), provides DHS with fraud detection, investigation and prevention services across DHS’s public assistance programs, including SNAP. DHS staff refer to OIA SNAP cases in which staff suspect fraud. OIA, in turn, investigates the allegation. If OIA determines that the household has committed an intentional program violation of SNAP, they pursue disqualification of the individual(s) from the program, either through an administrative disqualification hearing (ADH), a waiver of ADH, or refer the case to the state police for criminal prosecution. If the individual is found to have committed the IPV, and received SNAP benefits they were not entitled to, DHS establishes an overpayment claim against the household’s liable individuals. The liable individuals are required to make payment agreements to return to DHS, the benefits they received, but were not entitled to. If the fraud is referred for criminal prosecution, the amount of overpaid benefits is determined by the Court through an Order for Restitution. DHS followed the established and required protocols in the case cited in this finding. DHS referred a case to OIA in which identity fraud was suspected. OIA, with DHS assistance, and collaboration from the USDA Office of Inspector General (OIG), conducted the investigation, which revealed, not only fraudulent actions, but also criminal behavior and a significant estimate of overpaid SNAP benefits. The case was referred to the U.S. Attorney’s Office for prosecution. The criminal case is currently pending. Once a disposition is issued, DHS will take the appropriate sanction actions(s), including any disqualification from the SNAP, as well establishing an overpayment claim for any restitution ordered. Pursuant to federal regulations, any collection by DHS of any overpaid SNAP benefits will be returned to the Food and Nutrition Service (FNS), with DHS retaining 30% as provided for in the regulations. Should the liable individual not pay the ordered restitution in a timely manner and the claim becomes delinquent, DHS will pursue all other available collection actions to recoup the overpaid benefits. OIA and DHS also engage in fraud prevention activities, mainly by utilizing data analytics and identifying case issues that are indicative of fraudulent activities. Once an issue is identified, OIA, in conjunction with DHS, review the impacted case population and determine actions that should be taken to mitigate the issue as well as educate customers on actions they can take to safeguard their benefits, including changing EBT card PINs, freezing cards or limiting access to out-of-state or internet transactions. Other prevention actions that may be taken include changes to the card security through vendor options, as well as widespread communication to customers and the public on new fraud trends, etc. OIA and DHS also provide training to DHS staff to spot fraud in cases, including identifying fraudulent/altered documents, use of invalid identification cards, and identity fraud trends, etc. Approximately 60% of DHS staff have completed or are in the process of completing the fraud training. Anticipated Completion Date: The criminal case is ongoing. Contact Person: Iwona Ramian, Deputy Chief Legal Counsel, Department of Human Services iwona.ramian@dhs.ri.gov

Planned Corrective Action: The Garland Housing Agency (GHA) relies on the certifications of the tenant and landlord, which states that there is not a familial relationship between the two parties. GHA will review applications for unusual items that could be indicative of a familial relationship and use online, public records to try to identify whether or not there is a familial relationship. GHA maintains a log of potential issues with the participants and will include potential familial relationships between the tenant and landlord in the log. Responsible officials: Steve Fitch, Director of Housing Planned completion date: September 30, 2025

Regent University agrees with this finding. The University will engage with the National Student Clearinghouse audit support office and will establish a working group with appropriate Regent stakeholders to review suggested changes made by the NSC to reporting methods, time buffers between reports, reporting frequency, and other “upstream” preventative measures that may be taken to prevent file backlogs. Internally, the University will establish formalized communication protocols between departments to be enacted in the case of an NSC enrollment reporting file delay that could result in noncompliance with enrollment reporting requirements. Regent University will establish a reporting process directly between the University and NSLDS to be used in the event of an NSC backlog that cannot be mitigated within the compliance window. Regent University will implement the first and second parts of this plan by June 30, 2025 and the final component (NSLDS direct file reporting process) by September 30, 2025. Name of responsible parties: Elizabeth Bayless (University Registrar) & Tameka Lyons (Associate Registrar)

Finding Number: 2024-001 Condition: GBQ identified errors in how employee time was allocated to the program, and salaries and wages allocated to the program in excess of the Executive Level II Salary maximum. Specifically, one employee had salaries and wages allocated to the program in excess of hours tracked to the program for a selected month. Another employee had an inappropriate wage rate applied to allocated time to the program. Last, two employees had compensation levels allocated to the program in excess of the Executive Level II Salary max amount in effect for the respective period. Planned Corrective Action: ECDI will put additional steps in place in Payroll Review process to ensure reconciliation of payroll charges to actual time records and rates. The organization will modify it's calculations to ensure that pay rates are reflective of the timeframe in question (not for periods before or after). ECDI will update its calculations to include thresholds for Executive pay so they are not entered in excess of approved rates. The company is also exploring technology enhancements so that information from ECDl's Payroll system flows directly into ECDl's Accounting system to limit the chance of errors during extraction from Payroll system and uploading into Accounting system. Contact Person Responsible for Corrective Action: Brian Barrett and Hudu Ahmed. Completion Date: In process

School policy committee to create/review a policy under the 2 CRF section 200.516.

Finding: During a review of the awards population for fiscal year 2024, the University identified 6 accounts that had duplicate contact and bank information. After further investigation, these accounts were determined to be fraudulently created. In total, $54,112 in funds were paid out. The school worked with the U.S. Department of Education’s Cyber Incident Division to inform the Department of the fraudulent activity. Corrective Action Plan: Management agrees with the findings and has put the following in place. The Bursar will work with ITS to perform a scan of all students’ accounts for duplicate contact and banking information. If duplicates are found students will be notified and accounts frozen until students are identified. This will be critical before refund checks are dispersed to students every semester. The amount of $54,112 will be paid back with the next draw down before February 28, 2025. Responsible Officials and Implementation Date: The Bursar and Director of ITS will be responsible for this action plan and will implement by July 1, 2025, a scan done by the system. Bursar will spot check for duplicates until the report is built and put in place for the scan.

Corrective Actions Taken Commons has taken the following actions to protect against such fraudulent incidents in the future: • Engaged a firm to assist with managing the incident; • Opened a new bank account; • Added account verification services with our banking partner, which will be utilized to verify account updates; • Limited the amount of per vendor/subrecipient daily payments to our insurance limits, with verifications prior to releasing additional funds when the total payment exceeds the insurance limits; • Subrecipient payment receipt is verified by both the subrecipient and the Commons grants team; • Updated our policy and procedures to direct our subrecipients to request banking changes through our procurement system and not through email; and • Expanded implementation of our Kissflow procurement system across the organization, which includes new vendor process as well as a change of vendor information module. Vendor changes would be approved first by the program/department that works with the vendor prior to Finance approval. Completion Date With the exception of implementing the change of vendor information module in Kissflow, the above actions have all been completed by the date of this report. The projected completion date for Kissflow change of vendor information module is April 30, 2025. Responsible Party Dana Thomas, Chief Financial Officer Angela Allen, Vice President of Finance

The District agrees and has already implemented processes to ensure receivables are created with each claim created in CNIP.

The School Board will ensure to require all contractors funded with federal funds maintain compliance with prevailing wage requirements and obtain documentation certifying compliance.

Type of Finding : Significant Deficiency Over Compliance with Procurement and Suspension Debarment Delta County Joint School District No. 50J had the following regarding internal controls in Nutritional Services: The District did not properly procure one vendor within the Child Nutritional Cluster that incurred questioned costs in excess of the $25,000 threshold, based on 2 CFR 200.516. Delta County Joint School District No. 50J concurs with finding 2024-001 and will implement the following corrective steps: Additional procedures have been put in place, and documentation will be maintained for purchases to satisfy Procurement and Debarment requirements.

Corrective Action Plan Finding No.: 2024 - 004 Condition: The District did not meet its maintenance of effort on either the aggregate or the per capita basis for fiscal year 2024. The shortfall in maintenance of effort was $401,982. Plan: The District will implement procedures and internal controls in FY 2025 to monitor maintenance of effort compliance. Furthermore the District will perform a comprehensive review of fiscal year 2024 expenditures to identify the cause of the decrease in special education expenditures from the FY 2023 amounts to determine if allowable exceptions can be identified in accordance with federal guidelines. Anticipated Date of Completion: 6/30/2025 Name of Contact Person: Sheila Johnson, Assistant Superintendent of Finance and Operations

Management has engaged its current auditing firm to complete the required Single Audits for its fiscal 2023 and 2022 year-ends.

Finding: 2024-002 Name of Contact Person: Michael Coone, Assistant Social Services Director Criteria: In accordance with 20 CFR 681.590, local youth programs must expend not less than 20 percent of the funds allocated to them, except for the local area expenditures for administration, to provide paid and unpaid work experiences. Recommendation: Require the County Program Directors to implement procedures to ensure that earmarking requirements are met. Corrective Action/Management’s Response: Management concurs with this finding and will adhere to the Corrective Action Plan in this audit report. The County has implemented the following process: Gaston County Workforce Development Board staff worked closely with the previous Youth service provider requesting them to assign 100% of their WEX specialist salary towards work-based learning expenses to obtain this goal. With a new service provider, Two Hawk Employment Services, their financial staff have budgeted 20% of all WEX related activities, salaries, staff costs, participant costs, etc. to meet the 20% goal. Gaston County WDB and Two Hawk Employment Services have adjusted staff day sheet logs to reflect 20% of staff activities to ensure all staff are assigning the work appropriately. The Gaston County Workforce Development Board mandated in the service provider Youth contract to meet the 20% WEX Expenditure and future contract awards are determined on successfully meeting the expenditure requirement. Per the state’s most recent Youth Expenditure Report at the end of October 2024, Gaston County Workforce Development Board is 76% towards meeting the goal. The Workforce Development Board staff and management will continue to monitor monthly that 20% of all salaries and WEX activities are accurately reflected on all invoices and financials from Two Hawk Employment Services. Proposed Completion Date: Management and the Board will implement the above procedures immediately with a completion date of June 30, 2025.

Federal Program Title: Postconviction Testing of DNA Evidence; Capital Case Litigation Initiative ALN: 16.820; 16.746 Recommendation: We recommend the University review its current procedures to ensure disallowable costs are not being charged allocated to federal programs. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action planned/taken in response to finding: Boise State University is reminding faculty and staff about lobbying and the basics of charging costs to a sponsored project with an emphasis on cost allocability. Name(s) of the contact person(s) responsible for corrective action: Jen Lutke Planned completion date for corrective action plan: December 31, 2024