Corrective Action Plans

Finding 1177913 (2025-094)

Material Weakness 2025

VA

Internal Control / Segregation of Duties Subrecipient Monitoring Significant Deficiency § 200.303

Responsible Person(s): Chaye Neal-Jones, Director of Office of Enterprise Management Services; Eric Billings, Director of Grants Management Corrective Action Planned: Staff is working with DBHDS IT to ensure that ticketing workflow includes managerial approval. Additionally, system administrators ar...

Responsible Person(s): Chaye Neal-Jones, Director of Office of Enterprise Management Services; Eric Billings, Director of Grants Management Corrective Action Planned: Staff is working with DBHDS IT to ensure that ticketing workflow includes managerial approval. Additionally, system administrators are removing individuals from the system when they receive HR notification of their separation from the agency via email and the system automatically disables inactive accounts after 60 days. DBHDS is still working to develop a process for periodically reviewing the appropriateness of system users access and the activity of system administrators within the system. Estimated Completion Date: 7/1/2026

View Audit 391258

Finding 1177912 (2025-026)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Subrecipient Monitoring Reporting

Responsible Person(s): Eric Billings, Director of Grants Management; Chaye Neal-Jones, Director of Office of Enterprise Management Services Corrective Action Planned: DBHDS identified that CSB subaward information was not being captured within the system's reports. Responsible staff are now entering...

Responsible Person(s): Eric Billings, Director of Grants Management; Chaye Neal-Jones, Director of Office of Enterprise Management Services Corrective Action Planned: DBHDS identified that CSB subaward information was not being captured within the system's reports. Responsible staff are now entering the executed date for CSB subawards which is being picked up by the report. Documents with an inception date of July 1, 2025, within the system have been updated to reflect the correct executed date. DBHDS staff are still working with the vendor to ensure that the report is working correctly. Estimated Completion Date: 4/1/2026

View Audit 391258

Finding 1177909 (2025-101)

Material Weakness 2025

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE ...

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 6/15/2026

View Audit 391258

Finding 1177908 (2025-100)

Material Weakness 2025

Commonwealth of Virginia

VA

Eligibility Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; David Carico, Business Operations Manager Corrective Action Planned: Below is the narrative for CR901 and CR902 Records Retention, including current production deployment timelines. CR901 establishes the datab...

Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; David Carico, Business Operations Manager Corrective Action Planned: Below is the narrative for CR901 and CR902 Records Retention, including current production deployment timelines. CR901 establishes the database infrastructure required to support compliant records retention within case management system. This includes partition creation across 75 plus high volume tables to enable structured aging and controlled purge activity aligned to retention thresholds. Production Deployment Timeline; scheduled as part of the February 2026 technical release. This phase is foundational and will be completed before purge logic can safely execute. CR902 Retention Logic and controlled execution; CR902 operationalizes the records retention policy by implementing controlled purge jobs leveraging the partitioning framework established in CR901. This Change Request moves the solution from infrastructure readiness to active lifecycle management. Phase 1 Database partition creation (February 2026 production release schedule) Phase 2 Controlled purge implementation (March 2026 release schedule) Phase 3 Validation, audit confirmation, and reporting controls (April 2026 release schedule) Phase 4 Reoccurring operational retention cycles with documented runbooks (ongoing/living) Estimated Completion Date: 4/30/2026

View Audit 391258

Finding 1177907 (2025-093)

Material Weakness 2025

Commonwealth of Virginia

VA

Eligibility Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; Lunita Browder-Harris, Business Operation Specialist, Business Operations Corrective Action Planned: DSS has identified critical or conflicting roles in the management system. The roles in scope have the capab...

Responsible Person(s): Kavansa Gardner, Business Program Manager Senior, Benefit Programs; Lunita Browder-Harris, Business Operation Specialist, Business Operations Corrective Action Planned: DSS has identified critical or conflicting roles in the management system. The roles in scope have the capability to perform all actions within the system, including inputting applications, determining eligibility, and authorizing benefits. DSS is in the process of implementing a procedure for reviewing and revoking conflicting roles ands privileges for all localities. DSS will work with APA to ensure adequate separation of duties is implemented within the eligibility system. Estimated Completion Date: 6/30/2026

View Audit 391258

Finding 1177906 (2025-085)

Material Weakness 2025

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS has contracted with two vendors to perform external IT Audits over sensitive systems. DSS is able to completed between 25-35 IT au...

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS has contracted with two vendors to perform external IT Audits over sensitive systems. DSS is able to completed between 25-35 IT audits out of their 89 sensitive systems per year. DSS expects all IT systems will be audited by the end of 2027. A set of 31 IT Audits will be completed March 30, 2026. Estimated Completion Date: 12/31/2027

View Audit 391258

Finding 1177905 (2025-084)

Material Weakness 2025

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE ...

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 5/29/2026

View Audit 391258

Finding 1177904 (2025-068)

Material Weakness 2025

Commonwealth of Virginia

VA

Reporting Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awardin...

Responsible Person(s): Mike Jones, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 6/30/2026

View Audit 391258

Finding 1177903 (2025-053)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Subrecipient Monitoring § 200.303

Responsible Person(s): Barry Davis, Information Security Officer; Timothy Kelly, Innovation, Architecture and Governance Director; Steve McCauley, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS Information Security and Risk Management team will ensure risk...

Responsible Person(s): Barry Davis, Information Security Officer; Timothy Kelly, Innovation, Architecture and Governance Director; Steve McCauley, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS Information Security and Risk Management team will ensure risk and control assessments identify and evaluate IAM focused security controls. DSS will develop and define processes and practices to collect monitor and evaluate performance metrics to ensure IAM functions are following define agency service level agreements. DSS will identify different systems and classes for IAM functions. DSS will then create a process to ensure performance metrics are identified. DSS will then implement a procedure to monitor and evaluate the performance metrics. DSS has a documented separation and offboarding process published on its Fusion employee portal. This is a multi-step manual process. DSS is developing training for supervisors and managers to ensure that they know how to navigate through the process. In addition, DSS is developing manual and automated processes to ensure compliance with the process. Estimated Completion Date: 12/30/2026

View Audit 391258

Finding 1177902 (2025-052)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Significant Deficiency § 200.303

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS is establishing the processes and supporting system resources to ensure that DSS has an effective and compliant change management process. These ...

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS is establishing the processes and supporting system resources to ensure that DSS has an effective and compliant change management process. These include: completion of migrating all application to a single repository which enables change tracking and version control in development projects; use of workflows in the system to enforce delivery of required artifacts prior to change submission; changes to the Change Advisory Board process, and post-change processes to validate meeting the acceptance criteria. Estimated Completion Date: 4/30/2026

View Audit 391258

Finding 1177901 (2025-051)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Significant Deficiency § 200.303

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE ...

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 3/9/2026

View Audit 391258

Finding 1177900 (2025-050)

Material Weakness 2025

Commonwealth of Virginia

VA

Subrecipient Monitoring Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk management Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective act...

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk management Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 12/30/2028

View Audit 391258

Finding 1177899 (2025-049)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Significant Deficiency § 200.303

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management; Steve McCauley, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS Information Security and Risk Management is reconcili...

Responsible Person(s): Barry Davis, Information Security Officer; John Vosper, Assistant Director Information Security and Risk Management; Steve McCauley, Assistant Director Information Security and Risk Management Corrective Action Planned: DSS Information Security and Risk Management is reconciling the system to identify security roles for each sensitive system. Estimated Completion Date: 6/30/2026

View Audit 391258

Finding 1177898 (2025-048)

Material Weakness 2025

Commonwealth of Virginia

VA

Reporting Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS will follow the direction of the IAG Team to improve compliance with the security standard. IAG has created a new roadmap for remediation of rela...

Responsible Person(s): Dan Lewis, Chief Technology Officer; Timothy Kelly, Innovation, Architecture and Governance Director Corrective Action Planned: DSS will follow the direction of the IAG Team to improve compliance with the security standard. IAG has created a new roadmap for remediation of related IT security and governance findings, and the IAG director is working with the CTO, CISO and TSD leadership on defining concrete plans for remediation of all related findings. The IAG director, the CTO and the TSD leadership continue to implement and refine the division-wide process to ensure sufficient resources are available and dedicated to prioritizing and implementing the planned IT governance structure changes. Roadmap review sessions are scheduled. Remediation working sessions are in process of being scheduled. Estimated Completion Date: 3/27/2026

View Audit 391258

Finding 1177897 (2025-043)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Subrecipient Monitoring Reporting § 200.303

Responsible Person(s): Steve Hanoka, Information Security Officer Corrective Action Planned: DMAS has started confirming the geographic location for sensitive data monthly and the vulnerability scans every 90 days for the one provider Medicaid management services IT Service provider. DMAS is taking ...

Responsible Person(s): Steve Hanoka, Information Security Officer Corrective Action Planned: DMAS has started confirming the geographic location for sensitive data monthly and the vulnerability scans every 90 days for the one provider Medicaid management services IT Service provider. DMAS is taking steps to ensure that this is completed for all of the service providers that are not under cloud oversight. Estimated Completion Date: 6/30/2026

View Audit 391258

Finding 1177896 (2025-018)

Material Weakness 2025

Commonwealth of Virginia

VA

Subrecipient Monitoring § 200.332

Responsible Person(s): Kristy Cardwell, Program Analyst and Department of Benefit Programs Corrective Action Planned: Benefit Programs acknowledges the deficiencies identified in Findings 1–6 related to monitoring documentation, supervisory oversight, and quality assurance controls. While monitoring...

Responsible Person(s): Kristy Cardwell, Program Analyst and Department of Benefit Programs Corrective Action Planned: Benefit Programs acknowledges the deficiencies identified in Findings 1–6 related to monitoring documentation, supervisory oversight, and quality assurance controls. While monitoring activities were generally performed, documentation and verification controls were not consistently applied. The following corrective actions have been implemented or are in progress to strengthen compliance, oversight, and accountability. Finding 1 - Benefit Programs did not confirm that program consultants selected and documented sampling units appropriately. As a result, 3 out of 20 locality reviews (15%) lacked sufficient documentation of sampling units, and 1 out of 20 reviews (5%) did not include the required number of sampled cases. Response and Corrective Action: Benefit Programs have reinforced sampling requirements and documentation standards with all program consultants. A standardized sampling methodology guide and checklist have been implemented to ensure: -Proper selection of sample units in accordance with established policy; -Clear documentation of the sampling universe, methodology, documented circumstances where sample is less than expected in the final sample selection; and -Verification that the required number of cases is selected prior to initiating the review. Sub-Recipient Coordinator procedures have been strengthened to require documented confirmation of sampling adequacy before the monitoring review progresses to completion. Finding 2 - Benefit Programs did not confirm that program consultants uploaded all required monitoring records to the data repository. As a result, Benefit Programs could not provide complete documentation for 6 out of 20 locality reviews (30%). Response and Corrective Action: A standardized monitoring documentation checklist has been implemented to identify all required documents that must be uploaded to the designated data repository. Program consultants are now required to complete and certify the checklist at the conclusion of each review. Sub-Recipient Coordinator to confirm that all required documentation has been uploaded before the review is formally closed. Periodic quality assurance reviews will be conducted to ensure ongoing compliance. Finding 3 - Benefit Programs did not confirm that program consultants provided timely notification to localities for the monitoring review. As a result, Benefit Programs could not provide this documentation for 1 out of 20 locality reviews (5%). Response and Corrective Action: A standardized notification template and tracking log have been implemented to ensure consistent and timely communication with localities. Program consultants are required to retain notification correspondence in the monitoring file and upload documentation to the platform. Sub-Recipient Coordinator will verify that advance notification was issued in accordance with policy and properly documented prior to the commencement of the review. Finding 4 - Benefit Programs did not ensure that program consultants issued the final monitoring review report for 1 out of 20 locality reviews (5%) and did not confirm that 2 out of 20 locality review reports (10%) included all required elements. Response and Corrective Action: Benefit Programs has updated the final report template to clearly outline all required elements. The monitoring tracking spreadsheet will be updated to include the names of all reports to be uploaded to the platform. The spreadsheet tracks report completion and distribution timelines. Sub-Recipient Coordinator will review all final monitoring reports to ensure completeness, accuracy, and inclusion of all required components. The coordinator will work with monitoring staff to obtain all required documentation. Finding 5 - Benefit Programs could not provide reasonable assurance that subrecipients complied with award requirements for 5 out of 20 locality reviews (25%) because program consultants did not maintain complete sampling documentation and final locality review reports. Response and Corrective Action: To strengthen reasonable assurance over subrecipient compliance, Benefit Programs will reinforce the existing controls: -Mandatory use of standardized sampling and reporting templates; -Required Sub-Recipient Coordinator review confirming completeness of documentation; -Enhanced documentation retention procedures within the centralized repository; and -Periodic internal quality assurance reviews to validate that monitoring files are complete and support conclusions reached. These measures are designed to ensure sufficient, appropriate documentation exists to support compliance determinations. Finding 6 - Benefit Programs did not confirm that program consultants fully documented corrective actions. As a result, 5 out of 20 locality reviews (25%) did not have complete corrective action documentation. Response and Corrective Action: Benefit Programs will have a corrective action tracking tool to document: -Identified findings; -Required corrective actions; -Responsible parties; -Target completion dates; and -Evidence of remediation. Program consultants are required to upload supporting documentation demonstrating corrective action completion. Sub-Recipient Coordinator will verify the adequacy of corrective action documentation and work with monitoring staff to address needed information. Follow-up emails will be used to ensure timely resolution and documented verification. Estimated Completion Date: 7/1/2025

View Audit 391258

Finding 1177895 (2025-014)

Material Weakness 2025

Commonwealth of Virginia

VA

Subrecipient Monitoring § 200.303 § 200.332

Responsible Person(s): Ousman Kah - Subrecipient Monitoring Coordinator Corrective Action Planned: This item can be marked as completed as the findings audit period was June 30, 2025. While all recommendations and corrective actions were initiated as of July 1, 2025, and are currently in place. The ...

Responsible Person(s): Ousman Kah - Subrecipient Monitoring Coordinator Corrective Action Planned: This item can be marked as completed as the findings audit period was June 30, 2025. While all recommendations and corrective actions were initiated as of July 1, 2025, and are currently in place. The pending Executive summary was done as of December 30, 2025. Estimated Completion Date: 12/30/2025

View Audit 391258

Finding 1177894 (2025-025)

Material Weakness 2025

Commonwealth of Virginia

VA

Procurement, Suspension & Debarment Subrecipient Monitoring Matching / Level of Effort / Earmarking § 200.303

Responsible Person(s): Ida Witherspoon, Chief Financial Officer; William Carter, Federal Reporting Manager Corrective Action Planned: Grants now uses a financial system created report to perform a perfunctory audit, matching submission data received from the various Program and Budget staff against ...

Responsible Person(s): Ida Witherspoon, Chief Financial Officer; William Carter, Federal Reporting Manager Corrective Action Planned: Grants now uses a financial system created report to perform a perfunctory audit, matching submission data received from the various Program and Budget staff against each individual upload into the federal system. Vendors are filtered by ALN by each analyst responsible for monitoring the various ALN's that make up the DSS portfolio. Once the lists are cross checked, DSS reaches out again to the sub awarding authority responsible within the agency to ask for additional FFATA information. Estimated Completion Date: 6/30/2026

View Audit 391258

Finding 1177893 (2025-019)

Material Weakness 2025

Commonwealth of Virginia

VA

Internal Control / Segregation of Duties Significant Deficiency § 200.303

Responsible Person(s): Ida Witherspoon, Chief Financial Officer; Ousman Kah, Subrecipient Monitoring Coordinator; James Pell, ARMICS Program Manager Corrective Action Planned: As part of the compliance review, an analysis will be conducted to identify divisions and associated service provider agenci...

Responsible Person(s): Ida Witherspoon, Chief Financial Officer; Ousman Kah, Subrecipient Monitoring Coordinator; James Pell, ARMICS Program Manager Corrective Action Planned: As part of the compliance review, an analysis will be conducted to identify divisions and associated service provider agencies that manage substantial fiscal responsibilities under federal or state funding streams. This includes mapping subrecipient institutions and other state agencies such as the Office of Community Services (OCS) that receive federal grant allocations. The objective is to ensure visibility into entities handling large-scale financial transactions, assess their internal controls, and confirm adherence to applicable federal and state requirements. This analysis will serve as the foundation for targeted monitoring and risk mitigation strategies. DSS receives federal funding, which is disbursed to state agencies as a pass-through transaction. These transactions are initiated by various divisions within DSS, based on agreements with subrecipients, and then sent to Finance for review/processing. The subrecipients receiving federal funding must carry out the mission of that specific federal program. Pass-through transactions are required to be summarized and submitted to DOA for year-end financial reporting by agency and ALN (Assistance Listing Number, i.e., 10.561 = SNAP). DSS needs to obtain confirmation that each agency receiving federal funding is using the federal funds appropriately and within the guidelines of the grant award. ARMICS team will work to obtain financial control assurances from identified significant fiscal recipients. Estimated Completion Date: 11/30/2026

View Audit 391258

Finding 1177892 (2025-016)

Material Weakness 2025

Commonwealth of Virginia

VA

Subrecipient Monitoring Procurement, Suspension & Debarment § 200.332

Responsible Person(s): Ousman Kah - Subrecipient Monitoring Coordinator Corrective Action Planned: The Single Audit of Non-Locality entities was previously not within the purview of the Compliance Division. Based on a recommendation from the contractor, this responsibility has now been assigned to C...

Responsible Person(s): Ousman Kah - Subrecipient Monitoring Coordinator Corrective Action Planned: The Single Audit of Non-Locality entities was previously not within the purview of the Compliance Division. Based on a recommendation from the contractor, this responsibility has now been assigned to Compliance. Compliance is currently gathering and formalizing the process to address the two entities (15%) that did not have a Single Audit report available in the Federal Audit Clearinghouse. Estimated Completion Date: 6/30/2026

View Audit 391258

Finding 1177890 (2025-022)

Material Weakness 2025

Commonwealth of Virginia

VA

Matching / Level of Effort / Earmarking Subrecipient Monitoring Period of Performance

Responsible Person(s): Rebecca Ullrich, Associate Director of Early Childhood Policy and Innovation Corrective Action Planned: Mitigating Information: -DOE identified incorrectly coded transactions at the end of SFY2025 and had begun correcting some entries prior to the APA audit. -DOE Finance and E...

Responsible Person(s): Rebecca Ullrich, Associate Director of Early Childhood Policy and Innovation Corrective Action Planned: Mitigating Information: -DOE identified incorrectly coded transactions at the end of SFY2025 and had begun correcting some entries prior to the APA audit. -DOE Finance and Early Childhood Divisions are developing strategies to ensure alignment of project codes with appropriate grant awards each federal fiscal year. These strategies will be in place no later than September 1, 2026. -General ledgers adjustments have been posted for the identified ARP grant transactions. DOE is in the process of returning those ineligible funds to the federal government. All funds were returned on February 5, 2026. Estimated Completion Date: 9/1/2026

View Audit 391258

Finding 1177889 (2025-021)

Material Weakness 2025

Commonwealth of Virginia

VA

Eligibility Matching / Level of Effort / Earmarking § 200.516

Responsible Person(s): Meredith Lumpkin/J’Noie Parker, Child Care Subsidy Program Manager Corrective Action Planned: 1.) Process Redesign and Standardization: DSS has redefined the redetermination packet to require submission of the application and all required verifications to ensure complete docum...

Responsible Person(s): Meredith Lumpkin/J’Noie Parker, Child Care Subsidy Program Manager Corrective Action Planned: 1.) Process Redesign and Standardization: DSS has redefined the redetermination packet to require submission of the application and all required verifications to ensure complete documentation to streamline eligibility review. Updated procedural guidance has been incorporated into the Interim Guidance Manual to clarify verification requirements and documentation standards. A standardized step-by-step resource guide and redetermination flow chart have been developed outlining required actions, decision points, and the importance of reviewing redetermination monitoring reports on a monthly basis to ensure cases do not exceed eligibility periods. 2.) Immediate Remediation: In January, following the initial APA audit, DSS conducted a statewide scope and scale review of all active cases to identify outstanding redeterminations. Through this analysis, DSS identified 88 overdue redeterminations (31 from January 2026 and 57 from periods prior to January 2026). Local departments and appropriate staff were notified individually of the specific cases requiring action and directed to take corrective steps. DSS will review cases at the end of March to ensure action has been taken. Going forward, DSS will direct all local departments to review the monthly system-generated redetermination monitoring report and resolve any cases identified as exceeding the eligibility period. DSS will distribute targeted overdue case lists to Regional Program Consultants (RPCs) and monitor locality progress through centralized tracking to ensure timely eligibility determinations and ongoing CCDF compliance. 3.) Centralized Oversight: DSS will implement a layered oversight process to ensure compliance with required monthly monitoring procedures: -Regional-Level Review: Regional Program Consultants (RPCs) will review redetermination monitoring activity monthly within their assigned localities and direct corrective action as needed to ensure timely processing and case closure when appropriate. -Home Office Verification: DSS Home Office, in collaboration with DOE, will conduct quarterly reviews of regional monitoring activity to verify compliance and provide direction to RPCs where additional corrective action or technical assistance is required. This dual-level oversight structure establishes both ongoing regional monitoring and periodic centralized verification to reduce the risk of recurrence. 4.) Training: Refresher training will be provided to staff at our Benefits Program Conference in April, emphasizing timely processing, required verifications, system documentation standards, and ongoing monitoring responsibilities. Additionally, DSS is collaborating with the Local Training and Development team to initiate the development of a targeted refresher course for tenured staff to reinforce critical requirements, including the redetermination process. Monthly report review, as outlined in bullet two, will inform ongoing training updates to address. 5.) System Control Evaluation: DSS will collaborate with IT to assess potential system enhancements in future releases to strengthen controls related to redetermination due dates, including additional automated functionality or reporting capabilities. DSS will deliver to CCSP leadership, by June 30, 2026, a prioritized list of recommended system enhancements with associated cost estimates for review and consideration. Estimated Completion Date: 6/30/2026

View Audit 391258

Finding 1177887 (2025-017)

Material Weakness 2025

Commonwealth of Virginia

VA

Subrecipient Monitoring § 200.332

Responsible Person(s): Kristy Cardwell - Program Analyst and Department of Benefit Programs Corrective Action Planned: A.) Risk Assessment Tracking and Scheduling: A comprehensive Risk Assessment Spreadsheet has been developed with individual tabs for each State Fiscal Year (SFY) through SFY2034. Ea...

Responsible Person(s): Kristy Cardwell - Program Analyst and Department of Benefit Programs Corrective Action Planned: A.) Risk Assessment Tracking and Scheduling: A comprehensive Risk Assessment Spreadsheet has been developed with individual tabs for each State Fiscal Year (SFY) through SFY2034. Each tab identifies all agencies for which a Risk Assessment is due during that fiscal year. This tracking process will be maintained and updated annually. Monitoring staff have been formally advised that all subrecipients rated High or Medium risk must be included in the current monitoring review schedule. If a monitoring review is not conducted, written justification must be documented and maintained. B.) Monthly Monitoring Newsletter: During months when virtual meetings are not held, a monthly newsletter will be distributed to monitoring staff to reinforce requirements and provide ongoing guidance. -Page One of newsletter – LDSS Subrecipients Announcement of the availability of the LDSS Risk -Assessment document or monitoring schedule template, including due dates -List of common items to prepare for the SFY2027 audit -“Subrecipient Coordinator Corner” outlining upcoming planned activities -Compilation of previously distributed reference documents -Page Two of newsletter – Non-LDSS Subrecipients -Risk Assessment due dates -List of common items to prepare for SFY2027 -“Subrecipient Coordinator Corner” outlining upcoming planned activities -Compilation of previously distributed reference documents C.) Quarterly Virtual Meetings: Quarterly virtual meetings will be conducted. Each meeting will include a formal agenda; time will be allotted for questions and discussion, and audit findings will be shared and reviewed to promote continuous improvement and compliance awareness. D.) Technical Guidance: Monitoring staff may request “How-To” instructional documents to support compliance with procedural requirements (e.g., uploading documentation to the platform). These resources will be developed and distributed as needed. E.) Audit Findings Tracking: APA audit findings are documented in a centralized tracking document for both LDSS and Non-LDSS subrecipients beginning with SFY2024 and shared with monitoring staff. The document includes statistical reporting that reflects percentages of progress and identifies areas where corrective actions are incomplete. Program consultants did not complete programmatic risk assessments for 17 of 42 (40%) non-locality sub-recipients with fiscal year payments. Program staff will conduct additional research to clarify and document the fiscal year payment criteria to ensure that all non-locality subrecipients meeting the applicable threshold are identified and included in the annual risk assessment process. The revised tracking mechanism described above will incorporate these subrecipients to ensure completeness and compliance going forward. Benefit Programs developed tracking tools to monitor completion of risk assessments and follow-up activities, but program consultants did not fully complete these tools during the fiscal year. The Sub-Recipient Coordinator will reinforce expectations regarding timely and complete use of the established tracking tools. Sub-Recipient Coordinator review procedures will be strengthened to ensure: -Risk assessments are completed within required timeframes, -Follow-up activities are documented appropriately, and -Tracking tools are updated accurately and consistently throughout the fiscal year. Ongoing monitoring and periodic Sub-Recipient Coordinator review will be implemented to ensure sustained compliance with federal requirements. Estimated Completion Date: 4/30/2026

View Audit 391258

Finding 1177869 (2025-020)

Material Weakness 2025

Commonwealth of Virginia

VA

§ 200.516

Responsible Person(s): Monique Majeus, Economic Assistance and Employment/TANF Consultant; Regional TANF Practice Consultants Corrective Action Planned: Targeted Staff Training: -Provide refresher training on TANF/VIEW eligibility requirements, case documentation standards, and mandated timelines. -...

Responsible Person(s): Monique Majeus, Economic Assistance and Employment/TANF Consultant; Regional TANF Practice Consultants Corrective Action Planned: Targeted Staff Training: -Provide refresher training on TANF/VIEW eligibility requirements, case documentation standards, and mandated timelines. -Training will address specific error trends identified during the review. Training Schedule: -February 2, 2026 – Statewide training on preventing duplicate benefit issuance -March 3, 2026 – Statewide training on Child Support Income (Redirection) and Required actions Pertaining to Tasks and Reminders (e.g., child turning 18, VIEW non-compliance) -January 22, 2026 – Broadcast message attached Regional TANF Practice Consultants will conduct ongoing case reviews and deliver targeted training based on errors identified within their respective local agencies. Standardized Case Processing Tools: -Implement updated checklists, job aids, and workflow guides to ensure consistent policy application and reduce avoidable errors. -Initial tool distributed to local agencies on January 7, 2026. Claims Establishment for Overpayments: -Initial request sent to Regional Practice Consultants for distribution to local agencies on January 7, 2026 to begin the claims process. Estimated Completion Date: 3/30/2026

View Audit 391258

Finding 1177865 (2025-015)

Material Weakness 2025

Commonwealth of Virginia

VA

Subrecipient Monitoring Material Weakness Reporting § 200.303

Responsible Person(s): Monique Majeus, Economic Assistance and Employment; Christie Bruce, TANF Consultant Corrective Action Planned: Change Request submitted to fix and implement the changes requiring correction in 2025. Estimated Completion Date: 11/25/2025

View Audit 391258

Corrective Action Plans

Filters