2023–026 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – ENROLLMENT REPORTING (N5) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Internal controls over the review and approval of the enrollment report sent to the National Student Clearinghouse (NSC) were not adequately designed or operating effectively for Bluefield State University (BSU), Blueridge Community and Technical College (BRCTC), Concord University (CU), Fairmont State University (FSU), Marshall University (MU), Mountwest Community and Technical College (MCTC), New River Community and Technical College (NRCTC), Pierpont Community and Technical College (PPCTC), Shepherd University (SU), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia State University (WVSU), West Virginia University (WVU), and West Virginia University at Parkersburg (WVUP). For the enrollment reporting transmissions tested for internal controls, we noted the following: * Final review and approval signoff to submit the enrollment report to NSC, the third-party used in the enrollment reporting process, was not consistently retained by the institution (BSU, BRCTC, PCTC, WLU, WVNCC, WVSU) * A record count reconciliation between the final enrollment report, text file and the number of files received by the NSC, including documentation over how any rejected records were addressed, was not retained. (BSU, BRCTC, CU, FSU, MU, MCTC, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, WVU, WVUP) * Details of the validation of student information included in the enrollment report for accuracy was not consistently retained by the institution. (BSU, FSU, MU, MCTC, NRCTC, WVSU) * The NSC automated emails used as a quality checklist regarding due dates, receipt of the text file by the NSC, availability and completion of the Error Resolution Report, and confirmation of certification and processing by the NSC were not consistently retained by the institution (BSU, BRCTC, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, WVUP) Cause: The institutions did not have adequately designed internal controls in place surrounding the enrollment reporting process. Effect or Potential Effect: The institutions may not promptly notify the National Student Loan Data System (NSLDS) of changes in student status in an accurate and complete manner; thus, inaccurate, or incomplete information could be reported to the NSLDS. Questioned Costs: None Context: The total expenditures for the SFA Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–012 and 2021–016 Recommendation: Documentation over the review and approval of the enrollment report for accuracy and completeness should be retained to evidence the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–017 SPECIAL TESTS AND PROVISIONS – SATISFACTORY ACADEMIC PROGRESS (N9) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.16(e) states: “For purposes of determining student eligibility for assistance under a title IV, HEA program, establishes, publishes, and applies reasonable standards for measuring whether an otherwise eligible student is maintaining satisfactory academic progress in his or her educational program. The Secretary considers an institution's standards to be reasonable if the standards are in accordance with the provisions specified in § 668.34.” 34 CFR 668.34 states: “An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs. The Secretary considers the institution's policy to be reasonable if— (1) The policy is at least as strict as the policy the institution applies to a student who is not receiving assistance under the title IV, HEA programs; (2) The policy provides for consistent application of standards to all students within categories of students, e.g., full-time, part-time, undergraduate, and graduate students, and educational programs established by the institution; (3) The policy provides that a student's academic progress is evaluated— (i) At the end of each payment period if the educational program is either one academic year in length or shorter than an academic year; or (ii) For all other educational programs, at the end of each payment period or at least annually to correspond with the end of a payment period; (4) (i) The policy specifies the grade point average (GPA) that a student must achieve at each evaluation, or if a GPA is not an appropriate qualitative measure, a comparable assessment measured against a norm; and (ii) If a student is enrolled in an educational program of more than two academic years, the policy specifies that at the end of the second academic year, the student must have a GPA of at least a “C” or its equivalent, or have academic standing consistent with the institution's requirements for graduation; (5) The policy specifies— (i) For all programs, the maximum timeframe as defined in paragraph (b) of this section; and (ii) For a credit hour program using standard or nonstandard terms that is not a subscription-based program, the pace, measured at each evaluation, at which a student must progress through his or her educational program to ensure that the student will complete the program within the maximum timeframe, calculated by either dividing the cumulative number of hours the student has successfully completed by the cumulative number of hours the student has attempted or by determining the number of hours that the student should have completed by the evaluation point in order to complete the program within the maximum timeframe. In making this calculation, the institution is not required to include remedial courses; (6) The policy describes how a student's GPA and pace of completion are affected by course incompletes, withdrawals, or repetitions, or transfers of credit from other institutions. Credit hours from another institution that are accepted toward the student's educational program must count as both attempted and completed hours; (7) Except as provided in paragraphs (c) and (d) of this section, the policy provides that, at the time of each evaluation, a student who has not achieved the required GPA, or who is not successfully completing his or her educational program at the required pace, is no longer eligible to receive assistance under the title IV, HEA programs; (8) If the institution places students on financial aid warning, or on financial aid probation, as defined in paragraph (b) of this section, the policy describes these statuses and that— (i) A student on financial aid warning may continue to receive assistance under the title IV, HEA programs for one payment period despite a determination that the student is not making satisfactory academic progress. Financial aid warning status may be assigned without an appeal or other action by the student; and (ii) A student on financial aid probation may receive title IV, HEA program funds for one payment period. While a student is on financial aid probation, the institution may require the student to fulfill specific terms and conditions such as taking a reduced course load or enrolling in specific courses. At the end of one payment period on financial aid probation, the student must meet the institution's satisfactory academic progress standards or meet the requirements of the academic plan developed by the institution and the student to qualify for further title IV, HEA program funds; (9) If the institution permits a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy describes— (i) How the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; (ii) The basis on which a student may file an appeal: The death of a relative, an injury or illness of the student, or other special circumstances; and (iii) Information the student must submit regarding why the student failed to make satisfactory academic progress, and what has changed in the student's situation that will allow the student to demonstrate satisfactory academic progress at the next evaluation; (10) If the institution does not permit a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy must describe how the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; and (11) The policy provides for notification to students of the results of an evaluation that impacts the student's eligibility for title IV, HEA program funds.” Condition: Bluefield State University (BSU), Fairmont State University (FSU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the satisfactory academic progress (SAP) policy. During our testing, we noted there was no documentation retained to evidence that a review of the SAP policy was performed to ensure compliance with federal regulations. Additionally, Blue Ridge Community College (BRCTC) and WVUP did not publish the most recent version of the SAP policy on their websites. Furthermore, WVSOM did not include reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policy as the related SAP polices excluded the required element #11 above. BRCTC had an appropriate policy, but they did not publish the most recent version of the policy on their website. The older version of the SAP policy that was published on their website did not include the required element #11 above. Cause: Management of BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP did not retain sufficient documentation for their review procedures over the SAP policy. Management of BRCTC and WVSOM did not include all reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policies. Effect or Potential Effect: The published SAP policy may be deemed insufficient for the compliance requirements. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP were $5,084,582, $7,651,688, $17,584,932, $93,991,163, $3,672,778, $16,726,007, $3,090,314, $44,681,370, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should ensure the SAP is reviewed and approved on an annual basis and supporting documentation of the review retained. Management should design and implement internal controls over the SAP policy to ensure all requirements are included in the policy appropriately and published on the institution’s website timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–019 SPECIAL TESTS AND PROVISIONS – GRAMM-LEACH-BLILEY ACT-STUDENT INFORMATION SECURITY (N12) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. At a minimum, an institution’s written information security program — (1) Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). (2) Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 3 14.4(b)). (3) Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 3 14.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: (i) Implement and periodically review access controls. (ii) Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. (iii) Encrypt customer information on the institution’s system and when it’s in transit. (iv) Assess apps developed by the institution (v) Implement multi-factor authentication for anyone accessing customer information on the institution’s system (vi) Dispose of customer information securely (vii) Anticipate and evaluate changes to the information system or network. (viii) Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. (4) Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). (5) Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). (6) Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). (7) Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Condition: Blue Ridge Community and Technical College (BRCTC), Concord University (CU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program for Bluefield University (BSU), CU, MU, NRCTC, Shepherd University (SU), WLU, WVNCC, West Virginia State University (WVSU) and WVUP did not address all required elements per 16 CFR 314.4 outlined above. Furthermore, Fairmont State University (FSU) and Pierpont Community and Technical College (PCTC) did not have a written Information Security Program. For FSU, the written Information Security Program was not in place until May 2023. Cause: Management of BRCTC, CU, MU, NRCTC, WLU, WVNCC, and WVUP did not retain sufficient documentation for their review procedures over the Information Security Program. Management of BSU, CU, MU, NRCTC, SU, WVNCC, and WVSU did not include all reasonable standards required for the Information Security Program. Management of FSU and PCTC did not have a written Information Security Program. Effect or Potential Effect: The written Information Security Program may not be compliant with federal regulations. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, CU, FSU, MU, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, and WVUP were $5,084,582, $7,651,688, $13,833,684, $17,584,932, $93,991,163, $3,672,778, $4,388,461, $15,171,851, $16,726,007, $3,090,314, $9,313,808, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–020 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – VERIFICATION (N1) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Fairmont State University (FSU) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing, we noted for the samples selected that there were multiple selections showing a lack of proper review in the verification process. Cause: FSU did not have adequate internal controls in place to ensure that verification changes identified were processed and submitted to the U.S. Department of Education. Effect or Potential Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Questioned Costs: N/A Context: We selected a sample of 23 students for FSU and identified 8 instances where the verification forms were not reviewed and approved. Total Student Financial Assistance Cluster expenditures for FSU were $17,584,932 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–015 and 2021–014 Recommendation: Management should develop and update internal controls to ensure that controls related to the verification process are implemented. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–021 BANNER INFORMATION TECHNOLOGY GENERAL CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The State of West Virginia did not implement all logical access and change management controls that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application instances at 12 of 15 universities / colleges. As a result, Banner ITGCs, and therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Across the 11 universities/colleges (Blue Ridge Community and Technical College, Bluefield State University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia University, West Virginia University at Parkersburg, and West Virginia State University), management did not have a formalized process to support access provisioning events were authorized, approved and documented. Additionally, documentation did not exist to support the timely revocation of access upon a user leaving the university / college. Further, a user access review for Banner was not performed to ensure access remains appropriate based on users’ job responsibilities. We also identified instances where privileged accounts to Banner were shared amongst users and password settings were not configured with leading industry standards. Specific to the change management process, a formalized and documented process was not consistently followed to support that Banner application and supporting infrastructure patches and releases were authorized, tested, and approved prior to being implemented to production. Effect or Potential Effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the student financial aid system may be inappropriately created or modified. Effective testing of the required logical access and change management controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned Costs: None Context: The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Documentation of the requestor, access rights requested, and approval should be defined and maintained for all new and modified Banner access requests. This documentation should allow for an audit trail of all new and transferred users ensuring that access was granted/removed from the Banner application. Additionally, segregation of duties should exist between the requestor/approver and grantor of the access. Management should remove the terminated user's access from the Banner application. Management should enhance the process of communicating terminated employees to ensure access is revoked or disabled timely. Management should ensure that a review of user access is performed on a periodic basis (e.g., annually) to ensure user access rights remain consistent with user job responsibilities. Review procedures should be performed for all users with access to the Banner application to determine access appropriateness. In addition, management should ensure that adequate documentation is maintained to provide evidence (i.e., sign-offs, hard-copy reports, etc.) of the review. Management should configure Banner password settings related to minimum length, complexity, expiration, history, and account lockout to enhance overall security. Further, privileged access to the Banner application should be granted to administrators via unique IDs to provide accountability and avoid the sharing of default privileged accounts. A formal, documented change process needs implemented to capture authorization, testing and production migration approvals for patches and releases to the Banner application and supporting infrastructure. This documentation should allow for an audit trail of all program changes ensuring that changes were appropriately authorized and administered. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–024 SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE (N3) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of federal student aid credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. Regulations at 34 CFR 668.164(e) and (f) establish two different types of arrangements between schools and financial account providers: Tier One arrangements and Tier Two arrangements. The type of arrangement determines the provisions that are applicable to the school. 34 CFR 668.164(e)(2)(viii) states under a T1 arrangement, the institution must “provide to the Secretary an up-to-date URL for the contract and contract data as described in paragraph (e)(2)(vii) of this section for publication in a centralized database accessible to the public.” 34 CFR 668.164(e)(2)(ix) states under a T1 arrangement, the institution must “ensure that the terms of the accounts offered pursuant to a T1 arrangement are not inconsistent with the best financial interests of the students opening them. The Secretary considers this requirement to be met if (A) The institution documents that it conducts reasonable due diligence reviews at least every two years to ascertain whether the fees imposed under the T1 arrangement are, considered as a whole, consistent with or below prevailing market rates; and (B) All contracts for the marketing or offering of accounts pursuant to T1 arrangements to the institution's students make provision for termination of the arrangement by the institution based on complaints received from students or a determination by the institution under paragraph (e)(2)(ix)(A) of this section that the fees assessed under the T1 arrangement are not consistent with or are higher than prevailing market rates.” 34 CFR 668.164(e)(2)(x) states under a T1 arrangement, the institution must “take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that requirements of this section are met with respect to all accounts offered pursuant to T1 arrangements.” Condition: Bluefield State University (BSU), Blueridge Community & Technical College (BRCTC), Concord University (CU), Mountwest Community & Technical College (MCTC), Shepherd University (SU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) have a T1 arrangement with a third-party servicer. BSU, CU, SU, WVNCC, and WVUP were unable to provide documentation showing that their institutions had submitted a URL to their contract with their third-party servicer and cost information related to their third-party servicer to the U.S. Department of Education for publication in the Cash Management Contracts Database. BSU, BRCTC, CU, MCTC, SU and WVNCC were unable to provide evidence showing that their institutions documented a due diligence review over the fees assessed by their third-party servicer of Title IV credit balances. Cause: BSU, BRCTC, CU, MCTC, SU, WVUP, and WVNCC did not have an internal control in place to review the contract with their third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. As such, instances of noncompliance were noted above. Effect or Potential Effect: The schools are not in compliance with certain federal regulations over T1 arrangements contained in 34 CFR 668.164(e). Questioned Costs: None Context: BSU, BRCTC, CU, MCTC, SU, WVNCC, and WVUP had total expenditures of $7,651,688, $5,084,582, $13,833,684, $4,467,631, $15,171,851, $3,090,314, and $6,847,451 respectively. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should implement internal controls over the review of the contract with their third-party servicer of Title IV credit balances and their Title IV compliance audit, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2) to ensure compliance with the federal regulations over T1 arrangements. Documentation over the specific items reviewed and conclusions reached should be retained to support the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–028 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF) ESF Section 1 – Elementary and Secondary Education COVID-19 84.425C COVID-19 84.425D Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission.” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: During our testing of Federal Funding Accountability and Transparency Act (FFATA) Reports, it was noted that eight (8) reports were not submitted by the State of West Virginia. In addition, for 1 of the 9 reports that was submitted, there was not adequate documentation to support an appropriate level of review and approval of the FFATA report. Cause: The original grant funding from the U.S. Department of Education was received by the Office of the Governors of the State of West Virginia. These funds were in turn passed through to the State of West Virginia Department of Education (WVDE) which subsequently passed through a portion of the funding to the Local Educational Agencies (subrecipients). WVDE did not notify the Office of the Governor that the monies were passed to subrecipients and the FAFTA report was not filed. In addition, documentation to support internal controls review was not provided for the 1 report that was submitted during the year. Effect or Potential Effect: The State of West Virginia did not report the necessary FFATA report for the Education Stabilization Fund first-tier subawards over $30,000 to the FFATA Subaward Reporting System. Questioned Costs: N/A Context: We tested 9 FFATA reports related to subawards with grant funding amount of $4,030,511. of which 8 FFATA reports were not submitted that totaled $2,750,250. The federal expenditures for the Education Stabilization Fund program for the fiscal year ended June 30, 2023 were $323,733,675. Identification as a Repeat Finding: Prior Year Finding 2022–025 Recommendation: We recommend that WVDE strengthen internal controls and procedures over communication with the Office of the Governor related to FFATA reporting to ensure they are in compliance with the federal reporting requirements. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–028 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF) ESF Section 1 – Elementary and Secondary Education COVID-19 84.425C COVID-19 84.425D Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission.” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: During our testing of Federal Funding Accountability and Transparency Act (FFATA) Reports, it was noted that eight (8) reports were not submitted by the State of West Virginia. In addition, for 1 of the 9 reports that was submitted, there was not adequate documentation to support an appropriate level of review and approval of the FFATA report. Cause: The original grant funding from the U.S. Department of Education was received by the Office of the Governors of the State of West Virginia. These funds were in turn passed through to the State of West Virginia Department of Education (WVDE) which subsequently passed through a portion of the funding to the Local Educational Agencies (subrecipients). WVDE did not notify the Office of the Governor that the monies were passed to subrecipients and the FAFTA report was not filed. In addition, documentation to support internal controls review was not provided for the 1 report that was submitted during the year. Effect or Potential Effect: The State of West Virginia did not report the necessary FFATA report for the Education Stabilization Fund first-tier subawards over $30,000 to the FFATA Subaward Reporting System. Questioned Costs: N/A Context: We tested 9 FFATA reports related to subawards with grant funding amount of $4,030,511. of which 8 FFATA reports were not submitted that totaled $2,750,250. The federal expenditures for the Education Stabilization Fund program for the fiscal year ended June 30, 2023 were $323,733,675. Identification as a Repeat Finding: Prior Year Finding 2022–025 Recommendation: We recommend that WVDE strengthen internal controls and procedures over communication with the Office of the Governor related to FFATA reporting to ensure they are in compliance with the federal reporting requirements. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–029 REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF), ESF Section 1 – Elementary and Secondary Education COVID-19 84.425D/84.425R/84.425U/84.425V, Grant Award S425R210008, Grant Award S425D210036, Grant Award S425U210036, Grant Award S425V210008 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the American Rescue Plan (ARP) Act and 34 CFR Part 76, grantees that receive Elementary and Secondary School Emergency Relief (ESSER) Fund, Governor’s Emergency Education Relief (GEER) Fund and Emergency Assistance to Nonpublic Schools (EANS) Program must submit an annual performance report with data on expenditures, planned expenditures, subrecipients, and uses of funds, including for mandatory reservations. Condition: Management did not provide evidence of the review and approval of the annual ESSER and EANS report. In addition, for the annual EANS report, documentation supporting the amounts reported was not provided. Cause: The Department of Education did not have sufficient internal controls over the review and approval of the annual ESSER and EANS reports. In addition, sufficient internal controls are not in place to require the maintenance of supporting documentation. Effect or Potential Effect: ESSER and EANS reports submitted could have incorrect or inaccurate data/amounts. Questioned Costs: N/A Context: The ESSER and the EANS annual reports submitted relate to year ended June 30, 2022. The total expenditures for the ARP ESSER and ARP EANS programs in fiscal year 2022 were $163,642,108 and $2,989,943, respectively. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend WVDE enforces the existing policies and procedures and retain documentation over review and approval of reports prior to submission. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–030 ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF), ESF Section 1 – Elementary and Secondary Education COVID-19 84.425D/84.425U; Grant Award – S425U210036, Grant Award – S425D210036, Grant Award – S425D200036 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the West Virginia Department of Education must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.403 requires that costs “be necessary and reasonable for the performance of the Federal award.” Costs should not consist of improper payments, including payments that were made to an ineligible party or for an ineligible good or service or payments for goods or services not received. Condition: The West Virginia Department of Education (WVDE) paid a Local Educational Agency invoice amounting to $566,340 for which the good or service was not received or was only partially received. Cause: WVDE paid invoices to a Local Educational Agency that has not followed the appropriate procurement procedures. Effect or Potential Effect: Unallowable expenditures may have been paid with federal funds. Questioned Costs: $566,340 Context: Total federal expenditures for the Education Stabilization Fund program were $323,733,675 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that WVDE strengthen its internal controls over subrecipient monitoring to ensure that all invoices are accurate and that costs are for appropriately procured and eligible good or service under the federal program. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–033 CASH MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF), ESF Section 2 – Higher Education, (Higher Education Emergency Relief Fund (HEERF)) COVID-19 84.425E, F, J; Grant Award P425J200063, Grant Award P425E201113, Grant Award P425F201736, Grant Award P425J200056 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” For CRRSAA, HEERF II and ARP HEERF III, the Certification and Agreements and/or Supplemental Agreements requires that Student Aid Portion (Assistance Listing 84.425E) should be disbursed within 15 calendar days of the drawdown from ED’s G5 grants system and Institutional Aid Portion, (a)(2), and (a)(3) funds (all other ALNs) should be disbursed within three calendar days of the drawdown from G5. For lost revenue, the “obligation” occurs on the date the institution completes its estimate of its amount of lost revenue after the estimation period. Condition: For three disbursement samples for Bluefield State College (BSC) we noted that the disbursements did not occur within 3 calendar days of the drawdown from ED’s G5 grants system. In addition, during our review of the schedule of expenditures of federal awards, we noted West Virginia State University (WVSU) had an ending cash balance of $397,412 at June 30, 2023. Cause: BSC incurred the expenses and performed the drawdown from the ED’s G5 grants system. Three of the expenses were paid by the State of West Virginia on behalf of Bluefield State College and these expenses were initially rejected by the State auditor and while subsequently resolved and paid, the timing caused the time lag between the drawdown date and the payment date to be outside of the allowed 3 calendar days. WVSU did not have adequate internal controls in place to ensure a thorough review of cash balance on hand was performed prior to performing drawdowns from the ED’s G5 grants system. Effect or Potential Effect: BSC was not incompliance with the requirement to disburse funds within 3 days of the drawdown from G5. WVSU has over drawn funds under the HEERF program resulting in an ending cash balance at June 30, 2023. Consequently, this resulted in a violation of the cash management rules. Questioned Costs: $397,412 (Grant Award No’s: P425E201113, P425F201736, P425J200056 Context: Total BSC expenditures for the HEERF were $5,959,981 and the total WVSU expenditures for the HEERF were $13,084,264 representing 1.8% and 4.0%, respectively of the total Education Stabilization Fund and HEERF (84.425) expenditures of $323,733,675 for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Finding 2022–024 Recommendation: Management of BSC and WVSU should enhance its internal controls to ensure funds are disbursed within the stipulated time frame and/or drawdown funds after the expenditures have been disbursed. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–032 INTERNAL CONTROLS OVER ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF), ESF Section 2 – Higher Education, (Higher Education Emergency Relief Fund (HEERF)) COVID-19 84.425F, Grant Award P425F201180 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of allowability at West Liberty University (WLU), we noted $1,017,478 was disbursed in student aid payments from the HEERF institutional funds. The detail report on student enrollment and outstanding balances was generated from Banner and downloaded into an excel file. WLU did not retain the detail Banner report or report parameters used to run the report, therefore, we could not support the completeness and accuracy of the report. In addition, in our allowability testing we noted 1 instance where the appropriate review and approval of the costs charged to the HEERF program was not noted. Cause: Management did not retain the supporting documentation for the detail Banner report on student enrollment or outstanding balances. For the 1 instance there was no documentation to support that the review of the expenditure for allowability was performed. Effect or Potential Effect: There is a risk that the report on student enrollment and outstanding balances generated from the Banner system is inaccurate or incomplete. This may further lead to improper amounts applied to the student’s accounts. In addition, lack of an appropriate review and approval of expenditures could potentially lead to unallowable costs charged to the program. Questioned Costs: None Context: Total HEERF expenditures for WLU was $3,298,313 for the year ended June 30, 2023. The total expenditures for the HEERF program for the year ended June 30, 2023 were $323,733,675. Identification as a Repeat Finding: Prior Year Finding 2022–023 Recommendation: We recommend Management retain the supporting Banner reports and report parameters to support the accuracy and completeness of the data. In addition, we recommend Management to document the review and approval of costs charged to the HEERF program. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–033 CASH MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF), ESF Section 2 – Higher Education, (Higher Education Emergency Relief Fund (HEERF)) COVID-19 84.425E, F, J; Grant Award P425J200063, Grant Award P425E201113, Grant Award P425F201736, Grant Award P425J200056 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” For CRRSAA, HEERF II and ARP HEERF III, the Certification and Agreements and/or Supplemental Agreements requires that Student Aid Portion (Assistance Listing 84.425E) should be disbursed within 15 calendar days of the drawdown from ED’s G5 grants system and Institutional Aid Portion, (a)(2), and (a)(3) funds (all other ALNs) should be disbursed within three calendar days of the drawdown from G5. For lost revenue, the “obligation” occurs on the date the institution completes its estimate of its amount of lost revenue after the estimation period. Condition: For three disbursement samples for Bluefield State College (BSC) we noted that the disbursements did not occur within 3 calendar days of the drawdown from ED’s G5 grants system. In addition, during our review of the schedule of expenditures of federal awards, we noted West Virginia State University (WVSU) had an ending cash balance of $397,412 at June 30, 2023. Cause: BSC incurred the expenses and performed the drawdown from the ED’s G5 grants system. Three of the expenses were paid by the State of West Virginia on behalf of Bluefield State College and these expenses were initially rejected by the State auditor and while subsequently resolved and paid, the timing caused the time lag between the drawdown date and the payment date to be outside of the allowed 3 calendar days. WVSU did not have adequate internal controls in place to ensure a thorough review of cash balance on hand was performed prior to performing drawdowns from the ED’s G5 grants system. Effect or Potential Effect: BSC was not incompliance with the requirement to disburse funds within 3 days of the drawdown from G5. WVSU has over drawn funds under the HEERF program resulting in an ending cash balance at June 30, 2023. Consequently, this resulted in a violation of the cash management rules. Questioned Costs: $397,412 (Grant Award No’s: P425E201113, P425F201736, P425J200056 Context: Total BSC expenditures for the HEERF were $5,959,981 and the total WVSU expenditures for the HEERF were $13,084,264 representing 1.8% and 4.0%, respectively of the total Education Stabilization Fund and HEERF (84.425) expenditures of $323,733,675 for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Finding 2022–024 Recommendation: Management of BSC and WVSU should enhance its internal controls to ensure funds are disbursed within the stipulated time frame and/or drawdown funds after the expenditures have been disbursed. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–031 INTERNAL CONTROLS OVER ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF), ESF Section 2 – Higher Education, (Higher Education Emergency Relief Fund (HEERF)) COVID-19 84.425J, Grant Award –P425J200056 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the West Virginia State University (WVSU) must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: In our testing of payroll expenditures charged to the HEERF, we noted 7 transactions for which the employee’s time sheets were not approved. Cause: WVSU does not have proper internal controls in place to ensure that timesheets are approved by the employee’s supervisor/manager. Effect or Potential Effect: Potentially incorrect or unallowable costs could be charged to the federal program. Questioned Costs: None Context: We tested a total of 40 payroll transactions (total costs of $91,515) for the WVSU and for 7 payroll transactions (totaling $19,645), timesheets were not approved by the employee’s supervisor or manager. Total payroll expenditures charged to HEERF in fiscal year 2023 was $8,706,376. The total expenditures for the HEERF program is $323,733,675 for the year ended June 30, 2023. Identification as a Repeat Finding: This finding is not a repeat finding from prior year. Recommendation: We recommend that WVSU strengthen its internal controls to ensure that all timesheets are approved to ensure allowable costs are charged under the federal program. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–033 CASH MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF), ESF Section 2 – Higher Education, (Higher Education Emergency Relief Fund (HEERF)) COVID-19 84.425E, F, J; Grant Award P425J200063, Grant Award P425E201113, Grant Award P425F201736, Grant Award P425J200056 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” For CRRSAA, HEERF II and ARP HEERF III, the Certification and Agreements and/or Supplemental Agreements requires that Student Aid Portion (Assistance Listing 84.425E) should be disbursed within 15 calendar days of the drawdown from ED’s G5 grants system and Institutional Aid Portion, (a)(2), and (a)(3) funds (all other ALNs) should be disbursed within three calendar days of the drawdown from G5. For lost revenue, the “obligation” occurs on the date the institution completes its estimate of its amount of lost revenue after the estimation period. Condition: For three disbursement samples for Bluefield State College (BSC) we noted that the disbursements did not occur within 3 calendar days of the drawdown from ED’s G5 grants system. In addition, during our review of the schedule of expenditures of federal awards, we noted West Virginia State University (WVSU) had an ending cash balance of $397,412 at June 30, 2023. Cause: BSC incurred the expenses and performed the drawdown from the ED’s G5 grants system. Three of the expenses were paid by the State of West Virginia on behalf of Bluefield State College and these expenses were initially rejected by the State auditor and while subsequently resolved and paid, the timing caused the time lag between the drawdown date and the payment date to be outside of the allowed 3 calendar days. WVSU did not have adequate internal controls in place to ensure a thorough review of cash balance on hand was performed prior to performing drawdowns from the ED’s G5 grants system. Effect or Potential Effect: BSC was not incompliance with the requirement to disburse funds within 3 days of the drawdown from G5. WVSU has over drawn funds under the HEERF program resulting in an ending cash balance at June 30, 2023. Consequently, this resulted in a violation of the cash management rules. Questioned Costs: $397,412 (Grant Award No’s: P425E201113, P425F201736, P425J200056 Context: Total BSC expenditures for the HEERF were $5,959,981 and the total WVSU expenditures for the HEERF were $13,084,264 representing 1.8% and 4.0%, respectively of the total Education Stabilization Fund and HEERF (84.425) expenditures of $323,733,675 for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Finding 2022–024 Recommendation: Management of BSC and WVSU should enhance its internal controls to ensure funds are disbursed within the stipulated time frame and/or drawdown funds after the expenditures have been disbursed. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–029 REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF), ESF Section 1 – Elementary and Secondary Education COVID-19 84.425D/84.425R/84.425U/84.425V, Grant Award S425R210008, Grant Award S425D210036, Grant Award S425U210036, Grant Award S425V210008 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the American Rescue Plan (ARP) Act and 34 CFR Part 76, grantees that receive Elementary and Secondary School Emergency Relief (ESSER) Fund, Governor’s Emergency Education Relief (GEER) Fund and Emergency Assistance to Nonpublic Schools (EANS) Program must submit an annual performance report with data on expenditures, planned expenditures, subrecipients, and uses of funds, including for mandatory reservations. Condition: Management did not provide evidence of the review and approval of the annual ESSER and EANS report. In addition, for the annual EANS report, documentation supporting the amounts reported was not provided. Cause: The Department of Education did not have sufficient internal controls over the review and approval of the annual ESSER and EANS reports. In addition, sufficient internal controls are not in place to require the maintenance of supporting documentation. Effect or Potential Effect: ESSER and EANS reports submitted could have incorrect or inaccurate data/amounts. Questioned Costs: N/A Context: The ESSER and the EANS annual reports submitted relate to year ended June 30, 2022. The total expenditures for the ARP ESSER and ARP EANS programs in fiscal year 2022 were $163,642,108 and $2,989,943, respectively. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend WVDE enforces the existing policies and procedures and retain documentation over review and approval of reports prior to submission. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–027 MAINTENANCE OF EFFORT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF) COVID-19 84.425U, Grant Award S425D210036, Grant Award S425V210008, Grant Award S425U210036, Grant Award S425U210036 – 21A, Grant Award S425W210050 – 21A, Grant Award S425D200036 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under section 317 of the Coronavirus Response and Relief Supplemental Appropriation (CRRSA) Act, for fiscal year 2022, a state that receives Elementary and Secondary School Emergency Relief (ESSER) II, Governor’s Emergency Education Relief (GEER) II, or Emergency Assistance to Nonpublic Schools (EANS) funds under the CRRSA Act must: a) Maintain State support for elementary and secondary education in fiscal year 2022 at least at the proportional level of the state’s support for elementary and secondary education relative to the state’s overall spending, averaged over fiscal years 2017, 2018, and 2019; and b) Maintain state support for higher education in fiscal year 2022 at least at the proportional level of the state’s support for higher education relative to the state’s overall spending, averaged over fiscal years 2017, 2018, and 2019. Under section 2004(a) of the American Rescue Plan (ARP) Act, a state that receives ARP ESSER funds must meet the above Maintenance of Effort (MOE) requirement in each of fiscal years 2022 and 2023. Condition: The Department of Education did not provide the calculations to support meeting the maintenance of effort provisions for fiscal year 2023. Cause: The Department of Education did not provide the documentation and calculations supporting the maintenance of effort for fiscal year 2023. The calculations are performed by the State Budget Office and the calculations have not been prepared as of the date of the audit report. The Department of Education had previously requested a waiver from the provisions but did not receive approval specific to fiscal year 2023. Effect or Potential Effect: The ESF did not meet the maintenance of effort requirement. Questioned Costs: N/A Context: Total federal expenditures for the ESF program for the fiscal year ended June 30, 2023, were $323,733,675. Identification as a Repeat Finding: Prior Year Finding 2022-021 Recommendation: The West Virginia Department of Education management and the State Legislative officials need to implement procedures to ensure adequate appropriations are made to meet the maintenance of effort requirements. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–029 REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF), ESF Section 1 – Elementary and Secondary Education COVID-19 84.425D/84.425R/84.425U/84.425V, Grant Award S425R210008, Grant Award S425D210036, Grant Award S425U210036, Grant Award S425V210008 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the American Rescue Plan (ARP) Act and 34 CFR Part 76, grantees that receive Elementary and Secondary School Emergency Relief (ESSER) Fund, Governor’s Emergency Education Relief (GEER) Fund and Emergency Assistance to Nonpublic Schools (EANS) Program must submit an annual performance report with data on expenditures, planned expenditures, subrecipients, and uses of funds, including for mandatory reservations. Condition: Management did not provide evidence of the review and approval of the annual ESSER and EANS report. In addition, for the annual EANS report, documentation supporting the amounts reported was not provided. Cause: The Department of Education did not have sufficient internal controls over the review and approval of the annual ESSER and EANS reports. In addition, sufficient internal controls are not in place to require the maintenance of supporting documentation. Effect or Potential Effect: ESSER and EANS reports submitted could have incorrect or inaccurate data/amounts. Questioned Costs: N/A Context: The ESSER and the EANS annual reports submitted relate to year ended June 30, 2022. The total expenditures for the ARP ESSER and ARP EANS programs in fiscal year 2022 were $163,642,108 and $2,989,943, respectively. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend WVDE enforces the existing policies and procedures and retain documentation over review and approval of reports prior to submission. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–030 ACTIVITIES ALLOWED OR UNALLOWED AND ALLOWABLE COSTS/COST PRINCIPLES Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF), ESF Section 1 – Elementary and Secondary Education COVID-19 84.425D/84.425U; Grant Award – S425U210036, Grant Award – S425D210036, Grant Award – S425D200036 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the West Virginia Department of Education must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.403 requires that costs “be necessary and reasonable for the performance of the Federal award.” Costs should not consist of improper payments, including payments that were made to an ineligible party or for an ineligible good or service or payments for goods or services not received. Condition: The West Virginia Department of Education (WVDE) paid a Local Educational Agency invoice amounting to $566,340 for which the good or service was not received or was only partially received. Cause: WVDE paid invoices to a Local Educational Agency that has not followed the appropriate procurement procedures. Effect or Potential Effect: Unallowable expenditures may have been paid with federal funds. Questioned Costs: $566,340 Context: Total federal expenditures for the Education Stabilization Fund program were $323,733,675 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that WVDE strengthen its internal controls over subrecipient monitoring to ensure that all invoices are accurate and that costs are for appropriately procured and eligible good or service under the federal program. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–029 REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF), ESF Section 1 – Elementary and Secondary Education COVID-19 84.425D/84.425R/84.425U/84.425V, Grant Award S425R210008, Grant Award S425D210036, Grant Award S425U210036, Grant Award S425V210008 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the American Rescue Plan (ARP) Act and 34 CFR Part 76, grantees that receive Elementary and Secondary School Emergency Relief (ESSER) Fund, Governor’s Emergency Education Relief (GEER) Fund and Emergency Assistance to Nonpublic Schools (EANS) Program must submit an annual performance report with data on expenditures, planned expenditures, subrecipients, and uses of funds, including for mandatory reservations. Condition: Management did not provide evidence of the review and approval of the annual ESSER and EANS report. In addition, for the annual EANS report, documentation supporting the amounts reported was not provided. Cause: The Department of Education did not have sufficient internal controls over the review and approval of the annual ESSER and EANS reports. In addition, sufficient internal controls are not in place to require the maintenance of supporting documentation. Effect or Potential Effect: ESSER and EANS reports submitted could have incorrect or inaccurate data/amounts. Questioned Costs: N/A Context: The ESSER and the EANS annual reports submitted relate to year ended June 30, 2022. The total expenditures for the ARP ESSER and ARP EANS programs in fiscal year 2022 were $163,642,108 and $2,989,943, respectively. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend WVDE enforces the existing policies and procedures and retain documentation over review and approval of reports prior to submission. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–017 SPECIAL TESTS AND PROVISIONS – SATISFACTORY ACADEMIC PROGRESS (N9) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.16(e) states: “For purposes of determining student eligibility for assistance under a title IV, HEA program, establishes, publishes, and applies reasonable standards for measuring whether an otherwise eligible student is maintaining satisfactory academic progress in his or her educational program. The Secretary considers an institution's standards to be reasonable if the standards are in accordance with the provisions specified in § 668.34.” 34 CFR 668.34 states: “An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs. The Secretary considers the institution's policy to be reasonable if— (1) The policy is at least as strict as the policy the institution applies to a student who is not receiving assistance under the title IV, HEA programs; (2) The policy provides for consistent application of standards to all students within categories of students, e.g., full-time, part-time, undergraduate, and graduate students, and educational programs established by the institution; (3) The policy provides that a student's academic progress is evaluated— (i) At the end of each payment period if the educational program is either one academic year in length or shorter than an academic year; or (ii) For all other educational programs, at the end of each payment period or at least annually to correspond with the end of a payment period; (4) (i) The policy specifies the grade point average (GPA) that a student must achieve at each evaluation, or if a GPA is not an appropriate qualitative measure, a comparable assessment measured against a norm; and (ii) If a student is enrolled in an educational program of more than two academic years, the policy specifies that at the end of the second academic year, the student must have a GPA of at least a “C” or its equivalent, or have academic standing consistent with the institution's requirements for graduation; (5) The policy specifies— (i) For all programs, the maximum timeframe as defined in paragraph (b) of this section; and (ii) For a credit hour program using standard or nonstandard terms that is not a subscription-based program, the pace, measured at each evaluation, at which a student must progress through his or her educational program to ensure that the student will complete the program within the maximum timeframe, calculated by either dividing the cumulative number of hours the student has successfully completed by the cumulative number of hours the student has attempted or by determining the number of hours that the student should have completed by the evaluation point in order to complete the program within the maximum timeframe. In making this calculation, the institution is not required to include remedial courses; (6) The policy describes how a student's GPA and pace of completion are affected by course incompletes, withdrawals, or repetitions, or transfers of credit from other institutions. Credit hours from another institution that are accepted toward the student's educational program must count as both attempted and completed hours; (7) Except as provided in paragraphs (c) and (d) of this section, the policy provides that, at the time of each evaluation, a student who has not achieved the required GPA, or who is not successfully completing his or her educational program at the required pace, is no longer eligible to receive assistance under the title IV, HEA programs; (8) If the institution places students on financial aid warning, or on financial aid probation, as defined in paragraph (b) of this section, the policy describes these statuses and that— (i) A student on financial aid warning may continue to receive assistance under the title IV, HEA programs for one payment period despite a determination that the student is not making satisfactory academic progress. Financial aid warning status may be assigned without an appeal or other action by the student; and (ii) A student on financial aid probation may receive title IV, HEA program funds for one payment period. While a student is on financial aid probation, the institution may require the student to fulfill specific terms and conditions such as taking a reduced course load or enrolling in specific courses. At the end of one payment period on financial aid probation, the student must meet the institution's satisfactory academic progress standards or meet the requirements of the academic plan developed by the institution and the student to qualify for further title IV, HEA program funds; (9) If the institution permits a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy describes— (i) How the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; (ii) The basis on which a student may file an appeal: The death of a relative, an injury or illness of the student, or other special circumstances; and (iii) Information the student must submit regarding why the student failed to make satisfactory academic progress, and what has changed in the student's situation that will allow the student to demonstrate satisfactory academic progress at the next evaluation; (10) If the institution does not permit a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy must describe how the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; and (11) The policy provides for notification to students of the results of an evaluation that impacts the student's eligibility for title IV, HEA program funds.” Condition: Bluefield State University (BSU), Fairmont State University (FSU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the satisfactory academic progress (SAP) policy. During our testing, we noted there was no documentation retained to evidence that a review of the SAP policy was performed to ensure compliance with federal regulations. Additionally, Blue Ridge Community College (BRCTC) and WVUP did not publish the most recent version of the SAP policy on their websites. Furthermore, WVSOM did not include reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policy as the related SAP polices excluded the required element #11 above. BRCTC had an appropriate policy, but they did not publish the most recent version of the policy on their website. The older version of the SAP policy that was published on their website did not include the required element #11 above. Cause: Management of BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP did not retain sufficient documentation for their review procedures over the SAP policy. Management of BRCTC and WVSOM did not include all reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policies. Effect or Potential Effect: The published SAP policy may be deemed insufficient for the compliance requirements. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP were $5,084,582, $7,651,688, $17,584,932, $93,991,163, $3,672,778, $16,726,007, $3,090,314, $44,681,370, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should ensure the SAP is reviewed and approved on an annual basis and supporting documentation of the review retained. Management should design and implement internal controls over the SAP policy to ensure all requirements are included in the policy appropriately and published on the institution’s website timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–019 SPECIAL TESTS AND PROVISIONS – GRAMM-LEACH-BLILEY ACT-STUDENT INFORMATION SECURITY (N12) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. At a minimum, an institution’s written information security program — (1) Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). (2) Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 3 14.4(b)). (3) Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 3 14.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: (i) Implement and periodically review access controls. (ii) Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. (iii) Encrypt customer information on the institution’s system and when it’s in transit. (iv) Assess apps developed by the institution (v) Implement multi-factor authentication for anyone accessing customer information on the institution’s system (vi) Dispose of customer information securely (vii) Anticipate and evaluate changes to the information system or network. (viii) Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. (4) Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). (5) Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). (6) Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). (7) Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Condition: Blue Ridge Community and Technical College (BRCTC), Concord University (CU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program for Bluefield University (BSU), CU, MU, NRCTC, Shepherd University (SU), WLU, WVNCC, West Virginia State University (WVSU) and WVUP did not address all required elements per 16 CFR 314.4 outlined above. Furthermore, Fairmont State University (FSU) and Pierpont Community and Technical College (PCTC) did not have a written Information Security Program. For FSU, the written Information Security Program was not in place until May 2023. Cause: Management of BRCTC, CU, MU, NRCTC, WLU, WVNCC, and WVUP did not retain sufficient documentation for their review procedures over the Information Security Program. Management of BSU, CU, MU, NRCTC, SU, WVNCC, and WVSU did not include all reasonable standards required for the Information Security Program. Management of FSU and PCTC did not have a written Information Security Program. Effect or Potential Effect: The written Information Security Program may not be compliant with federal regulations. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, CU, FSU, MU, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, and WVUP were $5,084,582, $7,651,688, $13,833,684, $17,584,932, $93,991,163, $3,672,778, $4,388,461, $15,171,851, $16,726,007, $3,090,314, $9,313,808, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–020 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – VERIFICATION (N1) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Fairmont State University (FSU) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing, we noted for the samples selected that there were multiple selections showing a lack of proper review in the verification process. Cause: FSU did not have adequate internal controls in place to ensure that verification changes identified were processed and submitted to the U.S. Department of Education. Effect or Potential Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Questioned Costs: N/A Context: We selected a sample of 23 students for FSU and identified 8 instances where the verification forms were not reviewed and approved. Total Student Financial Assistance Cluster expenditures for FSU were $17,584,932 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–015 and 2021–014 Recommendation: Management should develop and update internal controls to ensure that controls related to the verification process are implemented. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–021 BANNER INFORMATION TECHNOLOGY GENERAL CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The State of West Virginia did not implement all logical access and change management controls that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application instances at 12 of 15 universities / colleges. As a result, Banner ITGCs, and therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Across the 11 universities/colleges (Blue Ridge Community and Technical College, Bluefield State University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia University, West Virginia University at Parkersburg, and West Virginia State University), management did not have a formalized process to support access provisioning events were authorized, approved and documented. Additionally, documentation did not exist to support the timely revocation of access upon a user leaving the university / college. Further, a user access review for Banner was not performed to ensure access remains appropriate based on users’ job responsibilities. We also identified instances where privileged accounts to Banner were shared amongst users and password settings were not configured with leading industry standards. Specific to the change management process, a formalized and documented process was not consistently followed to support that Banner application and supporting infrastructure patches and releases were authorized, tested, and approved prior to being implemented to production. Effect or Potential Effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the student financial aid system may be inappropriately created or modified. Effective testing of the required logical access and change management controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned Costs: None Context: The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Documentation of the requestor, access rights requested, and approval should be defined and maintained for all new and modified Banner access requests. This documentation should allow for an audit trail of all new and transferred users ensuring that access was granted/removed from the Banner application. Additionally, segregation of duties should exist between the requestor/approver and grantor of the access. Management should remove the terminated user's access from the Banner application. Management should enhance the process of communicating terminated employees to ensure access is revoked or disabled timely. Management should ensure that a review of user access is performed on a periodic basis (e.g., annually) to ensure user access rights remain consistent with user job responsibilities. Review procedures should be performed for all users with access to the Banner application to determine access appropriateness. In addition, management should ensure that adequate documentation is maintained to provide evidence (i.e., sign-offs, hard-copy reports, etc.) of the review. Management should configure Banner password settings related to minimum length, complexity, expiration, history, and account lockout to enhance overall security. Further, privileged access to the Banner application should be granted to administrators via unique IDs to provide accountability and avoid the sharing of default privileged accounts. A formal, documented change process needs implemented to capture authorization, testing and production migration approvals for patches and releases to the Banner application and supporting infrastructure. This documentation should allow for an audit trail of all program changes ensuring that changes were appropriately authorized and administered. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–024 SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE (N3) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of federal student aid credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. Regulations at 34 CFR 668.164(e) and (f) establish two different types of arrangements between schools and financial account providers: Tier One arrangements and Tier Two arrangements. The type of arrangement determines the provisions that are applicable to the school. 34 CFR 668.164(e)(2)(viii) states under a T1 arrangement, the institution must “provide to the Secretary an up-to-date URL for the contract and contract data as described in paragraph (e)(2)(vii) of this section for publication in a centralized database accessible to the public.” 34 CFR 668.164(e)(2)(ix) states under a T1 arrangement, the institution must “ensure that the terms of the accounts offered pursuant to a T1 arrangement are not inconsistent with the best financial interests of the students opening them. The Secretary considers this requirement to be met if (A) The institution documents that it conducts reasonable due diligence reviews at least every two years to ascertain whether the fees imposed under the T1 arrangement are, considered as a whole, consistent with or below prevailing market rates; and (B) All contracts for the marketing or offering of accounts pursuant to T1 arrangements to the institution's students make provision for termination of the arrangement by the institution based on complaints received from students or a determination by the institution under paragraph (e)(2)(ix)(A) of this section that the fees assessed under the T1 arrangement are not consistent with or are higher than prevailing market rates.” 34 CFR 668.164(e)(2)(x) states under a T1 arrangement, the institution must “take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that requirements of this section are met with respect to all accounts offered pursuant to T1 arrangements.” Condition: Bluefield State University (BSU), Blueridge Community & Technical College (BRCTC), Concord University (CU), Mountwest Community & Technical College (MCTC), Shepherd University (SU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) have a T1 arrangement with a third-party servicer. BSU, CU, SU, WVNCC, and WVUP were unable to provide documentation showing that their institutions had submitted a URL to their contract with their third-party servicer and cost information related to their third-party servicer to the U.S. Department of Education for publication in the Cash Management Contracts Database. BSU, BRCTC, CU, MCTC, SU and WVNCC were unable to provide evidence showing that their institutions documented a due diligence review over the fees assessed by their third-party servicer of Title IV credit balances. Cause: BSU, BRCTC, CU, MCTC, SU, WVUP, and WVNCC did not have an internal control in place to review the contract with their third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. As such, instances of noncompliance were noted above. Effect or Potential Effect: The schools are not in compliance with certain federal regulations over T1 arrangements contained in 34 CFR 668.164(e). Questioned Costs: None Context: BSU, BRCTC, CU, MCTC, SU, WVNCC, and WVUP had total expenditures of $7,651,688, $5,084,582, $13,833,684, $4,467,631, $15,171,851, $3,090,314, and $6,847,451 respectively. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should implement internal controls over the review of the contract with their third-party servicer of Title IV credit balances and their Title IV compliance audit, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2) to ensure compliance with the federal regulations over T1 arrangements. Documentation over the specific items reviewed and conclusions reached should be retained to support the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–004 INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR 93.788, Grant Award 1H79TI085744-01, Grant Award 1H79TI083313-01, Grant Award 6H79TI083313-02M002, Grant Award 6H79TI083313-02M004, Grant Award 5H79TI083313-02 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04, Child Care and Development Fund (CCDF) Cluster 93.575/93.596/COVID-19 93.575, Grant Award G2201WVCCDF, Grant Award G2301WVCCDF Temporary Assistance for Needy Families 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our internal control testing of subrecipient monitoring, we determined that the subrecipient risk assessment performed did not clearly conclude the level of risk assessed (Low, Medium, High) for each subrecipient. Cause: The internal controls over subrecipient monitoring are not designed sufficiently to require a conclusion to be reached on a subrecipient’s risk assessment to determine the level of monitoring required to be performed. Effect or Potential Effect: Subrecipients may not be properly risk assessed; therefore, impacting the type and amount of monitoring that would be performed in the future. Questioned Costs: N/A Context: The federal expenditures and subrecipient expenditures for the Opioid STR program for the fiscal year ended June 30, 2023, were $34,877,309 and $32,388,417, respectively. The federal expenditures and subrecipient expenditures for the Child Care and Development Fund (CCDF Cluster) for the fiscal year ended June 30, 2023, were $202,427,780 and $45,239,361, respectively. The federal expenditures and subrecipient expenditures for the Temporary Assistance for Needy Families for the fiscal year ended June 30, 2023, were $85,510,454, and $18,789,521, respectively. Identification as a Repeat Finding: Prior Year Finding 2022–041 Recommendation: We recommend that DHHR management review its internal controls over the risk assessment process to perform the risk assessment and conclude on the level of risk and monitoring required. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–034 SUBRECIPIENT CASH MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.305(b)(1) requires that the non-federal entity must “monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the federal award to the recipient.” Per DHHR policy, the Spending Unit shall limit cash advances to a subrecipient to the minimum amounts needed and be timed in accordance with the actual, immediate cash requirements of the subrecipient for carrying out the purpose of the approved program or project. The timing and amount of cash advances shall be as close as is administratively feasible to the actual disbursements by the subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. Condition: During our testing of Epidemiology and Laboratory Capacity for Infectious Diseases, the West Virginia Department of Health and Human Resources (DHHR) was unable to provide adequate documentation supporting why a subrecipient drawdown was approved for payment for 1 of the 36 drawdowns selected for testing. The supporting documentation for the draw down showed less expenses than the amount that had been drawn down to date on the grants and also showed the subrecipient appeared to have adequate cash balances on hand at the time of the request. Cause: Supporting documentation was not retained to demonstrate cash advances to the subrecipient represented the minimum amount needed for actual and immediate cash requirements of the subrecipient for carrying out the purpose of the program. Effect or Potential Effect: The cash remitted to the subrecipient may not be accurate and may be in excess of the subrecipients actual and immediate cash requirements for carrying out the purpose of the program. Questioned Costs: $77,063 Context: The total subrecipient drawdowns selected for testing was $1,879,150. The total amount of subrecipient drawdowns for the Epidemiology program during FY23 was $7,478,038. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that DHHR establish policies and procedures requiring documentation from subrecipients substantiating that the amount of a drawdown is appropriate based on the expenditures through the request date so that the reconciliation preformed for the related drawdown is sufficient to determine that the drawdown is appropriate and excess cash is not remitted to the subrecipient. View of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–058 EQUIPMENT AND REAL PROPERTY MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.313(b) requires a state use, manage and dispose of equipment acquired under a Federal award by the state in accordance with state laws and procedures. According to State Policy, “All agencies are required to take a physical inventory once every three years, and shall have completed such physical inventory by June 30th of the relevant year. The physical inventory shall include viewing of all Reportable Assets under the agency’s jurisdiction. The head of every spending unit of state government shall, on or before the fifteenth day of July of each year, file with the Purchasing Division director an inventory of all real and personal property, and of all equipment, supplies and commodities in its possession as of the close of the last fiscal year as stated in West Virginia Code §5A-3-35. Condition: During our testing of Epidemiology and Laboratory Capacity for Infectious Diseases, the West Virginia Department of Health and Human Resources (DHHR) was unable to provide adequate documentation supporting the most recent physical inventory of fixed assets for the agency. Cause: Adequate documentation supporting compliance with the State’s policies regarding physical inventory was not provided. Effect or Potential Effect: The Epidemiology and Laboratory Capacity for Infectious Diseases Program may not be in compliance with the requirements of F. Equipment & Real Property Management. Questioned Costs: Unknown Context: The total expenditures for the year ended June 30, 2023 were $23,002,255. Total equipment purchases for FY 2023 were $2,533,124. Identification as a Repeat Finding: This is not a repeat finding from prior year. Recommendation: We recommend that DHHR follow the State’s established policies and maintain documentation evidencing the internal control and oversight of fixed asset management. View of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–004 INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR 93.788, Grant Award 1H79TI085744-01, Grant Award 1H79TI083313-01, Grant Award 6H79TI083313-02M002, Grant Award 6H79TI083313-02M004, Grant Award 5H79TI083313-02 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04, Child Care and Development Fund (CCDF) Cluster 93.575/93.596/COVID-19 93.575, Grant Award G2201WVCCDF, Grant Award G2301WVCCDF Temporary Assistance for Needy Families 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our internal control testing of subrecipient monitoring, we determined that the subrecipient risk assessment performed did not clearly conclude the level of risk assessed (Low, Medium, High) for each subrecipient. Cause: The internal controls over subrecipient monitoring are not designed sufficiently to require a conclusion to be reached on a subrecipient’s risk assessment to determine the level of monitoring required to be performed. Effect or Potential Effect: Subrecipients may not be properly risk assessed; therefore, impacting the type and amount of monitoring that would be performed in the future. Questioned Costs: N/A Context: The federal expenditures and subrecipient expenditures for the Opioid STR program for the fiscal year ended June 30, 2023, were $34,877,309 and $32,388,417, respectively. The federal expenditures and subrecipient expenditures for the Child Care and Development Fund (CCDF Cluster) for the fiscal year ended June 30, 2023, were $202,427,780 and $45,239,361, respectively. The federal expenditures and subrecipient expenditures for the Temporary Assistance for Needy Families for the fiscal year ended June 30, 2023, were $85,510,454, and $18,789,521, respectively. Identification as a Repeat Finding: Prior Year Finding 2022–041 Recommendation: We recommend that DHHR management review its internal controls over the risk assessment process to perform the risk assessment and conclude on the level of risk and monitoring required. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–034 SUBRECIPIENT CASH MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.305(b)(1) requires that the non-federal entity must “monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the federal award to the recipient.” Per DHHR policy, the Spending Unit shall limit cash advances to a subrecipient to the minimum amounts needed and be timed in accordance with the actual, immediate cash requirements of the subrecipient for carrying out the purpose of the approved program or project. The timing and amount of cash advances shall be as close as is administratively feasible to the actual disbursements by the subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. Condition: During our testing of Epidemiology and Laboratory Capacity for Infectious Diseases, the West Virginia Department of Health and Human Resources (DHHR) was unable to provide adequate documentation supporting why a subrecipient drawdown was approved for payment for 1 of the 36 drawdowns selected for testing. The supporting documentation for the draw down showed less expenses than the amount that had been drawn down to date on the grants and also showed the subrecipient appeared to have adequate cash balances on hand at the time of the request. Cause: Supporting documentation was not retained to demonstrate cash advances to the subrecipient represented the minimum amount needed for actual and immediate cash requirements of the subrecipient for carrying out the purpose of the program. Effect or Potential Effect: The cash remitted to the subrecipient may not be accurate and may be in excess of the subrecipients actual and immediate cash requirements for carrying out the purpose of the program. Questioned Costs: $77,063 Context: The total subrecipient drawdowns selected for testing was $1,879,150. The total amount of subrecipient drawdowns for the Epidemiology program during FY23 was $7,478,038. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that DHHR establish policies and procedures requiring documentation from subrecipients substantiating that the amount of a drawdown is appropriate based on the expenditures through the request date so that the reconciliation preformed for the related drawdown is sufficient to determine that the drawdown is appropriate and excess cash is not remitted to the subrecipient. View of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–058 EQUIPMENT AND REAL PROPERTY MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.313(b) requires a state use, manage and dispose of equipment acquired under a Federal award by the state in accordance with state laws and procedures. According to State Policy, “All agencies are required to take a physical inventory once every three years, and shall have completed such physical inventory by June 30th of the relevant year. The physical inventory shall include viewing of all Reportable Assets under the agency’s jurisdiction. The head of every spending unit of state government shall, on or before the fifteenth day of July of each year, file with the Purchasing Division director an inventory of all real and personal property, and of all equipment, supplies and commodities in its possession as of the close of the last fiscal year as stated in West Virginia Code §5A-3-35. Condition: During our testing of Epidemiology and Laboratory Capacity for Infectious Diseases, the West Virginia Department of Health and Human Resources (DHHR) was unable to provide adequate documentation supporting the most recent physical inventory of fixed assets for the agency. Cause: Adequate documentation supporting compliance with the State’s policies regarding physical inventory was not provided. Effect or Potential Effect: The Epidemiology and Laboratory Capacity for Infectious Diseases Program may not be in compliance with the requirements of F. Equipment & Real Property Management. Questioned Costs: Unknown Context: The total expenditures for the year ended June 30, 2023 were $23,002,255. Total equipment purchases for FY 2023 were $2,533,124. Identification as a Repeat Finding: This is not a repeat finding from prior year. Recommendation: We recommend that DHHR follow the State’s established policies and maintain documentation evidencing the internal control and oversight of fixed asset management. View of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.
2023–017 SPECIAL TESTS AND PROVISIONS – SATISFACTORY ACADEMIC PROGRESS (N9) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.16(e) states: “For purposes of determining student eligibility for assistance under a title IV, HEA program, establishes, publishes, and applies reasonable standards for measuring whether an otherwise eligible student is maintaining satisfactory academic progress in his or her educational program. The Secretary considers an institution's standards to be reasonable if the standards are in accordance with the provisions specified in § 668.34.” 34 CFR 668.34 states: “An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs. The Secretary considers the institution's policy to be reasonable if— (1) The policy is at least as strict as the policy the institution applies to a student who is not receiving assistance under the title IV, HEA programs; (2) The policy provides for consistent application of standards to all students within categories of students, e.g., full-time, part-time, undergraduate, and graduate students, and educational programs established by the institution; (3) The policy provides that a student's academic progress is evaluated— (i) At the end of each payment period if the educational program is either one academic year in length or shorter than an academic year; or (ii) For all other educational programs, at the end of each payment period or at least annually to correspond with the end of a payment period; (4) (i) The policy specifies the grade point average (GPA) that a student must achieve at each evaluation, or if a GPA is not an appropriate qualitative measure, a comparable assessment measured against a norm; and (ii) If a student is enrolled in an educational program of more than two academic years, the policy specifies that at the end of the second academic year, the student must have a GPA of at least a “C” or its equivalent, or have academic standing consistent with the institution's requirements for graduation; (5) The policy specifies— (i) For all programs, the maximum timeframe as defined in paragraph (b) of this section; and (ii) For a credit hour program using standard or nonstandard terms that is not a subscription-based program, the pace, measured at each evaluation, at which a student must progress through his or her educational program to ensure that the student will complete the program within the maximum timeframe, calculated by either dividing the cumulative number of hours the student has successfully completed by the cumulative number of hours the student has attempted or by determining the number of hours that the student should have completed by the evaluation point in order to complete the program within the maximum timeframe. In making this calculation, the institution is not required to include remedial courses; (6) The policy describes how a student's GPA and pace of completion are affected by course incompletes, withdrawals, or repetitions, or transfers of credit from other institutions. Credit hours from another institution that are accepted toward the student's educational program must count as both attempted and completed hours; (7) Except as provided in paragraphs (c) and (d) of this section, the policy provides that, at the time of each evaluation, a student who has not achieved the required GPA, or who is not successfully completing his or her educational program at the required pace, is no longer eligible to receive assistance under the title IV, HEA programs; (8) If the institution places students on financial aid warning, or on financial aid probation, as defined in paragraph (b) of this section, the policy describes these statuses and that— (i) A student on financial aid warning may continue to receive assistance under the title IV, HEA programs for one payment period despite a determination that the student is not making satisfactory academic progress. Financial aid warning status may be assigned without an appeal or other action by the student; and (ii) A student on financial aid probation may receive title IV, HEA program funds for one payment period. While a student is on financial aid probation, the institution may require the student to fulfill specific terms and conditions such as taking a reduced course load or enrolling in specific courses. At the end of one payment period on financial aid probation, the student must meet the institution's satisfactory academic progress standards or meet the requirements of the academic plan developed by the institution and the student to qualify for further title IV, HEA program funds; (9) If the institution permits a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy describes— (i) How the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; (ii) The basis on which a student may file an appeal: The death of a relative, an injury or illness of the student, or other special circumstances; and (iii) Information the student must submit regarding why the student failed to make satisfactory academic progress, and what has changed in the student's situation that will allow the student to demonstrate satisfactory academic progress at the next evaluation; (10) If the institution does not permit a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy must describe how the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; and (11) The policy provides for notification to students of the results of an evaluation that impacts the student's eligibility for title IV, HEA program funds.” Condition: Bluefield State University (BSU), Fairmont State University (FSU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the satisfactory academic progress (SAP) policy. During our testing, we noted there was no documentation retained to evidence that a review of the SAP policy was performed to ensure compliance with federal regulations. Additionally, Blue Ridge Community College (BRCTC) and WVUP did not publish the most recent version of the SAP policy on their websites. Furthermore, WVSOM did not include reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policy as the related SAP polices excluded the required element #11 above. BRCTC had an appropriate policy, but they did not publish the most recent version of the policy on their website. The older version of the SAP policy that was published on their website did not include the required element #11 above. Cause: Management of BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP did not retain sufficient documentation for their review procedures over the SAP policy. Management of BRCTC and WVSOM did not include all reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policies. Effect or Potential Effect: The published SAP policy may be deemed insufficient for the compliance requirements. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP were $5,084,582, $7,651,688, $17,584,932, $93,991,163, $3,672,778, $16,726,007, $3,090,314, $44,681,370, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should ensure the SAP is reviewed and approved on an annual basis and supporting documentation of the review retained. Management should design and implement internal controls over the SAP policy to ensure all requirements are included in the policy appropriately and published on the institution’s website timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–019 SPECIAL TESTS AND PROVISIONS – GRAMM-LEACH-BLILEY ACT-STUDENT INFORMATION SECURITY (N12) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. At a minimum, an institution’s written information security program — (1) Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). (2) Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 3 14.4(b)). (3) Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 3 14.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: (i) Implement and periodically review access controls. (ii) Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. (iii) Encrypt customer information on the institution’s system and when it’s in transit. (iv) Assess apps developed by the institution (v) Implement multi-factor authentication for anyone accessing customer information on the institution’s system (vi) Dispose of customer information securely (vii) Anticipate and evaluate changes to the information system or network. (viii) Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. (4) Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). (5) Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). (6) Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). (7) Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Condition: Blue Ridge Community and Technical College (BRCTC), Concord University (CU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program for Bluefield University (BSU), CU, MU, NRCTC, Shepherd University (SU), WLU, WVNCC, West Virginia State University (WVSU) and WVUP did not address all required elements per 16 CFR 314.4 outlined above. Furthermore, Fairmont State University (FSU) and Pierpont Community and Technical College (PCTC) did not have a written Information Security Program. For FSU, the written Information Security Program was not in place until May 2023. Cause: Management of BRCTC, CU, MU, NRCTC, WLU, WVNCC, and WVUP did not retain sufficient documentation for their review procedures over the Information Security Program. Management of BSU, CU, MU, NRCTC, SU, WVNCC, and WVSU did not include all reasonable standards required for the Information Security Program. Management of FSU and PCTC did not have a written Information Security Program. Effect or Potential Effect: The written Information Security Program may not be compliant with federal regulations. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, CU, FSU, MU, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, and WVUP were $5,084,582, $7,651,688, $13,833,684, $17,584,932, $93,991,163, $3,672,778, $4,388,461, $15,171,851, $16,726,007, $3,090,314, $9,313,808, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–020 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – VERIFICATION (N1) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Fairmont State University (FSU) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing, we noted for the samples selected that there were multiple selections showing a lack of proper review in the verification process. Cause: FSU did not have adequate internal controls in place to ensure that verification changes identified were processed and submitted to the U.S. Department of Education. Effect or Potential Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Questioned Costs: N/A Context: We selected a sample of 23 students for FSU and identified 8 instances where the verification forms were not reviewed and approved. Total Student Financial Assistance Cluster expenditures for FSU were $17,584,932 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–015 and 2021–014 Recommendation: Management should develop and update internal controls to ensure that controls related to the verification process are implemented. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–021 BANNER INFORMATION TECHNOLOGY GENERAL CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The State of West Virginia did not implement all logical access and change management controls that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application instances at 12 of 15 universities / colleges. As a result, Banner ITGCs, and therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Across the 11 universities/colleges (Blue Ridge Community and Technical College, Bluefield State University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia University, West Virginia University at Parkersburg, and West Virginia State University), management did not have a formalized process to support access provisioning events were authorized, approved and documented. Additionally, documentation did not exist to support the timely revocation of access upon a user leaving the university / college. Further, a user access review for Banner was not performed to ensure access remains appropriate based on users’ job responsibilities. We also identified instances where privileged accounts to Banner were shared amongst users and password settings were not configured with leading industry standards. Specific to the change management process, a formalized and documented process was not consistently followed to support that Banner application and supporting infrastructure patches and releases were authorized, tested, and approved prior to being implemented to production. Effect or Potential Effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the student financial aid system may be inappropriately created or modified. Effective testing of the required logical access and change management controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned Costs: None Context: The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Documentation of the requestor, access rights requested, and approval should be defined and maintained for all new and modified Banner access requests. This documentation should allow for an audit trail of all new and transferred users ensuring that access was granted/removed from the Banner application. Additionally, segregation of duties should exist between the requestor/approver and grantor of the access. Management should remove the terminated user's access from the Banner application. Management should enhance the process of communicating terminated employees to ensure access is revoked or disabled timely. Management should ensure that a review of user access is performed on a periodic basis (e.g., annually) to ensure user access rights remain consistent with user job responsibilities. Review procedures should be performed for all users with access to the Banner application to determine access appropriateness. In addition, management should ensure that adequate documentation is maintained to provide evidence (i.e., sign-offs, hard-copy reports, etc.) of the review. Management should configure Banner password settings related to minimum length, complexity, expiration, history, and account lockout to enhance overall security. Further, privileged access to the Banner application should be granted to administrators via unique IDs to provide accountability and avoid the sharing of default privileged accounts. A formal, documented change process needs implemented to capture authorization, testing and production migration approvals for patches and releases to the Banner application and supporting infrastructure. This documentation should allow for an audit trail of all program changes ensuring that changes were appropriately authorized and administered. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–024 SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE (N3) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of federal student aid credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. Regulations at 34 CFR 668.164(e) and (f) establish two different types of arrangements between schools and financial account providers: Tier One arrangements and Tier Two arrangements. The type of arrangement determines the provisions that are applicable to the school. 34 CFR 668.164(e)(2)(viii) states under a T1 arrangement, the institution must “provide to the Secretary an up-to-date URL for the contract and contract data as described in paragraph (e)(2)(vii) of this section for publication in a centralized database accessible to the public.” 34 CFR 668.164(e)(2)(ix) states under a T1 arrangement, the institution must “ensure that the terms of the accounts offered pursuant to a T1 arrangement are not inconsistent with the best financial interests of the students opening them. The Secretary considers this requirement to be met if (A) The institution documents that it conducts reasonable due diligence reviews at least every two years to ascertain whether the fees imposed under the T1 arrangement are, considered as a whole, consistent with or below prevailing market rates; and (B) All contracts for the marketing or offering of accounts pursuant to T1 arrangements to the institution's students make provision for termination of the arrangement by the institution based on complaints received from students or a determination by the institution under paragraph (e)(2)(ix)(A) of this section that the fees assessed under the T1 arrangement are not consistent with or are higher than prevailing market rates.” 34 CFR 668.164(e)(2)(x) states under a T1 arrangement, the institution must “take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that requirements of this section are met with respect to all accounts offered pursuant to T1 arrangements.” Condition: Bluefield State University (BSU), Blueridge Community & Technical College (BRCTC), Concord University (CU), Mountwest Community & Technical College (MCTC), Shepherd University (SU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) have a T1 arrangement with a third-party servicer. BSU, CU, SU, WVNCC, and WVUP were unable to provide documentation showing that their institutions had submitted a URL to their contract with their third-party servicer and cost information related to their third-party servicer to the U.S. Department of Education for publication in the Cash Management Contracts Database. BSU, BRCTC, CU, MCTC, SU and WVNCC were unable to provide evidence showing that their institutions documented a due diligence review over the fees assessed by their third-party servicer of Title IV credit balances. Cause: BSU, BRCTC, CU, MCTC, SU, WVUP, and WVNCC did not have an internal control in place to review the contract with their third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. As such, instances of noncompliance were noted above. Effect or Potential Effect: The schools are not in compliance with certain federal regulations over T1 arrangements contained in 34 CFR 668.164(e). Questioned Costs: None Context: BSU, BRCTC, CU, MCTC, SU, WVNCC, and WVUP had total expenditures of $7,651,688, $5,084,582, $13,833,684, $4,467,631, $15,171,851, $3,090,314, and $6,847,451 respectively. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should implement internal controls over the review of the contract with their third-party servicer of Title IV credit balances and their Title IV compliance audit, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2) to ensure compliance with the federal regulations over T1 arrangements. Documentation over the specific items reviewed and conclusions reached should be retained to support the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–017 SPECIAL TESTS AND PROVISIONS – SATISFACTORY ACADEMIC PROGRESS (N9) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.16(e) states: “For purposes of determining student eligibility for assistance under a title IV, HEA program, establishes, publishes, and applies reasonable standards for measuring whether an otherwise eligible student is maintaining satisfactory academic progress in his or her educational program. The Secretary considers an institution's standards to be reasonable if the standards are in accordance with the provisions specified in § 668.34.” 34 CFR 668.34 states: “An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs. The Secretary considers the institution's policy to be reasonable if— (1) The policy is at least as strict as the policy the institution applies to a student who is not receiving assistance under the title IV, HEA programs; (2) The policy provides for consistent application of standards to all students within categories of students, e.g., full-time, part-time, undergraduate, and graduate students, and educational programs established by the institution; (3) The policy provides that a student's academic progress is evaluated— (i) At the end of each payment period if the educational program is either one academic year in length or shorter than an academic year; or (ii) For all other educational programs, at the end of each payment period or at least annually to correspond with the end of a payment period; (4) (i) The policy specifies the grade point average (GPA) that a student must achieve at each evaluation, or if a GPA is not an appropriate qualitative measure, a comparable assessment measured against a norm; and (ii) If a student is enrolled in an educational program of more than two academic years, the policy specifies that at the end of the second academic year, the student must have a GPA of at least a “C” or its equivalent, or have academic standing consistent with the institution's requirements for graduation; (5) The policy specifies— (i) For all programs, the maximum timeframe as defined in paragraph (b) of this section; and (ii) For a credit hour program using standard or nonstandard terms that is not a subscription-based program, the pace, measured at each evaluation, at which a student must progress through his or her educational program to ensure that the student will complete the program within the maximum timeframe, calculated by either dividing the cumulative number of hours the student has successfully completed by the cumulative number of hours the student has attempted or by determining the number of hours that the student should have completed by the evaluation point in order to complete the program within the maximum timeframe. In making this calculation, the institution is not required to include remedial courses; (6) The policy describes how a student's GPA and pace of completion are affected by course incompletes, withdrawals, or repetitions, or transfers of credit from other institutions. Credit hours from another institution that are accepted toward the student's educational program must count as both attempted and completed hours; (7) Except as provided in paragraphs (c) and (d) of this section, the policy provides that, at the time of each evaluation, a student who has not achieved the required GPA, or who is not successfully completing his or her educational program at the required pace, is no longer eligible to receive assistance under the title IV, HEA programs; (8) If the institution places students on financial aid warning, or on financial aid probation, as defined in paragraph (b) of this section, the policy describes these statuses and that— (i) A student on financial aid warning may continue to receive assistance under the title IV, HEA programs for one payment period despite a determination that the student is not making satisfactory academic progress. Financial aid warning status may be assigned without an appeal or other action by the student; and (ii) A student on financial aid probation may receive title IV, HEA program funds for one payment period. While a student is on financial aid probation, the institution may require the student to fulfill specific terms and conditions such as taking a reduced course load or enrolling in specific courses. At the end of one payment period on financial aid probation, the student must meet the institution's satisfactory academic progress standards or meet the requirements of the academic plan developed by the institution and the student to qualify for further title IV, HEA program funds; (9) If the institution permits a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy describes— (i) How the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; (ii) The basis on which a student may file an appeal: The death of a relative, an injury or illness of the student, or other special circumstances; and (iii) Information the student must submit regarding why the student failed to make satisfactory academic progress, and what has changed in the student's situation that will allow the student to demonstrate satisfactory academic progress at the next evaluation; (10) If the institution does not permit a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy must describe how the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; and (11) The policy provides for notification to students of the results of an evaluation that impacts the student's eligibility for title IV, HEA program funds.” Condition: Bluefield State University (BSU), Fairmont State University (FSU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the satisfactory academic progress (SAP) policy. During our testing, we noted there was no documentation retained to evidence that a review of the SAP policy was performed to ensure compliance with federal regulations. Additionally, Blue Ridge Community College (BRCTC) and WVUP did not publish the most recent version of the SAP policy on their websites. Furthermore, WVSOM did not include reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policy as the related SAP polices excluded the required element #11 above. BRCTC had an appropriate policy, but they did not publish the most recent version of the policy on their website. The older version of the SAP policy that was published on their website did not include the required element #11 above. Cause: Management of BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP did not retain sufficient documentation for their review procedures over the SAP policy. Management of BRCTC and WVSOM did not include all reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policies. Effect or Potential Effect: The published SAP policy may be deemed insufficient for the compliance requirements. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP were $5,084,582, $7,651,688, $17,584,932, $93,991,163, $3,672,778, $16,726,007, $3,090,314, $44,681,370, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should ensure the SAP is reviewed and approved on an annual basis and supporting documentation of the review retained. Management should design and implement internal controls over the SAP policy to ensure all requirements are included in the policy appropriately and published on the institution’s website timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–019 SPECIAL TESTS AND PROVISIONS – GRAMM-LEACH-BLILEY ACT-STUDENT INFORMATION SECURITY (N12) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. At a minimum, an institution’s written information security program — (1) Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). (2) Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 3 14.4(b)). (3) Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 3 14.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: (i) Implement and periodically review access controls. (ii) Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. (iii) Encrypt customer information on the institution’s system and when it’s in transit. (iv) Assess apps developed by the institution (v) Implement multi-factor authentication for anyone accessing customer information on the institution’s system (vi) Dispose of customer information securely (vii) Anticipate and evaluate changes to the information system or network. (viii) Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. (4) Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). (5) Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). (6) Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). (7) Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Condition: Blue Ridge Community and Technical College (BRCTC), Concord University (CU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program for Bluefield University (BSU), CU, MU, NRCTC, Shepherd University (SU), WLU, WVNCC, West Virginia State University (WVSU) and WVUP did not address all required elements per 16 CFR 314.4 outlined above. Furthermore, Fairmont State University (FSU) and Pierpont Community and Technical College (PCTC) did not have a written Information Security Program. For FSU, the written Information Security Program was not in place until May 2023. Cause: Management of BRCTC, CU, MU, NRCTC, WLU, WVNCC, and WVUP did not retain sufficient documentation for their review procedures over the Information Security Program. Management of BSU, CU, MU, NRCTC, SU, WVNCC, and WVSU did not include all reasonable standards required for the Information Security Program. Management of FSU and PCTC did not have a written Information Security Program. Effect or Potential Effect: The written Information Security Program may not be compliant with federal regulations. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, CU, FSU, MU, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, and WVUP were $5,084,582, $7,651,688, $13,833,684, $17,584,932, $93,991,163, $3,672,778, $4,388,461, $15,171,851, $16,726,007, $3,090,314, $9,313,808, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–020 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – VERIFICATION (N1) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Fairmont State University (FSU) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing, we noted for the samples selected that there were multiple selections showing a lack of proper review in the verification process. Cause: FSU did not have adequate internal controls in place to ensure that verification changes identified were processed and submitted to the U.S. Department of Education. Effect or Potential Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Questioned Costs: N/A Context: We selected a sample of 23 students for FSU and identified 8 instances where the verification forms were not reviewed and approved. Total Student Financial Assistance Cluster expenditures for FSU were $17,584,932 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–015 and 2021–014 Recommendation: Management should develop and update internal controls to ensure that controls related to the verification process are implemented. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–021 BANNER INFORMATION TECHNOLOGY GENERAL CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The State of West Virginia did not implement all logical access and change management controls that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application instances at 12 of 15 universities / colleges. As a result, Banner ITGCs, and therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Across the 11 universities/colleges (Blue Ridge Community and Technical College, Bluefield State University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia University, West Virginia University at Parkersburg, and West Virginia State University), management did not have a formalized process to support access provisioning events were authorized, approved and documented. Additionally, documentation did not exist to support the timely revocation of access upon a user leaving the university / college. Further, a user access review for Banner was not performed to ensure access remains appropriate based on users’ job responsibilities. We also identified instances where privileged accounts to Banner were shared amongst users and password settings were not configured with leading industry standards. Specific to the change management process, a formalized and documented process was not consistently followed to support that Banner application and supporting infrastructure patches and releases were authorized, tested, and approved prior to being implemented to production. Effect or Potential Effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the student financial aid system may be inappropriately created or modified. Effective testing of the required logical access and change management controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned Costs: None Context: The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Documentation of the requestor, access rights requested, and approval should be defined and maintained for all new and modified Banner access requests. This documentation should allow for an audit trail of all new and transferred users ensuring that access was granted/removed from the Banner application. Additionally, segregation of duties should exist between the requestor/approver and grantor of the access. Management should remove the terminated user's access from the Banner application. Management should enhance the process of communicating terminated employees to ensure access is revoked or disabled timely. Management should ensure that a review of user access is performed on a periodic basis (e.g., annually) to ensure user access rights remain consistent with user job responsibilities. Review procedures should be performed for all users with access to the Banner application to determine access appropriateness. In addition, management should ensure that adequate documentation is maintained to provide evidence (i.e., sign-offs, hard-copy reports, etc.) of the review. Management should configure Banner password settings related to minimum length, complexity, expiration, history, and account lockout to enhance overall security. Further, privileged access to the Banner application should be granted to administrators via unique IDs to provide accountability and avoid the sharing of default privileged accounts. A formal, documented change process needs implemented to capture authorization, testing and production migration approvals for patches and releases to the Banner application and supporting infrastructure. This documentation should allow for an audit trail of all program changes ensuring that changes were appropriately authorized and administered. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–024 SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE (N3) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of federal student aid credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. Regulations at 34 CFR 668.164(e) and (f) establish two different types of arrangements between schools and financial account providers: Tier One arrangements and Tier Two arrangements. The type of arrangement determines the provisions that are applicable to the school. 34 CFR 668.164(e)(2)(viii) states under a T1 arrangement, the institution must “provide to the Secretary an up-to-date URL for the contract and contract data as described in paragraph (e)(2)(vii) of this section for publication in a centralized database accessible to the public.” 34 CFR 668.164(e)(2)(ix) states under a T1 arrangement, the institution must “ensure that the terms of the accounts offered pursuant to a T1 arrangement are not inconsistent with the best financial interests of the students opening them. The Secretary considers this requirement to be met if (A) The institution documents that it conducts reasonable due diligence reviews at least every two years to ascertain whether the fees imposed under the T1 arrangement are, considered as a whole, consistent with or below prevailing market rates; and (B) All contracts for the marketing or offering of accounts pursuant to T1 arrangements to the institution's students make provision for termination of the arrangement by the institution based on complaints received from students or a determination by the institution under paragraph (e)(2)(ix)(A) of this section that the fees assessed under the T1 arrangement are not consistent with or are higher than prevailing market rates.” 34 CFR 668.164(e)(2)(x) states under a T1 arrangement, the institution must “take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that requirements of this section are met with respect to all accounts offered pursuant to T1 arrangements.” Condition: Bluefield State University (BSU), Blueridge Community & Technical College (BRCTC), Concord University (CU), Mountwest Community & Technical College (MCTC), Shepherd University (SU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) have a T1 arrangement with a third-party servicer. BSU, CU, SU, WVNCC, and WVUP were unable to provide documentation showing that their institutions had submitted a URL to their contract with their third-party servicer and cost information related to their third-party servicer to the U.S. Department of Education for publication in the Cash Management Contracts Database. BSU, BRCTC, CU, MCTC, SU and WVNCC were unable to provide evidence showing that their institutions documented a due diligence review over the fees assessed by their third-party servicer of Title IV credit balances. Cause: BSU, BRCTC, CU, MCTC, SU, WVUP, and WVNCC did not have an internal control in place to review the contract with their third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. As such, instances of noncompliance were noted above. Effect or Potential Effect: The schools are not in compliance with certain federal regulations over T1 arrangements contained in 34 CFR 668.164(e). Questioned Costs: None Context: BSU, BRCTC, CU, MCTC, SU, WVNCC, and WVUP had total expenditures of $7,651,688, $5,084,582, $13,833,684, $4,467,631, $15,171,851, $3,090,314, and $6,847,451 respectively. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should implement internal controls over the review of the contract with their third-party servicer of Title IV credit balances and their Title IV compliance audit, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2) to ensure compliance with the federal regulations over T1 arrangements. Documentation over the specific items reviewed and conclusions reached should be retained to support the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–002 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP Cluster) 10.551/10.561/COVID-19 10.561, Grant Award 1WV400401, Grant Award 1WV430459, Grant Award 1WV430469, Grant Award 1WV460479, U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF, Child Care and Development Fund (CCDF) Cluster, 93.575/93.596/COVID 19 93.575, Grant Award 2201WVCCDF, Grant Award 2201WVCCDM, Grant Award 2201WVCCDD, Grant Award 2301WVCCDF, Grant Award 2301WVCCDM, Grant Award 2301WVCCDD, Foster Care Title IV-E, 93.658, Grant Award 2201WVFOST, Grant Award 2301WVFOST, Adoption Assistance 93.659, Grant Award 2201WVADPT, Grant Award 2301WVADPT Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs’ data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. In addition, no supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approver to review each transaction individually. Cause: Controls have not been implemented over the segregation of duties within RAPIDS and FACTS. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect or Potential Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS and RAPIDS applications. Information can be input into the FACTS and RAPIDS applications or modified within the applications without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant’s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. Identification as a Repeat Finding: Prior Year Findings 2022–001 and 2021–001 Recommendation: We recommend that access to various FACTS and RAPIDS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–004 INTERNAL CONTROLS OVER SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR 93.788, Grant Award 1H79TI085744-01, Grant Award 1H79TI083313-01, Grant Award 6H79TI083313-02M002, Grant Award 6H79TI083313-02M004, Grant Award 5H79TI083313-02 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04, Child Care and Development Fund (CCDF) Cluster 93.575/93.596/COVID-19 93.575, Grant Award G2201WVCCDF, Grant Award G2301WVCCDF Temporary Assistance for Needy Families 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our internal control testing of subrecipient monitoring, we determined that the subrecipient risk assessment performed did not clearly conclude the level of risk assessed (Low, Medium, High) for each subrecipient. Cause: The internal controls over subrecipient monitoring are not designed sufficiently to require a conclusion to be reached on a subrecipient’s risk assessment to determine the level of monitoring required to be performed. Effect or Potential Effect: Subrecipients may not be properly risk assessed; therefore, impacting the type and amount of monitoring that would be performed in the future. Questioned Costs: N/A Context: The federal expenditures and subrecipient expenditures for the Opioid STR program for the fiscal year ended June 30, 2023, were $34,877,309 and $32,388,417, respectively. The federal expenditures and subrecipient expenditures for the Child Care and Development Fund (CCDF Cluster) for the fiscal year ended June 30, 2023, were $202,427,780 and $45,239,361, respectively. The federal expenditures and subrecipient expenditures for the Temporary Assistance for Needy Families for the fiscal year ended June 30, 2023, were $85,510,454, and $18,789,521, respectively. Identification as a Repeat Finding: Prior Year Finding 2022–041 Recommendation: We recommend that DHHR management review its internal controls over the risk assessment process to perform the risk assessment and conclude on the level of risk and monitoring required. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–035 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission. Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the issuance and removal of sanctions; however, adequate documentation to determine that the controls were operating effectively was not consistently maintained or available. Cause: Internal controls over the documentation of the review and approval of the issuance or removal of sanctions against TANF recipients are not operating effectively. Effect or Potential Effect: Recipient benefits may potentially be reduced or increased in error or without appropriate cause. Questioned Costs: N/A Context: Total federal expenditures for Temporary Assistance for Needy Families (TANF) for the fiscal year ended June 30, 2023, were $85,510,454. Identification as a Repeat Finding: Prior Year Findings 2022–027 and 2021–028 Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review prior to the issuance or removal of sanctions. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–036 SPECIAL TESTS AND PROVISIONS – PENALTY FOR REFUSAL TO WORK Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The State agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each State agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the State by an amount not less than one percent and not more than five percent of the SFAG for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60, 261.61, 261.62, 261.63, 261.64, and 261.65). If an individual in a family receiving assistance refuses to engage in required work, a State must reduce assistance to the family, at least pro rata, with respect to any period during the month in which the individual so refuses or may terminate assistance. Any reduction or termination is subject to good cause or other exceptions as the State may establish (42 USC 607(e)(1); 45 CFR sections 261.13 and 261.14(a) and (b)). However, a State may not reduce or terminate assistance based on a refusal to work if the individual is a single custodial parent caring for a child who is less than 6 years of age if the individual can demonstrate the inability (as determined by the State) to obtain child care for one or more of the following reasons: (a) the unavailability of appropriate care within a reasonable distance of the individual’s work or home; (b) unavailability or unsuitability of informal child care; or (c) unavailability of appropriate and affordable formal child care (42 USC 607(e)(2); 45 CFR sections 261.15(a), 261.56, and 261.57). Condition: For one of the 40 cases selected for testing, the individual should not have been included in the overall population of individuals not participating in their assigned activity. The State has supporting documentation that the client had been participating in their assigned activity. We determined that the cause was from the individual being incorrectly included in the population provided by the state. Cause: There are insufficient internal controls in place surrounding the generation and review of the population of individuals not participating in an assigned activity provided to the auditor, and caseworker data entry into the Recipient Automated Payment Information Data System (RAPIDS). Effect or Potential Effect: The State may inappropriately reduce or terminate the assistance grant of an individual who refuses to engage in work but are subject to good cause or other exceptions established by the State. Further the State may not be able to effectively identify individuals that should or should not be subject to reductions or terminations in benefits. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–037 SPECIAL TESTS AND PROVISIONS – INCOME ELIGIBILITY AND VERIFICATION SYSTEM Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF, Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Social Security Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows (42 USC 1320b-7; 45CFR section 205.55). (a) Wage information from the state Wage Information Collection Agency (SWICA) should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d) Information from the U.S. Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e) Unearned income from the Internal Revenue Service (IRS). Condition: During testing of 40 TANF cases subject to IEVS, we noted the following: Control - For 40 of the 40 cases selected for control testing, adequate documentation of review of the data exchanges, and system matches, and review of actions taken by the caseworker when required was not provided. Compliance- For 3 of the 40 cases selected for testing, the recipient did not appear to be receiving WVWorks benefits. The auditor was unable to determine if these cases should have been subject to a data match under TANF. For 12 of the 40 cases selected for testing, the recipient appeared to be receiving WVWorks benefits, and a data match indicating caseworker action required was noted, but no action was completed. Additionally, additional documentation supporting no action required for the match was not available. For the remaining 25 of the 40 cases, the recipient appeared to be receiving WVWorks, a data match occurred, and related worker action was taken, but documentation supporting the action was not available. In addition, the auditor could not determine if specific action items were completed relating to individual exchange types. Cause: There are insufficient internal controls in place surrounding the generation and review of populations provided to the auditor, the Income Eligibility and Verification System matches, and the caseworker actions required within the Recipient Automated Payment Information Data System (RAPIDS). Also, insufficient documentation surrounding matches made between the information systems and actions taken after a match is made. Effect or Potential Effect: The State of WV may not be coordinating data exchanges with other federally assisted benefit programs as required by the state plan. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454. Identification as a Repeat Finding: Prior Year Finding 2022–028 and 2021–029 Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. In addition, we also recommend DHHR evaluate their control over the caseworker action requirement within RAPIDS on matches related to the IEVS. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–038 SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.332(a) requires that a pass-through entity “Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward.” Required information includes the Federal Award Identification Number (FAIN). Condition: For four of four subawards selected for testing for subrecipient monitoring, the West Virginia Department of Education (DOE) did not communicate the FAIN to the subrecipient in the subaward. Cause: There are insufficient internal controls in place surrounding what information is included in the subaward. Effect or Potential Effect: The DOE is not providing required information to their subrecipients and therefore, not complying with federal regulations. Questioned Costs: Unknown Context: The federal expenditures and subrecipient expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454, and $18,789,521, respectively. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that DOE implement policies and procedures to ensure that the subawards include all requirements information to be communication to subrecipients in line with federal regulations. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–040 SPECIAL TESTS AND PROVISIONS – PENALTY FOR FAILURE TO COMPLY WITH WORK VERFICATION PLAN Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WV TANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the state by an amount not less than one percent and not more than five percent of the SFAG for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60, 261.61, 261.62, 261.63, 261.64, and 261.65). Condition: For one of the 40 cases selected for testing, the individual’s work eligibility and participation status documented in the case file and RAPIDS were not consistent with the data elements reported. For one of the 40 cases selected for testing, there was conflicting information for the participation hours for the individual/month selected. The incorrect information was included in the data elements reported. Cause: The discrepancies between data elements reported and supported were due to caseworker errors. Internal controls are not suitably designed to review and approve participant eligibility applications. Effect or Potential Effect: The auditor was unable to determine if the auditee was in compliance with the specified compliance requirement. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2023 were $85,510,454. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS is complete and accurate. In addition, we also recommend DHHR evaluate the effectiveness of the current training programs for the TANF program to ensure adequate technical training is provided. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–041 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF, Low-Income Home Energy Assistance, 93.568/COVID-19 93.568, Grant Award G-2101WVE5C6, Grant Award G-2201WVLIEA, Grant Award G-2201WVLIEI, Grant Award G-2301WVLIEE, Grant Award G-2301WVLIEA, Grant Award G-2301WVLIEI Criteria or specific requirement (including statutory, regulatory, or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: During our testing of Federal Funding Accountability and Transparency Act (FFATA) reports for the Temporary Assistance for Needy Families (TANF) program, the subawards were not reported timely and support could not be provided for certain required data elements. Therefore, the TANF program was not in compliance with the provisions of 2 CFR 170 Appendix A. During our testing of Federal Funding Accountability and Transparency Act (FFATA) reports for the Low-Income Home Energy Assistance (LIHEAP) program, it was noted that the reports were not submitted by the Department of Health and Human Resources (DHHR) within the timeframe designated in 2 CFR 170 Appendix A, as well as did not contain accurate subaward grant numbers. Cause: The West Virginia Department of Health and Human Resources (DHHR) received awards directly from the federal awarding agency. DHHR passed through a portion of the awards to other non-federal entities that were also agencies of the State. Those other agencies of the State subsequently passed through a portion of their awards to other non-federal entities that are not agencies of the State. When DHHR passed through the awards to other agencies of the State, DHHR used their standard grant agreement template since those agencies were external to DHHR. When completing the FFATA reports, the DHHR inappropriately entered the other State agencies as the subrecipient/subawardee and did not report the first-tier subrecipients of DOE timely. DHHR was also not able to provide supporting documentation for the subrecipients unique entity identification (UEI) number. Effect or Potential Effect: The FFATA reports were not submitted timely, and documentation could not be provided to ensure all required data elements were accurate. Questioned Costs: N/A Context: Subawards for the TANF program awarded by the West Virginia Department of Education (DOE) included 11 subawards that totaled $5,653,405 for the year ended June 30, 2023. The 5 subawards that were reported to the FFATA Subaward Reporting System incorrectly and/or late represent the entirety of the $2,851,508 selected for testing. Total federal expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454. Subawards for the LIHEAP program included 28 subawards that totaled $17,348,041 for the year ended June 30, 2023. The 5 subawards that were incorrectly reported to the FFATA Subaward Reporting System represent the entirety of the $3,775,558 selected for testing. Total federal expenditures for LIHEAP for the fiscal year ended June 30, 2023, were $78,229,389. Identification as a Repeat Finding: Prior Year Finding 2022-029 Recommendation: DHHR should consider the State of West Virginia to be the prime recipient. Even if the DHHR passes through a portion of a federal award to other non-federal entities that are agencies of the State, the DHHR should consider those agencies to be part of the prime recipient tier instead of subrecipients. Regardless of the State agency that receives the award directly from the federal awarding agency, the only time a subrecipient relationship exists for the State is when a portion of the award is passed through to a non-federal entity that is not an agency of the State. Accordingly, when DHHR receives and passes through a portion of a federal award to another agency of the State, DHHR should work with the other agency when completing the FFATA reports in an effort to ensure that all subawardee information is complete and accurate. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–002 DHHR INFORMATION SYSTEM AND RELATED BUSINESS PROCESS CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP Cluster) 10.551/10.561/COVID-19 10.561, Grant Award 1WV400401, Grant Award 1WV430459, Grant Award 1WV430469, Grant Award 1WV460479, U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2201WVTANF, Grant Award 2301WVTANF, Child Care and Development Fund (CCDF) Cluster, 93.575/93.596/COVID 19 93.575, Grant Award 2201WVCCDF, Grant Award 2201WVCCDM, Grant Award 2201WVCCDD, Grant Award 2301WVCCDF, Grant Award 2301WVCCDM, Grant Award 2301WVCCDD, Foster Care Title IV-E, 93.658, Grant Award 2201WVFOST, Grant Award 2301WVFOST, Adoption Assistance 93.659, Grant Award 2201WVADPT, Grant Award 2301WVADPT Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Family and Children Tracking System (FACTS): West Virginia Department of Health and Human Resources (DHHR) operates a wide variety of computer applications, many of which affect federal and State programs’ data. Our review of the information system controls noted that adequate segregation of duties does not exist for the FACTS information system. Certain users have the ability to both create and approve cases. We noted that management implemented a mitigating detect control for the Foster Care program during fiscal year 2012 in response to this repeat finding; however, it was not designed to encompass the Adoption Assistance program or automatic payments in the Foster Care program. Additionally, no supervisory review is required for provider payment information input into the system. Recipient Automated Payment Information Data System (RAPIDS): Our testing of the controls surrounding eligibility determination noted that adequate segregation of duties does not exist for the RAPIDS system. In addition, no supervisory review is required for case information input into the system. Further, it was noted that approval of disbursements only occurs at the batch level, which does not allow the approver to review each transaction individually. Cause: Controls have not been implemented over the segregation of duties within RAPIDS and FACTS. Furthermore, management indicated that a lack of personnel resources contributes to the improper segregation of duties issue. Effect or Potential Effect: Without proper segregation of duties or adequate detect controls, the ability exists for certain information system users to create and approve cases and demand payments within the FACTS and RAPIDS applications. Information can be input into the FACTS and RAPIDS applications or modified within the applications without supervisory review, which could lead to payments being made to ineligible applicants, for the improper amount, or for an improper length of time. Without proper segregation of duties or adequate detect controls, the ability exists for case workers to input unsupported information into an applicant’s eligibility calculation within RAPIDS. Further, without supervisory review at the transactional level, disbursements for unallowable costs or activities could occur. Questioned Costs: N/A Context: Total federal expenditures for these programs can be located in the Schedule of Expenditures of Federal Awards. Identification as a Repeat Finding: Prior Year Findings 2022–001 and 2021–001 Recommendation: We recommend that access to various FACTS and RAPIDS system applications be restricted to a limited number of users. Controls should be established to ensure that an individual is limited to either creating or approving cases or payments. A detect control should be implemented that would require a review of all individual cases and payments with the same request and approval worker to ensure that cases and payments created and approved were appropriate. Further, we recommend that a formal review process be implemented to ensure that information input into FACTS and RAPIDS is properly reviewed by authorized individuals prior to payment. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.