Corrective Action Plans

Finding 526363 (2024-002)

Material Weakness 2024

North Vermillion Community School Corporation

IN

School Nutrition Programs Internal Control / Segregation of Duties Allowable Costs / Cost Principles § 200.303

Context: During testing over controls for eligibility, we noted there was no formal, secondary review for the applications entered in the food service software determining eligibility. Additionally, there was no documented annual review by School Corporation personnel of the income eligibility guide...

Context: During testing over controls for eligibility, we noted there was no formal, secondary review for the applications entered in the food service software determining eligibility. Additionally, there was no documented annual review by School Corporation personnel of the income eligibility guidelines used by the food service software. Contact Person Responsible for Corrective Action: Michele Harrison/ Corporation treasurer Brian Byrum / Superintendent Contact Phone Number: M. Harrison:765-492-5101 B. Byrum: 765-492-5102 Views of Responsible Officia.l : We concur with the finding. Description of Corrective Action Plan: Prior to printing accounts payable checks, the corporation treasurer prints the AP voucher register for the superintendent to review and sign. After this internal control, the treasurer processes the checks. Once checks are printed, the voucher is paired with the invoice, initialled by the corporation treasurer and signed by the superintendent. Anticipated Completion Date: 3/7/2025

View Audit 345287

Finding 526361 (2024-002)

Material Weakness 2024

Fremont Community Schools

IN

Matching / Level of Effort / Earmarking Special Tests & Provisions Subrecipient Monitoring § 200.303

See attached letter that was sent to the DOE on 2/25/25 along with the approval email and documents from DOE. During ESSER II Constmction we had several companies work on projects at Fremont Community Schools. To no one's fault but my own, the Davis-Bacon requirements wore not fully communicated to ...

See attached letter that was sent to the DOE on 2/25/25 along with the approval email and documents from DOE. During ESSER II Constmction we had several companies work on projects at Fremont Community Schools. To no one's fault but my own, the Davis-Bacon requirements wore not fully communicated to these companies. One company that did work for us could not respond with a positive affirmation on Davis-Bacon. Their response is as follows: "We will not be able tQ v.rovide a letter stating we paid our employees a Prevailing Wage (pr work completed at Fremont Community Schools. We do not have any proposals or signed contracts stating these iobs were Prevailing Wage. As such, our employees were not p_aid a Prevailing Wage when working on these proiects. •~ I (Dr. William Stitt) have watched the webinar regarding Davis-Bacon requirements provided by the U.S. Department of Education (USDE) and U.S. Department of Labor (DO1). I have also read through the questions and responses for the December 7, 2023 webinar. I attest that I and Fremont Community Schools commit that applicable Davis-Bacon requfrements will be utilized on any future construction, or construction related, activities using $2,000 or greater of Federal grant funds and will follow Davis-Bacon requirements.

View Audit 345281

Finding 526356 (2024-004)

Significant Deficiency 2024

Saint Louis University

MO

Matching / Level of Effort / Earmarking Student Financial Aid Allowable Costs / Cost Principles

We are in the process of revising our disbursement process to ensure that all Title IV aid disbursements are held until the corresponding aid offer notification has been sent. This will eliminate any timing gaps between the notification process and disbursements. With the financial aid office now ne...

We are in the process of revising our disbursement process to ensure that all Title IV aid disbursements are held until the corresponding aid offer notification has been sent. This will eliminate any timing gaps between the notification process and disbursements. With the financial aid office now near full staffing, we have reinforced training for staff to emphasize the importance of adhering to the revised disbursement timeline. This training includes guidance on managing exceptions and prioritizing compliance in the aid process. While we currently lack the capacity to send aid notifications daily, we are conducting a review of our automated processes to explore solutions for increasing the frequency of aid offer notifications. This may include evaluating potential system enhancements or resource reallocation to support more frequent notifications. We have implemented additional internal monitoring procedures to regularly review the timing of aid offer notifications and disbursements. Any rejected records will be resolved and resubmitted with the same timeframe. This will ensure ongoing compliance and allow for prompt identification and resolution of any discrepancies. The University is committed to maintaining compliance with all federal regulations and ensuring transparency in our financial aid processes. By implementing these corrective actions, we are confident that the risk of future noncompliance has been minimized. Alex DeLonis, Assistant Vice President for Student Financial Services, is responsible for addressing the above item by May 2025.

View Audit 345274

Finding 526346 (2024-002)

Material Weakness 2024

Saint Louis University

MO

Eligibility Matching / Level of Effort / Earmarking Student Financial Aid

To address the conditions identified, we are taking immediate and proactive steps to strengthen our internal controls and processes. These include enhancing staffing capacity, providing additional training, and implementing more robust checks and balances to ensure all verification information is ac...

To address the conditions identified, we are taking immediate and proactive steps to strengthen our internal controls and processes. These include enhancing staffing capacity, providing additional training, and implementing more robust checks and balances to ensure all verification information is accurately and completely submitted to the CPS. The University has opened multiple positions within the department to enhance efficiency. All current staff will be trained on a continuous basis to ensure knowledge of compliance. We have also engaged an outside consultant to conduct a comprehensive compliance review, ensuring alignment with federal requirements and best practices. Additionally, we are increasing funding for professional development to equip our staff with the skills and knowledge necessary to maintain compliance and ensure the integrity of our processes. Regarding timely submission to CPS, we affirm that all affected students' eligibility was accurately determined, and no Title IV funds were disbursed to ineligible students. We remain committed to maintaining the integrity of the Title IV programs and will take the necessary steps to prevent future occurrences.  Alex DeLonis, Assistant Vice President for Student Financial Services, is responsible for addressing the above item by May 2025.

View Audit 345274

Finding 526338 (2024-003)

Material Weakness 2024

Saint Louis University

MO

Student Financial Aid Matching / Level of Effort / Earmarking Reporting

To address these findings, the University is committed to increasing staffing levels and enhancing training programs to reduce the likelihood of human input errors and ensure the timely resolution of system updates. The University has already hired multiple positions and had various training courses...

To address these findings, the University is committed to increasing staffing levels and enhancing training programs to reduce the likelihood of human input errors and ensure the timely resolution of system updates. The University has already hired multiple positions and had various training courses in order to enhance knowledge of compliance. Additionally, we are actively reviewing and revising our internal control procedures, including:  Strengthening review processes to verify the accuracy of enrollment data reported to the NSLDS.  Working with University staff to enhance the functionality of Tableau reports to avoid filtering issues and improve the identification of withdrawn students requiring reporting.  We recognize the importance of accurate and timely reporting to the NSLDS to maintain compliance with program requirements and support the USDE's ability to monitor enrollment status. These corrective actions will help us address the root causes of the issues identified and prevent recurrence in the future.  Alex DeLonis, Assistant Vice President for Student Financial Services, is responsible for addressing the above item by May 2025.

View Audit 345274

Finding 526335 (2024-001)

Material Weakness 2024

Saint Louis University

MO

Matching / Level of Effort / Earmarking Student Financial Aid

First, we believe the inaccuracies identified in the academic end date and student year reporting were isolated errors, which have not been a historical issue for the University. Second, the delays in reporting Pell and Federal Direct Loan disbursements to the COD were due to capacity challenges, in...

First, we believe the inaccuracies identified in the academic end date and student year reporting were isolated errors, which have not been a historical issue for the University. Second, the delays in reporting Pell and Federal Direct Loan disbursements to the COD were due to capacity challenges, including staffing shortages that impacted our ability to resolve rejected submissions within the required timeframe.  To address these issues, we are taking proactive steps to strengthen our processes and ensure future compliance. These include efforts to fully staff our team, engaging an outside consulting firm to conduct a compliance and best practices review, and increasing funding for professional development to enhance staff expertise and efficiency.  Additionally, the University is working with external consultants to enhance financial aid processing systems. This will gain efficiencies to ensure data is reported within the required timeframes. We remain confident in the overall accuracy and integrity of our processes and are committed to implementing improvements to ensure timely and accurate reporting to the COD moving forward.  Alex DeLonis, Assistant Vice President for Student Financial Services, is responsible for addressing the above item by May 2025.

View Audit 345274

Finding 526334 (2024-002)

Significant Deficiency 2024

Greenfield Community College

MA

Student Financial Aid Reporting Matching / Level of Effort / Earmarking

Finding number: 2024-002 Corrective Action Plan: An internal review of our process for reporting Pell payments to Common Origination & Disbursement (COD) reveals that the vast majority of Pell payments are reported within 2 business of disbursement. The Pell payment in question was disbursed two wee...

Finding number: 2024-002 Corrective Action Plan: An internal review of our process for reporting Pell payments to Common Origination & Disbursement (COD) reveals that the vast majority of Pell payments are reported within 2 business of disbursement. The Pell payment in question was disbursed two weeks after our scheduled fall disbursement and reported to COD 12 and 13 days late. The disbursement occurred once the student completed all outstanding financial aid requirements. The procedures for reporting all Title IV payments and disbursements to COD has been reviewed with the staff members responsible for transmitting origination and disbursement records to COD. Procedures have been developed to more readily identify financial aid disbursements that take place outside of the established disbursement date for the term. This corrective action plan was put into place in February 2024. Finding 2024-02 occurred prior to the action plan’s implementation. Timeline for Implementation of Corrective Action Plan: February 2024 Contact Person Mark Boudreau, Comptroller

View Audit 345265

Finding 526332 (2024-001)

Significant Deficiency 2024

Greenfield Community College

MA

Student Financial Aid Reporting Matching / Level of Effort / Earmarking

Finding number: 2024-001 Corrective Action Plan: To ensure that the college is using the same effective date for (unofficial) withdrawal on both the R2T4 calculations and for reporting unofficial withdrawal enrollment changes to NSLDS, the financial aid office will forward the list of students who a...

Finding number: 2024-001 Corrective Action Plan: To ensure that the college is using the same effective date for (unofficial) withdrawal on both the R2T4 calculations and for reporting unofficial withdrawal enrollment changes to NSLDS, the financial aid office will forward the list of students who are determined to have unofficially withdrawn and their associated date of unofficial withdrawal to the registrar's office at the end of each term. The registrar's office will then adjust all students' records in their SIS (Banner) as needed prior to submitting their report to NSC/NSLDS. This corrective action plan was finalized in June 2024. Finding 2024-01 occurred prior to the action plan’s implementation. Timeline for Implementation of Corrective Action Plan: June 2024 Contact Person Mark Boudreau, Comptroller

View Audit 345265

Finding 526319 (2024-002)

Significant Deficiency 2024

Bossier Parish School Board

LA

Allowable Costs / Cost Principles § 200.430

Reference # and title: 2024-002 Internal Control and Compliance over Title I Payroll Federal program and specific federal award identification: AL Number Award Year FEDERAL GRANTER/ PASS THROUGH GRANTOR/PROGRAM NAME United States Department of Education; passed through Louisiana Department of ...

Reference # and title: 2024-002 Internal Control and Compliance over Title I Payroll Federal program and specific federal award identification: AL Number Award Year FEDERAL GRANTER/ PASS THROUGH GRANTOR/PROGRAM NAME United States Department of Education; passed through Louisiana Department of Education Title I Grants to Local Educational Agencies #84.010A 2024 Condition: For an employee who works in part on the consolidated administrative cost objective and in part on a Federal program whose administrative funds have not been consolidated or on activities funded from other revenue sources, an LEA must maintain time and effort distribution records in accordance with 2 CFR section 200.430(i)(1)(vii) that support the portion of time and effort dedicated to (a) the consolidated cost objective, and (b) each program or other cost objective supported by non-consolidated Federal funds or other revenue sources. Employee pay should be reviewed to ensure that payment amount is correct. Employee attendance should be documented on a consistent basis. In testing 25 payroll transactions for the Title I program, the following exception were noted: 2 exceptions noted in which there was inadequate attendance records; 9 exceptions where time records were not initialed or signed by the employee; 2 exceptions where one employee was not paid in accordance with the salary schedule, which resulted in under payment. 14 exceptions where time certifications were completed, but not in a timely manner. Corrective action planned: During the year, there was staff turnover within the Title 1 department. The School Board will ensure that new personnel are properly trained in necessary internal controls over payroll transactions moving forward. Person responsible for corrective action: Mrs. Nicia Bamburg, Chief Financial Officer Mr. Waylon Bates, Assistant Superintendent of Curriculum and Academic Affairs P.O. Box 2000 Benton, Louisiana 71006-2000 Phone: (318) 549-5000 Anticipated completion date: June 30, 2025

View Audit 345248

Finding 526316 (2024-002)

Significant Deficiency 2024

Commonwealth Cahtolic Charities

VA

Eligibility Significant Deficiency Internal Control / Segregation of Duties

Action Plan: CCC’s managerial and quality assurance review processes include reviews of all client files to ensure appropriate documentation of eligibility, services rendered, and client progress. These reviews happen at intake and periodic intervals to ensure the accuracy and quality of the client ...

Action Plan: CCC’s managerial and quality assurance review processes include reviews of all client files to ensure appropriate documentation of eligibility, services rendered, and client progress. These reviews happen at intake and periodic intervals to ensure the accuracy and quality of the client record. We acknowledge that in some cases, management did not specifically document the management review of eligibility documentation, however the review process did ensure that all files did include appropriate documentation of client eligibility. Moving forward, we will ensure that all client files specifically evidence managerial confirmation of client eligibility with one or more of the following: 1. a signed checklist containing potential eligibility documents 2. a signature on the actual eligibility document or referral 3. an electronic case note to the file confirming review and presence of eligibility documentation. We have already begun working with relevant departments to implement these improvements and will monitor the implemented changes to ensure their effectiveness as we are committed to maintaining and enhancing our internal controls environment and the quality of services provided to the individuals and families we serve.

View Audit 345244

Finding 526313 (2024-001)

Significant Deficiency 2024

Isle of Palms Water & Sewer Commission

SC

1. We have reviewed internal policies and procedures to identify existing and unidentified internal control weaknesses. Our intent is to establish an internal control structure sufficient to satisfy our needs and to comply with regulatory and industry standards for an effective control struct...

1. We have reviewed internal policies and procedures to identify existing and unidentified internal control weaknesses. Our intent is to establish an internal control structure sufficient to satisfy our needs and to comply with regulatory and industry standards for an effective control structure to proactively identify and remediate identified and potential control weaknesses.

View Audit 345224

Finding 526313 (2024-001)

Significant Deficiency 2024

Isle of Palms Water & Sewer Commission

SC

2. We are in the process of setting up continuing education for the accounting of grant receivables.

View Audit 345224

Finding 526306 (2024-001)

Material Weakness 2024

Greenwood Community School Corporation

IN

Procurement, Suspension & Debarment Subrecipient Monitoring School Nutrition Programs § 200.303

FINDING 2024-001 (Auditor Assigned Reference Number) Finding Subject: Child Nutrition Cluster Summary of Finding: Lack of an internal control system to ensure compliance with the Suspension and Debarment requirements for contractors and subrecipients Contact Person Responsible for Corrective Action:...

FINDING 2024-001 (Auditor Assigned Reference Number) Finding Subject: Child Nutrition Cluster Summary of Finding: Lack of an internal control system to ensure compliance with the Suspension and Debarment requirements for contractors and subrecipients Contact Person Responsible for Corrective Action: Katy Dowling Contact Phone Number and Email Address: 317-889-4060 and kdowling@gws.k12.in.us Views of Responsible Officials: The district concurs with the finding. The procurement of the item in question began with the prior Director of Food Service and was then completed at a later date by her successor. We believe this is a contributing factor to this error. The district participates in CIESC’s Region 9 Child Nutrition Cooperative. This cooperative conducts the bidding/procurement process on behalf of its members in compliance with all Federal Procurement and Suspension and Debarment requirements. From time to time, there are items needed that are not available through the cooperative. Most often, this is food service equipment purchases. Description of Corrective Action Plan: Policy 6325 covers procurement for federal grants/funds. Within this policy, procurement and suspension and debarment expectations are provided. The district plans to add an administrative guideline that will cover the process for any purchase reasonably expected to exceed $25,000 including, but not limited to, (1) how to verify if a vendor is suspended or debarred; (2) what documentation is required and how it is submitted/tracked; (3) validation process involving accounts payable for purchases over $25,000 from federal grants/funds to confirm steps 1 and 2 were properly followed. In addition, communication and direction will be provided to any staff in the district who have the ability to make purchases for grant-funded items. Anticipated Completion Date: 3/1/25 – Review of purchases from grant funds from 7/1/24 through 2/20/25 to ensure compliance. 3/1/25 – Completion of Administrative Guidelines 6325 to specify the internal control process. 3/1/25 – Communication to impacted staff regarding the policy and administrative guideline.

View Audit 345221

Finding 526305 (2024-001)

Significant Deficiency 2024

Louisville/jefferson County Metro Government

KY

Questioned Costs Reporting § 200.510

Finding ALN 11.307 During testing of the Economic Adjustment Assistance (ALN 11.307) grant two issues were noted. The federal expenditure amount was reported incorrectly on the SEFA provided by Louisville Metro and information in the loan payment system was incorrect for two written off loans. The a...

Finding ALN 11.307 During testing of the Economic Adjustment Assistance (ALN 11.307) grant two issues were noted. The federal expenditure amount was reported incorrectly on the SEFA provided by Louisville Metro and information in the loan payment system was incorrect for two written off loans. The amount reported on the SEFA was $1,501,755. The correct federal expenditure amount is $3,072,347. An adjustment to the SEFA was made to correct the federal expenditure amount. The loan payment for the written off loan, Barbie Bac’z, did not follow the order of priority. The METCO Board approved $14,699 to be written off for The Limbo LLC per the 12/14/23 METCO memo. However, the amount on the grant portfolio that was written off was $14,577. The difference between the minutes and the grant portfolio is $122. “We recommend communication between the OMB Grants division and the agency handling a federal grant be improved to ensure the SEFA is accurate. Auditor’s Recommendation We recommend management periodically reconcile the RLF loan system to catch errors before too much time has passed and make corrections when needed. We recommend that management correct the next semi-annual report and the information used to prepare the chart attached to the semi-annual report is for the correct fiscal year.” Management Response Management concurs with the auditors’ finding and recommendation. Metro Government will implement controls for periodic reconciliation of the RLF loan system to catch errors before too much time has passed in addition to a year-end review for a secondary supervisor and management review to ensure an accurate outcome before submission for audit review. Anticipated Completion Date Periodic Reconciliation of RLF program quarterly beginning April 1, 2025 Annual Review to be completed by July 15 for fiscal year ending June 30 Contact Responsible For Corrective Action Richard Champion Louisville Metro Finance Director (502) 574-1881

View Audit 345218 Questioned Costs: $1

Finding 526303 (2024-001)

None 2024

Greeley Area Habitat for Humanity

CO

Procurement, Suspension & Debarment

Corrective Action Planned: Habitat will continue to verify that vendors used for purchases of goods or services have not been suspended or debarred by checking the System for Award Management (SAM) and make sure to include this information in the contract file. Habitat did check the System for Award...

Corrective Action Planned: Habitat will continue to verify that vendors used for purchases of goods or services have not been suspended or debarred by checking the System for Award Management (SAM) and make sure to include this information in the contract file. Habitat did check the System for Award Management (SAM) in February 2025 noting that the vendor at that time had not been suspended or debarred.

View Audit 345217

Finding 526260 (2024-082)

Material Weakness 2024

Commonwealth of Virginia

VA

Subrecipient Monitoring § 200.303 § 200.332

Responsible Contact Person(s): Ousman Kah, Subrecipient Monitoring Coordinator Corrective Action Planned: A Grants Management solution is being pursued by DSS in anticipation that it can be deployed with Subrecipient Monitoring capabilities needed to comply with these requirements. A new budget requ...

Responsible Contact Person(s): Ousman Kah, Subrecipient Monitoring Coordinator Corrective Action Planned: A Grants Management solution is being pursued by DSS in anticipation that it can be deployed with Subrecipient Monitoring capabilities needed to comply with these requirements. A new budget request has been submitted for funding of a contingent Subrecipient Monitoring System solution. This will help bridge the deficiencies noted util an integrated permanent solution is implemented. Estimated Completion Date: 6/30/2025

View Audit 345214

Finding 526259 (2024-071)

Significant Deficiency 2024

Commonwealth of Virginia

VA

Subrecipient Monitoring Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Naveen Abraham, Chief Core Infrastructure Services Corrective Action Planned: Ensuring that infrastructure suppliers fulfill all contractual requirements with respect to Commonwealth security policies and standards necessitates a programmatic, continuous improvement ap...

Responsible Contact Person(s): Naveen Abraham, Chief Core Infrastructure Services Corrective Action Planned: Ensuring that infrastructure suppliers fulfill all contractual requirements with respect to Commonwealth security policies and standards necessitates a programmatic, continuous improvement approach. VITA has made improved cybersecurity a primary goal and major initiatives have completed and are underway. Based on the improved SLAs and with the improved tools previously implemented, VITA will continue to monitor and improve the security of infrastructure services through ongoing governance, including the requirements of architecture documentation, system security plans, and audit reports. VITA’s infrastructure services group will work with our security group to confirm that the current state achieves security standards compliance. VITA will also continue to work with agencies to drive continued vulnerability remediation and access to log data and to further refine documentation regarding SOPs of the security program and regarding the responsibilities of VITA vs the responsibilities of agencies and suppliers. Estimated Completion Date: 6/30/2025

View Audit 345214

Finding 526258 (2024-068)

Significant Deficiency 2024

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer Karen Holt, Human Resource Business Process Consultant Corrective Action Planned: An agency-wide work group will be established to determine the exact processes need to implement the controls necessary to address this fi...

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer Karen Holt, Human Resource Business Process Consultant Corrective Action Planned: An agency-wide work group will be established to determine the exact processes need to implement the controls necessary to address this finding. Estimated Completion Date: 6/30/2025

View Audit 345214

Finding 526257 (2024-067)

Significant Deficiency 2024

Commonwealth of Virginia

VA

Eligibility HUD Housing Programs Significant Deficiency § 200.303

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Stephen Schleck, Associate Director of Enterprise Business Solutions Angela Morse, Benefit Programs Corrective Action Planned: A Change Request (CR), for the management system was developed 2 years ago and DSS is reviewing the CR...

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Stephen Schleck, Associate Director of Enterprise Business Solutions Angela Morse, Benefit Programs Corrective Action Planned: A Change Request (CR), for the management system was developed 2 years ago and DSS is reviewing the CR to determine a status. It was agreed by Line of Business and ITS EBS and the O&M provider that there will be an iterative approach to completing the record retention and purge rules for implementation in the management system. DSS anticipates the first of a series of changes to address this finding to be implemented in the February 2024 Information Technology Services release. DSS is planning for the final phase of Purge by quarter three of 2025 and will include the following scope: • Scope of change is 150 EDBC tables across all programs beyond a defined cut-off date. • A one-time purge process and on-going purge process will be developed to purge the Uncertified/Unauthorized, Non-current Eligibility Determination. • Develop ongoing purge process for the Phase 1 and Phase 2 tables. • Purge Data files and Data logs App/Batch server. Estimated Completion Date: 12/30/2025

View Audit 345214

Finding 526256 (2024-064)

Significant Deficiency 2024

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Fede...

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 12/31/2025

View Audit 345214

Finding 526255 (2024-061)

Significant Deficiency 2024

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management Corrective Action Planned: DSS Information Security and Risk Management security awareness and training assets will develop role based training for system administrat...

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management Corrective Action Planned: DSS Information Security and Risk Management security awareness and training assets will develop role based training for system administrators and data custodians. Estimated Completion Date: 6/30/2025

View Audit 345214

Finding 526254 (2024-058)

Significant Deficiency 2024

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management John Vosper, Assistant Director of Information Security & Risk Management Corrective Action Planned: DSS has contracted external IT auditors to perform IT audits once...

Responsible Contact Person(s): Barry Davis, Chief Information Security Officer and Director of Information Security & Risk Management John Vosper, Assistant Director of Information Security & Risk Management Corrective Action Planned: DSS has contracted external IT auditors to perform IT audits once every three years on an ongoing rotating basis in accordance with yellow book audit standards. Estimated Completion Date: 12/15/2025

View Audit 345214

Finding 526253 (2024-053)

Significant Deficiency 2024

Commonwealth of Virginia

VA

Subrecipient Monitoring Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Mike Jones, Chief Information Officer Steve Hanoka, Information Security Officer Corrective Action Planned: Vulnerability Management policies and procedures exist. These include scanning for both vulnerabilities and baseline configuration. They are being tracked acco...

Responsible Contact Person(s): Mike Jones, Chief Information Officer Steve Hanoka, Information Security Officer Corrective Action Planned: Vulnerability Management policies and procedures exist. These include scanning for both vulnerabilities and baseline configuration. They are being tracked according to SEC530 resolution standards. Goal is to ensure that all vulnerabilities are remediated within the SLA or have approved exceptions by May 30, 2025. In addition, DMAS has gained guidance from VITA on acceptable alternatives to penetration testing and are tracking completion. Estimated Completion Date: 5/30/2025

View Audit 345214

Finding 526252 (2024-047)

Significant Deficiency 2024

Commonwealth of Virginia

VA

Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Fede...

Responsible Contact Person(s): Kevin Platea, Chief Information Officer Corrective Action Planned: This finding was marked as FOIA Exempt (FOIAE) and as a result, the State Comptroller has determined that the resulting corrective actions are FOIAE under §2.2-3705.2 (9.) of the Code of Virginia. Federal awarding agencies and pass-through entities, please see the Appendix titled “Applicable Management Contacts for Findings and Questioned Costs” to request the corrective action planned from the applicable entity. Estimated Completion Date: 6/30/2025

View Audit 345214

Finding 526251 (2024-042)

Significant Deficiency 2024

Commonwealth of Virginia

VA

Eligibility Significant Deficiency Internal Control / Segregation of Duties § 200.303

Responsible Contact Person(s): Kavansa Gardner, IT Manager Corrective Action Planned: DSS performed an annual access review of user accounts for the system. As of December 20, 2024, the DSS projected completion date for the 2024 system Annual Review was December 31, 2024. The IT Manager is waiting f...

Responsible Contact Person(s): Kavansa Gardner, IT Manager Corrective Action Planned: DSS performed an annual access review of user accounts for the system. As of December 20, 2024, the DSS projected completion date for the 2024 system Annual Review was December 31, 2024. The IT Manager is waiting for eight more FIPs to submit screenshots of roles that have been removed or changed. The IT Manager has been in contact with all noncompliant agencies and has meetings scheduled to ensure all necessary documentation is obtained prior to the cutoff point. DSS will be reviewing final documents to certify the accuracy of the review before deadline. Estimated Completion Date: 1/31/2025

View Audit 345214

Corrective Action Plans

Filters