State of West Virginia

2023–005 SPECIAL TESTS AND PROVISIONS – ADP SYSTEM FOR SNAP Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP Cluster) 10.551/10.561/COVID-19 10.561, Grant Award 1WV400401, Grant Award 1WV430459, Grant Award 1WV430469, Grant Award 1WV460479, Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 7 CFR section 272.10 requires that State agencies “sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP.” This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period; and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Condition: The Department of Health and Human Resources (DHHR) uses the Recipient Automated Payment Information Data System (RAPIDS) as its Automated Data Processing (ADP) system for SNAP. Our testing of the controls surrounding eligibility determination noted that no independent review and approval is required in RAPIDS for case information input by the case worker. Further, it was noted that review and approval of disbursements only occurs at the batch level, which does not allow the independent reviewer to review each transaction individually. Data integrity is a critical for the automation SNAP operations. Due to limitations of the ADP system for SNAP, the auditor was unable to conclude whether or not the State’s ADP system for SNAP (i.e., RAPIDS) was in compliance with requirements of 7 CFR section 272.10. Cause: Controls within the RAPIDS system are not designed to sufficiently protect the integrity of data input into the system. Effect or Potential Effect: The information related to the operations of the SNAP Cluster may not be appropriately maintained, processed or transmitted by the ADP system. Questioned Costs: N/A Context: Total federal expenditures for the SNAP Cluster were $884,947,739 for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Finding 2022–002 Recommendation: We recommend that management establish the appropriate segregation of duties related to the review and approval of eligibility applications, in order to maintain effective IT general controls over the RAPIDS ADP system for SNAP. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – ADP SYSTEM FOR SNAP Department of Health and Human Resources (DHHR) Assistance Listing Number 10.551, 10.561, COVID-19 10.561 Management within the DHHR, Bureau for Family Assistance (BFA), appreciates and shares the auditors’ concern with SNAP program integrity as it relates to the Recipient Automated Payment and Information Data System (RAPIDS) ADP system. The BFA notes that 7 CFR § 272.10 begins with, “(1) Purpose. All state agencies are required to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP. Sufficient automation levels are those which result in effective programs or in cost effective reductions in errors and improvements in management efficiency, such as decreases in program administrative costs...” Within the RAPIDS ecosystem for SNAP administration, this automation includes data matching measures undertaken, in compliance with related federal rules as specified in 7 CFR § 272.8, 7 CFR § 272.16, etc., to automate the validation of client-provided, worker-input information while mitigating the additional administrative burden of secondary review for all worker interactions with a client’s case. Policy regarding state and federal data matching is laid out in Chapter 6 of the State’s Income Maintenance Manual (IMM) at https://dhhr.wv.gov/bfa/policyplans/Documents/ Binder4.pdf. The primary data exchange system detailed in IMM Chapter 6 that is applicable to SNAP is the Income and Eligibility Verification System (IEVS) required by 7 CFR § 272.8. Systems mandated federally for inclusion in the IEVS include those operated by WorkForce WV, the Internal Revenue Service (IRS), and the U.S. Social Security Administration (SSA). A variety of other sources may also be queried for the purpose of validating client-provided information entered into RAPIDS by a worker, including Veterans Affairs (VA), Beneficiary and Earnings Data Exchange (BENDEX), Beneficiary Earnings and Exchange Record System (BEERS), National Directory of New Hires, and Prisoner Matching with the Department of Corrections as well as the Federal Data Services Hub (FDSH). IMM Chapter 6, page 2 describes the purpose of data matching through the IEVS thusly: Information obtained through IEVS is used for the following purposes: • To verify the eligibility of the assistance group (AG). • To verify the proper amount of benefits. • To determine if the AG received benefits to which it was not entitled. • To obtain information for use in criminal or civil prosecution based on receipt of benefits to which the AG was not entitled. IMM Chapter 6, pages 2-3 further detail the points at which a match with the IEVS must take place: A data exchange in the eligibility system occurs: • When a new case is created; • When a new person is added to a benefit; • When a person’s demographic information is changed; and, • On a periodic basis for all individuals in the eligibility system, depending on the type of benefit being received. Requirements for independent verification of information when automated data matches fail or report a discrepancy with client-provided, worker-input information are spelled out in IMM 6.4.4. The BFA believes that these automations, while perhaps not foolproof, are in keeping with both the word and intent of 7 CFR § 272.10, 7 CFR § 272.8, 7 CFR § 272.16, etc., which aim to automate processes in order to reduce administrative burden and associated costs, such as those that would be associated with a secondary review of all worker interactions with a client’s case. Furthermore, page 4-10.551-9 of the Compliance Supplement 2023, which lays out the suggested audit procedures for this topic, recommends the use of the USDA-FNS SNAP System Integrity Review Tool (SIRT) to ensure that the State’s ADP system is in alignment with USDA-FNS requirements and ensure that automated processes within RAPIDS continue to comport with federal requirements for ADP systems. To our knowledge, the auditors neither utilized that tool to guide their work nor requested verification from the State that the SIRT had been completed and previously employed. To support this response, management advocates a review of the SIRT submitted to FNS on October 26, 2023 in preparation for the go-live stage of the West Virginia People’s Access to Help (WV PATH) Family Assistance pilot program; as there is no significant difference in system functionality between the Family Assistance module of WV PATH and the existing eRAPIDS system, the responses/comments/replies from both FNS and the State that are included in this version of the SIRT generally apply both to eRAPIDS and to PATH. Throughout 2023, the BFA Division of Performance and Quality Improvement continued its ongoing SNAP case reviews, as well as its efforts to report compliance with monthly requirements for expanded supervisor case reviews conducted and tracked through the Rushmore case review system, as mandated in a December 7, 2022 memorandum to supervisors and made available to the auditors last year. Furthermore, the BFA developed additional worker training, including the reinstatement of face-to-face Statewide Payment Accuracy Conferences (held throughout the summer of 2023), with the aim to ensure that client information is accurately captured in RAPIDS so the APD can perform its automated functions with integrity.

2022-002

2023–016 SPECIAL TESTS AND PROVISIONS - NOTIFICATION OF CHANGES TO KEY PERSONNEL Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Transportation National Infrastructure Investments 20.933, Grant Award 693JJ22040000BDG0WV0522045, Grant Award 693JJ22040000BDG0WV0484326, Grant Award 693JJ22140000BDG3WV0641399, Grant Award 693JJ22240000BDG6WV0793309 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The terms and conditions of the grant awards require the recipient to notify all U.S. Department of Transportation (USDOT) representatives, noted in the grant agreement, in writing within 30 calendar days of any change in key personnel. Condition: The West Virginia Division of Highways (the Division) could not provide documentation that the USDOT was made aware of changes in key personnel within 30 calendar days. Cause: The Division does not have proper policies and procedures in place over the notification of changes to key personnel requirements. Effect or Potential Effect: The Division is not in compliance with the provisions of the grant awards since changes to key personnel were not communicated in writing to the USDOT within 30 calendar days. Questioned Costs: Unknown Context: There were three grants that had a change in key personnel; the change in key personnel was not communicated to the USDOT. Total federal expenditures for the National Infrastructure Investments program were $35,831,611 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Division implement policies and procedures surrounding the notification of changes to key personnel requirements to ensure compliance with all conditions of the grant awards. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – NOTIFICATION OF CHANGES TO KEY PERSONNEL Division of Highways (the Division) Assistance Listing Number 20.933 Due to staff turnover, WVDOT recipient contact/key personnel had changed for some of the BUILD Transportation Discretionary Federal Grants. The USDOT representatives noted in the federal grants were not notified of these changes. The USDOT will be notified of all recent recipient contact/key personnel changes. Effective February 2024, when there are recipient changes, the USDOT will be notified within 30 days of the occurrence.

2023–017 SPECIAL TESTS AND PROVISIONS – SATISFACTORY ACADEMIC PROGRESS (N9) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.16(e) states: “For purposes of determining student eligibility for assistance under a title IV, HEA program, establishes, publishes, and applies reasonable standards for measuring whether an otherwise eligible student is maintaining satisfactory academic progress in his or her educational program. The Secretary considers an institution's standards to be reasonable if the standards are in accordance with the provisions specified in § 668.34.” 34 CFR 668.34 states: “An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs. The Secretary considers the institution's policy to be reasonable if— (1) The policy is at least as strict as the policy the institution applies to a student who is not receiving assistance under the title IV, HEA programs; (2) The policy provides for consistent application of standards to all students within categories of students, e.g., full-time, part-time, undergraduate, and graduate students, and educational programs established by the institution; (3) The policy provides that a student's academic progress is evaluated— (i) At the end of each payment period if the educational program is either one academic year in length or shorter than an academic year; or (ii) For all other educational programs, at the end of each payment period or at least annually to correspond with the end of a payment period; (4) (i) The policy specifies the grade point average (GPA) that a student must achieve at each evaluation, or if a GPA is not an appropriate qualitative measure, a comparable assessment measured against a norm; and (ii) If a student is enrolled in an educational program of more than two academic years, the policy specifies that at the end of the second academic year, the student must have a GPA of at least a “C” or its equivalent, or have academic standing consistent with the institution's requirements for graduation; (5) The policy specifies— (i) For all programs, the maximum timeframe as defined in paragraph (b) of this section; and (ii) For a credit hour program using standard or nonstandard terms that is not a subscription-based program, the pace, measured at each evaluation, at which a student must progress through his or her educational program to ensure that the student will complete the program within the maximum timeframe, calculated by either dividing the cumulative number of hours the student has successfully completed by the cumulative number of hours the student has attempted or by determining the number of hours that the student should have completed by the evaluation point in order to complete the program within the maximum timeframe. In making this calculation, the institution is not required to include remedial courses; (6) The policy describes how a student's GPA and pace of completion are affected by course incompletes, withdrawals, or repetitions, or transfers of credit from other institutions. Credit hours from another institution that are accepted toward the student's educational program must count as both attempted and completed hours; (7) Except as provided in paragraphs (c) and (d) of this section, the policy provides that, at the time of each evaluation, a student who has not achieved the required GPA, or who is not successfully completing his or her educational program at the required pace, is no longer eligible to receive assistance under the title IV, HEA programs; (8) If the institution places students on financial aid warning, or on financial aid probation, as defined in paragraph (b) of this section, the policy describes these statuses and that— (i) A student on financial aid warning may continue to receive assistance under the title IV, HEA programs for one payment period despite a determination that the student is not making satisfactory academic progress. Financial aid warning status may be assigned without an appeal or other action by the student; and (ii) A student on financial aid probation may receive title IV, HEA program funds for one payment period. While a student is on financial aid probation, the institution may require the student to fulfill specific terms and conditions such as taking a reduced course load or enrolling in specific courses. At the end of one payment period on financial aid probation, the student must meet the institution's satisfactory academic progress standards or meet the requirements of the academic plan developed by the institution and the student to qualify for further title IV, HEA program funds; (9) If the institution permits a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy describes— (i) How the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; (ii) The basis on which a student may file an appeal: The death of a relative, an injury or illness of the student, or other special circumstances; and (iii) Information the student must submit regarding why the student failed to make satisfactory academic progress, and what has changed in the student's situation that will allow the student to demonstrate satisfactory academic progress at the next evaluation; (10) If the institution does not permit a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy must describe how the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; and (11) The policy provides for notification to students of the results of an evaluation that impacts the student's eligibility for title IV, HEA program funds.” Condition: Bluefield State University (BSU), Fairmont State University (FSU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the satisfactory academic progress (SAP) policy. During our testing, we noted there was no documentation retained to evidence that a review of the SAP policy was performed to ensure compliance with federal regulations. Additionally, Blue Ridge Community College (BRCTC) and WVUP did not publish the most recent version of the SAP policy on their websites. Furthermore, WVSOM did not include reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policy as the related SAP polices excluded the required element #11 above. BRCTC had an appropriate policy, but they did not publish the most recent version of the policy on their website. The older version of the SAP policy that was published on their website did not include the required element #11 above. Cause: Management of BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP did not retain sufficient documentation for their review procedures over the SAP policy. Management of BRCTC and WVSOM did not include all reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policies. Effect or Potential Effect: The published SAP policy may be deemed insufficient for the compliance requirements. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP were $5,084,582, $7,651,688, $17,584,932, $93,991,163, $3,672,778, $16,726,007, $3,090,314, $44,681,370, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should ensure the SAP is reviewed and approved on an annual basis and supporting documentation of the review retained. Management should design and implement internal controls over the SAP policy to ensure all requirements are included in the policy appropriately and published on the institution’s website timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – SATISFACTORY ACADEMIC PROGRESS Blue Ridge Community and Technical College, Bluefield State University, Fairmont State University, Marshall University, New River Community and Technical College, West Liberty University, West Virginia Northern Community College, West Virginia School of Osteopathic Medicine, and West Virginia University at Parkersburg Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364 Blue Ridge Community and Technical College (BRCTC) response BRCTC agrees with the auditor’s comments that the internal control process regarding the Satisfactory Academic Progress (SAP) Policy can be improved by maintaining documentation of an annual formal review of the SAP policy and its publication on the website, internal policy manuals and the student catalog. Effective January 2024, BRCTC’s website has been updated to appropriately reflect the SAP policy. Bluefield State University (BSU) response Effective January 2024, internal controls are in place to perform the Review of the Standards of Satisfactory Academic Progress Policy to comply with federal regulations 2-CFR 200.303, 34 CFR 668.16 (e) and 34 CFR 668.34. The current SAP policy was reviewed in June of 2023, but a signature was not maintained. The SAP policy will be reviewed annually prior to the new academic year that begins each August. The review will consist of the Director of Financial Aid, Chief Financial Officer and Provost reviewing all aspects of the current policy at first and then maintaining any changes annually along with retaining signatures of the annual review. The policies and procedures will be given a new review date each year to reflect the process.   Fairmont State University (FSU) response Effective January 2024, the following has been placed into the Satisfactory Academic Progress policy and will go into effect in Spring 2024 - Institutional Documentation Retention. Prior to the Satisfactory Academic Progress policy being applied to students at FSU, the Director will be responsible for the following: 1. Download the most current Satisfactory Academic Progress regulations from studentaid.gov. This documentation will be retained on the M drive under the appropriate aid year file folder for SAP. 2. Review, compare, and update the current Satisfactory Academic Progress policy at FSU with the most current federal regulations. The most current version of the policy will be signed off and dated by the Director of Financial Aid & Scholarship. This documentation will be retained on the M drive under the appropriate aid year file folder for SAP. 3. The Director of Financial Aid & Scholarships will provide any updates to the policy to the Information Systems Specialist by email in order for the Banner system to be updated with the updates. Email documentation will be retained on the M drive under the appropriate aid year file folder for SAP. 4. The Information Systems Specialist will update the Banner system in TEST. 5. The updates will be ran in TEST by running the ROPSAPR process for the future fall and future summer terms. 6. The TEST data will be reviewed and evaluated to ensure all policy updates have been captured and the students have been appropriately evaluated according to federal regulations. 7. The Information Systems Specialist will notify the Director of Financial Aid & Scholarships by email the status of the TEST system to determine if additional updates need to be made. 8. If the Director approves the data from the TEST system, they will notify the Information Systems Specialist by email that the updates are ready for production. Email documentation will be retained on the M drive under the appropriate aid year file folder for SAP. 9. Updates will be applied to the production system by the Information Systems Specialist and the ROPSAPR process will be run on all current students for evaluation. 10. The Information Systems Specialist will notify the Director of Financial Aid & Scholarships by email once the process is complete for one final review of the data to ensure all federal regulations are being met and the students have been evaluated accordingly. Email documentation will be retained on the M drive under the appropriate aid year file folder for SAP. 11. The Director of Financial Aid & Scholarships will sign off on the completed process by email to the Information Systems Specialist. Email documentation will be retained on the M drive under the appropriate aid year file folder for SAP. Marshall University (MU) response MU updated the website in February-March which included a review of SAP Policies and Procedures. MU did not update the Revision Date as there were no updates to Satisfactory Academic Progress federal regulations for the 2023-24 aid year. The policy did not change but was reviewed when updates were made to the website. This policy was updated and also added to the website. Effective February 2024, MU will document and retain all reviews and approvals for compliance with federal regulations. New River Community and Technical College (NRCTC) response NRCTC will continue to review policies and procedures at least once, and sometimes twice a year when the catalog is reviewed. NRCTC will continue doing this review and maintain documentation to ensure compliance with federal regulations. West Liberty University (WLU) response Effective January 2024, to comply with internal control over federal awards, WLU will ensure that SAP policies are compliant with the US DOE standards and retain evidence of the review before the SAP procedures are completed annually. If there are no changes, the policy will be approved to move forward. A signed sheet of the SAP policy approval will be retained in the office and an email of no updates will be sent to others in the Financial Aid Office. If changes are necessary, a financial aid committee would meet to make the appropriate updates. Once the policies and procedures are updated, a signed copy of the update will be retained in the FA Office and an email of the updates will be sent to the Financial Aid Office and communicated to all faculty, staff and students. West Virginia Northern Community College (WVNCC) response Effective December 2023, a new internal control process has been added to validate WVNCC’s processes (including SAP) with any changes to the Dept of Ed regulations, as available for the upcoming school year. WVNCC begins creating the new policy and procedure manual as the new year financial aid setup begins. The Director of Financial Aid will be creating a task force which meets two times per year to review the procedures. As WVNCC’s policy and procedure manual is a live working document, updates will be made as needed with a revision date denoted where applicable. WVNCC had an initial conversation with NASFAA on their policy and procedure information available and has created a sign off form to verify the review of the policy each academic year. This process is being implemented during the 2023-2024, prior to this year, as with the 2022-2023 documents, changes in regulations or college policy changes were made in the policy and procedure manual but may not have had a revision date as it done during the manual creation. This process will be fully implemented for the new 2024-2025 policy and procedure manual as it is being created. The new control will formalize this process, a review of applicable review is in process. West Virginia School of Osteopathic Medicine (WVSOM) response WVSOM did not have adequate internal controls in place surrounding the satisfactory academic policy (SAP) policy. A new SAP policy will be written and published to the public website to include reasonable standards for measuring whether eligible students are maintaining SAP in the educational program in our published SAP policy. The new policy will provide notification to the students of the results of an evaluation that impacts the students’ eligibility for title IV program funds. WVSOM will retain sufficient documentation that the procedures are performed and reviewed by the Financial Aid Director and a second review performed by the Associate Director of Financial Aid. The review will provide two signature sign-offs. West Virginia University at Parkersburg (WVU-P) response Financial Aid employees review all financial aid policies and procedures at minimum once per academic year. The Satisfactory Academic Progress (SAP) policy was reviewed and updated by financial aid staff throughout the spring and was approved by the Executive Vice President in June 2023, the updated SAP policy was forwarded to the President’s office to be filed and posted in the appropriate places, including online. WVU-P agrees that the updated and most recent SAP policy was not posted to the website prior to June 30, 2023. There was a college-wide policy review this spring, and the volume of that caused a delay in the policy’s posting. The resolution for this issue is to complete our policy review process earlier, and ensure if updates are necessary then the Marketing and Communications staff are aware of a deadline prior to June 30 to post the updated policy. WVU-P believes that there is sufficient documentation to show that the review of the SAP policy occurred within the academic year. The policies themselves have footnotes to document that Heather Skidmore reviewed the policies, and then the secondary review completed by Alice Harris before submission to the President. WVU-P will retain all communication that occurs related to future review processes to avoid a repeat finding on this issue.

2023–019 SPECIAL TESTS AND PROVISIONS – GRAMM-LEACH-BLILEY ACT-STUDENT INFORMATION SECURITY (N12) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. At a minimum, an institution’s written information security program — (1) Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). (2) Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 3 14.4(b)). (3) Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 3 14.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: (i) Implement and periodically review access controls. (ii) Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. (iii) Encrypt customer information on the institution’s system and when it’s in transit. (iv) Assess apps developed by the institution (v) Implement multi-factor authentication for anyone accessing customer information on the institution’s system (vi) Dispose of customer information securely (vii) Anticipate and evaluate changes to the information system or network. (viii) Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. (4) Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). (5) Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). (6) Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). (7) Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Condition: Blue Ridge Community and Technical College (BRCTC), Concord University (CU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program for Bluefield University (BSU), CU, MU, NRCTC, Shepherd University (SU), WLU, WVNCC, West Virginia State University (WVSU) and WVUP did not address all required elements per 16 CFR 314.4 outlined above. Furthermore, Fairmont State University (FSU) and Pierpont Community and Technical College (PCTC) did not have a written Information Security Program. For FSU, the written Information Security Program was not in place until May 2023. Cause: Management of BRCTC, CU, MU, NRCTC, WLU, WVNCC, and WVUP did not retain sufficient documentation for their review procedures over the Information Security Program. Management of BSU, CU, MU, NRCTC, SU, WVNCC, and WVSU did not include all reasonable standards required for the Information Security Program. Management of FSU and PCTC did not have a written Information Security Program. Effect or Potential Effect: The written Information Security Program may not be compliant with federal regulations. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, CU, FSU, MU, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, and WVUP were $5,084,582, $7,651,688, $13,833,684, $17,584,932, $93,991,163, $3,672,778, $4,388,461, $15,171,851, $16,726,007, $3,090,314, $9,313,808, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – GRAMM-LEACH-BLILEY ACT-STUDENT INFORMATION SECURITY Blue Ridge Community and Technical College, Bluefield State University, Concord University, Fairmont State University, Marshall University, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia State University, and West Virginia University at Parkersburg Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364 Blue Ridge Community and Technical College (BRCTC) response Management acknowledges that BRCTC did not retain documentation for the review of the written information security policy during the audit year in question. Effective January 2024, documentation will be kept for the annual review of the written information security policy. Bluefield State University (BSU) response BSU will implement policies and procedures by May 2024 to ensure policies and procedures are in place to address the 7 elements and 8 safeguards that are in the Information Security Program. Concord University (CU) response A Complete Risk Assessment was conducted and completed in May 2023 using the ITIL standards. CU also completed the annual GLBA Risk Assessment using the WolfPac software from Wolf and Company in June 2023. This assessment is done in conjunction with Information Technology, Financial Aid, and the Business Office to evaluate the Controls established by NIST 800-171. In addition, CU uses the KnowBe4 product to do simulated phishing campaigns to test the effectiveness of the CyberSecurity Training. CU and every individual are assigned a Risk Score that can be compared to scores for the industry. Anyone that falls for a simulated phishing email is automatically enrolled in additional training. CU has also added the phish reporting function to email clients so everyone can easily report suspected phishing emails for analysis by IT. The GLBA Risk Assessment addresses the following: Employee training and management: All employees are required to complete two trainings each year. One on privacy focused on FERPA and the other on cybersecurity. Current training is being provided using the KnowBe4 software product. CU has reviewed the access to all college resources, especially Banner over the past few months, and made necessary changes to each employee’s access as needed. This review was completed by the Banner data custodians and supervisors. This allows us to ensure alignment of user privileges and job responsibilities. Access to all Banner data was approved by the appropriate data custodian. This is documented and archived in an IT account. All users are required to enter a unique username and password to gain access and are required to meet Microsoft’s password complexity standards. Another important safeguard is physical security. All tele-communication closets are secured by locks and only IT staff has access via a master key or badge. This also is true of the Data Center which houses our on-campus servers. Access to all of our campus services are secured by VPN tunnels. Trendmicro is used to protect client PCs. CU also uses bitlocker on mobile equipment used by employees to encrypt the data. Data that may be stored on mobile devices are required to be encrypted. CU is currently creating a data retention policy for the retention and disposal of data. This policy will meet the state and federal requirements for data retention. Information Systems, including network and software design, as well as, information processing, storage, transmission, disposal, and a complete risk assessment was conducted and completed in May 2023 using the ITIL standards. CU completed a risk assessment using the WolfPac software from Wolf and Company in June 2023. In addition, CU uses the KnowBe4 product to do simulated phishing campaigns to test the effectiveness of the cybersecurity training. The institution and every individual are assigned a risk score that can be compared to scores for the industry. Anyone that falls for a simulated phishing email is automatically enrolled in additional training. CU has also added the phish reporting function to email clients so everyone can easily report suspected phishing emails for analysis by IT. Detecting, preventing, and responding to attacks, intrusions, or other system failures. CU uses a Fortinet Fortigate Appliance to provide Intrusion Prevention System (IPS) Firewall, and Virtual Private Network (VPN) connections to campus. Regular software maintenance and patch management of network equipment is performed. Network patches are deployed in a test bed as they are released. If no issues are found, they are deployed to production network equipment. Systems are monitored weekly and required patches are first cleared with Enterprise Systems to ensure compatibility with Student Information System before production implementation. CU created the incident response plan and disaster recovery plan in 2022. CU partnered with CISA of Homeland Security to conduct weekly vulnerability scans using their Cyber Hygiene Services in 2022. CU also uses Nessus to do internal vulnerability scans on a monthly basis. CU is using these reports to make needed changes to network and server infrastructure to stay as protected as possible from threats. CU implemented multifactor factor authentication for all employees in 2022. Backups of student information system are facilitated by Oracle in our Oracle cloud environment using the Oracle database backup cloud service. Production backups are configured to retain 45 days of changes. CU conducts redundant nightly backups that will be stored on-campus for 365 day coverage and retention. CU also implemented immutable backups through ORACLE during 2023. Safeguards for each risk were identified. Safeguard for each risk were discussed and are shown in the Risk Assessment. CU identified two areas for improvement. Implementing data loss prevention in TrendMicro Apex 1 and blocking traffic from unfriendly nations. Implement and periodically review access controls. Access to Banner is reviewed annually by the data stewards and any unnecessary employee access is removed. Additionally, access is removed when employees leave the institution. CU conducts a periodic inventory of data, noting where it’s collected, stored, or transmitted. This is done as part of the GLBA risk assessment using WolfPac. CU encrypts customer information on the institution’s system and when it’s in transit. Bitlocker is used on university equipment to encrypt the entire computer hard drive. Security channels are used to transfer data when needed. A vpn tunnel and web access firewalls are used to access the Banner data in the Oracle Cloud Infrastructure (OCI). The databases are encrypted at rest and in-transit. Assess apps are developed by CU and internal and external vulnerability scans are conducted. CU also reviews system logs and uses well supported development frameworks and tools. CU implemented multi-factor authentication for anyone accessing customer information on the institution’s system. Multi-factor authentication is required of all employees before they can access CU resources off-site. The employee network is segmented on its own virtual local area network. CU disposes of customer information securely and purged online forms that are no longer needed, especially those that contain PII. Financial Aid recently destroyed old documents using an onsite shredding service after scanning the documents that needed to be retained. For equipment, CU removes hard drives before the equipment is recycled and destroys the drives. CU anticipates and evaluates changes to the information system or network. CU plans for changes to information systems and the network and incorporate appropriate measures to ensure both physical and data security. Banner upgrades and changes are tested by the Banner users group before they are placed into production. A log is maintained of authorized users’ activity and keep an eye out for unauthorized access. Banner currently provides this functionality on a limited basis with a full logging system to be delivered during the current year by Ellucian. Risk assessments of all NIST 800-171 controls are conducted annually using WolfPac. CU uses a continuous improvement model. This year, CU identified improvements we could make in data loss prevention. CU already uses Microsoft’s data loss prevention features, but determined CU could also use Trendmicro’s DLP feature to further lessen the likelihood that emails or files containing PII will be shared. The other improvement CU made was by blocking network traffic from designated countries outside the US. CU can’t block all countries besides the US because the needs of our international students must be met. Vulnerability scans are conducted externally by CISA of Homeland Security weekly and internal vulnerability scans are conducted monthly using NESSUS. Simulated phishing campaigns are run continuously throughout the year through the KnowBe4 software which provides an institution risk score along with the industry average for phish-prone comparison. Risk scores are also assigned to each employee. CU’s average phish-prone percentage is 4.9 compared to the industry 5.5%. The phish prone percentage for the last campaign is 3%. CU has the following policies and procedures which are reviewed by the IT Council and IT Security Council: • Acceptable Use of Information Technology Policy • Disaster Recovery • Incident Response • Information Security Policy • Wireless Network policy Third parties are required to sign a document as part of the contract signifying security compliance. Additionally, all third-party software is included in the vulnerability scans. Changes are determined and implemented based on the risk assessments and regular review of security information from external and internal sources by the IT Security Council. CU has a written Incident Response Procedure which became effective on March 8, 2022. The Chief Information Officer reports at least annually on the institution’s information security program. After reviewing the security plan in February in the Security Council Meeting, CU determined that adding a section on multifactor authentication was overlooked. CU does require and enforce MFA on all employees, but it is not documented in the plan. This will be added to the plan and approved at the next meeting. Fairmont State University (FSU) response A written program was developed in May 2023, management has reviewed and signed the documentation for the written information security program. The written program is effective January 2024. Marshall University (MU) response A regular review of each policy is being implemented per recommendations by our cybersecurity advisor in the 2023 GLBA Assessment Report. Information Technology (IT) policies and administrative procedures are being updated by the Marshall University IT Council (ITC). Once updated, they will be scheduled for an annual policy review as part of the IT activity wheel as a corrective action for this finding. In late June 2023, a GLBA Risk Assessment was conducted by an external cyber security advisor. Remediation of findings from this risk assessment is currently underway by a cross-functional team lead by IT. Priority is being placed on addressing updates to 14 CFR 314.4 which took effect in early June 2023. As a corrective action for this finding, the CISO revise the written information security program to reflect the latest updates to 14 CFR 314.4 New River Community and Technical College (NRCTC) response NRCTC’s Data Stewards will be reviewing and approving this information each spring and then sharing that approval with the President’s Cabinet so that it appears in the minutes as evidence for the next audit. NRCTC also developed GLBA Compliance Procedures which were implemented in January 2024. Pierpont Community and Technical College (PCTC) response PCTC’s Information Security Program is overseen and administered by the CIO of the Institution. The CIO will use all information that can be gathered to help protect the Institution. PCTC uses multiple vendors to help identify and mitigate internal and external risks. A third-party vendor is used to perform a yearly security audit. A weekly cyber hygiene assessment is provided to the Institution by CISA. A third-party vendor is used to patch and maintain all on-prem networking equipment to the latest patch levels where needed including firewalls and internal equipment. The following safeguards are used: a. Physical access to all sensitive information technology (IT) areas is locked down via either key or keycard access and follow the access to security controlled spaces policy. PCTC adheres to a least privileged access model for sensitive data. b. Random periodic checks are done on data inventory throughout the year. c. The system that houses all student systems and employee information is hosted on web-based systems and the connections are encrypted and secure. Email to outside parties that contain sensitive information is encrypted. The data security policy will be followed. d. PCTC does not use any in-house developed applications. e. Multi-factor authentication (MFA) will be turned on for email and all other SSO applications in the first quarter of 2024 for all internal employees. f. Any data stored electronically on physical media is disposed of using a third-party vendor that provides the Institution with a certificate of destruction and follows the Computer Disposal Policy. g. All PCTC systems and networks are periodically reviewed for changes. Any changes outside of a standard change (i.e. Windows updates), will be logged in the change control document. h. System logs and privileged access groups (i.e. domain admins, etc.) are routinely reviewed for inappropriate changes. PCTC uses the information from the yearly audit in conjunction with the weekly cyber hygiene report to test and monitor any remediations that have been deployed. PCTC is currently working on a formal policy committee approval process that will be implemented withing the first quarter of 2024. At this time, all IT policies will be formally accepted and followed. PCTC will have a service contract and/or business agreement in place with all outside vendors that will outline the terms and scope between the two entities. All information that is discovered from all audits, testing, scans, or other tools that the IT department deems necessary, will be used to remediate and/or help make changes to existing polices to help protect PCTC and all user’s data. Shepherd University (SU) response Joseph Dagg serves as the CIO/CISO, Director of IT Services and serves as the point of contact for all things data security related, including GLBA as the Privacy Officer. Effective February 2024, activities performed as normal operations include access controls being reviewed at minimum once per year internally. Additionally, access/purge processes are executed on a rolling basis for students per year. Inventory of data occurs at minimum once per year internally. Protocols adhere to internal processes approving access via Banner custodian group. All data is encrypted at all stages, including transit. No apps are developed by SU. MFA is active. Customer information is retained/disposed according to internal guidelines within IT Services of data. Changes are anticipated and regularly reviewed internally and externally with the aid of IT consultants and vendors to ensure our security posture. User logs are reviewed at a minimum of once per year internally. Internally, IT management meets every month to discuss security and additional processes that need accounted for in addition to monthly stand-up meetings to account for immediate agile changes. Internally, executive governance meetings occur at minimum annually to review existing policies and address security issues to forecast change. Internally, SU will be working with IT consultants and external vendors to participate in table top security exercises to test/validate internal procedures. Monthly and quarterly, Nessus scans are performed to assess risks and mitigation needs within network, adhering to the CISA and NIST protocols for data security. Executive governance staff, internal IT management, IT consultant and vendors work cohesively together to provide a pathway to improve our security posture. Effective immediately, IT Services will review all affiliated policies, procedures, and activities related to GLBA compliance on a quarterly basis. Results of these reviews and/or any corrective actions identified will be documented and retained through the IT ticketing system for future reference. West Liberty University (WLU) response WLU is active in evaluating the need and designing a procedure to ensure documentation relating to evidence of management reviews of user access to the WLU production network and our Banner financial system. The procedure will be complete by February 2024 and implemented immediately thereafter. It will include a minimum of two reviews per fiscal cycle. West Virginia Northern Community College (WVNCC) response The WVNCC IT Policies has been updated as of February 2024 to include the previous missing items of 1) designate the Director of IT to oversee and implement security programs and 2) periodic review schedule of access controls. West Virginia State University (WVSU) response WVSU concurs with the finding and has developed a plan of action to include the following: 1. Review and Identify Gaps: - Conduct a thorough review of the current Information Security Program (ISP) against the requirements outlined in 16 CFR 314.4 and identify specific elements that are missing or inadequately addressed in the existing ISP. 2. Develop a Remediation Plan: Based on the identified gaps and insights through discussions with management and experts, create a detailed remediation plan and clearly outline the steps required to address each missing element in the ISP, including timelines, responsibilities, and resources needed. 3. Update Information Security Program: Implement the remediation plan by updating the Information Security Program to incorporate all the required elements specified in 16 CFR 314.4 and ensure that the revised ISP reflects best practices and industry standards for information security. 4. Training and Awareness Programs: Conduct training sessions and awareness programs for WVSU faculty and staff involved in the management and implementation of the Information Security Program and emphasize the importance of compliance with regulatory standards and educate staff on their roles and responsibilities in maintaining information security. 5. Periodic Reviews and Audits: Establish a system for periodic internal reviews of the Information Security Program to ensure ongoing compliance and implement a feedback loop that allows for continuous improvement and adjustments to the ISP based on changing regulatory requirements and emerging threats. 6. Documentation and Reporting: Maintain comprehensive documentation of the updated Information Security Program, including the rationale for each inclusion and the corresponding actions taken. 7. Continuous Monitoring: Implement a continuous monitoring process to track the effectiveness of the updated ISP in real-time and utilize automated tools and regular risk assessments to identify and address any new vulnerabilities or compliance gaps promptly. 8. Communication and Transparency: Communicate the changes made to the Information Security Program transparently to all relevant stakeholders and foster a culture of openness and encourage reporting of any potential security issues or concerns. By following this plan of action, WVSU can implement the updated Information Security Program, and demonstrate a commitment to maintaining a robust and compliant information security posture by August 2024. West Virginia University at Parkersburg (WVU-P) response By March 29, 2024, WVU-P will implement a formal tracking program that will adequately document the review process of its Information Security Program. Review will occur the month of March for all sections of the Security Program by the designated responsible party and will repeat annually. Each section will be listed in a spreadsheet, shared with the appropriate responsible parties, along with the following details: section name, responsible party, last update date, last updated by, last review date, last reviewed by, and additional notes. All reviews will be tracked using this spreadsheet. Additionally, by March, 29, 2024, WVU-P will implement and enforce the following password settings for Banner accounts: ● Minimum password length of <x> ● Password complexity requirements (Upper, lowercase, numbers, and symbols required) ● History (last three passwords will be checked) ● Account lockout: 3 attempts, 30 minute lock out ● WVU-P currently utilizes unique accounts for privileged access and will continue to prohibit the sharing of default privileged accounts. By March 29, 2024, WVU-P will add internally developed applications to the annual formal review process. Application reviews will use the same process as Access Control and Information Security Policy reviews. Applications will be reviewed to identify which specific data sources are used, how they are used, and the potential impact of unauthorized access. Additionally, applications will be reviewed to ensure that industry standard security best practices are followed.

2023–020 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – VERIFICATION (N1) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Fairmont State University (FSU) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing, we noted for the samples selected that there were multiple selections showing a lack of proper review in the verification process. Cause: FSU did not have adequate internal controls in place to ensure that verification changes identified were processed and submitted to the U.S. Department of Education. Effect or Potential Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Questioned Costs: N/A Context: We selected a sample of 23 students for FSU and identified 8 instances where the verification forms were not reviewed and approved. Total Student Financial Assistance Cluster expenditures for FSU were $17,584,932 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–015 and 2021–014 Recommendation: Management should develop and update internal controls to ensure that controls related to the verification process are implemented. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – VERIFICATION Fairmont State University (FSU) Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364 Effective February 2024, controls were put into place to address the additional review of the verification compliance requirement process once the initial review was completed. A weekly review with a comprehensive monthly review will be implemented to ensure no students are missed through the review process.

2022-015

2023–022 SPECIAL TESTS AND PROVISIONS – RETURN OF TITLE IV FUNDS (N4) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 668.173(b) requires timely return of title IV, HEA program funds. “In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if - (1) The institution deposits or transfers the funds into the bank account it maintains under § 668.163 no later than 45 days after the date it determines that the student withdrew; (2) The institution initiates an electronic funds transfer (EFT) no later than 45 days after the date it determines that the student withdrew; (3) The institution initiates an electronic transaction, no later than 45 days after the date it determines that the student withdrew, that informs a FFEL lender to adjust the borrower’s loan account for the amount returned; or (4) The institution issues a check no later than 45 days after the date it determines that the student withdrew. An institution does not satisfy this requirement if - (i) The institution’s records show that the check was issued more than 45 days after the date the institution determined that the student withdrew; or (ii) The date on the cancelled check shows that the bank used by the Secretary or FFEL Program lender endorsed that check more than 60 days after the date the institution determined that the student withdrew.” Condition: Blue Ridge Community and Technical College (BRCTC), Mountwest Career & Technical College (MCTC), Pierpont Community and Technical College (PCTC), and West Virginia Northern Community College (WVNCC) were unable to provide adequate documentation showing they maintained an effective review process over the returns of Title IV funds. In addition, for Bluefield State University (BSU) it was noted during compliance testing that certain amounts to be returned were not returned timely. Cause: The institutions do not have adequate internal controls in place over the return of Title IV funds to prevent noncompliance. Effect or Potential Effect: The institutions may not be returning the correct amount of federal student financial assistance required or the funds are not returned within the required time frame to the United States Department of Education. Questioned Costs: None Context: In 11 of 29 instances of internal control testing at BRCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. The support documentation provided did not include any evidence of review. In 19 of 22 instances of internal control testing at MCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. MCTC relied on application controls within the Banner system, which has been determined to have ineffective ITGCs. Additionally, the support documentation provided did not include sufficient evidence of review. In 2 of 18 instances in internal control testing at PCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. In addition, the return to Title IV funds was not completed within the required 45-day timeframe. In all 20 instances of internal control testing at WVNCC, we noted that the internal control was not sufficiently documented or not functioning effectively. WVNCC relied on the application controls within the Banner system, which has been determined to have ineffective ITGCs. Additionally, there was no evidence of review of the calculation in the support documentation provided. In one of 40 returns tested for compliance, we noted that one return related to BSU was not completed within the required 45-day timeframe. Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, MCTC, PCTC, and WVNCC were $5,084,582, $7,651,688, $4,467,631, $4,388,461, and $3,090,314, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643 Identification as a Repeat Finding: Prior Year Findings 2022–011 and 2021–015 Recommendation: Management should implement internal controls to ensure that the correct amount of federal student financial assistance is returned and returned within the required time frame. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – RETURN OF TITLE IV FUNDS Blueridge Community and Technical College, Bluefield State University, Fairmont State University, Mountwest Community & Technical College, Pierpont Community and Technical College, and West Virginia Northern Community College Assistance Listing Number 84.007, 84.033, 84.063, 84.268 Blueridge Community and Technical College (BRCTC) response BRCTC maintains a review procedure implemented in December 2023 over the entire Return of Title IV process; after this review, BRCTC will add a secondary review and sign off of those students whose aid does not have to be returned due to being outside the return window. Bluefield State University (BSU) response Effective February 2024, internal controls are in place to perform the Return of Title IV withdrawal and calculation ensuring records comply and that Return of Title IV Refunds are within the required time frame of 45 days. Controls include the review of “Permit to Withdraw” forms to ensure they are completed with all signatures of offices involved and the sign off of Return of Title IV calculations. All reviews will occur within the time frame of 45 days by the Financial Aid Director along with Business Office and Accounting. On February 8, 2024, the Director of Financial Aid spoke with the Registrar and the FA Counselors in separate meetings regarding the late submission of withdrawal forms and performing the Return of Title IV calculations. The Registrar understands they must submit the completed withdrawal forms to the Financial Aid office the same day they are completed by her office. When the forms are received by Financial Aid, a Return of Title IV will be completed within the same week of receipt and sent to the Business Office, if a Return of Title IV Aid is required. The Business Office will then review the calculations and perform the necessary repayment of Title IV Aid to the Department of Ed, utilizing the refund process through G5 within the required 45-day timeline. All adjustments to the students account will be made with in the same time frame.   Fairmont State University (FSU) response FSU has been identified as an institution that does not have adequate internal controls in place over the return of Title IV funds to prevent noncompliance. FSU has implemented the following Return of Title IV controls. Step by Step-Initial Review: 1. FSU (Information Systems Technician) performs all Return of Title IV calculations through FAA Access to CPS on-line. 2. In Banner, the funds are unapplied to the student’s account according to the Return of Title IV calculation from FAA Access. 3. Return completed Title IV Returns spreadsheet to the Accounting Assistant II that sent them to you with a ‘y’ in the column marked Aid Returned and the dollar amounts of any aid that was returned, and if a letter was mailed to the student and the dollar amount the student is responsible for paying. 4. In Banner comments are added to RHACOMM which include the date of withdraw(s), the type of funds that were returned and the amount of each fund that was returned. 5. If the student has to return Pell Grant (section 10 of the Title IV worksheet)- must send a letter then student has 45 days. Follow up according to federal regulations. 6. If there is a post withdraw disbursement, a letter is sent to the student. Follow up according to federal regulations. 7. FSU only completes the Return of Title IV calculation for students who have withdrawn outside of the withdraw window upon request. Secondary Review: FSU (Financial Aid Counselor) performs a second review of the Return of Title IV calculations through FAA Access to CPA on-line. This individual verified the data for the calculation has been entered correctly, the adjustments to the Banner system are accurate, and signs off on the Return to Title IV calculation worksheet. FSU has the following controls in place: Who performs the control? Finance Program Manager and Information Systems Technician. What are the reviewer’s qualifications? 3+ years’ experience. When or how often is the control performed? Weekly. What does the reviewer evaluate? Verifies the data for the calculation has been entered correctly, and the adjustments to the Banner system are accurate. What precision is encompassed? (How granular is the review? What are the criteria for investigation? What is the objective of the review?) By student. Additional investigation is needed when reviewer cannot produce the same results from the Return to Title IV form. Verify the accuracy of the calculation and to ensure the data being used for recalculation is accurate. What actions are taken or result? Redoing the recalculation worksheet after verifying the data from the system. Mountwest Career & Technical College (MCTC) response MCTC maintains email communication regarding the completion of Unofficial Return of Title IV Withdrawal Calculations each semester indicating timeliness of calculations. Sampling is done to check calculations and that will be made available in future audits, effective February 2024. MCTC will maintain the SFRWDRL reports for all withdrawals (both official and unofficial) run in “update” mode with notations to indicate timeliness, and to indicate that touch points along the calculation have been reviewed such as checking start and end dates in STVTERM and break days in SOATBRK as well as percentage calculated comparing Banner percentages to manually calculated percentages. Sampling of calculations will be compared to manual calculations using USDE supplied manual Return to Title IV worksheets to ensure that the Banner calculation of returns aligns with the manual calculation. Pierpont Community and Technical College (PCTC) response During the prior year’s audit, it was discovered that the prior processer was not completing the Return of Title IV properly. The processer left employment and Return of Title IV procedures were taught to the new processer and Asst. Director. This took place in November 2022. Unfortunately, the processer also did not complete two Return to Title IV before leaving and failed to communicate this information. It was not discovered until after the 45-day window for completion. Upon discovery, the two Return of Title IV were completed and PCTC have since followed the process and have had no additional similar findings. The process is functioning properly which will continue to be followed going forward. West Virginia Northern Community College (WVNCC) response Effective February 2024, for Return to Title IV review and processing in addition to the policies and procedures manual, these additional steps will be taken to maintain internal controls including maintaining email communication regarding the completion of Return of Title IV withdrawal calculations each semester indicating timeliness of calculations. Sampling will be done to check calculations and will be made available in future audits. WVNCC will continue to maintain in the Registrar’s office, the SFRWDRL reports for all withdrawals (both official and unofficial) run in “Update” mode with notations to indicate timeliness, and to indicate the calculations have been reviewed such as checking start and end dates in STVTERM and break days in SOATBRK as well as percentage calculated comparing Banner percentages to manually calculated percentages. The Financial Aid office will maintain a sampling of calculations that are compared to manual calculations using US Dept of Ed supplied manual Return of Title IV Worksheets to ensure that the Banner calculation of returns aligns with the manual calculation. Additionally for the Fall 2024 semester, a manual sampling of calculations will be reviewed to confirm that the calculations for the current award year are matching.

2022-011

2023–024 SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE (N3) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of federal student aid credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. Regulations at 34 CFR 668.164(e) and (f) establish two different types of arrangements between schools and financial account providers: Tier One arrangements and Tier Two arrangements. The type of arrangement determines the provisions that are applicable to the school. 34 CFR 668.164(e)(2)(viii) states under a T1 arrangement, the institution must “provide to the Secretary an up-to-date URL for the contract and contract data as described in paragraph (e)(2)(vii) of this section for publication in a centralized database accessible to the public.” 34 CFR 668.164(e)(2)(ix) states under a T1 arrangement, the institution must “ensure that the terms of the accounts offered pursuant to a T1 arrangement are not inconsistent with the best financial interests of the students opening them. The Secretary considers this requirement to be met if (A) The institution documents that it conducts reasonable due diligence reviews at least every two years to ascertain whether the fees imposed under the T1 arrangement are, considered as a whole, consistent with or below prevailing market rates; and (B) All contracts for the marketing or offering of accounts pursuant to T1 arrangements to the institution's students make provision for termination of the arrangement by the institution based on complaints received from students or a determination by the institution under paragraph (e)(2)(ix)(A) of this section that the fees assessed under the T1 arrangement are not consistent with or are higher than prevailing market rates.” 34 CFR 668.164(e)(2)(x) states under a T1 arrangement, the institution must “take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that requirements of this section are met with respect to all accounts offered pursuant to T1 arrangements.” Condition: Bluefield State University (BSU), Blueridge Community & Technical College (BRCTC), Concord University (CU), Mountwest Community & Technical College (MCTC), Shepherd University (SU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) have a T1 arrangement with a third-party servicer. BSU, CU, SU, WVNCC, and WVUP were unable to provide documentation showing that their institutions had submitted a URL to their contract with their third-party servicer and cost information related to their third-party servicer to the U.S. Department of Education for publication in the Cash Management Contracts Database. BSU, BRCTC, CU, MCTC, SU and WVNCC were unable to provide evidence showing that their institutions documented a due diligence review over the fees assessed by their third-party servicer of Title IV credit balances. Cause: BSU, BRCTC, CU, MCTC, SU, WVUP, and WVNCC did not have an internal control in place to review the contract with their third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. As such, instances of noncompliance were noted above. Effect or Potential Effect: The schools are not in compliance with certain federal regulations over T1 arrangements contained in 34 CFR 668.164(e). Questioned Costs: None Context: BSU, BRCTC, CU, MCTC, SU, WVNCC, and WVUP had total expenditures of $7,651,688, $5,084,582, $13,833,684, $4,467,631, $15,171,851, $3,090,314, and $6,847,451 respectively. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should implement internal controls over the review of the contract with their third-party servicer of Title IV credit balances and their Title IV compliance audit, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2) to ensure compliance with the federal regulations over T1 arrangements. Documentation over the specific items reviewed and conclusions reached should be retained to support the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE Bluefield State University, Blueridge Community & Technical College, Concord University, Mountwest Community and Technical College, Shepherd University, West Virginia Northern Community College, and West Virginia University at Parkersburg Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364 Bluefield State University (BSU) response BSU will submit the URL of their contract with their third-party servicer and cost information to the U.S. Department of Education for their publication in the Cash Management Contracts Database by Friday, February 23, 2024. BSU will also implement a detailed due diligence review over the fees assessed by the third-party servicer of Title IV credit balances. Blueridge Community & Technical College (BRCTC) response We acknowledge that BRCTC did not have internal controls in place to review the contract with our third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. By February 2024, documents will be requested and an annual due diligence review will be performed and documented of the third-party servicer contract and compliance audit as well as review of fees assessed by the third-party servicer. Concord University (CU) response CU agrees with this finding and due to changes in personnel, this regulation was not followed. CU will review and document the review of the Cash Management Database annually to ensure the link is posted. CU will review and document the review of other financial institutions charges compared against BankMobile’s fees annually. CU will annually review the servicer’s SOC report. CU will review BankMobile’s report, specifically looking for instances of noncompliance and internal control breaches. This will be documented annually. Mountwest Community and Technical College (MCTC) response Effective February 2024, MCTC will implement a review process to be conducted on an annual or monthly basis, as applicable, of all accounts opened with the Servicer during the specified timeframe. The "Activation & Preferences Report" available to management through the Servicers Administrator portal will be used to provide the data for review by management. The review process will consist of the following: • A request made of the servicer to provide a report of accounts opened with date/time stamp of consent to opening. Frequency: Monthly • Review of "Activation & Preferences Report" validated against Servicer "Accounts Opened" report. Frequency: Monthly • Generate a follow-up email to applicable students confirming the opening of the Servicer Account which will include an attachment of the Servicer "Terms and Conditions" and "Fee Schedules". Frequency: Monthly • Review the Servicers' Client Contract and Profile site for accuracy and completeness of information. Frequency: Annually • Review the Servicers' System and Organization Controls (SOC) and Compliance audits. Frequency: Annually • Management will incorporate as part of its "Due Diligence and Attestation" copies of comparable banking institution fee schedules that are date/time stamped to serve as evidence of review. Shepherd University (SU) response By April 2024, SU will develop and maintain a checklist that will be periodically reviewed and signed off related to this finding, specifically: Annually, SU will be submitting the URL to the Department of Education related to the contracts between SU and BankMobile, reviewing compliance audits and SOC reports for BankMobile, recording areas of risk, and noting ways to mitigate the potential risk moving forward. West Virginia Northern Community College (WVNCC) response Beginning June 2024, during the annual review meeting between WVNCC and BankMobile (the servicer that delivers Title IV credit balances to students), WVNCC will obtain a copy of the BankMobile compliance audit. This will be kept on file within the Business Office for reference if needed. In addition, the budget committee will review annual the fees charged by BankMobile and attempt to compare them to other providers of similar services. West Virginia University at Parkersburg (WVU-P) response WVU-P has submitted a URL to the US Department of Education of our contract and cost information with our third-party servicer. This submission should correct this portion of the finding although it was done after the end of the fiscal year under audit but serves to correct the finding in subsequent periods. WVU-P will ensure compliance with the remaining items noted by creating a written internal control policy requiring the following: • Verification of the required submission of the third-party contract with the Department of Education. • Documentation of a due diligence review of the fees assessed by the third-party servicer. • Obtain a copy of the annual compliance examination of the Title IV Programs. The 2022 report dated June 29, 2023, was received and reviewed by us for compliance with eligibility, systems, and internal controls, disbursements, Return of Title IV funds, and administrative requirements. • Obtain a list of students whose refunds were disbursed by the third-party vendor and cross-reference it with a list of the students processed and sent to the third-party vendor by WVU-P. For those students who elected to open a checking account, WVU-P will review supporting documentation to indicate that the student gave proper consent. These policies and procedures will be effective February 2024.

2023–025 SPECIAL TESTS AND PROVISIONS – PERKINS LOAN RECORDKEEPING AND RECORD RETENTION (N7) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.038 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” As stated in the 2023 OMB Compliance Supplement (34 CFR 674.19), “when an institution uses a third-party servicer for its Perkins Loan program, the institution must perform due diligence to ensure that the third-party servicer is in compliance with the requirements for the functions the third-party servicer is performing for the institution. Such due diligence could include obtaining and reviewing the third-party servicer’s most recent Title IV compliance audit.” 34 CFR 674.19(e)(2) states “an institution shall retain a record of disbursements for each loan made to a borrower on a Master Promissory Note (MPN). This record must show the date and amount of each disbursement.” 34 CFR 674.19(e)(4) states “Manner of retention of promissory notes and repayment schedules. An institution shall keep the original promissory notes and repayment schedules until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. (i) An institution shall keep the original paper promissory note or original paper MPN and repayment schedules in a locked, fireproof container. (ii) If a promissory note was signed electronically, the institution must store it electronically and the promissory note must be retrievable in a coherent format. An original electronically signed MPN must be retained by the institution for 3 years after all the loans made on the MPN are satisfied. (iii) After the loan obligation is satisfied, the institution shall return the original or a true and exact copy of the note marked “paid in full” to the borrower, or otherwise notify the borrower in writing that the loan is paid in full, and retain a copy for the prescribed period.” Condition: Concord University (CU), Marshall University (MU), Shepherd University (SU), West Liberty University (WLU), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University (WVU) did not maintain sufficient evidence of the due diligence review performed over their third-party servicer of its Federal Perkins Loan Program portfolio. While the schools obtained the third-party servicer’s Title IV compliance audit report, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2), the schools did not retain documentation showing what specific items were reviewed or what conclusions were reached related to the servicers compliance with the requirements they were contracted for. For six of 40 Perkins loans sampled, WVU could not provide a copy of the MPN. Cause: CU, MU, SU, WLU, WVSOM and WVU did not have effective internal controls in place requiring retention of the due diligence review performed. WVU did not have adequate internal controls in place over the retention of Perkins loan records, specifically, MPNs. Effect or Potential Effect: The third-party servicer could be out of compliance with federal regulations and have ineffective internal controls which could impact the school’s compliance with the Federal Perkins Loan Program requirements. In addition, WVU is in noncompliance with federal Perkins loan recordkeeping and record retention requirements. Questioned Costs: None Context: CU, MU, SU, WLU, WVSOM, and WVU had Federal Perkins Loan Program expenditures of $1,096,355, $2,246,751, $60,304, $1,076,806, $482,984, and $8,147,751, respectively. Total Federal Perkins Loan Program expenditures were $13,183,684 for the year ended June 30, 2023. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should retain all relevant documentation used in performing the due diligence review, including the specific items reviewed and the conclusions reached. In addition, WVU should ensure it is retaining the required Perkins loan program records for the timeframe required per federal regulations. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – PERKINS LOAN RECORDKEEPING AND RECORD RETENTION Concord University, Marshall University, Shepherd University, West Liberty University, West Virginia School of Osteopathic Medicine, and West Virginia University Assistance Listing Number 84.038 Concord University (CU) response Due to changes in personnel, CU did not follow this regulation. CU will review ECSI’s report, specifically looking for instances of noncompliance and internal control breaches. This will be documented annually and will be effective August 2024. Marshall University (MU) response MU has regularly monitored the services provided by ECSI for accuracy and completeness throughout a 30-year relationship without significant issues. Additionally, during fiscal year 2023, MU worked closely with ECSI on the Department of Education’s government assignment of 837 Perkins loans going back as far as 1978. This process clearly involved several compliance requirements of this program and was completed with no compliance problems encountered. MU will document the review of ECSI’s annual audit going forward. Shepherd University (SU) response By April 2024, SU will develop and maintain a checklist that will be periodically reviewed and signed off related to this finding, specifically: Annually, SU will pull SOC reports along with any compliance audits for review of findings or areas of interest and will assess and determine any factors that may need further investigation or mitigation from SU. West Liberty University (WLU) response Effective February 2024, WLU’s CFO, Controller and Student Accounts Manager together will meet and review the most recent Title IV compliance audit. The meeting will be set using emails. Minutes and notes will be taken regarding items reviewed and conclusions reached and will retain documentation and all other relevant documentation will be retained. Any issues that arise will be dealt with accordingly. West Virginia School of Osteopathic Medicine (WVSOM) response Adequate due diligence was not performed to ensure that the third-party services, Educational Computer Systems, Inc. (ECSI) were following the requirements for the functions that they are performing for WVSOM. The third-party services Title IV compliance audit was obtained but was not signed off on as reviewed. A new procedure will be written with the following steps: 1) Accountant Senior in the Cashiers office will request the “Examination Report on Compliance with Title IV Programs” and the System and Organization Controls for Service Organizations: Controls Relevant to Security (SOC 2). The Accountant Senior will review the reports for compliance and sign off. 2) Accountant Senior will forward the reports to the Director of Finance. The reports will be reviewed for compliance and signed. 3) The Director of Finance will forward it to the Director of Accounting for submission with the audit. The new procedure will provide two reviews and sign-offs and are effective January 2024. West Virginia University (WVU) response WVU’s Student Financials Services (SFS) department receives the 3rd Party Servicer compliance reports annually and reviews these reports once received. WVU will maintain detailed meeting minutes to document the review of 3rd Party Servicer reports moving forward. The review of the report available for fiscal year 2024 was conducted on December 19, 2023 between members of Compliance and Training (CT) and Revenue Management (RM) teams. In this meeting, the following 3rd Party Servicer reports were discussed; report on controls at a service organization relevant to user entities’ internal control over financial reporting, SOC 2 report and examination report on compliance with Title IV programs. It was noted there were no findings in the reports. Regarding MPN’s, deferments and cancellations for Perkins loans, members of SFS are pursuing several areas of remediation to resolve the fiscal year 2023 finding. SFS personnel will review all open Perkins loans and inventory files to consolidate into one central location. All files will be reviewed for paper MPN’s, deferment and cancellations request and an inventory list will be attached to a central location for all Perkins records. Additionally, WVU is in the process of exploring liquidation of all Perkins loans currently held by the school. While SFS is committed to resolving the current issues regarding Perkins Recordkeeping, it should be noted that this commitment must be balanced with staff’s requirements to process student aid for current students that has been delayed numerous times due to FAFSA simplification delays.

2023–026 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – ENROLLMENT REPORTING (N5) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Internal controls over the review and approval of the enrollment report sent to the National Student Clearinghouse (NSC) were not adequately designed or operating effectively for Bluefield State University (BSU), Blueridge Community and Technical College (BRCTC), Concord University (CU), Fairmont State University (FSU), Marshall University (MU), Mountwest Community and Technical College (MCTC), New River Community and Technical College (NRCTC), Pierpont Community and Technical College (PPCTC), Shepherd University (SU), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia State University (WVSU), West Virginia University (WVU), and West Virginia University at Parkersburg (WVUP). For the enrollment reporting transmissions tested for internal controls, we noted the following: * Final review and approval signoff to submit the enrollment report to NSC, the third-party used in the enrollment reporting process, was not consistently retained by the institution (BSU, BRCTC, PCTC, WLU, WVNCC, WVSU) * A record count reconciliation between the final enrollment report, text file and the number of files received by the NSC, including documentation over how any rejected records were addressed, was not retained. (BSU, BRCTC, CU, FSU, MU, MCTC, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, WVU, WVUP) * Details of the validation of student information included in the enrollment report for accuracy was not consistently retained by the institution. (BSU, FSU, MU, MCTC, NRCTC, WVSU) * The NSC automated emails used as a quality checklist regarding due dates, receipt of the text file by the NSC, availability and completion of the Error Resolution Report, and confirmation of certification and processing by the NSC were not consistently retained by the institution (BSU, BRCTC, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, WVUP) Cause: The institutions did not have adequately designed internal controls in place surrounding the enrollment reporting process. Effect or Potential Effect: The institutions may not promptly notify the National Student Loan Data System (NSLDS) of changes in student status in an accurate and complete manner; thus, inaccurate, or incomplete information could be reported to the NSLDS. Questioned Costs: None Context: The total expenditures for the SFA Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–012 and 2021–016 Recommendation: Documentation over the review and approval of the enrollment report for accuracy and completeness should be retained to evidence the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – ENROLLMENT REPORTING Bluefield State University, Blueridge Community and Technical College, Concord University, Fairmont State University, Marshall University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia State University, West Virginia University, and West Virginia University at Parkersburg Assistance Listing Number 84.063, 84.268 Bluefield State University (BSU) response Effective February 2024, BSU will review the final enrollment report and approvals will be signed off to submit the report to NSC, the third party will consistently retain a copy within our institution. BSU will retain the record count reconciliation between the final enrollment report, text file, and the number of files received by the NSC, including documentation on how any rejected records were addressed. BSU will retain the details of the validation of the student’s information included in the report for accuracy. BSU will consistently retain the NSC automated emails used as a quality checklist regarding due dates, and receipt of the text files by the NSC. The availability and completion of the Error Resolution Report, as well as the confirmation of certification and processing by the NSC report, will all be retained. Blueridge Community and Technical College (BRCTC) response BRCTC asserts that the Enrollment Reporting process is accurate and reviewed in a timely manner; BRCTC further asserts that the emails from the National Student Clearinghouse are reviewed. As a result of this finding, BRCTC will expand its internal control to include documentation of reviews internally and externally with the NSC. This update to the internal control process was implemented in February 2024. Concord University (CU) response Effective February 2024, the internal controls at CU over the review and approval of the enrollment report sent to the National Student Clearinghouse (NSC) have been updated to include the following control measures in addition to the current controls on file: 1. CU has contacted NSC to begin generating the email response for the receipt of the .txt file when submitting it to the NSC FTP portal. This email notification will be kept on file with the other report documentation. 2. CU has implemented a new checklist sheet to accompany the report and its documentation to provide a clear and organized outline of required documents and to ensure these requirements are provided. This sheet will be part of the Spot Check Letter that is included in the current control method and signed off on by two members of the Registrar’s Office staff. 3. CU has also included in this new checklist a space to document the number of student files submitted to NSC and the number of files submitted to NSLDS as noted by NSC. The printout of this notation provided by NSC will also serve as documentation attached to the report. Fairmont State University (FSU) response Effective February 2024, FSU will retain a screen shot of the record count received by the NSC and will document any rejected records and what the plan is to address the rejected records. FSU will review a portion of the enrollment records being submitted before the submission is uploaded to NSC. This review will include detailed documentation, for a select few, of how we validated the student’s enrollment status. FSU will keep a spreadsheet of the students that are validated and the Banner screens that are used to do so.   Marshall University (MU) response Effective February 2024, MU will document that a record count reconciliation has been completed between the enrollment submission file and the number of files received by the NSC. MU will document and retain how any rejected records were addressed. MU will also document and retain records of the spot check validation for accuracy of student information included in the enrollment submission files. Mountwest Community and Technical College (MCTC) response Effective February 2024, a record count reconciliation between the final enrollment report and the number of files received by the National Student Clearinghouse (NSC) will be completed. MCTC will have the NSC query historical data and have it provided in Excel format. This will be a new source of data that will be collected and retained. This file will be generated after every rejection error report that is returned to the NSC. Each file will be saved, and a copy will be sent to the Registrar’s Office. Transmission history can also be saved by table, that can be exported to Excel. These files will also be saved, and a copy sent to the Registrar’s Office. For validation of student information, MCTC will being the process to collect data for the NSC submission first begin in audit mode. This will allow for review of the data to make any corrections that appear in the first stage of the report. Next, a second row of audits processed by the Associate Registrar will be conducted and confirm the data integrity. After this is complete, a copy of the final submission will be sent to the Registrar for final review and authorization. When approval is returned to the Associate Registrar, the data will be uploaded to the NSC. New River Community and Technical College (NRCTC) response Effective August 2024, the Registrar's office will run a random selection of 20 students from NSLDS to ensure students are correct in the clearinghouse, which will be done at least 50 days out from the time students were initially reported. The Registrar’s office will keep documentation of the sampled students. The Registrar’s office will keep records of how many files were accepted and how many were rejected. The Registrar’s office will provide documentation of validation of student information included in the enrollment report and retain emails by providing a file specially for NSC enrollment reporting emails received and sent regarding enrollment reporting. Emails to be retained are error resolution and confirmation of certification and processing by the NSC. The Registrar’s office will also create a checklist to follow and use as documentation to ensure all steps throughout the process are completed and checked off the list. Pierpont Community and Technical College (PCTC) response Effective February 2024, PCTC will complete the review of the file before it is submitted, not after it’s submitted. The Associate Registrar will pull the report prior to the due date to give those in the review process ample time to review the files before the Associate Registrar submits the document to the NSC. PCTC will keep track of the due date of submission, the date the text file was sent to the NSC, the date the error resolution report was received, the date it was sent back, and the date the report was certified by the NSC. A new tab in the worksheet in Teams has been created that will be completed each time an enrollment verification is submitted to the NSC. PCTC will note the actual enrollment count as of the time of the NSC submission, the enrollment count on the TXT file, the number of files received by the NSC, and the number of rejected files. This is to verify that all of the files intended to be submitted to the NSC were actually received by the NSC and processed. This information will be kept on each spreadsheet used to verify the information sent to the NSC. Shepherd University (SU) response Effective February 2024, SU will add a checklist to the existing reporting and retention structure that had already been established for Clearinghouse data transmission. The checklist will be completed with each transmission, organizing data retention efforts to ensure inclusion of the additional elements required.   West Liberty University (WLU) response To comply with internal control over the review and approval of the enrollment reporting to NSC, WLU will enhance their policies and procedures. The update of these policies and procedures will be effective February 2024 and carry forward into future academic years. WLU will ensure that enrollment reporting policies and procedures are compliant with the US DOE standards and retain evidence of the internal controls. Currently, WLU is reorganizing the processing of enrollment reporting from our IT System Administrator to our Enrollment Services Coordinator. This employee will add to the current policy a process by which a record count reconciliation will happen between the final enrollment report text file and the number of files received by NSC. There will also be documentation kept showing how many rejected records were addressed with each report. Proper documentation will also kept of a final review and approval signoff to submit the enrollment report to NSC. Lastly, WLU will create an email specific to enrollment reporting where all communication from NSC will be stored for auditing and record keeping purposes. West Virginia Northern Community College (WVNCC) response Effective February 2024, the enrollment reporting to the Clearinghouse (NSC) is being moved from the Registrar/Records office to the Institutional Research (PIER office). All reports including determination of reporting intervals per Clearinghouse and SFA guidelines, will be scheduled by the IR office with the Clearinghouse. The following items will be retained to match internal controls for each file sent to the Clearinghouse: 1) Retain internal emails or approval document regarding review and approval from two persons for file prior to sending to NSC 2) Retain verification of count of student record in file matching student enrollment at that time 3) Retain verification of record count with records received by NSC 4) Retain a spot check of students (approx. 8-10) from the file which were tested for accuracy including printout of where this was matched (usually SFAREGS time status page is printed) 5) Retain NSC Error Report for each file prior to resolution and document of resolution 6) Retain reminder email from NSC that the submission file is due 7) Retain initial txt file receipt email from NSC 8) Retain NSC posted error resolution report notification email 9) Retain NSC Completed Error Resolution report notification email 10) Retain NSC final processing email The following information for each file will also need maintained (this information is usually obtained from the NSC reporting page under the enrollment reporting link for approximately an 18 month time frame, header records on the files also show file generation date and term date information for the students reported). 1) Scheduled transmission date 2) File certification date 3) NSC received date 4) NSC processed date 5) Academic term the file is sent for 6) Submission type of the file (first of term, subsequent of term, graduate only, etc.) West Virginia State University (WVSU) response WVSU utilizes the National Student Clearinghouse (NSC) to update student’s enrollment and its effects on student’s direct loan and Pell statuses. Thorough edit checks of student data for each semester will be produced by IT on a regular basis. The Office of the Registrar, in coordination with Admissions, Dual Enrollment, and other contributors of student data, will make sure these errors are corrected. Special focus will be placed on resolving these errors before each enrollment file is produced. (initial data integrity, first check). On or around the 25th of each month, IT will produce the NSC enrollment file. Each time the file is produced, the file will be sent to the Registrar for review to ensure accuracy of the data being pulled from Banner. Registrar sends approval for upload to NSC. Emails from NSC, IT, and files with student checks to be retained. (process integrity, second check) The file will be uploaded to the NSC by IT, ensuring NSC received the appropriate number of records. The data will then be reviewed and any discrepancies in the data, when compared with past data, will be resolved in a timely manner. The NSC error report will be reviewed and any errors corrected. The NSC process makes sure these errors are resolved before the data is reported to the NSLDS, it is the responsibility of the Registrar to make sure these are resolved with accurate data. Emails from NSC, and screenshots of errors will be retained. (data integrity, third check) After resolution of errors, the NSC will perform a final review of data before sending to the NSLDS. This will be reported on the NSLDS Reporting tab of the Enrollment Reporting screen in the NSC website. If data is satisfactory, the submission will be marked with “Congrats. No Errors!” by the originator clearinghouse. The NSC sends emails whenever these items are updated. It is the responsibility of the Registrar to review and resolve any errors in a timely manner. Emails from NSC and screenshot of NSLDS reporting dashboard to be retained. (data integrity, fourth check) The enrollment data is then submitted to the NSLDS. After NSLDS reviews the data, any errors will be reported back through the NSC in the same manner as NSC errors. Resolution of these errors is of special importance and will be given top priority. The NSC sends emails whenever these items are updated. It is the responsibility of the registrar to review and resolve any errors in a timely manner. Emails from NSC and any error documentation to be retained. (data integrity, fifth check). These policies and procedures will be implemented in August 2024. West Virginia University (WVU) response WVU’s Registrar’s office reviews rejected records and takes appropriate action to clear the rejections. Many of these rejections require additional information from students, therefore resolution is based on student discretion in providing documentation. Effective February 2024, WVU will ensure that documentation of the submission record count and rejection follow up is maintained. West Virginia University at Parkersburg (WVU-P) response Effective February 2024, WVU-P will reconcile the record count of enrollment records processed by taking the following actions: 1. Highlighting the record count at the end of the Banner-generated enrollment report file as part of the spot-checking review process. 2. Screenshotting the number of files received by NSC once they acknowledge that the file has been received. 3. Retaining documentation to show that if for some reason the file count does not match, research was done to locate the reason for the discrepancy, and the discrepancy was either resolved or WVU-P is able to document why it could not be resolved. Records and Financial Aid are working together now to develop procedures to properly document the error resolution process. WVU-P will have this process in place by April 2024, in time for the new process to be fully implemented beginning with the Summer 2024 term. WVU-P will retain all documentation, including all emails sent by NSC throughout each enrollment reporting process, within a folder in a secure drive. The name of the folder will be the date that the enrollment report was sent to NSC.

2022-012

2023–027 MAINTENANCE OF EFFORT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education, Education Stabilization Fund (ESF) COVID-19 84.425U, Grant Award S425D210036, Grant Award S425V210008, Grant Award S425U210036, Grant Award S425U210036 – 21A, Grant Award S425W210050 – 21A, Grant Award S425D200036 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under section 317 of the Coronavirus Response and Relief Supplemental Appropriation (CRRSA) Act, for fiscal year 2022, a state that receives Elementary and Secondary School Emergency Relief (ESSER) II, Governor’s Emergency Education Relief (GEER) II, or Emergency Assistance to Nonpublic Schools (EANS) funds under the CRRSA Act must: a) Maintain State support for elementary and secondary education in fiscal year 2022 at least at the proportional level of the state’s support for elementary and secondary education relative to the state’s overall spending, averaged over fiscal years 2017, 2018, and 2019; and b) Maintain state support for higher education in fiscal year 2022 at least at the proportional level of the state’s support for higher education relative to the state’s overall spending, averaged over fiscal years 2017, 2018, and 2019. Under section 2004(a) of the American Rescue Plan (ARP) Act, a state that receives ARP ESSER funds must meet the above Maintenance of Effort (MOE) requirement in each of fiscal years 2022 and 2023. Condition: The Department of Education did not provide the calculations to support meeting the maintenance of effort provisions for fiscal year 2023. Cause: The Department of Education did not provide the documentation and calculations supporting the maintenance of effort for fiscal year 2023. The calculations are performed by the State Budget Office and the calculations have not been prepared as of the date of the audit report. The Department of Education had previously requested a waiver from the provisions but did not receive approval specific to fiscal year 2023. Effect or Potential Effect: The ESF did not meet the maintenance of effort requirement. Questioned Costs: N/A Context: Total federal expenditures for the ESF program for the fiscal year ended June 30, 2023, were $323,733,675. Identification as a Repeat Finding: Prior Year Finding 2022-021 Recommendation: The West Virginia Department of Education management and the State Legislative officials need to implement procedures to ensure adequate appropriations are made to meet the maintenance of effort requirements. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.

MAINTENANCE OF EFFORT Department of Education (DOE) Assistance Listing Number 84.425, COVID-19 84.425 The Maintenance of Effort (MOE) calculation is in process. A waiver was requested and approved for the FY 2023 MOE data. The MOE will be completed by March 15, 2024.

2022-021

2023–035 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission. Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the issuance and removal of sanctions; however, adequate documentation to determine that the controls were operating effectively was not consistently maintained or available. Cause: Internal controls over the documentation of the review and approval of the issuance or removal of sanctions against TANF recipients are not operating effectively. Effect or Potential Effect: Recipient benefits may potentially be reduced or increased in error or without appropriate cause. Questioned Costs: N/A Context: Total federal expenditures for Temporary Assistance for Needy Families (TANF) for the fiscal year ended June 30, 2023, were $85,510,454. Identification as a Repeat Finding: Prior Year Findings 2022–027 and 2021–028 Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review prior to the issuance or removal of sanctions. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE Department of Health & Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 In August of 2023, the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), Division of Professional Development, released a mandatory Blackboard course on Sanctions (Course ID: BFA-ITT-WV-400-2023). All staff completed the training by September 21, 2023. The BFA will repeat this mandatory training on an annual basis for all staff that have the capability to impose, approve, or remove a sanction. Reminders and desk guides will also continue to be distributed to field staff. The BFA Policy Unit will also continue its monthly reviews of RAPIDS Management reports regarding 3rd level sanctions that are being sent to the unit for review and approval.

2022-027

2023–036 SPECIAL TESTS AND PROVISIONS – PENALTY FOR REFUSAL TO WORK Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The State agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each State agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the State by an amount not less than one percent and not more than five percent of the SFAG for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60, 261.61, 261.62, 261.63, 261.64, and 261.65). If an individual in a family receiving assistance refuses to engage in required work, a State must reduce assistance to the family, at least pro rata, with respect to any period during the month in which the individual so refuses or may terminate assistance. Any reduction or termination is subject to good cause or other exceptions as the State may establish (42 USC 607(e)(1); 45 CFR sections 261.13 and 261.14(a) and (b)). However, a State may not reduce or terminate assistance based on a refusal to work if the individual is a single custodial parent caring for a child who is less than 6 years of age if the individual can demonstrate the inability (as determined by the State) to obtain child care for one or more of the following reasons: (a) the unavailability of appropriate care within a reasonable distance of the individual’s work or home; (b) unavailability or unsuitability of informal child care; or (c) unavailability of appropriate and affordable formal child care (42 USC 607(e)(2); 45 CFR sections 261.15(a), 261.56, and 261.57). Condition: For one of the 40 cases selected for testing, the individual should not have been included in the overall population of individuals not participating in their assigned activity. The State has supporting documentation that the client had been participating in their assigned activity. We determined that the cause was from the individual being incorrectly included in the population provided by the state. Cause: There are insufficient internal controls in place surrounding the generation and review of the population of individuals not participating in an assigned activity provided to the auditor, and caseworker data entry into the Recipient Automated Payment Information Data System (RAPIDS). Effect or Potential Effect: The State may inappropriately reduce or terminate the assistance grant of an individual who refuses to engage in work but are subject to good cause or other exceptions established by the State. Further the State may not be able to effectively identify individuals that should or should not be subject to reductions or terminations in benefits. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – PENALTY FOR REFUSAL TO WORK Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 The TANF policy staff within the West Virginia Department of Health and Human Resources, Bureau for Family Assistance, will work with Optum, the State’s eligibility system vendor, and the Recipient Automated Payment and Information Data System (RAPIDS) team to ensure that the criteria for the population for penalty for refusal to work are interpreted and applied correctly. Policy staff will also conduct monthly reviews of a random sample of cases to which the penalty for refusal to work is applicable in order to ensure that it is being applied appropriately.

2023–037 SPECIAL TESTS AND PROVISIONS – INCOME ELIGIBILITY AND VERIFICATION SYSTEM Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF, Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Social Security Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows (42 USC 1320b-7; 45CFR section 205.55). (a) Wage information from the state Wage Information Collection Agency (SWICA) should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d) Information from the U.S. Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e) Unearned income from the Internal Revenue Service (IRS). Condition: During testing of 40 TANF cases subject to IEVS, we noted the following: Control - For 40 of the 40 cases selected for control testing, adequate documentation of review of the data exchanges, and system matches, and review of actions taken by the caseworker when required was not provided. Compliance- For 3 of the 40 cases selected for testing, the recipient did not appear to be receiving WVWorks benefits. The auditor was unable to determine if these cases should have been subject to a data match under TANF. For 12 of the 40 cases selected for testing, the recipient appeared to be receiving WVWorks benefits, and a data match indicating caseworker action required was noted, but no action was completed. Additionally, additional documentation supporting no action required for the match was not available. For the remaining 25 of the 40 cases, the recipient appeared to be receiving WVWorks, a data match occurred, and related worker action was taken, but documentation supporting the action was not available. In addition, the auditor could not determine if specific action items were completed relating to individual exchange types. Cause: There are insufficient internal controls in place surrounding the generation and review of populations provided to the auditor, the Income Eligibility and Verification System matches, and the caseworker actions required within the Recipient Automated Payment Information Data System (RAPIDS). Also, insufficient documentation surrounding matches made between the information systems and actions taken after a match is made. Effect or Potential Effect: The State of WV may not be coordinating data exchanges with other federally assisted benefit programs as required by the state plan. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454. Identification as a Repeat Finding: Prior Year Finding 2022–028 and 2021–029 Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. In addition, we also recommend DHHR evaluate their control over the caseworker action requirement within RAPIDS on matches related to the IEVS. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – INCOME ELIGIBILITY AND VERIFICATION SYSTEM Department of Health & Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 The Division of Family Support within the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), will send the current desk guides to all WV WORKS (TANF) staff, which includes the Data Exchange desk guide and the Viewing Data Exchanges by Exchange Type desk guide. The BFA Division of Family Support will also work with the BFA Division of Professional Development to create a blackboard course for supervisors and community service managers [who supervise WV WORKS (TANF) staff] to assist the supervisors and management in identifying deficiencies regarding the IEVS system.

2022-028

2023–039 ELIGIBILITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/COVID-19 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WVTANF Criteria or specific requirement (including statutory, regulatory or other citation): Any family that includes an adult or minor child head of household or a spouse of the head of household who has received assistance under any State program funded by federal Temporary Assistance for Needy Families (TANF) funds for 60 months (whether or not consecutive) is ineligible for additional federally funded TANF assistance. However, the State may extend assistance to a family on the basis of hardship, as defined by the State, or if a family member has been battered or subjected to extreme cruelty. In determining the number of months for which the head of household or the spouse of the head of household has received assistance, the State must not count any month during which the adult received the assistance while living in ©ndian country or in an Alaskan Native Village and the most reliable data available with respect to that month (or a period including that month) indicate at least 50% of the adults living in Indian country or in the village were not employed (42 USC 608(a)(7); 45 CFR sections 264.1(a), (b), and (c)). Further, the average monthly number of families that include an adult or minor child head of household, or the spouse of the head of household, who has received assistance under any State program funded by federal TANF funds for more than 60 countable months (whether or not consecutive) may not exceed 20 percent of the average monthly number of all families to which the State provided assistance during the fiscal year or the immediately preceding fiscal year (but not both), as the State may elect (42 USC 608(a)(7)(C)(ii); 45 CFR sections 264.1(c) and©)). Condition: During analysis of the TANF Data Report, ACF 199, two individuals were noted to have received TANF benefits for 61 months and one individual received benefits for 86 months. Cause: Management indicated the finding was caused by worker errors and insufficient verification of case information. Internal controls are not suitably designed to review and approve participant eligibility applications. Effect or Potential Effect: Ineligible claims may have been reimbursed using federal funds. Questioned Costs: $1,754 Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2023, were $85,510,454. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS is complete and accurate to ensure compliance with eligibility requirements. In addition, we also recommend DHHR evaluate the effectiveness of the current training programs for the TANF program to ensure adequate technical training is provided. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

ELIGIBILITY Department of Health & Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 The TANF policy staff within the West Virginia Department of Health and Human Resources, Bureau for Family Assistance, will submit monthly reminders to field staff, supervisors, and community service manager to refresh them on policies and procedures regarding the 60-month lifetime limit for benefits funded by TANF. The TANF policy staff will send the reminder in February 2024 and June 2024.

2023–040 SPECIAL TESTS AND PROVISIONS – PENALTY FOR FAILURE TO COMPLY WITH WORK VERFICATION PLAN Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558, Grant Award 2022 – 2201WVTANF, Grant Award 2023 – 2301WV TANF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the state by an amount not less than one percent and not more than five percent of the SFAG for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60, 261.61, 261.62, 261.63, 261.64, and 261.65). Condition: For one of the 40 cases selected for testing, the individual’s work eligibility and participation status documented in the case file and RAPIDS were not consistent with the data elements reported. For one of the 40 cases selected for testing, there was conflicting information for the participation hours for the individual/month selected. The incorrect information was included in the data elements reported. Cause: The discrepancies between data elements reported and supported were due to caseworker errors. Internal controls are not suitably designed to review and approve participant eligibility applications. Effect or Potential Effect: The auditor was unable to determine if the auditee was in compliance with the specified compliance requirement. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2023 were $85,510,454. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS is complete and accurate. In addition, we also recommend DHHR evaluate the effectiveness of the current training programs for the TANF program to ensure adequate technical training is provided. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – PENALTY FOR FAILURE TO COMPLY WITH WORK VERFICATION PLAN Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558 For each data element quarter of the calendar year, the new component entry deadline and the participation hours entry deadline are established by the West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA). For the first data element quarter (January, February, March), the new component entry deadline is April 30, and the participation hours entry deadline is May 5. For the second data element quarter (April, May, June), the new component entry deadline is July 31, and the participation hours entry deadline is August 5. For the third data element quarter (July, August, September), the new component entry deadline is October 31, and the participation hours entry deadline is November 5. For the fourth data element quarter (October, November, December), the new component entry deadline is January 31, and the participation hours entry deadline is February 5. To resolve the condition that led to this finding, the BFA will work with the Recipient Automated Payment and Information Data System (RAPIDS) Data Team. The BFA will request joint meetings with the RAPIDS Data Team to review sample cases and the components and hours related thereto to ensure they have been entered into the data system correctly. The meetings will take place quarterly, within five days after the participation hours entry deadlines, and will be documented accordingly.

2023–042 SPECIAL TESTS AND PROVISIONS – PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/COVID-19 93.575/93.596, Grant Award 2022 – 2201WVCCDD, Grant Award 2022 – 2201WVCCDF, Grant Award 2023 – 2301WVCCDD, Grant Award 2023 – 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). According to Pub L 117-2 Sec. 2201: “To be qualified to receive ARP Act stabilization funds, a provider on the date of application for the award must either be: (1) open and available to provide child care services, or (2) closed due to public health, financial hardship, or other reasons relating to the COVID-19 public health emergency. In addition, the provider must either (1) be eligible to serve children who receive CCDF subsidies at the time of application for stabilization funds, or (2) be licensed, regulated, or registered in the state, territory, or tribe as of March 11, 2021 and meet applicable state and local health and safety requirements at the time of application for stabilization funds. In their application for stabilization funds, a child care provider must certify: a). That the provider will, when open and providing services, implement policies in line with guidance and orders from corresponding state, territorial, tribal, and local authorities and, to the greatest extent possible, implement policies in line with guidance from the CDC. b). For each employee, the provider must pay at least the same amount in weekly wages and maintain the same benefits for the duration of the stabilization funding. c). The provider will provide relief from copayments and tuition payments for the families enrolled in the provider’s program, to the extent possible, and prioritize such relief for families struggling to make either type of payment.” Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the review and approval of provider certifications in the application for funding and review and approval of verification of eligibility criteria; however, adequate documentation to support the review was not maintained. In addition, 2 of the 40 selected did not have a Provider Service Agreement that was completed and 1 of the 40 Provider Service Agreements did not have evidence of provider’s required certifications available. Cause: Internal controls are not operating effectively surrounding the review and approval of provider certifications and verification of eligibility criteria. Effect or Potential Effect: Providers who received ARP Act Stabilization funds may not have met the eligibility criteria or made the required certifications. Questioned Costs: N/A Context: Total federal expenditures for CCDF Cluster for the fiscal year ended June 30, 2023, were $202,427,780. Identification as a Repeat Finding: Prior Year Finding 2022–026 Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review and approval of provider certifications and eligibility criteria. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER CHILD CARE PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Department of Health & Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 All funds resulting from the American Rescue Plan Act (ARPA) were expended and all related programs ended on or before September 30, 2023. The West Virginia Department of Health and Human Resources, Bureau for Family Assistance (BFA), Division of Early Care and Education, employs Child Care Policy Specialists who visit contracted Resource and Referral Agencies to monitor and audit both electronic and hard records. Training and coaching also takes place during these visits. These visits continued throughout the reporting period. The BFA will evaluate the effectiveness of the current training programs for the collection and storing of eligibility records. Furthermore, the BFA will follow established policies and procedures to ensure provider information and documentation is appropriately obtained, reviewed, and retained.

2022-026

2023–045 SPECIAL TESTS AND PROVISIONS – FRAUD DETECTION AND REPAYMENT Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.575/93.596 COVID-19 93.575, Grant Award 2201WVCCDD, Grant Award 2201WVCCDF, Grant Award 2301WVCCDD, Grant Award 2301WVCCDF Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 states that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). (b) Comply with Federal statutes, regulations, and the terms and conditions of the Federal awards. (c) Evaluate and monitor the non-Federal entity’s compliance with statute, regulations and the terms and conditions of Federal awards. (d) Take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings. (e) Take reasonable measures to safeguard protected personally identifiable information and other information the Federal awarding agency or pass-through entity designates as sensitive or the non-Federal entity considers sensitive consistent with applicable Federal, state and local laws regarding privacy and obligations of confidentiality.” Lead Agencies shall recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud. (45 CFR section 98.60). Condition: Current policies indicate the DHHR refers potentially fraudulent payments to the Office of the Inspector General (OIG) for investigation. When an investigation results in a determination of fraud, a repayment plan is required to be established and tracked. However, documentation of the review of the listing of cases referred for investigation, including the status was not available. For one of the five closed investigations selected, a repayment plan was approved however repayments were not received and documentation of action taken was not available. For two of the five closed investigations selected, documentation for approval of the repayment plan, repayments received, or other follow-up action taken was not available. Therefore, the auditor was unable to reach a conclusion. Cause: Staff turnover in recent years in Departments responsible for this process caused inconsistencies in the way investigation of potentially fraudulent claims were identified, documented, and reported. Effect or Potential Effect: Payments resulting from fraud may not have been identified, and the proper procedures to establish repayment or recovery may not have occurred in a reasonable amount of time. Questioned Costs: $16,103 Context: Total federal expenditures for the CCDF Cluster for fiscal year ended June 30, 2023, were $202,427,780. Identification as a Repeat Finding: This is not a repeat finding from prior year. Recommendation: The DHHR should work with the OIG to ensure its internal controls and policies and procedures are robust and include sufficient documentation of oversight and review to ensure fraudulent claims are identified and tracked beginning in the year of identification and continuing through the establishment and enforcement of repayment agreements. Additionally, status monitoring of cases referred for investigation should be documented, and follow-up completed timely. Views of Responsible Officials: Management acknowledges the finding. See corrective action plan.

SPECIAL TESTS AND PROVISIONS – FRAUD DETECTION AND REPAYMENT West Virginia Department of Health and Human Resources (DHHR) Assistance Listing Number 93.575, 93.596, COVID-19 93.575 Per 45 CFR 98.68(b)(2), there is no requirement for lead agencies to recoup Child Care and Development Fund overpayments, except in instances of fraud as defined by the lead agency. Within the State of West Virginia, the lead agency is the DHHR. As indicated in Section 8.1.6 of the CCDF [State] Plan for West Virginia for Federal fiscal years 2022-2024, the DHHR Office of Inspector General (OIG) is responsible for pursuing fraud and overpayments. As indicated in Section 1.1.2 of the CCDF [State] Plan, the Division of Early Care and Education within the DHHR Bureau for Family Assistance (BFA) administers the CCDF program. Accordingly, the OIG and BFA strive to work as a unified team within the DHHR and State as a whole to identify and prevent fraud or intentional program violations; to identify and recover misspent funds as a result of fraud; and to otherwise fight fraud and ensure program integrity. As the lead agency, and as necessary to ensure program integrity, the DHHR has policies and procedures in place to define fraud and to identify and recover payments resulting from fraud, as the auditors indicated within the condition and recommendation sections of this finding and to track referrals and determinations from beginning to end (i.e., beginning in the year of identification and continuing through resolution or the establishment and enforcement of repayment agreements). The policies and procedures are specifically referenced in Chapter 8 of the BFA’s “Child Care Subsidy Policy and Procedures Manual.” Chapter 8 of the manual is titled, “Improper Payments: Prevention, Identification, Measurement and Recoupment.” Improper Payments Per Chapter 8 of the manual, an improper payment occurs when the funds go to the wrong recipient, the recipient receives the incorrect amount of funds, or the recipient obtains or uses the funds in an improper manner. Improper payments include 1) worker error in determining eligibility, authorizing care, or paying for care; 2) misrepresentation on the part of the parent or provider; and 3) programmatic infractions by parents or providers. 1. Worker Error – Improper payments due to worker error are defined as payments that should not have been made or that were made in an incorrect amount due to an error in determining and verifying eligibility, calculating the benefit, or entering the data into the eligibility system. Repayment of an improper payment due to worker error is not mandatory regardless of the amount. 2. Misrepresentation – Misrepresentation (i.e., fraud) occurs when a specific section of the child care policy is violated as a result of the information not having been reported by the client or provider or reported falsely. Improper payments made as a result of mis-interpretation must be referred to the OIG when the amount exceeds $1,000.00. If the amount does not exceed $1,000.00, the BFA must initiate repayment procedures. A willfully false statement is one that is deliberately given, with the intent that it be accepted as true, with the knowledge that it is false. It is an essential element in a misrepresentation charge that the client or provider knew the statement was false. 3. Programmatic Infraction – There are times when it is difficult to discern whether an improper payment occurred due to willful misrepresentation or is simply the result of a client or provider’s genuine confusion over subsidy program rules and responsibilities. When the case manager believes that improper payments were the result of the client or provider’s failure to understand, it is considered to be a programmatic infraction; it is the BFA’s responsibility to collect the improper payment in this instance, regardless of the amount. If the case manager is in doubt as to whether an improper payment is a programmatic infraction or is the result of misrepresentation by the client or provider, and the improper payment is less than $1,000.00, the case manager discusses the case with the supervisor and the supervisor subsequently consults with the program director; together, they make the decision whether to pursue repayment. Referrals from the Bureau for Family Assistance to the Office of Inspector General If the overpayment is $1,000.00 or greater and is due to misrepresentation by the client or provider, the case manager prepares a memo explaining the circumstances, the time period, and an estimate of the amount involved; indicates the person(s) who can verify the information within the memo; attaches a copy of all applicable documentation including, but not limited to, the payment form and attendance sheets that help support the complaint; states what corrective actions the case manager has taken on the case; and sends a copy of the memo and supporting documents to the Office of Inspector General, Division of Investigations and Fraud Management. Recovery of Improper Payments Resulting from Misrepresentation (i.e., Fraud) The supervisors within the BFA are responsible for negotiating repayment schedules with providers and clients and completing a Child Care Benefit Repayment Agreement to include the amount to be recovered, the period of recovery, the monthly recovery amount, and the procedure for repayment. If the provider or client is active, the case manager attempts to collect the payment in full; if this is not feasible, the case manager requests that the client or provider be asked to repay the amount in monthly installment payments of approximately 10% of the amount due. If a payment is more than 45 days late (15 days past the due date), the entire unpaid balance becomes due and must be paid in full. Failure to repay the requested amount results in case closure for clients or denial of participation in the certificate system for child care providers. Client services will not be reinstated until full payment is received. There are no policies or procedures to pursue repayments or collection beyond that point. There is no method to recoup overpayments from ongoing benefits, and the CCDF is not subject to the Treasury Offset Program, as other Federal programs are. Corrective Action Plan As previously stated, the OIG and BFA strive to work as a unified team within the DHHR to identify and prevent fraud or intentional program violations; to identify and recover misspent funds as a result of fraud; and to otherwise fight fraud and ensure program integrity. In response to the auditor’s recommendation for this finding, the OIG and BFA will revisit existing policies and procedures over fraud detection and repayment and will attempt to enhance the controls related thereto, particularly in relation to ensuring that all efforts concerning fraud detection and repayment are sufficiently documented, thus demonstrating full compliance with 45 CFR 98.60. Maintaining documentation of the decision-making process, the activities performed, and the results of those activities is of paramount importance in achieving that objective. A high level of documentation is necessary to support that the DHHR has policies and procedures in place and is following those policies and procedures. Maintaining adequate records and other documentary evidence will resolve this audit finding, prevent the occurrence of future audit findings, and provide a means to corroborate statements and assurances provided to regulatory agencies and other authorized individuals with regards to the DHHR’s overall compliance with 45 CFR 98.60. It is not enough to perform the activities; there must be an adequate audit trail to show the “who, what, when, where, and how” of the activities performed. As such, the OIG and BFA will also develop and maintain an appropriate system for categorizing their files and organizing their records, reports, and documents in a systematic and orderly manner to ensure, among other purposes, that they can substantiate their efforts when audited, reviewed, or evaluated by internal staff or authorized external organizations.

2023–046 ELIGIBILITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Low-Income Home Energy Assistance 93.568/COVID-19 93.568, Grant Award G-2101WVE5C6, Grant Award G-2201WVLIEA, Grant Award G-2201WVLIEI, Grant Award G-2301WVLIEE, Grant Award G-2301WVLIEA, Grant Award G-2301WVLIEI Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” LIHEAP requires the West Virginia Department of Health and Human Resources (DHHR) to determine whether federal monies are spent in accordance with the eligibility guidelines promulgated by 42 USC 8624(b)(2). Condition: During our testing of 40 LIHEAP benefit payments for eligibility, we noted that three of the six sampled cases from May and June 2023 were paid using the incorrect benefit amount. Cause: Management indicated that the errors were due to the benefit tables not being properly updated within the RAPIDS system to properly calculate the recipients’ benefits during the months of May and June 2023. This was due to insufficient oversight to ensure the table amounts were correct and the benefits were calculating properly. Effect or Potential Effect: Benefit payments were made at the incorrect amount based on the eligible recipients household size, income, and source of energy. Questioned Costs: $1,637 LIHEAP #93.568, Grant # G-2301WVLIEE Context: The three instances noted (three out of six case files tested for May and June, 2023) represent $1,637 of benefit payments out of $3,471 tested from those months. Total payments for benefit assistance for the LIHEAP program were $2,659,674 for the months of May and June 2023 and were $58,226,354 for the year ended June 30, 2023. The federal expenditures for the LIHEAP program for the fiscal year ended June 30, 2023, were $78,229,389. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: DHHR should evaluate its policies and procedures to ensure that the benefit tables within the RAPIDS system are properly updated and reviewed to ensure that all recipients benefits are properly calculated. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

ELIGIBILITY West Virginia Department of Health and Human Resources (DHHR) Assistance Listing Number 93.568, COVID-19 93.568 The LIHEAP policy staff within the DHHR, Bureau for Family Assistance (BFA), have worked with the Recipient Automated Payment and Information Data System (RAPIDS) team to confirm that the benefit table has been accurately entered into the RAPIDS system for fiscal year 2024. The LIHEAP policy staff will continue to review the work of the RAPIDS team to ensure that the benefit table has been accurately entered prior to the opening of LIHEAP application intake annually.

2023–051 SPECIAL TESTS AND PROVISIONS – ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/93.778, Grant Award 2005WVINCT, Grant Award 1905WV5MAP, Grant Award 2005WV5ADM, Grant Award 2005WVIMPL, Grant Award 2005WV5MAP, Grant Award 2105WV5MAP, Grant Award 2105WV5ADM, Grant Award 2105WVIMPL, Grant Award 2105WVINCT, Grant Award 2005WVINCT, Grant Award 1905WV5MAP Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 45 CFR 95.621 requires State Medicaid Agencies (SMAs) “shall review the Automated Data Processing (ADP) system security installations involved in the administration of the Secretary of the U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews.” States agencies must establish and maintain a program for conducting periodic risk analyses to ensure appropriate, cost-effective safeguards are incorporated into new and existing systems. As part of complying with the above requirement, a state may obtain a statement on Standards for Attestation Engagements (AT) Section 801, Reporting on Controls at a Service Organization Service Organization Control (SOC) 1 type 2 report from its service organization (if the state has a service organization). The specific areas covered by a SOC 1 type 2 report differ according to each individual service organization’s operations; however, in every instance, the type 2 report procedures assess the sufficiency of the design of an organization’s controls and test their effectiveness. Condition: The West Virginia Department of Health & Human Resources (DHHR) utilizes two ADP systems related to Medicaid: RAPIDS and West Virginia’s Medicaid Management Information System (MMIS). DHHR does not have policies and procedures established to perform periodic risk assessments and security reviews over MMIS. As this system utilizes sub-systems (Health PAS Solution) with automated components that directly affect the Medicaid cluster of programs, it meets the criteria stated above from 45 CFR 95.621. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for MMIS annually, but DHHR did not sufficiently document their review of the service organization’s controls and overall effectiveness of each control, in order to meet the aforementioned criteria for conducting a periodic risk analysis over each ADP system, per 45 CFR 95.621. Cause: Management’s policies and procedures surrounding the review of the MMIS SOC 1 Type 2 report related to assessing risk and system security do not include the retention of documentation outlining what was reviewed and the results of the review. Effect or Potential Effect: There could be risks related to physical and data security operating procedures, and personnel practices that are not identified timely and appropriately addressed. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,622,001,554. Identification as a Repeat Finding: Prior Year Finding 2022–037 Recommendation: DHHR should enhance its policies and procedures related to the review of the MMIS SOC 1 Type 2 report to ensure that appropriate documentation is retained in order to meet the criteria of an ADP periodic risk assessment and security review of WVMMIS. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS – ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 The Condition section within prior year finding 2022-037 recognized that the DHHR has policies and procedures in place for performing periodic risk assessments and security reviews over the Recipient Automated Payment and Information Data System (RAPIDS), which is an internal system; however, the Condition section also proclaimed that the DHHR does not have policies and procedures to perform periodic risk assessments and security reviews over the Medicaid Management Information System (MMIS). The first sentence of the corrective action plan for prior year finding 2022-037 indicates that the MMIS is designed, developed, implemented, and operated by an external service organization. Within the last two paragraphs of the corrective action plan for prior year finding 2022-037, the DHHR opined that it was in compliance with 45 CFR 95.621 since it receives the SOC 1 Type 2 report from the MMIS service organization and since the report documents that the service organization establishes and maintains a program for conducting periodic risk analyses to ensure appropriate, cost effective safeguards are incorporated into new and existing systems or whenever significant system changes occur, as required per 45 CFR 95.621. However, the DHHR also recognized the underlying concern expressed within the finding, in that the DHHR does not include the SOC 1 Type 2 report as part of its own policies and procedures for ADP security over the MMIS. To enhance its controls, the DHHR Bureau for Medical Services (BMS) was going to develop a policy and procedures to document MMIS compliance with 45 CFR 95.621. The procedures were to include but not be limited to a requirement to review and approve the SOC 1 Type 2 report from the MMIS service organization and document the review and approval process (e.g., for such matters as the service organization’s assertions, descriptions of its systems and controls, control objectives, and related controls, and the service auditor’s description of tests of controls and results). Although the DHHR BMS has not developed a comprehensive policy or any written procedures to date, they have developed a form to document internal review of the SOC 1 Type 2 report for such matters as the control environment, systems development and maintenance, logical security, physical access, computer operations, and input controls. The BMS has also discussed this issue with an independent consulting firm that is under contract with the BMS for Medicaid expertise and performs existing services related to information technology and security; modernization and planning for the overall Medicaid Enterprise Systems (MES); organization development, including alignment strategies; project management; and data architecture and governance, which includes managing the availability, usability, integrity, and security of data with comprehensive standards and policies. The BMS and its independent consulting firm will work together to develop a statement of work for an independent review of the existing control environment, if deemed necessary, and any additional services that might need performed in order to ensure the DHHR maintains full compliance with 45 CFR 95.621 and can document compliance for future HHS reviewers, independent auditors, or other authorized officials.

2022-037

2023–058 EQUIPMENT AND REAL PROPERTY MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) 93.323/COVID-19 93.323, Grant Award 6NU50CK000551-01-05, Grant Award 5NU50CK000551-C2-00, Grant Award 6NU50CK000551-02-01, Grant Award 6NU50CK000551-02-02, Grant Award 6NU50CK000551-03-05, Grant Award 6NU50CK000551-03-02, Grant Award 6NU50CK000551-02-04, Grant Award 6NU50CK000551-02-08, Grant Award 6NU50CK000551-02-06, Grant Award 6NU50CK000551-03-01, Grant Award 6NU50CK000551-01-07, Grant Award 6NU50CK000551-02-03, Grant Award 6NU50CK000551-01-06, Grant Award 5NU50CK000551-04-00, Grant Award 6NU50CK000551-04-02, Grant Award 6NU50CK000551-04-04 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.313(b) requires a state use, manage and dispose of equipment acquired under a Federal award by the state in accordance with state laws and procedures. According to State Policy, “All agencies are required to take a physical inventory once every three years, and shall have completed such physical inventory by June 30th of the relevant year. The physical inventory shall include viewing of all Reportable Assets under the agency’s jurisdiction. The head of every spending unit of state government shall, on or before the fifteenth day of July of each year, file with the Purchasing Division director an inventory of all real and personal property, and of all equipment, supplies and commodities in its possession as of the close of the last fiscal year as stated in West Virginia Code §5A-3-35. Condition: During our testing of Epidemiology and Laboratory Capacity for Infectious Diseases, the West Virginia Department of Health and Human Resources (DHHR) was unable to provide adequate documentation supporting the most recent physical inventory of fixed assets for the agency. Cause: Adequate documentation supporting compliance with the State’s policies regarding physical inventory was not provided. Effect or Potential Effect: The Epidemiology and Laboratory Capacity for Infectious Diseases Program may not be in compliance with the requirements of F. Equipment & Real Property Management. Questioned Costs: Unknown Context: The total expenditures for the year ended June 30, 2023 were $23,002,255. Total equipment purchases for FY 2023 were $2,533,124. Identification as a Repeat Finding: This is not a repeat finding from prior year. Recommendation: We recommend that DHHR follow the State’s established policies and maintain documentation evidencing the internal control and oversight of fixed asset management. View of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.

EQUIPMENT AND REAL PROPERTY MANAGEMENT Department of Health and Human Resources (DHHR) Assistance Listing Number 93.323, COVID-19 93.323 Due to the number of administrative and programmatic offices within the DHHR and the fact that those offices are located throughout the State, the DHHR does not conduct a mass physical inventory whereby one office or person at the central level views all of the reportable assets under the DHHR’s jurisdiction. Instead, the DHHR Office of Operational Administration compiles inventory reports for each office using the fixed asset module within wvOASIS, which is the statewide accounting system. The inventory reports indicate all tagged and entered assets under each office’s location code within the DHHR. Once the reports are compiled, the Office of Operational Administration sends a report to each applicable office within the DHHR and asks the offices to locate and verify the assets in the report. The lack of documentation indicated by the auditors is due to the fact that some DHHR offices throughout the state do not return the verification to the Office of Operational Management. For the next physical inventory of fixed assets within the DHHR, which will be for the year ended June 30, 2024, the Office of Operational Administration will monitor and regulate each office more stringently and will increase its efforts to ensure that each office completes the verification and returns it to the Office of Operational Administration in a timely manner. For offices that do not respond within a timeframe deemed reasonable by the Office of Operational Administration, they will inform and request assistance from a higher level of authority within the DHHR, such as the Executive Director of Operations.

2022?002 SPECIAL TESTS AND PROVISIONS ? ADP SYSTEM FOR SNAP Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) 10.551/10.561/ COVID-19 10.561 Grant Award 1WV400401 Grant Award 1WV400468 Grant Award 1WV430459 Grant Award 1WV430469 Grant Award 1WV460479Criteria: 7 CFR section 272.10 requires that State agencies ?sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP.? This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period; and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Condition: The Department of Health and Human Resources (DHHR) uses the Recipient Automated Payment Information Data System (RAPIDS) as its Automated Data Processing (ADP) system for SNAP. Our testing of the controls surrounding eligibility determination noted that no independent review and approval is required in the system for case information input by the case worker. Further, it was noted that review and approval of disbursements only occurs at the batch level, which does not allow the independent reviewer to review each transaction individually. Data integrity is a critical for the automation SNAP operations. Due to limitations of the ADP system for SNAP, the auditor was unable to conclude whether or not the State?s ADP system for SNAP (i.e., RAPIDS) was in compliance with requirements of 7 CFR section 272.10. Questioned Costs: N/A Context: Total federal expenditures for the SNAP program were $883,958,996 for the year ended June 30, 2022. Cause: Controls within the RAPIDS system are not designed to sufficiently protect the integrity of data input into the system. Effect: The State agency may not have sufficiently automated its SNAP operations and computerized its systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP. Recommendation: We recommend that management implement policies and procedures to ensure compliance with requirements surrounding the RAPIDS ADP system for SNAP. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? ADP SYSTEM FOR SNAP Department of Health and Human Resources (DHHR) Assistance Listing Number 10.551, 10.561, COVID-19 10.561 Management within the DHHR appreciates and shares the auditors? concern with SNAP program integrity as it relates to the Recipient Automated Payment Information Data (RAPIDS) ADP system. DHHR would note that 7 CFR ? 272.10 begins with, ?(1) Purpose. All State agencies are required to sufficiently automate their SNAP operations and computerize systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP. Sufficient automation levels are those which result in effective programs or in cost effective reductions in errors and improvements in management efficiency, such as decreases in program administrative costs?? Within the RAPIDS ecosystem for SNAP administration, this automation includes data matching measures undertaken, in compliance with related federal rules as specified in 7 CFR ? 272.8, 7 CFR ? 272.16, etc., to automate the validation of client-provided, worker-input information while mitigating the additional administrative burden of secondary review for all worker interactions with a client?s case. Policy regarding state and federal data matching is laid out in Chapter 6 of the State?s Income Maintenance Manual (IMM), which is available at https://dhhr.wv.gov/bfa/policyplans/Documents/Binder4.pdf. The primary data exchange system detailed in IMM Chapter 6 that is applicable to SNAP is the Income and Eligibility Verification System (IEVS) required by 7 CFR ? 272.8. Systems mandated federally for inclusion in the IEVS include those operated by WorkForce WV, the Internal Revenue Service (IRS), and the U.S. Social Security Administration (SSA). A variety of other sources may also be queried for the purpose of validating client-provided information entered into RAPIDS by a worker, including Veterans Affairs (VA), Beneficiary and Earnings Data Exchange (BENDEX), Beneficiary Earnings and Exchange Record System (BEERS), National Directory of New Hires, and Prisoner Matching with the Department of Corrections as well as the Federal Data Services Hub (FSDH). IMM Chapter 6, page 2 describes the purpose of data matching through the IEVS as follows: Information obtained through IEVS is used for the following purposes: ? To verify the eligibility of the assistance group (AG) ? To verify the proper amount of benefits ? To determine if the AG received benefits that were not entitled ? To obtain information for use in criminal or civil prosecution based on receipt of benefits to which the AG was not entitled. IMM Chapter 6, pages 2-3 further detail the points at which a match with the IEVS must take place: A data exchange in the eligibility system occurs: ? When a new case is created; ? When a new person is added to a benefit; ? When a person?s demographic information is changed; and, ? On a periodic basis for all individuals in the eligibility system, depending on the type of benefit being received. Requirements for independent verification of information when automated data matches fail or report a discrepancy with client-provided, worker-input information are spelled out in IMM 6.4.4. The State believes that these automations, while perhaps not foolproof, are in keeping with both the wording and intent of 7 CFR ? 272.10, 7 CFR ? 272.8, 7 CFR ? 272.16, etc., which aim to automate processes in order to reduce administrative burden and associated costs, such as those that would be associated with a secondary review of all worker interactions with a client?s case. With that in mind, the State commits to working to bolster SNAP program integrity as it relates to the auditors? expressed concerns through completion of the USDA-FNS SNAP System Integrity Review Tool (SIRT) in alignment with USDA-FNS requirements and timelines to ensure that automated processes within RAPIDS continue to comport with federal requirements for ADP systems. The DHHR Bureau for Family Assistance, Division of Performance and Quality Improvement (DPQI), will continue its ongoing SNAP case reviews, as well as continue its efforts to report compliance with monthly requirements for expanded supervisor case reviews conducted and tracked through the Rushmore case review system, as mandated in a December 7, 2022 memorandum to supervisors. Furthermore, the Bureau for Family Assistance will develop additional worker training, to include the reinstatement of face-to-face Statewide Payment Accuracy Conferences, with an aim to ensure that client information is accurately captured in RAPIDS so the APD can perform its automated functions with integrity.

2022?003 ALLOWABILITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) 10.551/10.561/ COVID-19 10.561 Grant Award 1WV400401 Grant Award 1WV400468 Grant Award 1WV430459 Grant Award 1WV430469 Grant Award 1WV460479 Grant Award 1WV400401Criteria: 2 CFR 200 requires that costs do not consist of improper payments, defined as ?any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. Incorrect amounts are overpayments or underpayments that are made to eligible recipients (including inappropriate denials of payment or service, any payment that does not account for credit for applicable discounts, payments that are for an incorrect amount, and duplicate payments). An improper payment also includes any payment that was made to an ineligible recipient or for an ineligible good or service, or payments for goods or services not received (except for such payments authorized by law).? Condition: During our testing of 40 cases for allowability for SNAP, we noted one emergency supplemental allotment payment to a recipient for a month that was not allowable. Questioned Costs: $1,125 Context: Total federal expenditures for the SNAP program were $883,958,996 for the year ended June 30, 2022. Cause: Adequate internal controls are not in place to prevent non-compliance surrounding the issuance of SNAP benefits. Effect: Disbursements to recipients could be made that are not allowable. Recommendation: We recommend that DHHR ensure that all compliance requirements are reviewed to ensure the benefit amounts are accurate prior to disbursement. Views of Responsible Officials: Management concurs with the findings and has developed a plan to correct the finding.

Department of Health and Human Resources (DHHR) Assistance Listing Number 10.551, 10.561, COVID-19 10.561 The DHHR Bureau for Family Assistance (the Bureau) analyzed the condition that led to this finding. The emergency supplement in question was paid on the initial month of SNAP issuance. However, these supplements were not to be based on the initial or prorated months of SNAP benefits. Per the U.S. Department of Agriculture, Food and Nutrition Service (FNS), emergency supplements were not to be initiated until the second month of SNAP issuance (i.e., the month following active SNAP approval). The emergency supplement allotments will end February 28, 2023. If the FNS instructs the Bureau to issue emergency supplement allotments for the SNAP Program beyond February 28, 2023, the Bureau will develop a blackboard course with video to ensure that all workers are trained on the procedures and policy. The blackboard platform has the capability to track who has completed the training which will ensure supervisors can determine who has or has not completed the required training.

2022?009 SPECIAL TESTS AND PROVISION ? UI PROGRAM INTEGRITY - OVERPAYMENTS (Repeat of Prior Year Findings 2021?007 and 2020?004) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Labor Unemployment Insurance (UI) 17.225 Grant Award UI-35683-21-55-A-54 Grant Award UI-37314-22-55-A-54 Grant Award UI-34749-20-55-A-54 Grant Award UI-35978-21-60-A-54 Grant Award UI-37099-21-55-A-54 Grant Award UI-37257-22-55-A-54Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During fiscal year 2022, the Workforce West Virginia (WWV) overpaid unemployment claims out of funds from the Unemployment Program and the Pandemic Unemployment Assistance Program (PUA). PUA is federal funding provided through the CARES Act to pay unemployment claims for self-employment individuals and independent contractors. Questioned Costs: N/A Context: Total federal disbursements for the Unemployment Insurance (UI) program were $307,154,978 for the year ended June 30, 2022. For three of the 60 overpayments, incomplete documentation did not indicate overpayment classification. For 10 of the 60 overpayments, documentation required by WWV?s policies could not be provided. Cause: WWV?s normal control procedures require proper documentation to be complete for the deputy?s review and approval to complete an overpayment determination and prior to notification to the claimant. However, WWV did not follow policy in retaining required documentation to support deputy decisions for overpayments. Effect: WWV is not following policies and procedures established to identify overpayments and classify them in a manner that allows the state to take appropriate follow-up actions. Recommendation: WWV should enforce appropriate procedures to ensure documentation of review and approval and required forms with deputy decisions is maintained for each overpayment. procedures. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISION ? UI PROGRAM INTEGRITY - OVERPAYMENTS Workforce West Virginia (WWV) Assistance Listing Number 17.225, COVID-19 17.225 WWV will provide training to all Unemployment Insurance claim staff by March 2023 and review procedures related to the establishment of overpayments.

2021-007

2022?011 SPECIAL TESTS AND PROVISIONS ? RETURN OF TITLE IV FUNDS (Repeat of Prior Year Findings 2021?015, 2020?014, and 2019?018) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/ 84.408/93.264/ 93.342/93.364/ 93.925Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 668.173(b) requires timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if - (1) The institution deposits or transfers the funds into the bank account it maintains under ? 668.163 no later than 45 days after the date it determines that the student withdrew; (2) The institution initiates an electronic funds transfer (EFT) no later than 45 days after the date it determines that the student withdrew; (3) The institution initiates an electronic transaction, no later than 45 days after the date it determines that the student withdrew, that informs a FFEL lender to adjust the borrower?s loan account for the amount returned; or (4) The institution issues a check no later than 45 days after the date it determines that the student withdrew. An institution does not satisfy this requirement if - (i) The institution?s records show that the check was issued more than 45 days after the date the institution determined that the student withdrew; or (ii) The date on the cancelled check shows that the bank used by the Secretary or FFEL Program lender endorsed that check more than 60 days after the date the institution determined that the student withdrew. Condition: In six of 10 instances in internal control testing at West Virginia State University (WVSU), we noted that the internal control was not sufficiently documented or not functioning effectively. We also noted inadequate documentation of internal controls at Pierpont Community College (PCTC), Bluefield State University (BSU), New River Community and Technical College (NRCTC), and West Liberty University (WLU). Additionally, for BSU, PCTC, and NRCTC, it was noted that certain amounts to be returned were calculated incorrectly, were not returned timely, or were not calculated and returned at all. Questioned Costs: $11,937 ? BSU; $1,001 ? NRCTC; and $7,530 known questioned cost plus unknown questioned costs for calculations not performed by management for all unofficial withdrawals ? PCTC Context: Total Student Financial Assistance Cluster expenditures for the year ended June 30, 2022, were $480,090,562. The total Student Financial Assistance Cluster expenditures for the year end June 30, 2022, for WVSU, PCTC, BSU, NRCTC, and WLU were $11,188,523, $4,888,594, $7,984,211, $3,423,043, and $15,701,217, respectively. Cause: The institutions do not have adequate internal controls in place over the return of Title IV funds to prevent non-compliance. Effect: The institutions may not be returning the correct amount of federal student financial assistance required or the funds are not returned within the required time frame to the United States Department of Education. Recommendation: Management should implement internal controls to ensure that the correct amount of federal student financial assistance is returned and returned within the required time frame. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? RETURN OF TITLE IV FUNDS West Virginia State University, Pierpont Community College, Bluefield State University, New River Community and Technical College, and West Liberty University Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 West Virginia State University (WVSU) response Effective January 2022, a weekly report of complete withdraw students is generated and an initial review and calculations are performed by a Financial Aid Administrator. A second review of the student?s record and calculations are then completed a second time by the Associate Director of Financial Aid or the Director of Financial Aid. After the second review is complete, the initial reviewer will update the student account accordingly and perform any Return of Title IV (R2T4) funds needed. The second reviewer will confirm that updates are accurate. Both the initial and second reviewer will sign off on R2T4 calculation documentation for the student's file. Pierpont Community and Technical College (PCTC) response Communication between the Financial Aid and the Finance offices will be enhanced to ensure Finance has a copy of the student letter and additional Finance Office staff now have access to the return of Title IV (R2T4) tracking sheet. The R2T4 tracking sheet will be monitored by both the Financial Aid and Finance staff to ensure all refunds are returned within the required 45-day time period. This process was implemented in January 2023. Bluefield State University (BSU) response In January 2023, BSU implemented controls to perform the Return of Title IV (R2T4) withdrawal and calculation to ensure that records comply and that return of R2T4 funds are within the required time frame of 45 days. Controls include the review of ?Permit to Withdraw? forms to ensure they are completed with all signatures of the offices involved and the sign-off of R2T4 calculations. All reviews will occur within the time frame of 45 days by the Interim Financial Director along with Business Office and Accounting. In December 2022, the Interim Financial Aid Director spoke with the Registrar and the Financial Aid Counselor in separate meetings regarding the late submission of withdrawal forms and performing the R2T4 calculations. The Registrar understands they must submit the completed withdrawal forms to the Financial Aid office the same day they are completed by her office. When the forms are received by Financial Aid an R2T4 will be completed within the same week of receipt and sent to the Business Office if a return of Title IV Aid is required. The Business Office will then review the calculations and perform the necessary repayment of Title IV Aid to the Department of Ed, utilizing the refund process through G5 within the required 45 day timeline. All adjustments to the students account will be made within the same time frame. New River Community and Technical College (NRCTC) response The Registrar's office will request the error report from IT. At that point the Registrar?s office will work on correcting the errors on the report. The Registrar?s office will request IT to run the error report again to make sure all errors are clear. Once all errors are clear from the report the Registrar?s office will request IT to send the enrollment report so that it can be submitted to the National Student Clearinghouse (the Clearinghouse). Once the enrollment report is received from IT someone in the Registrar?s office will upload the report in the Clearinghouse. The Registrar?s office will make sure the Clearinghouse report is submitted by the due date and errors sent by the Clearinghouse are corrected in a timely manner. The Registrar's office will run a random selection of 20 students from the National Student Loan Data System (NSLDS) to make sure students are correct in the Clearinghouse, which will be done at least 50 days out from the time students were initially reported. IT and someone in the Registrar?s office will sign off on these processes when the report is run, when the report is reviewed, and once the report is sent. The Registrar's will run the Failure Irregular Withdrawal report daily, instead of weekly to ensure all students who have not attended classes are taken out within a timely manner as soon as they are reported by the instructors. These procedures were implemented in August 2022. West Liberty University (WLU) response When the Registrar Office is recording and entering data for Withdrawal (WD) students, a review and approval process has been implemented to ensure dates and information are entered accurately and timely.

2021-015

2022?012 SPECIAL TESTS AND PROVISIONS ? ENROLLMENT REPORTING (Repeat of Prior Year Findings 2021?016, 2020?015, 2019?019, 2018?012, 2017?006, 2016?008, 2015?015, 2014?011, 2013?028, 2012?43, 2012?47, 2012?49, and 2011?22) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/ 84.408/93.264/ 93.342/93.364/ 93.925Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 685.309(b) requires that institutions must ?(1) Upon receipt of an enrollment report from the Secretary, a school must update all information included in the report and return the report to the Secretary - (i) In the manner and format prescribed by the Secretary; and (ii) Within the timeframe prescribed by the Secretary. (2) Unless it expects to submit its next updated enrollment report to the Secretary within the next 60 days, a school must notify the Secretary within 30 days after the date the school discovers that - (i) A loan under Title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended; or (ii) A student who is enrolled at the school and who received a loan under Title IV of the Act has changed his or her permanent address. Condition: In our compliance testing, Fairmont State University (FSU) did not certify the status update within the 60-day requirement. For four of the five internal control instances tested for Blue Ridge Community and Technical College (BRCTC), adequate support for the internal control was not retained. For two of the five internal control instances tested for Pierpont Community and Technical College (PCTC), adequate support for the internal control was not retained. At West Virginia State University, there was no identifiable control that could be tested in the fall semester. Further, Marshall University did not submit summer enrollment files to the National Student Clearinghouse. Questioned Costs: N/A Context: Total Direct Loan and Pell expenditures for the SFA cluster in total were $440,969105 for the year ended June 30, 2022. Total Direct Loan and Pell expenditures for FSU, BRCTC, PCTC, WVSU and Marshall University were $17,854,722, $5,105,071, $4,772,684, $10,699,711, and $89,405,192, respectively. Cause: The institutions did not have adequate internal controls in place surrounding the enrollment reporting process. Effect: The institutions may not promptly notify the National Student Loan Data System (NSLDS) of changes in student status in an accurate manner; thus, inaccurate information is reported to the NSLDS. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. As institutions are responsible for timely reporting whether they report directly or via a third-party servicer, we recommend that the institutions implement a review process to ensure they are promptly notifying the U.S. Department of Education and NSLDS of changes in a student?s status in a timely and accurate manner. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? ENROLLMENT REPORTING Fairmont State University, Blue Ridge Community and Technical College, Pierpont Community and Technical College, West Virginia State University, and Marshall University Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 Fairmont State University (FSU) response The Appeals committee has updated policies and procedures to include the Business Analyst and the Registrar on the email communication list when a retroactive drop that changes enrollment status and/or a retroactive withdrawal is approved. FSU will identify the steps necessary at the National Student Clearinghouse to update the student?s status because this status update will be after the term has ended. FSU has put this plan into action already and will begin cleaning up retroactive drops and withdrawals from here on out. Blue Ridge Community and Technical College (BRCTC) response BRCTC provided training in October 2022 to appropriate staff members on the proper maintenance of record retention. Pierpont Community and Technical College (PCTC) response PCTC?s procedures to Title IV refunds were updated in January 2023 to enhance communication between the Financial Aid and Finance offices to ensure Finance has a copy of the student letter and additional Finance Office staff now have access to the Return to Title IV (R2T4) tracking sheet. The R2T4 tracking sheet is monitored by both the Financial Aid and Finance staff to ensure all refunds are returned within the required 45-day time period. The Director or Assistant Director of Financial Aid also review the return of aid calculations to ensure accuracy. West Virginia State University (WVSU) response Effective January 2022, WVSU utilizes the National, Student Clearinghouse (NSC) to update student?s enrollment and its effects on student?s direct loan and Pell statuses. Thorough edit checks of student data for each semester will be produced by IT on a regular basis. The Office of the Registrar, in coordination with Admissions, Dual Enrollment, and other contributors of student data, will make sure these errors are corrected. Special focus will be placed on resolving these errors before each enrollment file is produced. (Initial Data Integrity, First Check). On or around the 25th of each month, IT will produce the NSC enrollment file. Each time the file is produced, the file will be sent to the Registrar for review to ensure accuracy of the data being pulled from Banner. Registrar sends approval for upload to NSC. (Process Integrity, Second Check) The file will be uploaded to the NSC by IT, ensuring NSC received the appropriate number of records. The data will then be reviewed and any discrepancies in the data, when compared with past data, will be resolved in a timely manner. The Registrar, as the ultimate steward of student enrollment data, has taken full responsibility for resolving NSC errors. The NSC process makes sure these errors are resolved before the data is reported to the NSLDS, it is the responsibility of the Registrar to make sure these are resolved with accurate data. (Data Integrity, Third Check) After resolution of errors, the NSC will perform a final review of data before sending to the National Student Loan Data System (NSLDS). This will be reported on the NSLDS Reporting tab of the Enrollment Reporting screen in the NSC website. If data is satisfactory, the submission will be marked with "Congrats. No Errors!" by the originator "CH" (Clearinghouse). The NSC sends emails whenever these items are updated. It is the responsibility of the Registrar to review and resolve any errors in a timely manner. (Data Integrity, Fourth Check) The enrollment data is then submitted to the NSLDS. After NSLDS reviews the data, any errors will be reported back through the NSC in the same manner as NSC errors. Resolution of these errors is of special importance and will be given top priority. The NSC sends emails whenever these items are updated. It is the responsibility of the Registrar to review and resolve any errors in a timely manner. (Data Integrity, Fifth Check) Marshall University (MU) response As approved by Faculty Senate and the President, the 2023 academic calendar has been adjusted so that MU?s summer semester is now one long term with parts of term within it. This calendar revision more closely resembles the current fall and spring semesters. Now that summer is one term with parts of term within, this will allow MU to report enrollment to the National Student Clearinghouse on a multiple report date submission schedule throughout the summer term.

2021-016

2022?015 SPECIAL TESTS AND PROVISIONS ? VERIFICATION (Repeat of Prior Year Findings 2021?014, 2020?012, and 2019?016) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/ 84.408/93.264/ 93.342/93.364/ 93.925Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 2022 Federal Compliance Supplement requires that ?a menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate and provide an accurate code for the individual?s verification status in the Common Origination and Disbursement (COD) system (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4).? Condition: Bluefield State University (BSU), Fairmont State university (FSU), and Pierpont Community and Technical College (PCTC) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing, we noted for the samples selected that there was no documentation that a review was performed over the verification files. Additionally, PCTC could not locate documentation supporting the completion of the verification for one student selected. Questioned Cost: $16,573 ? PCTC Context: Total Student Financial Assistance Cluster expenditures for BSU, FSU, and PCTC were $7,984,211, $18,146,824, and $4,888,594, respectively, for the year ended June 30, 2022. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2022 were $480,090,562. Cause: BSU, FSU, and PCTC did not have adequate internal controls in place to ensure that verification changes identified were processed and submitted to the U.S. Department of Education. Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Recommendation: Management should develop and update internal controls to ensure that changes identified during the verification process are submitted to the U.S. Department of Education. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS - VERIFICATION Bluefield State University, Fairmont State University, and Pierpont Community and Technical College Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 84.408, 93.264, 93.342, 93.364, 93.925 Bluefield State University (BSU) response Effective January 2023, after all calculations are made and checklists are completed the files will be reviewed by another counselor for accuracy. This reviewer will sign off on the file and checklist that it has been reviewed and no errors were found or recalculation needed. Both the preparer and the reviewer will sign off and date the checklist. Fairmont State University (FSU) response Controls were put into place in 2020-2021 to address the additional review of the verification process once the initial review was completed. FSU found that through some reporting and timing that the additional review did not occur for all students. FSU will implement a weekly review with a comprehensive review monthly to ensure no students are missed through the additional review process in February 2023. Pierpont Community and Technical College (PCTC) response Staff members have been, and will continue to be, prompted to print, scan and keep all documentation pertaining to verifications. In these two cases, the counselor did not print the Confirmation page that displays upon completing V4 & V5 verifications in Central Processing System (CPS) and did not follow the flow of placing the verification packet in the appropriate location for second review. PCTC has reviewed policies and procedures and made a slight modification. Beginning with the 22/23 aid year, the Financial Aid Administrator (FAA) brings the completed verification packet to the Director of Financial Aid. The Director then determines who will complete the second review. The second review can be completed by either the Director of Financial Aid, the Assistant Director of Financial Aid or another qualified FAA. Once completed and signed off, the verification packet is place into the permanent individual student?s file.

2021-014

2022?016 SPECIAL TESTS AND PROVISIONS ? BORROWER DATA TRANSMISSION AND RECONCILIATION (Repeat of Prior Year Findings 2021?013, 2020?016, 2019?020, 2018?013, 2017?007, and 2016?006) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/ 84.408/93.264/ 93.342/93.364/ 93.925Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR 685.300(b)(5) states that schools must agree to ?On a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the Secretary.? Condition: For our control testing of the Direct Loan School Account Statement (SAS) reconciliation requirements at Pierpont Community and Technical College (PCTC), there was no identifiable control. At West Virginia State University, there was no identifiable control that could be tested in the fall semester. Questioned Costs: N/A Context: Total Direct Loan expenditures for the SFA cluster in total were $350,719,890, for the year ended June 30, 2022. Total Direct Loan expenditures for PCTC and WVSU were $2,582,514 and $11,188,523, respectively for the year ended June 30, 2022. Cause: Written procedures detailing the process to reconcile loans from Common Origination and Disbursement (COD) records to Banner exist. However, management represented that a formal reconciliation review process has not been successfully implemented. Effect: The absence of proper reviews over the reconciliations could cause the institution?s financial records for Direct Loan expenditures to be improperly stated. Recommendation: We recommend that management implement its existing process that monthly reconciliations are performed and saved, as documented in the institution?s written procedure, including documentation of supervisor review and approval. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? BORROWER DATA TRANSMISSION AND RECONCILIATION Pierpont Community and Technical College and West Virginia State University Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 84.408, 93.264, 93.342, 93.364, 93.925 Pierpont Community and Technical College (PCTC) response Beginning July 1, 2022, PCTC has updated the monthly reconciliation process. The Direct Loan School Account Statement (DLSAS) reports from Common Origination and Disbursement (COD) are downloaded by the 10th of each month, as before, by the Information Systems Specialist (ISS). The reports are now provided to the Assistant Director of Financial Aid (Asst.) and then reconciled to both Banner paid and COD approved Direct Loan disbursements. Reports verifying reconciliation are then completed and saved by the Assistant Director of Financial Aid and reviewed by the Director of Financial Aid for completion and accuracy. PCTC will maintain the documentation of the DLSAS statements each month and the reconciliation report along with evidence of said review. West Virginia State University (WVSU) response After each weekly disbursement, the Financial Aid Technician requests a Year-to-Date SAS Disbursement Detail on Demand Report from COD. The report is compared with the disbursement data within Banner and a COD/Banner Comparison Report is generated. The comparison report is sent to the Associate Director of Financial Aid and Director of Financial Aid to correct and document any discrepancies and if necessary, refers to the monthly DLSAS reports to verify resolution to any found discrepancies. The monthly DLSAS report is reviewed each month by the Director of Financial Aid to confirm consistency between fund disbursement and drawdownsreturn of payments by the Fiscal Office. The Director of Financial Aid and Business and Operations Manager both sign off weekly confirming accuracy. Effective August 2022, policies and procedures have been updated so any corrections applied will be documented, dated and saved by the Associate Director of Financial Aid and/or Director of Financial Aid.

2021-013

2022?017 SPECIAL TESTS AND PROVISIONS ? GRAMM-LEACH-BLILEY ACT ? STUDENT INFORMATION SECURITY (Repeat of Prior Year Findings 2021?018, 2020?018, and 2019?022) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/ 84.408/93.264/ 93.342/93.364/ 93.925Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 16 CFR 314.4 (b) requires institutions to base their information security programs on a risk assessment that ?identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks.? Condition: Fairmont State University (FSU) and Pierpont Community and Technical College (PCTC) did not perform an adequate risk assessment that covered the entire fiscal year. It is to be noted that FSU performed the required risk assessment June 1, 2022 and documented safeguards for the risks identified which covered one month and PCTC performed the required risk assessment in December 2021 and documented safeguards for the risks identified which covered six months. Further, the institutions identified above do not have internal controls in place surrounding the Gramm-Leach-Bliley Act requirements regarding student information security. Questioned Costs: N/A Context: Total expenditures for the SFA cluster were $480,090,562 for the year ended June 30, 2022. Cause: Institutions do not have policies and procedures, including internal controls, addressing the requirements of the Gramm-Leach-Bliley Act regarding student information security. Effect: The absence of policies and procedures could result in the loss or improper storage of student account information. Recommendation: We recommend that management implement policies and procedures, including internal controls, to ensure that they are in compliance with the Gramm-Leach-Bliley Act regarding student information security. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? GRAMM-LEACH-BLILEY ACT ? STUDENT INFORMATION SECURITY Fairmont State University and Pierpont Community and Technical College Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 84.408, 93.264, 93.342, 93.364, 93.925 Fairmont State University (FSU) response FSU entered into a contract with Wolf & Company to perform an external risk assessment for our systems in 2021 but was not completed due to staffing changes until 2022. The external risk assessment was received from Wolf in June 2022. The report and its suggestions were immediately reviewed and approved. This action will be implemented in January 2023 for fiscal year 2023 and will be implemented each July, starting with July 2023, hereafter. It was not understood that annual reviews needed to occur at the beginning of each fiscal year until this finding was received. Pierpont Community and Technical College (PCTC) response In December 2022 and January 2023, PTCT developed the following policies and procedures, which also detail internal controls, relative to the Gramm-Leach-Bliley Act and student information security. ? Access to Security Controlled Spaces Policy ? Anti-Virus Policy ? Backup and Recovery Policy ? Change Management Policy ? Computer Disposal Policy ? Computer Security Policy ? Data Security Policy ? IT Firewall Policy ? IT Incident Response Policy ? System Update Policy ? Mobile Device Use Policy ? Remote Access Policy ? Risk Assessment Policy ? Banner Document Procedure ? Banner Security Procedure ? Argos Access Procedure ? Active Directory Security and User Creation ? National Student Loan Clearinghouse Enrollment Submission Procedure ? National Student Loan Clearinghouse Graduate Only Submission Procedure ? Nelnet Refunds Procedure ? Risk Assessment Procedure Risk assessments will now be performed two times a year and will follow the Risk Assessment Procedure. This procedure also incorporates all policies, procedures, and internal controls as the framework for the ensuring of student information security.

2021-018

2022?018 SPECIAL TESTS AND PROVISIONS ? DISBURSEMENTS TO OR ON BEHALF OF STUDENTS (Repeat of Prior Year Findings 2021?012, 2020?013, 2019?017, and 2018?011) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/ 84.408/93.264/ 93.342/93.364/ 93.925Criteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR 668.165(a)(2), requires that, ?Except in the case of a post-withdrawal disbursement made in accordance with ? 668.22(a)(5), if an institution credits a student ledger account with Direct Loan, Federal Perkins Loan, or TEACH Grant program funds, the institution must notify the student or parent of? (i) The anticipated date and amount of the disbursement; (ii) The student?s or parent?s right to cancel all or a portion of that loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Secretary; and (iii) The procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. (3) The institution must provide the notice described in paragraph (a)(2) of this section in writing.? Condition: For one disbursement notification selected for testing at Pierpont Community and Technical College (PCTC), the disbursement date on the notification did not match the actual date of disbursement. Questioned Costs: $3,711 ? PCTC ? Assistance Listing #84.268 Context: Total expenditures for the SFA cluster were $480,090,562 for the year ended June 30, 2022. Total SFA cluster expenditures for PCTC were $4,888,594 for the year ended June 30, 2022. Cause: Internal controls and policies and procedures related to the institution?s disbursement notifications were not effectively implemented. Effect: Without proper notification of a loan or grant disbursement, a student could lose the opportunity to cancel the loan or grant within the required timeframe. Recommendation: We recommend that the institution implement more effective internal controls and policies and procedures to ensure that all information required as part of the disbursement notifications sent to students is accurate. Further, documentation supporting the disbursement and related notification should be maintained as evidence of the institution?s compliance with federal requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? DISBURSEMENTS TO OR ON BEHALF OF STUDENTS Pierpont Community and Technical College (PCTC) Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 84.408, 93.264, 93.342, 93.364, 93.925 PCTC?s standard procedure for disbursement letters is to have the Information Systems Specialist (ISS) provide letters for review to the Director of Financial Aid before mailing. This was either not done by the ISS or overlooked by the Director. The process has been reviewed and communicated to the current Information Systems Specialist as well as the Assistant Director of Financial Aid. The Assistant Director of Financial Aid is authorized to review letters in the absence of or instead of the Director. This action was implemented January 2023.

2021-012

2022?021 MAINTENANCE OF EFFORT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Education Stabilization Fund (ESF) 84.425C/84.425D/ 84.425R/84.425U Grant Award S425D210036 Grant Award S425V210008 Grant Award S425U210036 Grant Award S425U210036 ? 21A Grant Award S425W210050 ? 21A Grant Award S425D200036Criteria: 2 CFR 200.303 requires that the non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Under section 317 of the CRRSA Act, for fiscal year 2022, a state that receives ESSER II, GEER II, or EANS funds under the CRRSA Act must: a) Maintain State support for elementary and secondary education in fiscal year 2022 at least at the proportional level of the state?s support for elementary and secondary education relative to the state?s overall spending, averaged over fiscal years 2017, 2018, and 2019; and b) Maintain state support for higher education in fiscal year 2022 at least at the proportional level of the state?s support for higher education relative to the state?s overall spending, averaged over fiscal years 2017, 2018, and 2019. Under section 2004(a) of the ARP Act, a state that receives ARP ESSER funds must meet the above MOE requirement in each of fiscal years 2022 and 2023. Condition: The Department of Education did not meet the maintenance of effort provisions during fiscal year 2022. Questioned Costs: N/A Context: Total federal expenditures for the Education Stabilization Fund program for the fiscal year ended June 30, 2022, were $413,605,940. Cause: The Department of Education did not receive adequate appropriations from the State Legislature. The Department of Education requested a waiver from the provisions, but did not receive approval prior to the submission of the audit report. Effect: The Education Stabilization Fund did not meet the maintenance of effort requirement. Recommendation: The West Virginia Department of Education management and the State Legislative officials need to implement procedures to ensure adequate appropriations are made each federal fiscal year to meet the maintenance of effort requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

MAINTENANCE OF EFFORT Department of Education (DOE) Assistance Listing Number 84.425C/84.425D/84.425R/84.425U DOE submitted a waiver request in June 2022 and is currently working with the U.S. Education Department to obtain a waiver for Maintenance of Effort for FY22. DOE is also working with the Office of the Governor and Legislative Leaders to review compliance for the 2023 fiscal year.

2022?026 INTERNAL CONTROLS OVER CHILD CARE PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Child Care Disaster Relief/Child Care Development Block Grant/Child Care Mandatory and Matching Funds of the Child Care Development Fund (CCDF Cluster) 93.489/93.575/ 93.596/ COVID-19 93.575 Grant Award 2022 ? 2022G999005 Grant Award 2022 ? 2022G996005 Grant Award 2022 ? 2022G999004 Grant Award 2021 ? 2021G996005 Grant Award 2021 ? 2021G999005 Grant Award 2021 ? 2021G999004Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the review and approval of provider certifications in the application for funding and review and approval of verification of eligibility criteria; however, adequate documentation to test and determine that the controls were operating effectively was not available. Questioned Costs: N/A Context: Total federal expenditures for CCDF Cluster for the fiscal year ended June 30, 2022, were $196,326,309. Cause: Internal controls are not operating effectively surrounding the review and approval of provider certifications and verification of eligibility criteria. Effect: Providers who received ARP Act Stabilization funds may not have met the eligibility criteria or made the required certifications. Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review and approval of provider certifications and eligibility criteria. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER CHILD CARE PROVIDER ELIGIBILITY FOR ARP ACT STABILIZATION FUNDS Department of Health and Human Resources (DHHR) Assistance Listing Number 93.489, 93.575, 93.596, COVID-19 93.575 The DHHR Bureau for Family Assistance, Division of Early Care and Education, has a process in place for the approval of ARP stabilization funding for childcare providers set forth in the West Virginia Child Care Stabilization Payment Policy and Procedure Manual that includes: ? Eligibility of childcare providers (Chapter 2: Overview of WV Child Care Stabilization Payment Eligibility, Section 2.1), ? Conditions under which childcare providers are eligible (Chapter 2: Overview of WV Child Care Stabilization Payment Eligibility, Section 2.2), ? Ineligible childcare providers (Chapter 2: Overview of WV Child Care Stabilization Payment Eligibility, Section 2.3) ? An application process for childcare providers to apply for ARP stabilization funding (Chapter 5: Application Process, Sections 5.0, 5.1 and 5.2). Beginning in August 2022, the Division of Early Care and Education began auditing childcare providers (in batches of 300) to ensure appropriate use of the funds by requesting invoices and statements showing how the provider has utilized the ARP funding they have been awarded. Each quarter, a new batch is being audited until all childcare providers participating in the ARP stabilization funding have been audited. The procedure manual referenced above explains that the documentation relevant to providers? applications, eligibility, and audit findings are maintained within each provider?s FACTS provider case record. The Division?s tracking of providers deemed to be ?in good standing? is maintained within a manually updated tracking form housed on the Division?s internal server. By May 1, 2023, the Division of Early Care and Education will modify the West Virginia Child Care Stabilization Policy and Procedure Manual to document workflows more clearly for the award and monitoring of stabilization grants, as well as how the Division will more effectively produce such documentation to ensure that controls are operating effectively.

2022?027 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS ? CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE (Repeat of Prior Year Findings 2021?028, 2020?025, 2019?025, 2018?019, 2017?010, 2016?016, 2015?024, 2014?018, 2013?036, 2012?56, 2011?44, and 2010?41) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/ COVID-19 93.558 Grant Award 2022 ? 2022G996115 Grant Award 2021 ? 2021G996115 Grant Award 2021 ? 2021G990228Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the issuance and removal of sanctions; however, adequate documentation to test and determine that the controls were operating effectively was not consistently maintained or available. Questioned Costs: N/A Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2022, were $105,423,491. Cause: Internal controls are not operating effectively surrounding the issuance or removal of sanctions against TANF recipients. Effect: Recipient benefits may potentially be reduced or increased in error or without appropriate cause. Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review prior to the issuance or removal of sanctions. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS ? CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 The WV WORKS Policy Unit within the DHHR Bureau for Family Assistance will continue to send out reminders and Sanction Flowchart/Desk Guides to staff. The bureau?s Policy Unit will work with the bureau?s Division of Professional Development regarding the continued use of Blackboard Courses and Virtual Training. The WV WORKS Council will add a ?Sanction Workshop? to Payment Accuracy Conferences; the anticipated date for completion is August 31, 2023. Finally, the Policy Unit will continue to review RAPIDS Management Reports monthly regarding third level sanctions to ensure the sanctions are being sent to the Policy Unit for review and approval.

2021-028

2022?028 SPECIAL TESTS AND PROVISIONS ? INCOME ELIGIBILITY AND VERIFICATION SYSTEM (Repeat of Prior Year Findings 2021?029 and 2020?026) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558/ COVID-19 93.558 Grant Award 2022 ? 2022G996115 Grant Award 2021 ? 2021G996115 Grant Award 2021 ? 2021G990228Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Social Security Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows (42 USC 1320b-7; 45CFR section 205.55). (a) Wage information from the state Wage Information Collection Agency (SWICA) should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d) Information from the U.S. Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e) Unearned income from the Internal Revenue Service (IRS). Condition: During testing of 40 TANF cases subject to IEVS, we noted the following: Control - For 40 of the 40 cases selected for control testing, adequate documentation of review of the data exchanges, and system matches, and review of actions taken by the caseworker when required was not provided. Compliance- For 13 of the 40 cases selected for testing, the recipient did not appear to be receiving WVWorks benefits. The auditor was unable to determine if these cases should have been subject to a data match under TANF. For three of the 40 cases selected for testing, the recipient appeared to be receiving WVworks benefits, and a data match indicating caseworker action required was noted, but no action was completed. Additionally, additional documentation supporting no action required for the match was not available. For the remaining 24 of the 40 cases, the recipient appeared to be receiving WVWorks, a data match occurred, and related worker action was taken, but documentation supporting the action was not available. In addition, the auditor could not determine if specific action items were completed relating to individual exchange types. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2022, were $105,423,491. Cause: There are insufficient internal controls in place surrounding the generation and review of populations provided to the auditor, the Income Eligibility and Verification System matches, and the caseworker actions required within the Recipient Automated Payment Information Data System (RAPIDS). Also, insufficient documentation surrounding matches made between the information systems and actions taken after a match is made. Effect: The State of WV may not be coordinating data exchanges with other federally assisted benefit programs as required by the state plan. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. In addition, we also recommend DHHR evaluate their control over the caseworker action requirement within RAPIDS on matches related to the Income Eligibility and Verification System. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? INCOME ELIGIBILITY AND VERIFICATION SYSTEM Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558, COVID-19 93.558 The Income and Eligibility Verification System (IEVS) provides the DHHR Bureau for Family Assistance (the Bureau) with sources of information for use in determining eligibility and the amount of the benefit for applicants and recipients. Procedures established to assist in the prevention of fraud and abuse in the form of computer matches are utilized. The social security number of the applicant or recipient is matched against the files from the West Virginia Bureau of Employment Programs, the Internal Revenue Service, and the Social Security Administration (SSA). The State Online Query (SOLQ) provides direct access to SSA?s databases. Information received includes SSN verification; Supplemental Security Income (SSI); and Retirement, Survivors, and Disability Insurance (RSDI) details. Requests can be made only for individuals known to the eligibility system within the previous five years. The Bureau?s Policy Unit will collaborate with the Bureau?s Division of Professional Development to create a more detailed and precise training for the IEVS System. The blackboard platform will allow supervisors to track workers that have completed the training. The anticipated date for completion is June 30, 2023. Furthermore, the Policy Unit will send out various IEVS Policy Reminders and will work to revise the IEVS User Guide.

2021-029

2022?030 SPECIAL TESTS AND PROVISIONS ? PROVIDER ELIGIBILITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2205WV5021Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 455 Subpart E requires CHIP providers to be licensed in accordance with federal, state, and local laws and regulations to participate in the CHIP program, be screened and enrolled in CHIP, and make certain required disclosures to the state. Condition: During our testing of 60 cases for provider eligibility for CHIP, we noted one instance where a provider selected not to be a CHIP provider, however, was documented as a CHIP provider. We also noted four providers who chose to be terminated as a CHIP provider, however, were still documented as a CHIP provider. We also noted three providers did not have a letter of approval noting provider number or effective date. We also noted one provider that did not have a current license in the file. Questioned Costs: Unknown Context: The federal expenditures for the CHIP program for the fiscal year ended June 30, 2022, were $75,615,993. Cause: Management indicated that the providers were input incorrectly into the system. The appropriate documentation was not provided for the providers that did not have a letter of approval or current license. Effect: Payments may have been made to ineligible providers. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? PROVIDER ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.767 For the population related to provider eligibility, the auditors were provided a population/report of active providers, which the auditors used to select their sample. To determine if a provider is enrolled or terminated, the provider record must be accessed, and the enrollment effective date and termination effective date must be viewed. The termination dates on the provider record are accurate in HPAS (claims processing/payments system), as the claims processing system refers to the dates on the provider record. However, radio buttons in HPAS, system do not accurately reflect active enrollment. Claims submitted by terminated providers (providers with no active enrollment) are denied. The processing system looks for a termination date on the provider record and denies claims for providers with termination dates. No payments were made to providers with terminated enrollment and no claims payment errors were identified. Two other errors identified resulted from human error. One provider was erroneously indicated as enrolled with CHIP but had no CHIP contract attached in the system, and one provider did not receive an approval letter. Continuing training will be conducted with provider enrollment staff to ensure plan relationships are removed if not applicable and that letters are manually generated when the application is also manually reviewed.

2022?031 SPECIAL TESTS AND PROVISIONS ? MEDICAL LOSS RATIO (MLR) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(k) requires each MCO, PIHP, and PAHP to submit a report with the data elements specified in 42 CFR 457.1203(e), cross-referencing 42 CFR 438.8 (k) and 438.8. The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the MLR. The state should have a method to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation rates are revised retroactively. Condition: During our testing of the MLR reports of the CHIP and Medicaid contracts required to be submitted by Managed Care Organizations (MCOs), it was noted all three of the MCOs submitted MLR reports, however, DHHR had no documentation of their review and approval of the three MLR reports selected for testing. DHHR does not have any PIHPs or PAHPs. Questioned Costs: N/A Context: The federal expenditures for the CHIP program for the fiscal year ended June 30, 2022, were $75,615,993. The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The population subject to testing were the MLR reports of CHIP and Medicaid?s three MCOs. Cause: Management indicated that the review and approval of the MLR reports was not documented and maintained in the files. Effect: The DHHR does not have a documented control over the Medical Loss Ratio special test requirements. The MCOs may be reporting inaccurate data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the MLR reports is documented and maintained. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? MEDICAL LOSS RATIO (MLR) Department of Health and Human Resources (DHHR) Assistance Listing Number 93.767, 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 Starting July 1, 2023, WVCHIP will be included in the Medicaid managed care contracts and will be consolidated into Medicaid's oversight and monitoring processes. This consolidation will ensure that documentation of review and approval of MLR reporting is maintained.

2022?033 SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2205WV5021Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(m) requires each MCO, PIHP, and PAHP to submit to the state an audited financial report specific to the CHIP contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: During our testing of the audited financial reports of the CHIP contract required to be submitted by Managed Care Organizations (MCOs), it was noted that none of the MCOs submitted audited financial reports. There are three MCOs and all three of the MCOs were selected for testing. DHHR does not have any PIHPs or PAHPs. Questioned Costs: N/A Context: The federal expenditures for the CHIP program for the fiscal year ended June 30, 2022, were $75,615,993. The populations subject to testing were the financial and periodic audits of Medicaid?s three MCOs. Cause: Management indicated that the audited financial statements had not been obtained. Management indicated that they were in the process of implementing procedures around financial reporting for the MCOs. Effect: The DHHR is not in compliance with the Managed Care Financial Audit special test requirements. The MCOs may be reporting inaccurate encounter or financial data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that the financial audits are obtained and documentation of review and approval of the financial audits is maintained. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT Department of Health and Human Resources (DHHR) Assistance Listing Number 93.767 Starting July 1, 2023, WV CHIP will be included in the Medicaid managed care contracts and will be consolidated into Medicaid's oversight and monitoring processes. This consolidation will ensure that audited financial reports are submitted by the managed care organizations and documentation of review and approval is maintained.

2022?034 ELIGIBILITY (Repeat of Prior Year Finding 2021?037) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2005WV5021 Grant Award 2105WV5021 Grant Award 2205WV5021Criteria: 42 CFR 435.914 states ?(a) The agency must include in each applicant's case record facts to support the agency's decision on his application. (b) The agency must dispose of each application by a finding of eligibility or ineligibility, unless?(1) There is an entry in the case record that the applicant voluntarily withdrew the application, and that the agency sent a notice confirming his decision; (2) There is a supporting entry in the case record that the applicant has died; or (3) There is a supporting entry in the case record that the applicant cannot be located.? 42 CFR 457.965 states ?The State must include in each applicant's record facts to support the State's determination of the applicant's eligibility for CHIP.? 42 CFR 435.945(j) and 457.380(j) require states to develop and submit to the Centers for Medicaid and Medicare Services (upon request) a plan describing the Medicaid and CHIP eligibility verification policies and procedures adopted by the State. The State of West Virginia Modified Adjusted Gross Income (MAGI)-Based Eligibility Verification Plan for Medicaid & CHIP requires the following eligibility factors to be verified: income, residency, age, social security number, citizenship, immigration status, household composition, pregnancy, caretaker relative, Medicare, application for other benefits, and other insurance coverage. These are either required to be verified through electronic data sources or through self-attestation without additional verification or self-attestation with post-eligibility verification. Electronic data sources include: the Internal Revenue Service, Social Security Administration, State Wage Information Collection Agency, State Unemployment Compensation, State Administered Supplementary Payment Program, State General Assistance Programs, Supplemental Nutrition Assistance Program, Temporary Assistance for Needy Family, Bureau for Child Support Enforcement, State Income Tax, TALX, Work Force West Virginia and Families and Children Tracking System Income. State verification plans does not provide specific details. The most recently submitted plan for the State is posted on Medicaid.gov. Condition: During our testing of 60 cases for eligibility for CHIP, we noted one instance where the social security number, age, date of birth, and immigration status was not verified in the Data Exchange System as required by the State?s MAGI-based CHIP eligibility verification plan; and nine instances where income was not verified. Questioned Costs: $4,104 ? Assistance Listing #93.767 Context: The federal expenditures for the CHIP program for the fiscal year ended June 30, 2022, were $75,615,993. The nine cases with questioned costs represent $4,104 of CHIP payments out of a population of benefit payments tested for eligibility of $199,490. Cause: Management indicated that the information was verified in accordance with the CHIP verification plan or State plan, but no documentation was kept in the file of the verification. Effect: Payments may have been made for ineligible recipients. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. DHHR implemented an eligibility system enhancement on April 17, 2021, to retain historical record of verification of financial information obtained from the Federal Data Services Hub. We recommend that DHHR continue to follow the new policies and procedures. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.767 For the one instance ?where the social security number, age, date of birth, and immigration status was not verified in the Data Exchange System,? the DHHR Bureau for Family Assistance has requested the creation of an administrative report to identify cases without a social security number entered in applicable case records. This report will be available by February 28, 2023 and will eventually be generated on a quarterly basis. For the nine instances ?where income was not verified,? the DHHR Bureau for Family Assistance will develop additional training that is targeted at both the verification of income and non-financial factors such as date of birth, age, and social security numbers. The training materials will be available to field staff by March 31, 2023 and will include a mandatory completion date of April 30, 2023.

2022?035 SPECIAL TESTING AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services. In addition, the state must have (1) methods of determining criteria for identifying suspected fraud cases; (2) methods for investigating these cases; and (3) procedures, developed in cooperation with legal authorities, for referring credible allegations of fraud cases to law enforcement officials (42 CFR parts 455, 456, and 1002). Credible allegations of provider fraud must be referred to the state MFCU or an appropriate law enforcement agency in states with no certified MFCU (42 CFR Part 455.21). See Special Test #6, MFCU. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23). In addition, the SMA as required per Section 1902(a)(68) ? [42 USC 1396a(a)(68)] False Claims Education must ensure that providers and contractors receiving or making payments of at least $5 million annually under a state?s Medicaid program have (a) established written policies for all employees (including management) about the Federal False Claims Act, whistleblower protections, administrative remedies, and any pertinent state laws and rules; (b) included as part of these policies detailed provisions regarding detecting and preventing fraud, waste, and abuse; and (c) included in any employee handbook a discussion of the False Claims Act, whistleblower protections, administrative remedies, and pertinent state laws and rules. Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding case closure process. The key control is the review and approval of the Case Closure checklist. Of the 40 cases selected for testing, we noted the following: four cases had no documentation of the Case Closure checklist and one case had documentation of review; however, the review was not completed within the 60 calendar days, per the entity?s policy. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $ $4,466,291,166. The total population subject to testing was 568 closed cases with the Office of Program Integrity (OPI). Cause: Management did not document the review and approval of the Case Closure checklist. Effect: Cases may be closed without verification by management that all required elements of closed cases are present. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that Office of Program Integrity establish policies and procedures to ensure that case files are reviewed timely upon closure by a member of management separate from the caseworker and that the review is documented. The Office of Program Integrity?s control policy for case closures should also define a reasonable time period for review of closed cases. Views of Responsible Officials: Management agrees with the finding and working on a corrective action plan.

SPECIAL TESTS AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA ? 93.778 The DHHR Bureau for Medical Services plans to leverage existing case closure policies and procedures and implement an updated case tracking system which, through workflow rules, will make the closure process and requirements explicit so the system will not permit closures without record of all required information and manager approval. This new system is being implemented as part of an ongoing data warehouse project and should be in place by April 1, 2023.

2022?036 SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT (Repeat of Prior Year Finding 2021?036) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCTCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(m) requires each MCO, PIHP, and PAHP to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. 42 CFR 438.602(e) requires that the ?State must periodically, but no less frequently than once every three years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP, or PAHP.? 42 CFR 438.602(g) requires that the periodic audits must be posted on the State?s website. Condition: a) During our testing of the audited financial reports of the Medicaid contract required to be submitted by Managed Care Organizations (MCOs), it was noted that all three of the MCOs submitted audited financial reports; however, West Virginia Department of Health and Human Resources (DHHR) had no documentation of their review and approval of the three audited financial reports selected for testing. b) During our testing of the periodic audits, it was noted that the DHHR has contracted for the conduct of an independent audit for each MCO, however the reports have not been completed or posted on the State?s website. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. The populations subject to testing were the financial and periodic audits of Medicaid?s three MCOs. Cause: a) Management indicated that the review and approval of the financial audits was not documented and maintained in the files. b) Management indicated that they contracted with an independent accounting firm to conduct the periodic audits on each MCO for fiscal year 2021; however, the reports have not been finalized and issued. Effect: The DHHR is not in compliance with the Managed Care Financial Audit special test requirements. The MCOs may be reporting inaccurate encounter or financial data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the financial audits is documented and maintained. We recommend that DHHR conduct or contract to conduct periodic audits of the MCOs in accordance with the compliance requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA ? 93.778 The DHHR Bureau for Medical Services (BMS) collected and reviewed the audited financial statements from the managed care organizations (MCOs); however, review and approval of the financial statements were not documented. The BMS is establishing a process to document this approval process for the next reporting period. The BMS also understands the requirements related to 42 CFR 438.602(e). These requirements became effective for contracts starting on or after July 1, 2017. The BMS acknowledges their responsibility to audit the financial and encounter data for the MCOs no less than once every three years and to post the results on the state website. The BMS has previously relied upon agreed-upon procedures engagements conducted by an independent auditor to support the accuracy, truthfulness, and completeness of the MCO reported encounter and financial data. For the reporting period ended June 30, 2022, the BMS has contracted and engaged with an MCO oversight and actuarial vendor to conduct the independent audits and post them to the state website upon completion and approval by the BMS; however, as of the date of this report, the audit has not yet been completed by the vendor. For future reporting periods, the BMS intends to retain an MCO oversight and actuarial vendor to conduct the required independent audits to ensure continued compliance with 42 CFR 438.602(e).

2022?037 SPECIAL TESTS AND PROVISIONS ? SPECIAL TEST AND PROVISIONS: ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ COVID-19 93.777/ 93.778/ ARRA 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Grant Award 2005WVINCT Grant Award 1905WV5MAPCriteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 45 CFR 95.621 requires SMAs must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the Automated Data Processing (ADP) system security installations involved in the administration of the Secretary of the U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. Condition: The West Virginia Department of Health & Human Resources (DHHR) utilizes two ADP systems related to Medicaid: RAPIDS and West Virginia?s Medicaid Management Information System (MMIS). DHHR has policies and procedures in place related to performing ADP system security & risk assessment annually over the RAPIDS system. DHHR does not have policies and procedures established to perform periodic risk assessments and security reviews over MMIS. As this system utilizes sub-systems (Health PAS Solution) with automated components that directly affect the Medicaid cluster of programs, it meets the criteria stated above from 45 CFR 95.621. DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report for MMIS annually, but DHHR does not include it in their ADP system security & risk assessment. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2022, were $4,466,291,166. Cause: Management?s policies and procedures do not include performing a risk assessment and system security review over MMIS. Management does not formally review the SOC-1 Type 2 report for MMIS. Effect: MMIS risk or security concerns or control issues may not be identified by management in a timely manner. This can potentially reduce the implementation or update safeguards to address risks over both physical and digital resources/information. Recommendation: DHHR should develop a corrective action plan to address this matter in a timely manner. We recommend the establishment of policies and procedures to perform the risk assessment and security review and review the SOC 1 type 2 report for control issues identified. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TEST AND PROVISIONS - ADP RISK ANALYSIS & SYSTEM SECURITY REVIEW Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, COVID-19 93.777, 93.778, ARRA 93.778 The DHHR utilizes an external service organization for the design, development, implementation, and operation of the West Virginia Medicaid Management Information System (MMIS). The system furnishes the core MMIS functionality to support the State's Medicaid program, including maintaining provider, member/recipient, and reference/procedure code data, as well as processing and adjudication rules for claims, encounters, and prior authorizations. The system also provides configuration and system management tools to govern access to data, user security, and communications. The system is an object-oriented, rules-based software program that is designed to manage multiple lines of health care business. The system employs a unified relational database that enables efficient use of data and consistent information throughout all applications. The system includes functionality for claims processing and adjudication, provider administration, benefit plan and policy administration, member administration, and medical service authorization management. The service organization has developed a variety of policies and procedures including related control activities to help ensure their objectives are carried out and risks are mitigated. The control environment includes control objectives related to claims input (hard copy/paper claims and electronic claims); claims processing; claims payment; file maintenance (provider master file, recipient master file, and procedure codes); logical access (passwords and authentication, adding and modifying user access, terminating user access, access to privileged functions, and access review monitoring); change management; production scheduling; and backup procedures. Control activities are performed at a variety of levels throughout the organization and at various stages during the relevant business or information technology process. As expected, controls may be preventive or detective in nature and may encompass a range of manual and automated controls, including authorizations, reconciliations, and information technology controls. The service organization has a formal program in place to review and update the service organization's policies and procedures on at least an annual basis. Any changes to the policies and procedures are reviewed and approved by the service organization?s management and communicated to its employees. As indicated in the Condition section of this finding, the DHHR obtains a Service Organization Controls (SOC) 1 Type 2 report from its service organization on an annual basis. For the period ended June 30, 2022, although the DHHR did not formally document its review of the service organization?s SOC 1 Type 2 report, the DHHR did indeed review it and can hereby confirm that the service organization provided an assertion about the fairness of the presentation of the description and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives stated in the description. The service organization was responsible for preparing the description and assertion, including the completeness, accuracy, and method of presentation of the description and assertion; providing the services covered by the description; specifying the control objectives and stating them in the description; identifying the risks that threaten the achievement of the control objectives; selecting the criteria stated in the assertion; and designing, implementing, and documenting controls that are suitably designed and operating effectively to achieve the related control objectives stated in the description. The DHHR can also hereby confirm that the service organization?s service auditor conducted the examination in accordance with attestation standards established by the American Institute of Certified Public Accountants. Those standards required the service auditor to plan and perform the examination to obtain reasonable assurance about whether, in all material respects, based on the criteria in the service organization?s assertion, the description is fairly presented, and the controls were suitably designed and operating effectively to achieve the related control objectives stated in the description throughout the specified period. Finally, the DHHR can hereby confirm that in the service auditor?s opinion, in all material respects, based on the criteria described in the service organization?s assertion: 1) the description fairly presented the West Virginia MMIS that was designed and implemented throughout the period July 1, 2021 to June 30, 2022; 2) the controls related to the control objectives stated in the description were suitably designed to provide reasonable assurance that the control objectives would be achieved if the controls operated effectively throughout the period July 1, 2021 to June 30, 2022 and the subservice organizations and the user entity applied the complementary controls assumed in the design of the service organization?s controls throughout the period July 1, 2021 to June 30, 2022; and 3) the controls operated effectively to provide reasonable assurance that the control objectives stated in the description were achieved throughout the period July 1, 2021 to June 30, 2022 if the complementary subservice organizations and the user entity controls assumed in the design of the service organization?s controls operated effectively throughout the period July 1, 2021 to June 30, 2022. The DHHR is of the opinion that it is in compliance with 45 CFR 95.621 since it receives and reviews the SOC 1 Type 2 report from the service organization and since the report documents that the service organization establishes and maintains a program for conducting periodic risk analyses to ensure appropriate, cost-effective safeguards are incorporated into new and existing systems or whenever significant system changes occur. However, the DHHR recognizes the concern expressed within this finding, in that the DHHR does not include the SOC 1 Type 2 report as part of its own policies and procedures for ADP security over the MMIS. To enhance its controls, the DHHR will implement a policy and related procedures to document MMIS compliance with 45 CFR 95.621. The procedures will include but not be limited to a requirement to review and approve the SOC 1 Type 2 report from the MMIS service organization and document the review and approval process (e.g., for such matters as the service organization?s assertions, descriptions of its systems and controls, control objectives, and related controls, and the service auditor?s description of tests of controls and results). The anticipated date for implementation of the policy and related procedures is September 30, 2023, which is prior to the anticipated date for receipt of the next SOC 1 Type 2 report from the service organization.

SPECIAL TESTS AND PROVISION ? UI PROGRAM INTEGRITY - OVERPAYMENTS (Repeat of Prior Year Finding 2020?004) Federal Agency and Program Name Assistance Listing # U.S. Department of Labor Unemployment Insurance (UI) 17.225 and COVID-19 17.225 Grant Award UI-34093-20-55-A-54 Grant Award UI-34529-20-60-A-54 Grant Award UI-34749-20-55-A-54 Grant Award UI-35683-21-55-A-55 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During fiscal year 2021, the Workforce West Virginia (WWV) overpaid unemployment claims out of funds from the Unemployment Program and the Pandemic Unemployment Assistance Program (PUA). PUA is federal funding provided through the CARES Act to pay unemployment claims for self-employment individuals and independent contractors. Questioned Costs: $2,460 Grant Award UI-34749-20-55-A-54Context: Total federal disbursements for the Unemployment Insurance (UI) program were $1,332,242,594 for the year ended June 30, 2021. For six of the 60 overpayments, WWV could not provide documentation of the review and approval demonstrating the deputy?s decision of the overpayment case file. The six overpayments represent $2,460 of the total amount of overpayments tested of $289,038. Cause: WWV?s normal control procedures require the deputy?s review and approval documenting his/her decision in order to complete an overpayment determination and prior to notification to the claimant. Effect: WWV is not following policies and procedures established to identify overpayments and classify them in a manner that allows the state to take appropriate follow-up actions. Recommendation: WWV should implement policies and procedures that include maintaining documentation of the review and approval documenting the deputy decisions. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISION ? UI PROGRAM INTEGRITY - OVERPAYMENTS Workforce West Virginia (WWV) Assistance Listing Number 17.225, COVID-19 17.225 WWV will review current procedures by April 2022 and make appropriate modifications as necessary.

2020-004

SPECIAL TESTS AND PROVISIONS ? UI REEMPLOYMENT PROGRAMS: REEMPLOYMENT SERVICES AND ELIGIBILITY ASSESSMENTS (RESEA) Federal Agency and Program Name Assistance Listing # U.S. Department of Labor Unemployment Insurance (UI) 17.225 and COVID-19 17.225 Grant Award UI-34093-20-55-A-54 Grant Award UI-34529-20-60-A-54 Grant Award UI-34749-20-55-A-54 Grant Award UI-35683-21-55-A-55 Criteria: 2 CFR 200.303 requires that the non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? USC 506(e)(1)(A) requires that reemployment services and eligibility assessment (RESEA) programs provide ?proper notification to participating individuals of the programs? eligibility conditions, requirements, and benefits including the issuance of warnings and simple, clear notifications to ensure that participating individuals are fully aware of the consequences of failing to adhere to such requirements, including policies related to non-attendance or non-fulfillment of work search requirements; and reasonable scheduling accommodations to maximize participation for eligible individuals.? Condition: Two of the 60 RESEA tested did not properly identify the claimant interviewed. No policy or procedures are in place to verify a claimant?s identity during the RESEA interview specifically during the eligibility review. Two of the cases Workforce West Virginia (WWV) did not contact claimant on the scheduled interview date. Two of the cases did not notify claimant and no cause was noted for not rescheduling the interview. One of the cases did not document receiving feedback that the claimant reported as directed and participated in RESEA activities. Questioned Costs: N/A Context: Total federal disbursements for the Unemployment Insurance (UI) program were $1,332,242,594 for the year ended June 30, 2021. Cause: The internal controls over the RESEA interview process were not operating effectively. Effect: WWV does not have policies and procedures in place for verifying a claimant?s identity during the RESEA interview. WWV is not following the existing procedures in place for RESEA interviews. Recommendation: We recommend that management of WWV establish policies and procedures to verify the identity of the claimant during the RESEA interview. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS ? UI REEMPLOYMENT PROGRAMS: REEMPLOYMENT SERVICES AND ELIGIBILITY ASSESSMENTS (RESEA) Workforce West Virginia (WWV) Assistance Listing Number 17.225, COVID-19 17.225 WWV will establish a procedure for verifying the identity of claimants participating in the RESEA program using the identifying information found on the Automated Benefit Payment System (ABPS) by April 2022. Staff will verify identity using the Personal Identification Number and responses to security questions associated with the claim. Staff will also be able to use other identifying information such as claimant address, birthdate and information on former employers found on the Employee Wage Data screen of the ABPS to verify the identity of the claimant, as needed. If staff are unable to verify the identity of the participant, the interview will be ended, and the Fraud Unit will be notified.

SPECIAL TESTS AND PROVISION ? UI BENEFIT PAYMENTS Federal Agency and Program Name Assistance Listing # U.S. Department of Labor Unemployment Insurance (UI) 17.225 and COVID-19 17.225 Grant Award UI-34093-20-55-A-54 Grant Award UI-34529-20-60-A-54 Grant Award UI-34749-20-55-A-54 Grant Award UI-35683-21-55-A-55 Criteria: 2 CFR 200.303 requires that the non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: During our testing, one case of 60 selected did not provide or maintain documentation of supervisor review prior to case completion. Questioned Costs: N/A Context: Total federal disbursements for the Unemployment Insurance (UI) program were $1,332,242,594 for the year ended June 30, 2021. Cause: The internal controls over the benefit accuracy measurement (BAM) processes were not adequately enforced or documented. Effect: Federal requirements to assess the accuracy of UI benefit payments and denied claims could not be met. Recommendation: We recommend that Workforce West Virginia (WWV) implement internal controls over the benefit accuracy measurement review process, to ensure each case is reviewed by appropriate individuals familiar with the BAM requirements to ensure that accurate information is reported. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISION ? UI BENEFIT PAYMENTS Workforce West Virginia (WWV) Assistance Listing Number 17.225, COVID-19 17.225 WWV will review current procedures by April 2022 and make appropriate modifications to policies and procedures as necessary.

SPECIAL TESTS AND PROVISIONS ? DISBURSEMENTS TO OR ON BEHALF OF STUDENTS (Repeat of Prior Year Findings 2020-013, 2019-017, 2018?011) Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/84.408/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR 668.165(a)(2), requires that, ?Except in the case of a post-withdrawal disbursement made in accordance with ? 668.22(a)(5), if an institution credits a student ledger account with Direct Loan, Federal Perkins Loan, or TEACH Grant program funds, the institution must notify the student or parent of? (i) The anticipated date and amount of the disbursement; (ii) The student?s or parent?s right to cancel all or a portion of that loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Secretary; and (iii) The procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. (3) The institution must provide the notice described in paragraph (a)(2) of this section in writing.? Condition: For one disbursement notification selected for testing at Bluefield State College (BSC), the institutions did not provide all required notifications before disbursements were made. For one disbursement notification selected for testing at Concord University (Concord), the institution did not retain documentation of the disbursement notification sent to the student. The total sample selected for testing was 60. Questioned Costs: $3,901 ? BSC ? Assistance Listing #84.268 $896 ? Concord ? Assistance Listing #84.268 Context: Total expenditures for the Student Financial Assistance Cluster (SFA) cluster were $480,632,104 for the year ended June 30, 2021. The total SFA Cluster expenditures for BSC and Concord were $7,896,203 and $12,866,706 respectively, for the year ended June 30, 2021. Cause: Internal controls and policies and procedures related to the institutions? disbursement notifications did not encompass all of the required elements or were not maintained in the student?s file for auditor testing. Effect: Institutions were not in compliance with the requirements related to disbursement notification. Policies and procedures related to the institutions? disbursement notifications did not encompass all of the required elements or were not retained for auditor testing. Recommendation: We recommend that the institutions implement more effective internal controls and policies and procedures to ensure that all required information is part of the disbursement notifications sent to students and that supporting documentation for disbursement notifications is maintained and archived to allow for evidence of the institution?s compliance with federal guidelines. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? DISBURSEMENTS TO OR ON BEHALF OF STUDENTS Bluefield State College, Concord University Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 Bluefield State College (BSC) response Effective February 2021, policies and procedures were updated to ensure all student and parent borrowers will receive bi-weekly notification of their disbursement and right to cancel information of federal Direct Loans and Parent Plus Loans. The process for disclosure statements is electronic now with the disclosure statement sent electronically to the studentaid.gov website. In addition, the school will maintain and/or archive supporting documentation as evidence of BSC?s compliance with federal guidelines. Concord University (CU) response Effective November 2021, the Financial Aid Office added policies and procedures to include processes that ensure the notifications will be available. All disbursement email notifications are copied to the financial aid email to retain the document. All disbursement notifications will be inserted into RUAMAIL, a document in Banner, to show the date the email was sent. As the Assistant Director of Financial Aid disburses loans, the disbursement notices will be confirmed and copied into the financial aid email being placed in RUAMAIL.

2020-013

SPECIAL TESTS AND PROVISIONS ? BORROWER DATA TRANSMISSION AND RECONCILIATION (Repeat of Prior Year Findings 2020-016, 2019?020 2018?013, 2017?007, 2016?006) Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/84.408/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR 685.300(a)(5) states ?On a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the Secretary.? Condition: For our control testing of the Direct Loan School Account Statement (SAS) reconciliation requirements at Shepherd University (SU), Bluefield State College (BSC), and Pierpont Community and Technical College (PCTC), there were control findings. For SU and PCTC, there was no identifiable control that could be reviewed. For BSC, one of the two reconciliations selected for testing was not completed timely by the institution. Questioned Costs: N/A Context: Total Direct Loan expenditures for the Schedule of Expenditures Federal Awards (SFA) cluster in total were $373,935,103, for the year ended June 30, 2021. The total Direct Loan expenditures for SU, BSC, and PCTC were $11,801,984, $4,768,402, and $3,161,599 respectively, for the year ended June 30, 2021. Cause: Written procedures detailing the process to reconcile loans from Common Origination and Disbursement (COD) records to Banner exist, as provided in narrative form during the audit. However, management represented that a formal reconciliation review process has not been successfully implemented. Effect: The absence of proper reviews over the reconciliations could result in the institution?s financial records for Direct Loan expenditures to be improperly stated. Recommendation: We recommend that management implement a reconciliation process that monthly reconciliations are performed and saved as documented in the institution?s written procedure, including documentation of supervisor review and approval. In addition, management needs to ensure that all data received from COD is maintained within their records to facilitate audit procedures. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? BORROWER DATA TRANSMISSION AND RECONCILIATION Shepherd University, Bluefield State College and Pierpont Community and Technical College Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 Shepherd University (SU) response In October 2021, SU enhanced its reconciliation process to meet requirements. The Director of Financial Aid prepares the reconciliation. It will then be sent to the Associate Director of Financial Aid, who reviews and approves the reconciliation. Once approved, it is sent to the Director of Finance and the Associate Vice President of Finance/CFO to retain for verification purposes. Bluefield State College (BSU) response BSC updated its policies and procedures in February 2022 to ensure that Title IV financial aid data is reviewed and reconciled with the financial aid data recorded in the Banner system. All discrepancies are identified and resolved between Financial Aid after reviewing and reconciling the reports generated by the Common Origination and Disbursement records (COD) to the disbursement Excel spreadsheets from the Business Office. The Direct Loan Reconciliation Spreadsheet and any supporting spreadsheets will be reviewed within 30-45 days by the Financial Aid Manager and Director of Accounting. Pierpont Community and Technical College (PCTC) response Beginning July 1, 2021, PCTC instituted a monthly reconciliation process in which the Direct Loan Student Account Statement (DLSAS) reports from the Common Origination and Disbursement records (COD) are downloaded by the 10th of each month and reconciled to both Banner paid and COD approved Direct Loan disbursements. Reports verifying reconciliation are completed and saved by the associate director of Financial Aid and reviewed by the Information Systems Specialist or by one of the Financial Aid Counselors in the absence of the Information Systems Specialist. PCTC will maintain the documentation of the DLSAS statements each month and the reconciliation report along with evidence of staff review.

2020-016

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS ? VERIFICATION (Repeat of Prior Year Findings 2020-012, 2019-016) Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/84.408/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 2021 Federal Compliance Supplement requires that ?a menu of potential verification items for each award year is published in the Federal Register, and the items to verify for a given application are selected by ED from that menu and indicated on the student?s output documents. Verification tracking groups and verification items for each award year can also be found in the annual FSA Handbook, Application and Verification Guide, Chapter 4. The institution shall also require applicants to verify any information used to calculate an applicant?s EFC that the institution has reason to believe is inaccurate (34 CFR 668.54(a); FSA Handbook Application and Verification Guide, Chapter 4)?. Condition: West Virginia University ? Parkersburg (WVUP) and West Virginia State University (WVSU) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing we noted for the samples selected that there was no documentation that a review was performed over the verification files. Questioned Cost: N/A Context: Total Student Financial Assistance Cluster expenditures for WVUP and WVSU were $7,807,624 and $13,411,259 respectively for the year ended June 30, 2021. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2021 were $480,632,104. Cause: WVUP and WVSU did not have adequate internal controls in place to ensure that verification changes identified during the process were processed and submitted to the U.S. Department of Education. Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Recommendation: Management should develop and update internal controls to ensure that changes identified during the verification process are submitted to the U.S. Department of Education. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS - VERIFICATION West Virginia University ? Parkersburg and West Virginia State University Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 West Virginia University ? Parkersburg (WVUP) response Effective February 2022, WVUP will ensure that each student file selected for verification is reviewed and finalized by two different financial aid officials by entering the information in Banner. West Virginia State University (WVSU) response In January 2022, WVSU established policies and procedures for each student file to be initially reviewed by a Financial Aid Administrator and then reviewed by a second Administrator. The initial reviewer will then submit any corrections to the second reviewer, who will confirm accuracy. This process will repeat until all corrections are accurate.

2020-012

SPECIAL TESTS AND PROVISIONS ? RETURN OF TITLE IV FUNDS (Repeat of Prior Year Findings 2020?014, 2019?018) Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/84.408/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 668.173(b) requires timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if - (1) The institution deposits or transfers the funds into the bank account it maintains under ? 668.163 no later than 45 days after the date it determines that the student withdrew; (2) The institution initiates an electronic funds transfer (EFT) no later than 45 days after the date it determines that the student withdrew; (3) The institution initiates an electronic transaction, no later than 45 days after the date it determines that the student withdrew, that informs a FFEL lender to adjust the borrower?s loan account for the amount returned; or (4) The institution issues a check no later than 45 days after the date it determines that the student withdrew. An institution does not satisfy this requirement if - (i) The institution?s records show that the check was issued more than 45 days after the date the institution determined that the student withdrew; or (ii) The date on the cancelled check shows that the bank used by the Secretary or FFEL Program lender endorsed that check more than 60 days after the date the institution determined that the student withdrew. Condition: In three of the sixty samples selected for Return of Title IV compliance testing, West Virginia University ? Parkersburg (WVUP), New River Community and Technical College (NRCTC), and Bluefield State College (BSC), returned funds after the 45 day limit. In two of the sixty samples selected for Return of Title IV compliance testing, West Liberty University (WLU), and BlueRidge Community and Technical College (BRCTC) the institutions returned a different amount to the United States Department of Education than the amount calculated. For four out of nine other samples tested over the CARES Act compliance attribute for WVUP, the institution did not properly report the required CARES Act information to the Department of Education (ED) as the Coronavirus Indicator was not properly indicated when reported to the ED?s Common Origination and Disbursement. In addition to the compliance testing above, we also identified the following internal control exceptions: In two of twenty instances in internal control testing at NRCTC, in two of 16 instances of internal control testing at BSC, and in one of six instances of internal control testing at WVUP, we noted that the internal control was not sufficiently documented or not functioning effectively. Three institutions, Fairmont State University (FSU), Pierpont Community and Technical College (PCTC) and West Virginia State University (WVSU) did not have controls over return of Title IV calculation. Questioned Costs: $164 ? BlueRidge Community and Technical College $2,598 ? West Liberty University Context: The total amount of refunds tested for controls and compliance of Return of Title IV calculations for BlueRidge Community and Technical College and West Liberty University were $164 and $2,598, respectively. The amount of Title IV funds that were incorrectly returned were $173 and $2,606 for BRCTC and WLU respectively. Total Student Financial Assistance Cluster expenditures for the year ended June 30, 2021 were $480,632,104. The total Student Financial Assistance Cluster expenditures for the year end June 30, 2021, for WVUP, NRCTC, BSC, WLU, BRCTC, WVU, FSU, PCTC, and WVSU were $7,807,624, $3,427,146, $7,896,203, $18,271,470, $6,031,526, $199,712,968, $21,268,428, $5,831,626, and $13,411,259 respectively. Cause: The institutions do not have adequate internal controls in place to prevent non-compliance. Effect: The institutions are not returning the correct amount of federal student financial assistance required or the funds are not returned within the required time frame to the United States Department of Education. Recommendation: Management should implement internal controls to ensure that the correct amount of federal student financial assistance is returned and returned within the required time frame. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? RETURN OF TITLE IV FUNDS West Virginia University ? Parkersburg, New River Community and Technical College, Bluefield State University, West Liberty University, Blueridge Community and Technical College, Fairmont State University, Pierpont Community and Technical College and West Virginia State University Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 West Virginia University ? Parkersburg (WVUP) response WVUP runs and reviews a withdrawal report weekly for Return of Title IV (R2T4) calculations. WVUP will review this process as well as the accuracy of the report to ensure compliance. WVUP will also add the review of the Coronavirus indicator checkbox to R2T4 internal controls for as long as it is applicable. New River Community and Technical College (NRCTC) response In August 2021, NRCTC implemented an Administrative Withdrawal policy where Failure Irregular Withdrawal (FIW) reports are run and reviewed weekly by the Registrar to capture students that have not been attending classes to remove them from classes immediately and return Title IV funds. After it has been reviewed by the Registrar, the FIW report is sent to the Business and Financial Aid Offices for approval and records will be retained for verification purposes. Bluefield State College (BSC) response Internal controls are in place to perform Return of Title IV (R2T4) withdrawal and calculation ensuring records comply and that return of Title IV refunds are returned within the required time frame of 45 days. Controls include the review of permit to withdrawal forms completed with all signatures of offices involved and sign off on R2T4 calculations as reviewed will occur within time frame of 45 days by Financial Aid Manager. The controls were implemented in August 2021. West Liberty University (WLU) response All Return to Title IV calculations are completed by the Director and reviewed by the Assistant Director to ensure funds are returned accurately and timely. Beginning November 2021, the Assistant Director began processing additional calculations to ensure the calculated figures are accurate. Blueridge Community and Technical College (BRCTC) response In December 2021, BRCTC added a secondary review of return calculations to ensure accuracy between the return calculation and the actual dollars returned. This second review has been communicated to Financial Aid and Finance Office staff and added to the procedures. Fairmont State University (FSU) response In January 2022, procedures for the Return of Title IV funds were updated to include the review of the students who have withdrawn beyond the 60% term and have earned all their federal and state financial aid according to federal and state regulations. Pierpont Community and Technical College (PCTC) response PCTC?s financial aid staff will complete a Return of Title Funds (R2T4) for all students. This includes those outside the refund period to ensure adequate evidence that no federal funds were required to be returned for student who withdrew or received all ?F?s and failed to withdraw even after 60% of the term was completed by each. This will enhance the existing policies and procedure for students inside the refund period and will be completed in a timely manner. This process was implemented in November 2020 but was not followed 100%. The enhanced policies and procedure will be followed for the 2021/2022 Academic School Year beginning August 15, 2021. West Virginia State University (WVSU) response WVSU updated internal controls surrounding Return of Title IV (R2T4) in January 2022. An initial review and calculations will be performed by a Financial Aid Administrator and then reviewed by a second Administrator. The initial reviewer will update the student account accordingly and perform any return of Title IV funds needed. The second reviewer will confirm that all updates are accurate. Both reviewers will then sign off on R2T4 calculation documentation for the student?s file.

2020-014

SPECIAL TESTS AND PROVISIONS ? ENROLLMENT REPORTING (Repeat of Prior Year Findings 2020?015, 2019?019, 2018?012, 2017?006, 2016?008, 2015?015, 2014?011, 2013?028, 2012?43, 2012?47, 2012?49, 2011?22) Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/84.408/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 685.309(b) requires that institutions must ?(1) Upon receipt of an enrollment report from the Secretary, a school must update all information included in the report and return the report to the Secretary - (i) In the manner and format prescribed by the Secretary; and (ii) Within the timeframe prescribed by the Secretary. (2) Unless it expects to submit its next updated enrollment report to the Secretary within the next 60 days, a school must notify the Secretary within 30 days after the date the school discovers that - (i) A loan under title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended; or (ii) A student who is enrolled at the school and who received a loan under title IV of the Act has changed his or her permanent address. Condition: In our compliance testing, Bluefield State College (BSC) and New River Community and Technical College (NRCTC) did not certify the status update within the 60-day requirement. The following institutions did not have adequate internal controls in place surrounding the enrollment reporting process for the selections made: West Virginia State University (WVSU), BSC, NRCTC, Shepherd University (SU), and Pierpont Community and Technical College (PCTC). Further, West Virginia University did not have adequate internal controls around the review of graduate file information submitted to the National Student Clearinghouse. Questioned Costs: N/A Context: Total Direct Loan and Pell expenditures for the SFA cluster in total were $480,632,104, for the year ended June 30, 2021. Total Direct Loan and Pell expenditures for BSC, NRCTC, WVU, WVSU, SU, and PCTC were $7,896,203, $3,427,146, $199,712,968, $13,411,259, 16,325,525 and $5,831,626, respectively. Cause: The institutions did not have adequate internal controls in place surrounding the enrollment reporting process. Effect: The institutions may not promptly notify the National Student Loan Data System (NSLDS) of changes in student status in an accurate manner; thus, inaccurate information is reported to the NSLDS. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. As institutions are responsible for timely reporting whether they report directly or via a third-party servicer, we recommend that the institutions implement a review process to ensure they are promptly notifying the U.S. Department of Education and NSLDS of changes in a student?s status in a timely and accurate manner. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? ENROLLMENT REPORTING Bluefield State College, New River Community and Technical College, West Virginia State University, Shepherd University, Pierpont Community and Technical College and West Virginia University Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 Bluefield State College (BSC) response As of March 2022, the Registrar and Associate Registrar are trained and authorized to submit the National Student Loan Data System (NSLDS) reports in their entirety, including all error reports, thus ensuring continuity of reporting in the event of an absence. Each report now has its own file labeled with the type and submission due date and is accessible to both employees at all times. Error reports in Banner will now be run a minimum of two times, or until the error report is completely resolved before generating the enrollment report in Banner. These error reports will be printed, documented, and filed. After the report is generated from Banner, the enrollment number will be checked against the Current Student Audit in Argos. After reconciling the National Student Clearinghouse (NSC) error report, the reconciliation will be reviewed and approved by both the Registrar and Assistant Registrar to confirm the accuracy and timing of the report submission. New River Community and Technical College (NRCTC) response NRCTC?s Registrar office will request the error report from IT and correct the errors on the report. The Registrar?s office will request IT to run the error report again to make sure all errors have been cleared. Once the report is free of errors, the Registrar?s Office will request the enrollment report from IT and submit it to the NSC. The Registrar?s office will make sure the report is submitted by the due date and errors sent by the NSC are corrected in a timely manner. The Registrar?s office will run a random selection of 20 students from NSLDS to ensure students are correct in the NSC, which will be done at least 50 days out from the time students were initially reported. IT and the Registrar?s office will review and approve these processes when the report is run, reviewed, and submitted. The Registrar has created an Administrative Withdrawal process which was approved and implemented in Fall 2021. The Failure Irregular Withdrawal (FIW) report is run weekly to ensure all students who have not attended are taken out of classes in a timely manner once they are reported by the instructors. West Virginia State University (WVSU) response WVSU utilizes the NSC to update students? enrollment and the effects on the students? direct loan and Pell statuses. WVSU has a five-step process to check the integrity and accuracy of the student enrollment data. First, IT conducts a thorough edit check of student data throughout the semester in coordination with the Office of the Registrar, Admissions, Dual Enrollment and other contributors to ensure errors are corrected. Particular focus will be placed on resolving errors before each enrollment file is produced. Next, the Office of the Registrar will conduct a full review of the process used to produce the NSC enrollment file on the 25th of each month. Each time the file is produced, an IT professional will confirm it is produced according to the agreed-upon process. In the third step, the Office of the Registrar verifies the accuracy of the data prior to the file being uploaded in the NSC by IT and ensures the number of files received by the NSC matches the number of files submitted. The Office of the Registrar will resolve any errors indicated by the NSC. This process will ensure any errors are resolved prior to the data being reported to the NSLDS. The fourth step, after the resolution of any errors, is the NSC will perform a final review of the data before sending it to the NSLDS. This will be reported on the NSLDS Reporting tab of the Enrollment Reporting screen in the NSC website. The NSC sends emails whenever these items are updated. It is the responsibility of the Registrar to review and resolve any errors in a timely manner. The fifth and final step is the submission of the enrollment data to the NSLDS. After NSLDS reviews the data, any errors will be reported back through the NSC in the same manner as NSC errors. Resolution of these errors is of special importance and will be given top priority by the Registrar. Shepherd University (SU) response Effective August 2021, SU has returned to the office full-time, and have further refined and strengthened the review and control process. The process includes making sure the review and approval is documented for enrollment reporting. The process has also been updated to support remote work if needed in the future. Pierpont Community and Technical College (PCTC) response PCTC?s Registrar staff will separate the withdrawal and review process between three separate employees. One employee will complete the withdrawal process, one employee will complete the file submission process to the National Student Clearinghouse (NSC), and then a third employee will complete the review of the NSC file submission. This review will include a random selection of 20 students within each population and those students will be manually reviewed in Banner to ensure accuracy of the enrollment status that was generated via a report to submit to NSC. In addition, the Registrar staff will sign off on said tracking document and share the document with the financial aid staff. The financial aid staff will then review a separate selection of 20 students from each submission in NSLDS to ensure accuracy of the reported enrollment status. Should any discrepancies be found, the Registrar?s office and Financial Aid office will work collectively to resolve each. This process was implemented in January 2021 and applies to all submissions to the NSC to ensure accuracy. West Virginia University (WVU) response WVU?s Office of the University Registrar (OUR) is currently working with the WVU ITS department to receive an output of all graduates being reported on the Grad Only file. After this output is received, an internal report will be created in Argos to pull out all students updated with a Degree Awarded status. The Argos report will then be compared to the output from the submission job. If any discrepancies are discovered, the issue will be identified and corrected. The OUR will run the Argos file against the NSC file by using ACCESS until all discrepancies have been resolved and the comparison files match. All data files will be signed off and cleared by two OUR staff members along with all NSC communication and will be saved and retained for verification purposes. The additional controls will be implemented by June 2022.

2020-015

SPECIAL TESTS AND PROVISIONS ? GRAMM-LEACH-BLILEY ACT ? STUDENT INFORMATION SECURITY (Repeat of Prior Year Findings 2020?18, 2019?022) Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/84.408/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 16 CFR 314.4 (b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. 16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.? Condition: The following institutions did not perform a risk assessment that addresses the three required areas as noted in 16 CFR 314.4(b), which are 1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures: West Virginia State University (WVSU), West Virginia University-Parkersburg (WVUP), Fairmont State University (FSU), Pierpont Community and Technical College (PCTC). Further, since risk assessments were not completed, the institutions did not document safeguards as required by 16 CFR 314.4(c). It is to be noted WVUP, WVSU, and PCTC performed the required risk assessment in August 2021, November 2021, and December 2021, respectively and documented safeguards for the risks identified. Further, the institutions identified above do not have internal controls in place around requirements listed in 16 CFR 314.4(b) and (c). Questioned Costs: N/A Context: Total expenditures for the SFA cluster in total were $480,632,104 for the year ended June 30, 2021. Cause: Institutions do not have policies and procedures, including internal controls, addressing the requirements of 16 CFR 314.4(b) and (c). Effect: The absence of policies and procedures could result in the loss or improper storage of student account information. Recommendation: We recommend that management implement policy and procedures, including internal controls, to ensure that they are in compliance with 16 CFR 314.4(b) and (c). Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? GRAMM-LEACH-BLILEY ACT ? STUDENT INFORMATION SECURITY West Virginia State University, West Virginia University ? Parkersburg, Fairmont State University and Pierpont Community and Technical College Assistance Listing Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 West Virginia State University (WVSU) response WVSU has performed the required risk assessment per 16 CFR 314.4(b) and also documented safeguards per requirements of 16 CFR 314.4(c). This assessment was initiated prior to the end of fiscal year 2021 but was not completed until fiscal year 2022. Policies and procedures have been established and implemented to ensure ongoing compliance. West Virginia University ? Parkersburg (WVUP) response After completion of the FY 2020 audit in April 2021, the FSA Cyber Compliance Division notified WVUP to submit a corrective action plan within 30 days and to implement that corrective action plan within six months. The risk assessment and required staff training were completed in July 2021. A follow-up risk assessment and GLBA staff training is scheduled to be conducted by April 2022. WVUP has also created a GLBA policy and procedures manual and continues to review and enhance internal controls and policies as needed to comply with GLBA requirements. Fairmont State University FSU has partnered with Wolf & Company to undergo a risk assessment and ensure safeguards are in place and documented. This process is currently underway and will be completed by April 2022. Pierpont Community and Technical College (PCTC) response PCTC contracted with Wolf and Company to purchase a Risk Assessment Product called WolfPac and to assist in performing the Risk Assessment to comply with GLBA requirements. That assessment was completed on December 15, 2021.

2020-018

ALLOWABILITY (Repeat of Prior Year Finding 2020-020) Federal Agency and Program Name Assistance Listing # U.S. Department of Education HEERF Education Stabilization Fund Under the Coronavirus Aid, Relief, and Economic Security Act Higher Education Emergency Relief Fund COVID-19 84.425E/84.425F/84.425J Education Stabilization Fund Under the Coronavirus Aid, Relief, and Economic Security Act Governor?s Emergency Education Relief 84.425C Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document issued October 14, 2020 question 19 states, ?Institutions may provide emergency financial aid grants to students using checks, electronic transfer payments, debit cards, and payment apps that adhere to the Department?s requirements for paying credit balances to students. The disbursement of the emergency financial aid grant to the student must remain unencumbered by the institution; debts, charges, fees, or other amounts owed to the institution may not be deducted from the emergency financial aid grant. The emergency financial aid grant may not be made to students through the use of a credit card that can be used only on campus or in a retail outlet affiliated with the institution.? Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document issued October 14, 2020 question 20 states, ?At institutions that provide both online and ground-based education, those students who were enrolled exclusively in an online program on March 13, 2020, the date of the President?s Proclamation, ?Declaring a National Emergency Concerning the Novel Coronavirus Disease (COVID-19) Outbreak,? Federal Register Vol. 85, No. 53 at 15337- 38, are not eligible for emergency financial aid grants. The formula provided by Congress for calculating the distribution of funds to institutions excludes students who were exclusively enrolled in distance education courses. Additionally, the emergency financial aid grants to students are for expenses related to the disruption of campus operations due to coronavirus, and students who were enrolled exclusively in online programs would not have expenses related to the disruption of campus operations due to coronavirus.? Condition: During our testing of allowability at Bluefield State College (BSC), New River Community and Technical College (NRCTC), and Pierpont Community and Technical College (PCTC), the following compliance findings were identified: ? During our testing of allowability at BSC, one transaction out of a sample of 16 nonpayroll transactions selected for testing was deemed unallowable to be paid from the HEERF II institutional funds because the expenditure was not an expenditure incurred due to the coronavirus. Additionally, nine students out of a sample of 40 selected for testing received a tuition discount paid out of the HEERF I funds that was deemed unallowable since the tuition discount was not related to changes in the delivery of instruction. ? During our testing of allowability at NRCTC, three students tested out of a sample of 40 were not prioritized as having exceptional need in line with the institution?s approved plan as required for expenditures incurred under the HEERF II and III student portion grant award. ? During our testing of allowability at PCTC, five students tested out of a sample of 40 were awarded an emergency aid grant out of the HEERF I student portion funds and were enrolled exclusively in an online program on March 13, 2020 and thus were ineligible to receive the grant since there was no documentation the students had exceptional need. Additionally, PCTC did not prioritize two students with exceptional need in line with the institution?s approved plan as required for expenditures incurred under the HEERF II and III student portion grant award. Every finding noted above has a corresponding control finding. In addition, West Virginia State University (WVSU), and West Liberty University (WLU) did not have adequate internal controls in place surrounding the student portion disbursements. WVSU, West Virginia Northern Community College (WVNCC), and Mountwest Community and Technical College (MCTC) had instances of the internal control review control not occurring related to institution portion disbursements. For our testing of GEER allowability at the Governor?s Office, there were no internal controls in place surrounding the disbursement of GEER funds to Institutions of Higher Education (IHEs) or other Education-Related Entities (84.425C). Subsequent to the disbursements, the Governor?s Office updated their policies and procedures to include a review and approval of amounts prior to disbursement. Questioned Costs: $29,047 ? BSC ? Assistance Listing #84.425F Grant Award #P425F200727 $3,015 ? NRCTC ? Assistance Listing #84.425E Grant Award #P425F203064 $5,526 ? PCTC ? Assistance Listing #84.425E Grant Award # P425E202354 Context: Total HEERF expenditures for WVSU, BSC, NRCTC, WVNCC, WLU, PCTC, and MCTC were $6,944,564, $4,473,185, $889,471, $1,619,254, $2,620,038, $1,939,764, and $3,116,584 respectively, for the year ended June 30, 2021. The total expenditures for the HEERF program for the year ended June 30, 2021 were $97,823,738. Total GEER expenditures for the State of West Virginia were $9,533,504. Cause: The institutions and the Governor?s Office do not have adequate internal controls in place to prevent non-compliance with the required regulations. Effect: The institutions are not in compliance with federal statues, regulations, and terms of the conditions of the federal award. Without sufficient internal controls in place, expenditures may be paid that are not allowable. Recommendation: We recommend that the institutions enhance their policies and procedures to ensure they are in compliance with all federal statutes, regulations, and terms and conditions of the federal award. We recommend that the institutions also implement controls to ensure that expenditures are properly reviewed and approved before being charged to a federal award. We recommend that the Governor?s Office implement effective internal controls and policies. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

ALLOWABILITY Bluefield State College, New River Community and Technical College, Pierpont Community and Technical College, West Virginia State University, West Liberty University, West Virginia Northern Community College, Mountwest Community and Technical College, and Office of the Governor Assistance Listing Number COVID-19 84.425E, 84.425F, 84.425J, 84.425C Bluefield State College (BSC) response As of September 2021, all potential expenses to be paid from the HEERF funds are reviewed and approved by the CFO or Director of Accounting prior to incurring the expense. New River Community and Technical College (NRCTC) response In December 2021, NRCTC simplified the definition of exceptional need to students who have received any Pell award. The list of students with exceptional are now reviewed by the Financial Aid Office for verification. Pierpont Community and Technical College (PCTC) response PCTC determined that any student who met the eligibility requirements under Section 484 in Title IV of the Higher Education Act of 1965 and who were not enrolled in 100% online programs were financially impacted by the disruption of campus operations due to coronavirus. Eligibility for Section 484 of Title IV of the Higher Education Act of 1965 is determined by requiring all students to complete a 2020-2021 FAFSA and by a review of each student?s compliance with Satisfactory Academic Progress (SAP). Students who failed to complete a FAFSA or comply with SAP were deemed to be ineligible to receive an Emergency Financial Aid Grant. Before any Emergency Financial Aid Grants were distributed, each student?s eligibility was confirmed by the Office of Financial Aid and prioritized by Pell Grant eligibility. Repeated occurrences of students receiving HEERF enrolled in only online classes will no longer be an issue. Criteria has been updated to allow students enrolled in 100% online classes to be eligible for the funding. To prevent further occurrences, such as the two students not prioritized in the finding, Financial Aid will generate a report of all enrolled students meeting the above criteria for each award period beginning the Spring 2022 semester on or about March 1, 2022. The report will be reviewed by the Financial Aid Counselors to ensure no eligible student has been inadvertently omitted from receiving priority disbursement of Higher Education Emergency Relief Funds. West Virginia State University (WVSU) response WVSU will implement a dual review and sign-off process by Business and Finance to ensure compliance by July 2022. West Liberty University (WLU) response WLU hired its CFO in August 2021. Regarding student portion disbursements, the CFO will work with the Financial Aid Director to obtain those students who are eligible for awards. The CFO will then review and approve the final list of students before having the Manager of Student Accounts issue the awards to the students. The Controller will then draw down the funds from G5. West Virginia Northern Community College (WVNCC) response In February 2022, WVNCC revised its internal checklist of requirements to include posting the annual report, and the Comptroller has been charged with verifying information prior to the posting of the report on or before the due date. Mountwest Community and Technical College (MCTC) response Effective February 2022, management will incorporate additional language in MCTC?s Purchasing Manual to encompass more restrictive guidelines as it relates to allowability and approvals. Management will implement the use of a ?grant? funding request form for any federal grant awarded. The form will require the requestor to include a purpose for the request and how it aligns to the overall goal of the federal award and, if applicable, appropriate budget lines. Signatures will be required of the requestor, the departmental supervisor, and the Vice President for Finance and Administration and/or their designee(s) before and expenditure can be made. Signature of the Vice President and their designee(s) will indicate a final review for allowability and compliance. The approved ?grant? funding request and applicable purchasing/receipting will be required to initiate disbursement from a federal grant award. Office of the Governor response When the United States Department of Education notified the Office of the Governor that GEER funding was subject to 2 CFR 200.303 and the associated Cash Management requirements, the Office of the Governor immediately implemented internal controls and policies in FY2021. The Office of the Governor now reviews costs as they are incurred by the subrecipient before processing the drawdown request for payment.

2020-020

SPECIAL TESTS AND PROVISIONS ? PENALTY FOR REFUSAL TO WORK (Repeat of Prior Year Finding 2020?027, 2019-026) Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558 Grant Award 2021 ? 2021G996115 Grant Award 2021 ? 2021G990228 Grant Award 2020 ? 2020G996115 Criteria: The State agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each State agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the State by an amount not less than one percent and not more than five percent of the SFAG for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60, 261.61, 261.62, 261.63, 261.64, and 261.65). If an individual in a family receiving assistance refuses to engage in required work, a State must reduce assistance to the family, at least pro rata, with respect to any period during the month in which the individual so refuses or may terminate assistance. Any reduction or termination is subject to good cause or other exceptions as the State may establish (42 USC 607(e)(1); 45 CFR sections 261.13 and 261.14(a) and (b)). However, a State may not reduce or terminate assistance based on a refusal to work if the individual is a single custodial parent caring for a child who is less than 6 years of age if the individual can demonstrate the inability (as determined by the State) to obtain child care for one or more of the following reasons: (a) the unavailability of appropriate care within a reasonable distance of the individual?s work or home; (b) unavailability or unsuitability of informal child care; or (c) unavailability of appropriate and affordable formal child care (42 USC 607(e)(2); 45 CFR sections 261.15(a), 261.56, and 261.57). Condition: During testing the following exceptions were identified: For six of the 60 cases selected for testing, the individuals should not have been included in the overall population of individuals not participating in their assigned activity. For four of these, the clients appeared to have been participating in their assigned activity or were enrolled in school. For the other two cases, case comments indicated that the clients completed the assigned activity, but due to caseworker error no participation hours were entered into the Recipient Automated Payment Information Data System (RAPIDS). Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2021, were $77,843,861. Cause: There are insufficient internal controls in place surrounding the generation and review of the population of individuals not participating in an assigned activity provided to the auditor, and caseworker data entry into the RAPIDS system. Effect: The State of WV may not be reducing or terminating the assistance grant of those individuals who refuse to engage in work and are not subject to good cause or other exceptions established by the State. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. In addition, we also recommend DHHR evaluate the effectiveness of the current training programs for the TANF program to ensure adequate technical training is provided. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? PENALTY FOR REFUSAL TO WORK Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558 The DHHR Bureau for Children and Families (BCF) will meet with staff members at Optum and RAPIDS by June 30, 2022 to review requirements to ensure accuracy of populations; will review populations when pulled by Optum; will send monthly reminders regarding the information needed in the case record to document engagement in an activity; and will continue reviewing WV WORKS cases monthly to ensure accuracy and try to eliminate findings.

2020-027

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS ?CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE (Repeat of Prior Year Findings 2020 ? 025, 2019?025, 2018?019, 2017?010, 2016?016, 2015?024, 2014?018, 2013?036, 2012?56, 2011?44, 2010?41) Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558 Grant Award 2020 ? 2020G996115 Grant Award 2021 ? 2021G996115 Grant Award 2021 ? 2021G990228 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the issuance and removal of sanctions; however, DHHR could not provide adequate documentation that the controls were operating effectively. ? In testing of good cause letters, 7 cases out of 60 cases selected for testing, inadequate or no documentation was provided supporting the good cause control. ? For 14 items out of 50 selected for testing in the caseworker training testing there was not adequate evidence that the control was operating effectively. These were related to the caseworker not participating in sufficient training, adequate support not being provided, the training took place too long after the hire date, or the hire date was after the end of the fiscal year indicating they should not have been in the population. ? In 11 out of the 11 cases selected for testing of 3rd level sanction controls, adequate documentation of the controls are not in place. Questioned Costs: N/A Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2021, were $77,843,861 Cause: Internal controls are not operating effectively surrounding the issuance or removal of sanctions against TANF recipients. Effect: Recipient benefits may potentially be reduced or increased in error or without appropriate cause. Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review prior to the issuance or removal of sanctions. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS ? CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558 The corrective action plan for the prior year finding will remain in place. The DHHR Bureau for Children and Families (BCF) Policy Unit will send monthly reminders regarding the sanction policy. The Policy Unit will redistribute the Sanction Flowchart/Desk Guide by April 29, 2022 as a reminder and will provide access to the flowchart on the BCF Division of Family Assistance SharePoint site. Management within the BCF will provide emphasis and additional training to all staff to supply all case documents for all steps of the sanction process to provide evidence of documentation of the internal controls pertaining to the issuance and removal of sanctions against TANF recipients. A Sanction Blackboard course will be reviewed and updated if needed before July 2022. Management will also emphasize the need to maintain accurate documentation of sanctions within case files. A checklist for sanctions will be sent to field staff to be included with all sanctions. The checklist will be scanned into On-Base as additional documentation of the sanction when sanctions are applied to cases. The Policy Unit will also continue reviewing WV WORKS cases monthly to ensure accuracy and try to eliminate findings. As additional measures beyond the corrective action plan for the prior year finding, the BCF will hold a virtual conference in each region throughout the state in August 2022 to review policies and procedures regarding sanctions; the WV WORKS Council will add payment accuracy training with staff quarterly; and the TANF Policy Unit will review RAPIDS Management Reports monthly regarding sanctions to ensure 3rd level sanctions are being sent to the Policy Unit for review.

2020-025

SPECIAL TESTS AND PROVISIONS ? INCOME ELIGIBILITY AND VERIFICATION SYSTEM (Repeat of Prior Year Finding 2020?026) Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558 Grant Award 2020 ? 2020G996115 Grant Award 2021 ? 2021G996115 Grant Award 2021 ? 2021G990228 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Social Security Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows (42 USC 1320b-7; 45CFR section 205.55). (a) Wage information from the state Wage Information Collection Agency (SWICA) should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d) Information from the U.S. Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e) Unearned income from the Internal Revenue Service (IRS). Condition: During testing of 40 TANF cases subject to IEVS, we noted the following: Control - For 40 of the 40 cases selected for control testing adequate documentation of review of the data exchanges, and system matches, and review of actions taken by the caseworker when required was not provided. Compliance- For 12 of the 40 cases selected for testing, the recipient did not appear to be receiving WVWorks benefits. The auditor was unable to determine if these cases should have been subject to a data match under TANF. For 6 of the 40 cases selected for testing, the recipient appeared to be receiving WVworks benefits, and a data match indicating caseworker action required was noted, but no action was completed. Additionally, additional documentation supporting no action required for the match was not available. For the remaining 22 of the 40 cases, the recipient appeared to be receiving WVWorks, a data match occurred, and related worker action was taken, but documentation supporting the action was not available. In addition, the auditor could not determine if specific action items were completed relating to individual exchange types. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2021, were $77,843,861. Cause: There are insufficient internal controls in place surrounding the generation and review of populations provided to the auditor, the Income Eligibility and Verification System matches, and the caseworker actions required within the Recipient Automated Payment Information Data System (RAPIDS). Also, insufficient documentation surrounding matches made between the information systems and actions taken after a match is made. Effect: The State of WV may not be coordinating data exchanges with other federally assisted benefit programs as required by the state plan. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. In addition, we also recommend DHHR evaluate their control over the caseworker action requirement within RAPIDS on matches related to the Income Eligibility and Verification System. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? INCOME ELIGIBILITY AND VERIFICATION SYSTEM Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558 The DHHR Bureau for Children and Families (BCF) Policy Unit will work with the BCF Division of Training to develop Blackboard Training for staff as a refresh for the Income Eligibility and Verification System. The Policy Unit will also work with Optum and RAPIDS staff to ensure that sample data is correctly gathered by June 30, 2022. Finally, the Policy Unit will continue reviewing WV WORKS cases monthly to ensure accuracy and try to eliminate findings.

2020-026

SPECIAL TESTS AND PROVISIONS ? PENALTY FOR FAILURE TO COMPLY WITH WORK VERIFICATION PLAN (Repeat of Prior Year Finding 2020?028) Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558 Grant Award 2021 ? 2021G996115 Grant Award 2021 ? 2021G990228 Grant Award 2020 ? 2020G996115 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the state by an amount not less than one percent and not more than five percent of the SFAG for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60, 261.61, 261.62, 261.63, 261.64, and 261.65). If an individual in a family receiving assistance refuses to engage in required work, a State must reduce assistance to the family, at least pro rata, with respect to any period during the month in which the individual so refuses or may terminate assistance. Any reduction or termination is subject to good cause or other exceptions as the State may establish (42 USC 607(e)(1); 45 CFR sections 261.13 and 261.14(a) and (b)). However, a State may not reduce or terminate assistance based on a refusal to work if the individual is a single custodial parent caring for a child who is less than 6 years of age if the individual can demonstrate the inability (as determined by the State) to obtain child care for one or more of the following reasons: (a) the unavailability of appropriate care within a reasonable distance of the individual?s work or home; (b) unavailability or unsuitability of informal child care; or (c) unavailability of appropriate and affordable formal child care (42 USC 607(e)(2); 45 CFR sections 261.15(a), 261.56, and 261.57). Condition: For 2 of the 40 individuals selected for testing, supporting documentation did not support the hours utilized in the compliance calculation for the penalty for failure to comply with work verification requirements. and the auditor was unable to determine if the data was correct in respect to the Work Participation rate and Work Verification Plan. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2021, were $77,843,861. Cause: There was insufficient documentation supporting the participation hours entered into Recipient Automated Payment Information Data System (RAPIDS) and reported to United States Health and Human Services. Effect: The State of WV is not incompliance with its Work Verification Plan, including adequate documentation, verification, and internal control procedures. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS is complete and accurate. In addition, we also recommend DHHR evaluate the effectiveness of the current training programs for the TANF program to ensure adequate technical training is provided. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? PENALTY FOR FAILURE TO COMPLY WITH WORK VERIFICATION PLAN Department of Health and Human Resources (DHHR) Assistance Listing Number 93.558 The DHHR Bureau for Children and Families (BCF) will meet quarterly with RAPIDS staff responsible for TANF Data Reporting to keep lines of communication open and offer technical assistance as needed, with the next meeting scheduled for May 2022. The BCF will also work with their Division of Training to develop a webinar on Hours of Participation Refresh for staff. Finally, the BCF will continue reviewing WV WORKS cases monthly to ensure accuracy and try to eliminate findings.

2020-028

SPECIAL TESTS AND PROVISIONS ? PAYMENT RATE SETTING AND APPLICATION Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Foster Care?Title IV-E 93.658 Grant Award 2001WVFOST Grant Award 2101WVFOST Criteria: 42 USC 671(a) requires that, to be eligible for payments under the Foster Care?Title IV-E program, States ?shall have a plan approved by the Secretary which provides for foster care maintenance payments.? 45 CFR section 1356.21(m)(1) adds that ?the title IV-E agency must review at reasonable, specific, time-limited periods to be established by the agency the amount of the payments made for foster care maintenance? to assure their continued appropriateness.? Condition: Two of the 60 cases tested for payment rate setting and application resulted in overpayments to providers based on the approved maintenance payment rates. In addition, for two of the 60 cases selected for payment rate setting and application, the Department of Health and Human Resources (DHHR) was unable to provide supporting documentation of the respective rate; therefore, we were unable to determine if the rate was appropriate. Questioned Costs: $5,783 ? Assistance Listing #93.658; $182 related to Grant Award 2101WVFOST and $5,601 related to Grant Award 2001WVFOST Context: The four instances represent $5,783 of foster care payments out of a total population of benefit payments tested for allowability of $131,909. Total federal expenditures for the Foster Care?Title IV-E program were $75,640,603 for the year ended June 30, 2021. Cause: Management indicated that the errors and lack of supporting documentation resulted from oversights by caseworkers. Effect: Federal funds were used to pay maintenance payments in excess of the approved rates. Recommendation: We recommend that DHHR review the current staffing and training programs to ensure sufficient staff levels are maintained and adequate technical training is provided related to payment rates. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? PAYMENT RATE SETTING AND APPLICATION Department of Health and Human Resources (DHHR) Assistance Listing Number 93.658 The providers who received overpayments were out-of-state providers. Whereas rates for in-state providers are calculated by rate setting staff within the DHHR Office of Accountability and Management Reporting based on the providers? cost report data, the out-of-state rates are negotiated with the providers by the DHHR Bureau for Children and Families (BCF) and are captured via contracts or other legal agreements with the providers. For the two cases questioned by the auditors, the BCF did not have the contracts or any other documentation on file to justify the rates associated thereto. Although the BCF maintains the rate data on comprehensive spreadsheets, the BCF does not always update the spreadsheets on a regular basis. To enhance their internal controls over this area, the BCF will collect additional details regarding the specific rates for children placed in out-of-state foster care facilities, update their spreadsheets to include the necessary details, and reinforce the requirement to update the spreadsheets when changes occur. The anticipated date for completion is September 30, 2022.

SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/93.778, COVID-19 93.777 & ARRA - 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR section 438.3(m) requires each MCO, PIHP, and PAHP to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. 42 CFR 438.602(e) requires that the ?State must periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP.? 42 CFR 438.602(g) requires that the periodic audits must be posted on the State?s website. Condition: During our testing of the audited financial reports of the Medicaid contract required to be submitted by Managed Care Organizations (MCOs), it was noted all three of the MCOs submitted audited financial reports, however, DHHR had no documentation of their review and approval of the three audited financial reports selected for testing. During our testing of the periodic audits, it was noted that the DHHR has not conducted or contracted for the conduct of an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO and the results of those audits are not posted on the Medicaid website. DHHR does not have any PIHPs or PAHPs. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2021, were $3,850,220,228. The populations subject to testing were the financial and periodic audits of Medicaid?s three MCOs. Cause: Management indicated that the review and approval of the financial audits was not documented and maintained in the files. Management indicated that they were in the process of contracting and working out the process with the MCO Oversight/Actuarial Vendor to conduct the periodic audits. Once completed, the DHHR will post the audits to the website. Effect: The DHHR is not in compliance with the Managed Care Financial Audit special test requirements. The MCOs may be reporting inaccurate encounter or financial data. Recommendation: We recommend that DHHR create a policy and procedure to ensure that documentation of review and approval of the financial audits is documented and maintained. We recommend that DHHR conduct or contract to conduct periodic audits of the MCOs in accordance with the compliance requirements. Views of Responsible Officials:

SPECIAL TESTS AND PROVISIONS ? MANAGED CARE FINANCIAL AUDIT Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, 93.778, COVID-19 93.777, ARRA 93.778 The DHHR Bureau for Medical Services (BMS) collected and reviewed the audited financial statements from the managed care organizations (MCOs); however, review and approval of the financial statements were not documented. The BMS is establishing a process to document this approval process for the next reporting period. The BMS also understands the requirements related to 42 CFR 438.602(e). These requirements became effective for contracts starting on or after July 1, 2017. The BMS acknowledges their responsibility to audit the financial and encounter data for the MCOs no less than once every three years and to post the results on the state website. The BMS has previously relied upon agreed-upon procedures engagements conducted by an independent auditor to support the accuracy, truthfulness, and completeness of the MCO reported encounter and financial data. For the reporting period ended June 30, 2021, the BMS has contracted and engaged with an MCO oversight and actuarial vendor to conduct the independent audits required under 42 CFR 438.602(e) and will post those audits to the state website upon completion and approval by the BMS. For future reporting periods, the BMS intends to retain an MCO oversight and actuarial vendor to conduct the required independent audits to ensure continued compliance with 42 CFR 438.602(e).

ELIGIBILITY (Repeat of Prior Year Findings 2020-032, 2019-034) Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/93.778, COVID-19 93.777 & ARRA - 93.778 Grant Award 2005WVINCT Grant Award 1905WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WV5MAP Grant Award 2105WV5MAP Grant Award 2105WV5ADM Grant Award 2105WVIMPL Grant Award 2105WVINCT Children?s Health Insurance Program (CHIP) 93.767 Grant Award 2105WV5021 Grant Award 1905WV5021 Grant Award 2005WV5021 Criteria: 42 CFR 435.914 states ?(a) The agency must include in each applicant's case record facts to support the agency's decision on his application. (b) The agency must dispose of each application by a finding of eligibility or ineligibility, unless?(1) There is an entry in the case record that the applicant voluntarily withdrew the application, and that the agency sent a notice confirming his decision; (2) There is a supporting entry in the case record that the applicant has died; or (3) There is a supporting entry in the case record that the applicant cannot be located.? 42 CFR 457.965 states ?The State must include in each applicant's record facts to support the State's determination of the applicant's eligibility for CHIP.? 42 CFR 435.945(j) and 457.380(j) require states to develop and submit to the Centers for Medicaid and Medicare Services (upon request) a plan describing the Medicaid and CHIP eligibility verification policies and procedures adopted by the State. The State of West Virginia Modified Adjusted Gross Income (MAGI)-Based Eligibility Verification Plan for Medicaid & CHIP requires the following eligibility factors to be verified: income, residency, age, social security number, citizenship, immigration status, household composition, pregnancy, caretaker relative, Medicare, application for other benefits, and other insurance coverage. These are either required to be verified through electronic data sources or through self-attestation without additional verification or self-attestation with post -eligibility verification. Electronic data sources include: the Internal Revenue Service, Social Security Administration, State Wage Information Collection Agency, State Unemployment Compensation, State Administered Supplementary Payment Program, State General Assistance Programs, Supplemental Nutrition Assistance Program, Temporary Assistance for Needy Family, Bureau for Child Support Enforcement, State Income Tax, TALX, Work Force West Virginia and Families and Children Tracking System Income. State verification plans does not provide specific details. The most recently submitted plan for the State is posted on Medicaid.gov. Condition: The Medicaid program and the CHIP program are required (as described at 42 CFR 435.914) to maintain facts in the case file to support the eligibility determination. During our testing of 60 cases for eligibility for the Medicaid program, we noted one instance where documentation of income verification to the electronic data source required by the State?s Medicaid eligibility verification plan was not maintained in the file. During our testing of 60 cases for eligibility for CHIP, we noted six instances where documentation of income verification to the electronic data source required by the State?s MAGI-based CHIP eligibility verification plan was not maintained in the file. We also noted three instances where the social security number, age, date of birth, and immigration status were not verified in the Data Exchange System as required by the State?s MAGI-based CHIP eligibility verification plan; one instance where the date of birth in RAPIDS did not agree with the date of birth in the Data Exchange System; and six instances where income was not verified. Questioned Costs: $373 Assistance Listing #93.778 $37,641 Assistance Listing #93.767 Context: The one case in Medicaid represents $373 of Medicaid payments out of a population of benefit payments tested for eligibility of $135,929. The 16 cases in CHIP represent $37,641 of CHIP payments out of a population of benefit payments tested for eligibility of $193,277. The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2021, were $3,850,220,228. The federal expenditures for the Children?s Health Insurance Program for the fiscal year ended June 30, 2021, were $72,405,224. Cause: Management indicated that the information was verified in accordance with the Medicaid and CHIP verification plan or State plan, but no documentation was kept in the file of the verification. The difference in date of birth was not corrected in RAPIDS due to oversight. Effect: Payments may have been made for ineligible recipients. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. DHHR implemented an eligibility system enhancement on April 17, 2021, to retain historical record of verification of financial information obtained from the Federal Data Services Hub. We recommend that DHHR continue to follow the new policies and procedures. Views of Responsible Officials:

ELIGIBILITY Department of Health and Human Resources (DHHR) Assistance Listing Number 93.775, 93.777, 93.778, COVID-19 93.777, ARRA 93.778, 93.767 The DHHR Bureau for Medical Services (BMS) will continue to coordinate and work with program staff throughout the DHHR to develop and implement updated training modules and courses designed to emphasize the importance of collecting and storing required documentation within the case record. This training will be available to workers by May 1, 2022. The BMS will stress that review of all case-related information must be obtained and verified prior to confirmation of Medicaid and WV CHIP benefits. Current training modules are available within the training system and are available for refreshers throughout the year. Monthly worker unit meetings will include topics designed to improve understanding of any policy or system updates. The information will be provided for unit meetings by May 1, 2022. Management will continue to use the Payment Error Rate Management (PERM) and Medicaid Eligibility Quality Control Review (MEQC) process to review Medicaid and WV CHIP cases throughout the year to ensure these measures are being followed. Any discrepancies noted via the review process can be addressed by local districts to improve accountability. Statewide Accuracy Meetings will continue to be held with Medicaid and WV CHIP Policy staff, Quality Control, Regional Program Managers, and the Statewide Accuracy Coordinator to discuss findings and provide responses from local districts after they are provided with the findings. These meetings will be scheduled quarterly at a minimum. System updates to retain historical data for the verification of electronic sources have provided substantial improvements in data retention and the state will continue to review for improvements. Additionally, the improvements from previous years can be used to discuss with staff the ability to continually improve and maintain the highest level of accuracy.

2020-032

MATCHING, LEVEL OF EFFORT, EARMARKING Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Opioid STR ? State Targeted Response to the Opioid Crisis Grants 93.788 Grant Award 6H79TI081724 Grant Award 5H79TI081724-02 Grant Award 1H79TI083313-01 Grant Award 3H79TI081724-01W1 Grant Award 1H79TI081724-01 Criteria: 2 CFR 200.303 requires that the non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.508(d) says an auditee must ?provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part.? Federal award funds must supplement, not replace (supplant) nonfederal funds. All recipients who receive awards under programs that prohibit supplanting by law must ensure that federal funds do not supplant funds that have been budgeted for the same purpose through non-federal sources. Applicants or award recipients may be required to demonstrate and document that a reduction in non-federal resources occurred for reasons other than the receipt of expected receipt of federal funds. Condition: During our testing of the State Targeted Response to the Opioid Crisis Grants, the West Virginia Department of Health and Human Resources (DHHR) was unable to provide documentation of the review and approval control related to the compliance with Level of Effort-Supplement not Supplant requirements. Questioned Costs: Unknown Context: The federal expenditures for the State Targeted Response to the Opioid Crisis program for the fiscal year ended June 30, 2021, were $33,424,959. Cause: Inadequate documentation of review and approval control related to the level of effort supplement not supplant requirements. Effect: Non-compliance with level of effort requirements may go undetected. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that DHHR establish policies and procedures requiring evidence of review and approval control procedures. View of Responsible Officials:

MATCHING, LEVEL OF EFFORT, EARMARKING Department of Health and Human Resources (DHHR) Assistance Listing Number 93.788 DHHR maintains a report that shows all opioid expenditures by source. The report includes a summary tab to document that state general revenue expenditures have increased each year in correlation with federal expenditures. Effective immediately, DHHR will implement additional controls to ensure that documentation of the internal review and approval process of the report is maintained.

ALLOWABILITY NameAssistance Listing # U.S. Department of Homeland Security Disaster Grants ? Public Assistance (Presidentially Declared Disasters) 97.036/COVID 19 97.036 Grant Award FEMA?4210-DR?WV Grant Award FEMA?4219-DR?WV Grant Award FEMA?4220-DR?WV Grant Award FEMA?4221-DR?WV Grant Award FEMA?4236-DR?WV Grant Award FEMA?4273-DR?WV Grant Award FEMA?4331-DR?WV Grant Award FEMA?4359-DR?WV Grant Award FEMA?4378-DR?WV Grant Award FEMA?4455-DR?WV Grant Award FEMA?4517-DR?WV Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.53 defines improper payments as ?any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements.? 2 CFR 200.403 indicates that costs must ?be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity? and must ?be adequately documented?. Condition: For 25 of the 40 payroll transactions selected for testing at the West Virginia Division of Highways (the Division), the expenditures were not considered allowable due to a payroll additive rate of 66.97% being used in calculating the amount charged to the program instead of the approved rate of 62.61%. Additionally, for 40 of the 40 payroll transactions selected for testing at the West Virginia Military Authority (the Authority), there was no documentation that the employee?s time worked was reviewed and approved. Questioned Costs: $188 ? Total $7 - Assistance Listing # 97.036 Grant Award FEMA?4210-DR?WV $34 - Assistance Listing # 97.036 Grant Award FEMA?4219-DR?WV $10 - Assistance Listing # 97.036 Grant Award FEMA?4273-DR?WV $98 - Assistance Listing # 97.036 Grant Award FEMA?4359-DR?WV $19 - Assistance Listing # 97.036 Grant Award FEMA?4378-DR?WV $20 - Assistance Listing # 97.036 Grant Award FEMA?4455-DR?WV Context: Total federal expenditures and total subrecipient expenditure for the Disaster Grants ? Public Assistance (Presidentially Declared Disasters) program were $64,560,406 and 39,642,854, respectively. The 25 payroll transactions represent $7,216 of the total payroll transactions tested of $11,932 at the Division. Total payroll charged to the grant at the Division was $844,290. The 40 payroll transactions represent $119,497 of the total payroll transactions tested of $119,497 at the Authority. Total payroll charged to the grant at the Authority was $4,113,189. Cause: The Division does not have adequate internal controls and policies and procedures in place to ensure that the payroll additive rate is being applied correctly. The Authority does not have adequate internal controls and policies and procedures in place to ensure all payroll transactions are reviewed and approved. Effect: The Division is not be in compliance with federal statues, regulations, and terms of the conditions of the federal award. Expenditures were paid that are not allowable. The Authority may not identify noncompliance with federal statues, regulations, and terms of the conditions of the federal award including allowability. Expenditures may be paid that are not allowable. Recommendation: We recommend that the Division and Authority implement controls to ensure that expenditures are properly reviewed and approved before being charged to a federal award. Views of Responsible Officials: Management acknowledges the finding. See corrective action plan.

ALLOWABILITY Division of Emergency Management (DEM) Assistance Listing Number 97.036 DEM has made significant changes to the Public Assistance program procedures over the last several years to ensure compliance with all federal, state, and program policy and regulation. DEM has processed numerous Project Worksheets for the WV Division of Highways (DOH), and FEMA has not indicated any issue with any portion of the DOH payroll reimbursement. The amount paid was the actual amount expended for the work on the allowable projects. Effective March 2022, DEM will get clarity on how to determine the appropriate additive rate and apply it to future reimbursements. DEM will also work with the DOH to ensure an accurate understanding of the allowable rate and reimbursement through the Public Assistance program.

2020?004 SPECIAL TESTS AND PROVISION ? UI PROGRAM INTEGRITY - OVERPAYMENTS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Labor Unemployment Insurance (UI) 17.225 and COVID-19 17.225 UI-23926-13-55-A-54 UI-31491-17-60-A-54 UI-32634-19-55-A-54 UI-31325-18-55-A-54 UI-34093-20-55-A-54 UI-34199-20-55-A-54 UI-32634-19-55-A-54 UI-34749-20-55-A-54 UI-27936-15-55-A-54 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.508(d) says an auditee must ?provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part.? Pub. L. No. 112-40 states that States are (1) required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments, and (2) States are prohibited from providing relief from charges to an employer?s UI account when overpayments are the result of the employer?s failure to respond timely or adequately to a request for information. States may continue to waive recovery of overpayments in certain situations and must continue to offer the individual a fair hearing prior to recovery. Condition: During fiscal year 2020, the Workforce West Virginia (WWV) overpaid unemployment claims out of funds from the Unemployment Program and the Pandemic Unemployment Assistance Program (PUA). PUA is federal funding provided through the CARES Act to pay unemployment claims for self-employment individuals and independent contractors. Questioned Costs: $65,153 ? Assistance Listing #17.225 Context: Total federal disbursements for the Unemployment Insurance (UI) program were $1,497,833,979 for the year ended June 30, 2020. For three of the 60 regular UI overpayments, WWV could not provide documentation of the review and approval of the overpayment case file. For one of those three overpayments, no documentation was provided by WWV and for two of the cases, management did not complete documentation to determine the type of overpayment. The three cases represent $4,300 of the total overpayments of $99,058. Further, for 15 of the 15 PUA overpayment selected for testing, WWV did not provide documentation of review and approval of the overpayment case file to demonstrate internal controls were in place nor did they document the basis for the overpayment. The 15 cases represent $60,853 of total PUA overpayments of $375,650. 2020?004 SPECIAL TESTS AND PROVISION ? UI PROGRAM INTEGRITY - OVERPAYMENTS (continued) Cause: For regular UI overpayments, established policies and procedures were not followed. WWV followed the protocol outlined in the PUA Program Questions and Answers Guidance from the Department of Labor for disbursement of unemployment benefits from PUA funds when wage information is not available. In accordance with this guidance, an individual can receive the minimum weekly benefit amount if WWV does not have existing wage records for the individual and evidence to support a higher benefit amount is not provided. While WWF followed the PUA Program Questions and Answers Guidance in order to expedite funds to claimants impacted the by the COVID-19 Pandemic, WWV?s normal control procedures requiring proof of income levels prior to payment of a claim were not followed for these minimum weekly benefit payments resulting in an overpayment of claims. Effect: Unemployment claims were overpaid by WWV with UI funds and PUA funds. Recommendation: We recommend that management work with the federal agency to determine a resolution to this issue since WWF followed the published guidance. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? UI PROGRAM INTEGRITY - OVERPAYMENTS Workforce West Virginia (WWV) CFDA Number 17.225, COVID-19 17.225 WWV will contact the US Department of Labor by June 2021 to determine a resolution to this finding.

2020?007 INTERNAL CONTROLS OVER QUALITY ASSURANCE PROGRAM Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Transportation Highways Planning and Construction Cluster 20.205/20.219/ 20.224/23.003 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? Condition: For one of the forty quality assurance samples selected for testing at the West Virginia Division of Highways (the Division), the sample was not appropriately reviewed and approved. Questioned Costs: N/A Context: Total federal expenditures for the Highways Planning and Construction Cluster program was $437,117,494 for the year ended June 30, 2020. Cause: The Division does not have adequate internal controls and policies and procedures in place to ensure that quality assurance samples are appropriately reviewed and approved. Effect: Verification samples may not be conducted in accordance with the quality assurance program, which would not be detected without an appropriate review and approval process. Recommendation: We recommend that the Division strengthen internal controls and policies and procedures over the quality assurance program. We recommend that the review of verification samples be performed by an individual independent of the testing process and evidence of such review be maintained. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER QUALITY ASSURANCE PROGRAM Division of Highways (DOH) CFDA Number 20.205, 20.219, 20.224, 23.003 With the current IT system (SiteManager), DOH uses a series of user groups and permissions to restrict access to certain functions including the authorization of a sample. Because the system generates these reports, DOH is using the authorization function as a digital signature to indicate review and approval by the appropriate authority. In most instances, a non-approving entity does not have the authority or system permission to authorize samples. DOH is in the process of migrating to Sitemanager?s replacement which has a much more robust role and permissions system. This system will be in place by October 2021. DOH will have the ability to control material verifications and certification such that a non-approving authority cannot accidentally approve a sample.

2020?012 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS ? VERIFICATION (Repeat of Prior Year Finding 2019-016) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: West Virginia University ? Parkersburg (WVUP) did not have adequate internal controls in place surrounding the verification process. During our testing we noted for the samples selected that there was no documentation that a review was performed over the verification files. Questioned Cost: N/A Context: Total Student Financial Assistance Cluster expenditures for WVU-P were $9,241,892, for the year ended June 30, 2020. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2020 were $565,231,098. Cause: The institution did not have adequate internal controls in place to ensure that verification changes identified during the process were processed and submitted to the U.S. Department of Education. Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Recommendation: Management should develop internal controls to ensure that changes identified during the verification process are submitted to the U.S. Department of Education. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS - VERIFICATION West Virginia University at Parkersburg (WVU-P) CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 During the 2019-2020 academic year, WVU-P invested in a software solution from a third-party vendor, CampusLogic, to assist with the collection of verification documentation and to improve the efficiency and accuracy of documentation for the verification process. Beginning July 2020, each document is signed off as reviewed and approved or rejected by a staff member. When the files are reviewed, the review is not considered complete until the corrections made have arrived back approved from the U.S. Department of Education. At that point, the corrections are loaded into both CampusLogic and Banner. The corrections are then reviewed in a side-by-side comparison with the original data that the student provided.

2019-016

2020?013 SPECIAL TESTS AND PROVISIONS ? DISBURSEMENTS TO OR ON BEHALF OF STUDENTS (Repeat of Prior Year Finding 2019-017 and 2018?011) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR 668.165(a)(2), requires that, ?Except in the case of a post-withdrawal disbursement made in accordance with ? 668.22(a)(5), if an institution credits a student ledger account with Direct Loan, Federal Perkins Loan, or TEACH Grant program funds, the institution must notify the student or parent of? (i) The anticipated date and amount of the disbursement; (ii) The student?s or parent?s right to cancel all or a portion of that loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Secretary; and (iii) The procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. (3) The institution must provide the notice described in paragraph (a)(2) of this section in writing.? Condition: For one disbursement notification selected for testing at Bluefield State College, the institutions did not provide all required notifications before disbursements were made. The total sample selected for testing was 60. Questioned Costs: $2,721 ? Assistance Listing # ? 84.268 Context: Total expenditures for the SFA cluster were $565,231,098 for the year ended June 30, 2020. The total SFA Cluster expenditures for Bluefield State College were $8,071,371 for the year ended June 30, 2020. Cause: Internal controls and policies and procedures related to the institutions? disbursement notifications did not encompass all of the required elements. 2019?013 SPECIAL TESTS AND PROVISIONS ? DISBURSEMENTS TO OR ON BEHALF OF STUDENTS (Repeat of Prior Year Finding 2019-017 and 2018?011) (continued) Effect: Institutions were not in compliance with the requirements related to disbursement notification. Policies and procedures related to the institutions? disbursement notifications did not encompass all of the required elements. Recommendation: We recommend that the institutions implement more effective internal controls and policies and procedures to ensure that all required information is part of the disbursement notifications sent to students and that supporting documentation for disbursement notifications is maintained and archived to allow for evidence of the institution?s compliance with federal guidelines. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? DISBURSEMENTS TO OR ON BEHALF OF STUDENTS Bluefield State College (BSC) CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 Effective February 2021, BSC will begin sending disbursement disclosure notices (Right to Cancel) to any student or parent with loans via email. Students will then have two weeks from date of email to cancel any applicable loans and will have to provide proper identification. BSC will maintain all records as documented evidence of compliance with federal guidelines.

2019-017

2020?014 SPECIAL TESTS AND PROVISIONS ? RETURN OF TITLE IV FUNDS (Repeat of Prior Year Finding 2019?018) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 668.173(b) requires timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if - (1) The institution deposits or transfers the funds into the bank account it maintains under ? 668.163 no later than 45 days after the date it determines that the student withdrew; (2) The institution initiates an electronic funds transfer (EFT) no later than 45 days after the date it determines that the student withdrew; (3) The institution initiates an electronic transaction, no later than 45 days after the date it determines that the student withdrew, that informs a FFEL lender to adjust the borrower?s loan account for the amount returned; or (4) The institution issues a check no later than 45 days after the date it determines that the student withdrew. An institution does not satisfy this requirement if - (i) The institution?s records show that the check was issued more than 45 days after the date the institution determined that the student withdrew; or (ii) The date on the cancelled check shows that the bank used by the Secretary or FFEL Program lender endorsed that check more than 60 days after the date the institution determined that the student withdrew. Condition: For three of the 12 Return of Title IV calculations selected for testing at BlueRidge Community and Technical College exceptions were identified. For one Return of Title IV calculation the incorrect amount was returned and for the second exception, no funds were returned. For the third Return of Title IV exception, an incorrect withdrawal date was used. This withdrawal was related to COVID-19 pandemic, and based upon flexibilities offered by the federal agency, no funds were required to be returned. For three of the seven Return of Title IV calculations selected for testing internal controls at West Liberty University an incorrect semester end date was used and for one of the seven Return of Title IV calculations, an incorrect withdrawal date was used. For two Return of Title IV calculations selected for testing for compliance, the incorrect semester end date was used. These exceptions resulted in, the calculation not being correct and the incorrect amount was returned. 2020?014 SPECIAL TESTS AND PROVISIONS ? RETURN OF TITLE IV FUNDS (Repeat of Prior Year Finding 2019?018) (continued) Further, Bluefield State College, New River Community and Technical College, Pierpont Community and Technical College and Fairmont State University did not have adequate internal controls in place surrounding the Return of Title IV funds. Questioned Costs: $24,153 ? West Liberty University $4,526 ? BlueRidge Community and Technical College Context: Total Student Financial Assistance Cluster expenditures for the year ended June 30, 2020 were $565,231,098. The total Student Financial Assistance Cluster expenditures for the year end June 30, 2020, for BlueRidge Community and Technical College, West Liberty University, Bluefield State College, New River Community and Technical College, Pierpont Community and Technical College and Fairmont State University were $7,082,870, $19,601,934, $8,071,371, $4,250,799, $7,088,386 and $23,078,065, respectively. The total amount of refunds tested for controls and compliance of Return of Title IV calculations for BlueRidge Community and Technical College and West Liberty University were $15,929 and $24,153, respectively. Cause: The institutions do not have adequate internal controls in place to prevent non-compliance. Effect: The institutions are not returning the correct amount of federal student financial assistance required or the funds are not returned within the required time frame. Recommendation: Management should implement internal controls to ensure that the correct amount of federal student financial assistance is returned and returned within the required time frame. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? RETURN OF TITLE IV FUNDS BlueRidge Community and Technical College, West Liberty University, Bluefield State College, New River Community and Technical College, Pierpont Community and Technical College, and Fairmont State University CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 BlueRidge Community and Technical College (BRCTC) response Effective November 2020, BRCTC?s Financial Aid Office provides notifications of student returns to the Finance Department. In order to strengthen this control and ensure greater accuracy, the Comptroller or other designated Finance Department staff and Financial Aid Office staff review and acknowledge that funds have been returned accurately. West Liberty University (WLU) response Effective April 2020, the Return of Title IV Funds (R2T4) process was moved from the Business Office and is now completely handled by the Financial Aid Office. Reports are run every Friday by the Director. Required R2T4s are completed in the Common Origination and Disbursement (COD) system. Withdraw dates within Banner are verified by the Director against forms completed by students and aid is reduced within Banner. R2T4s are checked by Assistant Director and Title IV Aid reports are sent to COD via EdConnect. Bluefield State College (BSC) response Effective August 2021, BSU will implement internal controls to perform Return of Title IV withdrawal and calculations ensuring records comply and are returned within the 45-day timeframe. Permit to withdraw forms will be completed and reviewed with all signatures and reviewed by the Financial Aid Manager. New River Community and Technical College (NRCTC) response Effective August 2020, NRCTC?s Registrar Office determines date of withdrawal and calculates the return of Title IV funds. Documentation will be sent to the Financial Aid Office where the date will be verified, and calculation will be performed on the Common Origination and Disbursement (COD) system. Once complete, all documentation will be sent to the Business Office. Calculated amounts will be verified and signed to ensure funds are returned timely. Pierpont Community and Technical College (PCTC) response PCTC?s financial aid staff will complete a Return of Title IV Funds (R2T4) for all students, including those outside the refund period to ensure adequate evidence that no federal funds were required to be returned for students who withdrew or received all ?F?s and failed to withdraw even after 60% of the term was completed by each. This will enhance the existing policies and procedures for students inside the refund period and will now be completed timely. This process was implemented in November 2020. Fairmont State University (FSU) response FSU will add controls at each step of the Return of Title IV Funds (R2T4) process to ensure the accuracy of the data. Those controls will consist of, but not limited to, verifying the accuracy of the withdraw date from the RZRWDRL process; verifying the accuracy of the withdraw date provided on the spreadsheet provided to Financial Aid prior to the R2T4 calculation being completed; and each step will be signed off by the reviewer. These additional controls were put in place in September 2020.

2019-018

2020?015 SPECIAL TESTS AND PROVISIONS ? ENROLLMENT REPORTING (Repeat of Prior Year Findings 2019?019, 2018?012, 2017?006, 2016?008, 2015?015, 2014?011, 2013?028, 2012?43, 2012?47, 2012?49, 2011?22) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 685.309(b) requires that institutions must ?(1) Upon receipt of an enrollment report from the Secretary, a school must update all information included in the report and return the report to the Secretary - (i) In the manner and format prescribed by the Secretary; and (ii) Within the timeframe prescribed by the Secretary. (2) Unless it expects to submit its next updated enrollment report to the Secretary within the next 60 days, a school must notify the Secretary within 30 days after the date the school discovers that - (i) A loan under title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended; or (ii) A student who is enrolled at the school and who received a loan under title IV of the Act has changed his or her permanent address. Condition: For one student selected from New River Community and Technical College and one student selected from West Liberty University in our compliance sample of 60 students who withdrew, graduated, or enrolled but never attended, New River Community and Technical College did not promptly notify the appropriate entities of a change in the student?s status in a timely and accurate manner and West Liberty University did not properly update the program enrollment effective date as required. Further the following institutions did not have adequate internal controls in place surrounding the enrollment reporting process for the selections made: Bluefield State College, Pierpont Community and Technical College, West Virginia State University, Mountwest Community and Technical College, Concord University, Fairmont State University, West Virginia University-Parkersburg, and West Virginia University. Questioned Costs: N/A 2020?015 SPECIAL TESTS AND PROVISIONS ? ENROLLMENT REPORTING (Repeat of Prior Year Findings 2019?019, 2018?012, 2017?006, 2016?008, 2015?015, 2014?011, 2013?028, 2012?43, 2012?47, 2012?49, 2011?22) (continued) Context: Total Direct Loan and Pell expenditures for the SFA cluster in total were $512,302,992, for the year ended June 30, 2020. Total Direct Loan and Pell expenditures for New River Community and Technical College, Bluefield State College, Pierpont Community and Technical College, West Virginia State University, Mountwest Community and Technical College, Concord University, Fairmont State University, West Virginia University ? Parkersburg, West Virginia University and West Liberty University were $4,148,514, $7,840,414, $6,944,183, $14,426,874, $5,553,704, $12,104,361, $22,807,532, $9,068,283, $214,403,740 and $17,680,152, respectively. Cause: The institutions did not have adequate internal controls in place surrounding the enrollment reporting process. Effect: The institutions are not promptly notifying the NSLDS of changes in student status in an accurate manner; thus, inaccurate information is reported to the NSLDS. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. As institutions are responsible for timely reporting whether they report directly or via a third-party servicer, we recommend that the institutions implement a review process to ensure they are promptly notifying the U.S. Department of Education and NSLDS of changes in a student?s status in a timely and accurate manner. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? ENROLLMENT REPORTING New River Community and Technical College, West Liberty University, Bluefield State College, Pierpont Community and Technical College, West Virginia State University, Mountwest Community and Technical College, Concord University, Fairmont State University, West Virginia University ? Parkersburg, and West Virginia University CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 New River Community and Technical College (NRCTC) response NRCTC?s Registrar's office will implement policies and procedures that will request the error report from IT and will correct the errors on the report. The Registrar?s office will request IT to rerun the error report to ensure all errors have been corrected. The Registrar?s office will then request IT to send the enrollment report to submit it to the clearinghouse by the due date and will correct any errors from the clearinghouse. The Registrar's office will run a random selection of 20 students from NSLDS to make sure students are correct in the clearinghouse, which will be done at least 50 days out from the time students were initially reported. IT and the Registrar?s office will sign off on these processes when the report is run, when the report is reviewed, and once the report is sent. These policies and procedures will be effective in August 2021. West Liberty University (WLU) response Effective August 2020, WLU has updated reporting for all enrolled, withdrawn, and graduated students to within 20 days to meet all federal requirements. Before reports are sent to the Clearinghouse, the Director of Financial Aid checks for accuracy and completeness with an internal review of the files. Bluefield State College (BSC) response Effective February 2021, BSC has implemented additional policies and procedures to verify the uploaded number of students with the enrollment in Banner and reconcile the two reports. BSC will then randomly select students to check enrollment, number of hours of enrollment, and check the withdrawal and graduation dates. Corrections will be made on the hard copy of the enrollment reports to ensure accuracy. Pierpont Community and Technical College (PCTC) response PCTC?s Registrar staff will separate the withdrawal and review process between three separate employees. One employee will complete the withdrawal process, one employee will complete the file submission process to the National Student Clearinghouse (NSC), and then a third employee will complete the review of the NSC file submission. This review will include a random selection of 20 students within each population and those students will be manually reviewed in Banner to ensure accuracy of the enrollment status that was generated via a report to submit to NSC. In addition, the Registrar staff will sign off on said tracking document and share the document with the financial aid staff. The financial aid staff will then review a separate selection of 20 students from each submission in NSLDS to ensure accuracy of the reported enrollment status. Should any discrepancies be found, the Registrar?s office and Financial Aid office will work collectively to resolve each. Implemented in January 2021, this process applies to all submissions to the NSC and will ensure accuracy. West Virginia State University (WVSU) response Beginning February 2021, the Division of Enrollment Management, through the Office of University Registrar, will implement policies and procedures to review, correct and report student data to the National Students Loan Data System (NSLDS) in a timely manner. An initial review will be performed four weeks after the start of each semester with monthly reviews performed on the fifth day of each month until the end of the semester. An end of term review will be completed three weeks after the end of the semester and the graduate file review will be performed within 45 days after graduation. Inter-office reviews will be done both 20 days and 10 days prior to submission to the Student Clearinghouse. Once the inter-office review phase has been completed, the VP Enrollment Management, Associated Registrar, Registrar and Director of Financial Aid will sign-off and approve the report certifying all checks and balances have been followed. Once the student data has been submitted to the Student Clearinghouse, Registration will receive a report of any errors that need to be corrected. Corrections will be made by Registrar Office staff within 10 days of receiving the error report. Mountwest Community and Technical College (MCTC) response Beginning February 2021, MCTC will create a paper record for audit purposes by sampling 20 students from each enrollment report before it is sent to National Student Clearinghouse (NSC) to verify the accuracy of enrollment status and the timeliness of the enrollment status. Each student sample will be reviewed and initialed by two reviewers. Further, MCTC will sample 20 students from NSLDS, within 60 days of enrollment submission to NSC, to verify that NSC did accurately and timely report the enrollment status of the sampled students to NSLDS. Each NSLDS sample will be reviewed and initialed by two staff persons. Each sample from the monthly enrollment reporting and NSLDS will be maintained in the Registrar?s Office. Concord University (Concord) response Concord?s Registrar plans to increase internal controls for enrollment reporting to the Clearinghouse effective January 2021. The Registrar?s Office will continue to spot check the printed NSC extract against Banner to ensure accuracy of the enrollment status for students reported. Concord will be expanding the current process by creating a memo which includes date and time of each extraction report, the names of students spot-checked, page number of the report, and date and time of each submission after spot-checking is completed. The Program Assistant and the Registrar will sign and date the memo documenting the review and approval process. Fairmont State University (FSU) response FSU will add additional controls to verify the accuracy of the data submission of the enrollment reporting files to the Clearinghouse beginning February 2021. West Virginia University at Parkersburg (WVU-P) response No compliance issue of incorrect or late enrollment reporting was identified during the audit. Currently, there are three staff members involved in the enrollment reporting process; the Associate Registrar, the Registrar, and the Director of Financial Aid. The Associate Registrar extracts the enrollment reports from Banner and submits those reports to the Registrar for review. In the Registrar?s absence, the FA Director can perform the review of the report. All three parties are included in the communication chain for these reviews. The Registrar reviews the report for accuracy, and then confirms that the report can be sent to the National Student Clearinghouse for processing. Sometimes we receive errors back, and the Associate Registrar reviews and corrects all error issues, with the approval again of the Registrar. All communication throughout the whole process, including the confirmations from NSC, are shared with all three parties (Registrar, Assoc. Registrar, Director of F.A.). To address the control issue identified, WVU-P has created an additional control within the withdrawal process effective with the Spring 2021 semester in which the student?s last date of attendance is verified with the faculty member and confirmed in the student?s record in Banner before their withdrawal from a course or term is processed. This confirmation step in the withdrawal process will eliminate any errors in enrollment reporting for withdrawn students, and also eliminate errors in reporting for changes in enrollment status (full-time to part-time, etc). WVU-P is in the process of creating additional steps in the process for a timely post-reporting review of NSLDS records to confirm that the enrollment that was reported to NSC was reported accurately and timely to NSLDS. WVU-P believes the measures detailed above are sufficient and provide the proper level of internal controls. The NSLDS review process is being finalized and will be fully implemented for the Summer 2021 term, using the Spring 2021 semester to finalize the procedures. West Virginia University (WVU) response WVU?s Office of the University Registrar (OUR) has verified each enrollment file sent to the National Student Clearinghouse (NSC) every 30 days. The Enrollment Reporting procedure includes steps for comparing and verifying the NSC data file and the Argos data file the OUR office pulls. Argos is a reporting tool used by OUR to pull student transaction data from Banner. If any discrepancies are discovered, the issue is identified and corrected. The OUR will run the Argos file against the NSC file by using ACCESS until all discrepancies have been resolved and the comparison files match. Beginning January 2020, all data files will be prepared by the Associate Registrar and reviewed and signed by the Assistant Registrar. All NSC communication will be saved and retained for verification purposes. The process is conducted for every enrollment file submitted to the NSC.

2019-019

2020?016 SPECIAL TESTS AND PROVISIONS ? BORROWER DATA TRANSMISSION AND RECONCILIATION (Repeat of Prior Year Findings 2019?020 2018?013, 2017?007, 2016?006) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR 685.300(a)(5) states ?On a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the Secretary.? Condition: For the two months selected for testing of Direct Loan School Account Statement (SAS) reconciliation requirements at Bluefield State College and West Virginia University ? Parkersburg (WVUP), proper reconciliations were not completed by the institutions. Questioned Costs: N/A Context: Total Direct Loan expenditures for the SFA cluster in total were $408,341,981 for the year ended June 30, 2020. The total Direct Loan expenditures for Bluefield State College were $4,606,418 and for WVUP were $4,757,373, for the year ended June 30, 2020. Cause: Written procedures detailing the process to reconcile loans from Common Origination and Disbursement (COD) records to Banner exist, as provided in narrative form during the audit. However, management represented that a formal reconciliation review process has not been successfully implemented. Effect: The absence of proper reconciliations could result in the institution?s financial records for Direct Loan expenditures to be improperly stated. 2020?016 SPECIAL TESTS AND PROVISIONS ? BORROWER DATA TRANSMISSION AND RECONCILIATION (Repeat of Prior Year Findings 2019?020, 2018?013, 2017?007, 2016?006) (continued) Recommendation: We recommend that management implement a reconciliation process that monthly reconciliations are performed and saved as documented in the institution?s written procedure, including documentation of supervisor review and approval. In addition, management needs to ensure that all data received from COD is maintained within their records to facilitate audit procedures. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? BORROWER DATA TRANSMISSION AND RECONCILIATION Bluefield State College and West Virginia University at Parkersburg CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 Bluefield State College (BSC) response Effective August 2020, BSC will reconcile Common Origination and Disbursement (COD) records and Banner monthly within the timeframe of 45 days by the Financial Aid Manager and/or the Chief Enrollment Officer. The reconciliations will be reviewed, signed, and maintained to help facilitate audit procedures. West Virginia University at Parkersburg (WVU-P) response WVU-P performs a proper reconciliation of the Direct Loan Program to the amounts disbursed to students in Banner. However, the reconciliation process was not documented. Written policies and procedures were developed in July 2019 to ensure compliance with this requirement. WVU-P Financial Aid officials have implemented the policies and procedures for the Direct Loan reconciliation process, including the usage of the SAS reports in a monthly reconciliation process. These policies and procedures were effective beginning August 2020 and have been followed for the full academic year. WVU-P will also continue to utilize the Direct Loan Reconciliation participant guide provided by the Department of Education to ensure that policies and procedures are compliant, and that proper documentation is maintained.

2019-020

2020?017 SPECIAL TESTS AND PROVISIONS ? DISTANCE EDUCATION Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 668.22 requires that ?when a recipient of a title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of title IV grant or loan assistance that the student earned as of the student?s withdrawal date.? Condition: For seven students in distance education programs selected for testing at Bluefield State College, one student at New River Community and Technical College, and one student at Pierpont Community and Technical College, the withdrawal date in Banner did not match the withdrawal form or return of title IV calculation forms. Therefore, the amount of title IV grant or loan assistance that the student earned as of the student?s withdrawal date could not be determined. Further, Bluefield State College, New River Community and Technical College, and Pierpont Community and Technical College did not have adequate internal controls in place surrounding the distance education attendance requirement. Questioned Costs: Unknown Context: Total Student Financial Assistance Cluster expenditures for the year ended June 30, 2020 were $565,231,098. The total Student Financial Assistance Cluster expenditures for the year end June 30, 2020, for Bluefield State College, New River Community and Technical College, and Pierpont Community and Technical College were $8,071,371, $4,250,799, and $7,088,386, respectively. Cause: The institutions do not have adequate internal controls in place to prevent noncompliance. 2020?017 SPECIAL TESTS AND PROVISIONS ? DISTANCE EDUCATIONS (continued) Effect: The institutions incorrectly recalculated refunds due to the U.S. Department of Education. Recommendation: The institutions should implement adequate policies and procedures to ensure distance education requirements are followed and refunds are appropriately calculated. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? DISTANCE EDUCATION Bluefield State College, New River Community and Technical College, and Pierpont Community and Technical College CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 Bluefield State College (BSU) response Effective January 2021, BSU has implemented internal controls to follow refund guidelines. When the Registrar?s Office receives the withdraw form, procedures will ensure the process date and the effective withdraw dates are the same. One employee will process the withdraw and a second employee will review the information to verify accuracy. New River Community and Technical College (NRCTC) response Effective August 2020, NRCTC?s Registrar?s Office will run a report to determine those students that received all F?s/FIW?s at the end of each semester. Last date of attendance will be determined by the dates provided by the instructors or the date the posting of the grade occurred. Once the last date of attendance is determined, the Registrar?s Office will complete a withdrawal form and send it to the Financial Aid Office to perform a Return of Title IV Funds (R2T4) calculation. If the last date of attendance cannot be determined, a 50% refund will be calculated. The Financial Aid Office will send the withdrawal form to the Business Office for final review and verification and signatures will be retained. Pierpont Community and Technical College (PCTC) response PCTC?s financial aid staff will complete a Return of Title IV Funds (R2T4) calculation for all students, including those outside the refund period to ensure adequate evidence that no federal funds were required to be returned for students who withdrew or received all ?F?s and failed to withdraw even after 60% of the term was completed by each. This will align with the existing procedure for students inside the refund period and will now be completed to ensure the required information is accurate. This process was implemented in November 2020.

2020?018 SPECIAL TESTS AND PROVISIONS ? GRAMM-LEACH-BLILEY ACT ? STUDENT INFORMATION SECURITY (Repeat of Prior Year Finding 2019?022) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 16 CFR 314.4 (b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. 16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.? Condition: The following institutions did not perform a risk assessment that addresses the three required areas as noted in 16 CFR 314.4(b), which are 1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures: West Virginia University, West Virginia State University, West Virginia University ? Parkersburg, Pierpont Community and Technical College, Fairmont State University, and New River Community and Technical College. Further, since risk assessments were not completed, the institutions did not document safeguards as required by 16 CFR 314.4(c). 2020?018 SPECIAL TESTS AND PROVISIONS ? GRAMM-LEACH-BLILEY ACT ? STUDENT INFORMATION SECURITY (Repeat of Prior Year Finding 2019?022) (continued) Further, Shepherd University, performed the required risk assessment in January 2020; West Virginia Northern Community and Technical College performed the required risk assessment in February 2020; Marshall University performed the required assessment in April 2020, Bluefield State College, West Virginia School of Osteopathic Medicine, and Concord University performed the required risk assessment in May 2020; and West Liberty University performed the required risk assessment in June 2020. Further, each of these schools documented safeguards for the risks identified. Further, the institutions identified above do not have internal controls in place around requirements listed in 16 CFR 314.4(b) and (c). Questioned Costs: N/A Context: Total expenditures for the SFA cluster in total were $565,231,098 for the year ended June 30, 2020. Cause: Institutions do not have policies and procedures, including internal controls, addressing the requirements of 16 CFR 314.4(b) and (c). Effect: The absence of policies and procedures could result in the loss or improper storage of student account information. Recommendation: We recommend that management implement policy and procedures, including internal controls, to ensure that they are in compliance with 16 CFR 314.4(b) and (c). Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? GRAMM-LEACH-BLILEY ACT ? STUDENT INFORMATION SECURITY West Virginia University, West Virginia State University, Marshall University, West Virginia University at Parkersburg, Pierpont Community and Technical College, Fairmont State University, New River Community and Technical College, Shepherd University, West Virginia Northern Community and Technical College, Bluefield State College, West Virginia School of Osteopathic Medicine, Concord University and West Liberty University CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 West Virginia University (WVU) response In 2018, WVU established an agreement with a third-party vendor to conduct annual risk assessments for GLBA compliance. An initial assessment was conducted in March 2019. A second assessment was scheduled to be conducted in March 2020, but was canceled by the vendor due to COVID-19. In June 2020, WVU compiled a report identifying (1) remediation progress to date and (2) priorities for FY21 remediation efforts. This report was presented to WVU?s GLBA Steering Committee in June for review. WVU also provided the report to the third-party vendor for review and feedback. For FY21, WVU continues to work on remediation of the compliance gaps identified from the FY20 report. To date, WVU has remediated 18 of 33 gaps identified in the 2019 assessment. The third-party vendor is scheduled to complete a 2021 risk assessment March 2021. West Virginia State University (WVSU) response WVSU retained a vendor that specializes in IT security to provide risk assessments and provide evaluation for the entire information technology infrastructure. WVSU will develop network monitoring and system management systems, develop security training programs for all personnel who work with student date, and will maintain and document ongoing training and monitoring to comply with the Gramm Leach Bliley Act. This will be complete by October 2021. Marshall University (Marshall) response Marshall continues to make progress towards addressing the findings from the April 2020 Gramm Leach Bliley Act (GLBA) risk assessment. In Spring 2021, the Marshall GLBA Task Force will meet with an external compliance advisor to review progress towards risks identified in the prior year. In Summer 2021, senior management will review existing policies and procedures to ensure compliance with 16 CFR 314.4(b)(c). By Fall 2021, the GLBA Task Force will conduct a GLBA risk assessment to evaluate effectiveness of key controls, systems and policies and procedures. West Virginia University at Parkersburg (WVU-P) response WVU-P completed and documented a GLBA risk assessment. The risk assessment addresses all of the required GLBA elements. To date, the risk assessment has not been evaluated by a third-party consultant. Third-party firms familiar with GLBA have been contacted to request a quote so that the cost/benefit of contracting an outside review of the risk assessment can be evaluated. COVID-19 delayed this process, but WVU-P expects to update communications with outside vendors and plans to conduct a review in June 2021. Pierpont Community and Technical College (PCTC) response PCTC has successfully separated their network from Fairmont State University. PCTC previously did not have an independent Information Technology infrastructure. PCTC will continue to develop a comprehensive risk assessment plan throughout the year. PCTC is currently working on a Disaster Recovery Plan and Risk Assessment that will be completed by June 2021. Fairmont State University (FSU) response FSU is currently engaging with security consultants to ensure the proper documentation, policies, and procedures are in place and annual internal audits are performed according to GLBA specifications. This will be complete by April 2021. New River Community and Technical College (NRCTC) response NRCTC has made great strides in recent months to establish policies and procedures, standards, and controls related to compliance with GLBA information security requirements. A recent internal security audit was conducted in February 2021 and improvements have been made. An assessment will be completed by June 2021. Shepherd University (Shepherd) response Shepherd continues to review and improve comprehensive risk assessment plans. The IT Services department works with independent, third parties to review and recommend improvements to core processes, data security, and infrastructure vulnerabilities on an annual basis. As a result, Shepherd has engaged with external vendors to assist in GLBA Assessment services and remediation and is targeted to begin by July 2021. West Virginia Northern Community and Technical College (WVNCC) response WVNCC had a risk assessment in February 2020 and will continue to have security assessments done on a yearly basis in the month of July going forward. WVNCC will continue to document safeguards in response to the identified risks from the security assessment. WVNCC will examine current policies and procedures, identify and update as necessary. From this assessment, WVNCC will develop internal controls so that policies and procedures are followed, monitored, and reviewed. Policies and procedures will be updated annually. Bluefield State College (BSC) response BSC?s IT staff met and reviewed the GLBA audit findings and the SyCom Security Assessment. Policies and procedures, training and internal controls are in the process of being updated and are expected to be in place by March 2021. West Virginia School of Osteopathic Medicine (WVSOM) response WVSOM completed the required an internal risk assessment in May 2020. WVSOM contracted with Software Compliance Associates (SCA) in June 2020 for a third-party risk assessment specific to GLBA, PCI compliance, internal/external penetration testing and mock phishing. The required components of GLBA 16 CFR 314.4(b) and (c) including risk assessments & mitigations for IT systems, and employee training on GLBA requirements have been addressed. Policies and procedures, internal controls, training courses, and a third-party contract (SCA) are in place to continue compliance with the GLBA requirements. Concord University (Concord) response Concord IT management completed an internal risk assessment in compliance with 16 CFR 314.4(c) in May 2020. Concord?s IT Department created the IT Security Council, comprised of the CIO, Director of IT Operations, and Director of Enterprise Applications. This council meets bi-weekly to discuss immediate security threats and to collaborate to address the identified risks from the most recent assessment. Concord has been making progress towards the issues identified. The COVID-19 pandemic and strain on resources has complicated progress, but Concord is committed to prioritizing the development of policies, procedures and internal controls using best practices to fully meet the requirements listed in 16 CFR 314.4(b) and (c) by June 2021. West Liberty University (WLU) response The WLU IT department performed the required assessment in June 2020 and is utilizing the findings as a guide for internal improvement. The assessment found no vulnerabilities in the WLU network infrastructure, but there were areas pointed out that required improvement from a documentation and policy perspective. WLU is reviewing policies and procedures that will remediate much of the assessment findings. These findings will be in place by June 2021. WLU is also taking steps to increase the cyber security level by implementing EPP / EDR systems during fiscal year 21 and are scheduling annual assessments. These activities have been incorporated into the annual schedule and budget to ensure that WLU remains compliant with the requirements of the audit and, more importantly, vigilant in efforts to provide a safe and secure environment for data.

2019-022

2020?025 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS ?CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE (Repeat of Prior Year Findings 2019?025, 2018?019, 2017?010, 2016?016, 2015?024, 2014?018, 2013?036, 2012?56, 2011?44, 2010?41) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558 Grant Award 2019 ? 2019G996115 Grant Award 2020 ? 2020G996115 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the issuance and removal of sanctions; however, DHHR could not provide adequate documentation that the control was operating effectively. In testing of good cause letters, out of 60 cases selected for testing, there were four instances where inadequate, or no, documentation was provided supporting the good cause. In the caseworker training testing, there were 7 instances of noncompliance out of a total of 50 items selected for testing. Four of the seven instances where related to the employee not participating in the appropriate training required to assess sanctions. There was one instance where the employee completed training two months after hire date, one that should have not been included in the population as the employee no longer had authorization to assess sanctions, and one instance where adequate support was not provided to complete testing. In testing of 3rd level sanction controls, out of 42 cases selected for testing, there were 7 instances where there was not sufficient documentation of approval of the sanction. Questioned Costs: N/A Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2020, were $80,602,537. Cause: Internal controls are not operating effectively surrounding the issuance or removal of sanctions against TANF recipients. Effect: Recipient benefits may potentially be reduced or increased in error or without appropriate cause. Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review prior to the issuance or removal of sanctions. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS ? CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE Department of Health and Human Resources (DHHR) CFDA Number 93.558 The corrective action plan for the prior year finding 2019-025 will remain in place. The DHHR Bureau for Children and Families (BCF) Policy Unit will send monthly reminders regarding the sanction policy. The Policy Unit will distribute the Sanction Flow Chart/Desk Guide by March 5,2021 and will provide access to the document on the BCF Division of Family Assistance SharePoint site. Management within the BCF will provide emphasis and additional training to all staff to supply all case documents for all steps of the sanction process to provide evidence of documentation of the internal controls pertaining to the issuance and removal of sanctions against TANF recipients. A Sanction Blackboard course will be sent out April 1, 2021 for completion by April 30, 2021. Management will also emphasize the need to maintain accurate documentation of sanctions within case files. A checklist for sanctions will be sent to field staff to be included with all Sanctions. The checklist will be scanned into On-Base as additional documentation of the sanction when sanctions are applied to cases. The Policy Unit will also continue reviewing WV WORKS cases monthly to ensure accuracy and try to eliminate findings. As additional measures beyond the corrective action plan for the prior year finding, the BCF will hold a virtual conference in each region throughout the state to review policies and procedures regarding sanctions; the WV WORKS Council will add payment accuracy training with staff quarterly; and the TANF Policy Unit will review RAPIDS Management Reports regarding Sanctions to ensure 3rd Sanctions are being sent to the Policy Unit for review.

2019-025

2020?026 SPECIAL TESTS AND PROVISIONS ? INCOME ELIGIBILITY AND VERIFICATION SYSTEM (Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558 Grant Award 2019 ? 2019G996115 Grant Award 2020 ? 2020G996115 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Social Security Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows (42 USC 1320b-7; 45CFR section 205.55). (a) Wage information from the state Wage Information Collection Agency (SWICA) should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d) Information from the U.S. Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e) Unearned income from the Internal Revenue Service (IRS). Condition: During testing of 40 TANF cases subject to IEVS, we noted the following: For twenty-five of the 40 cases selected for testing, there were no matches indicating whether the case was receiving WVWorks benefits. The auditor was unable to determine if these cases should have been subject to a data match under TANF. For five of the 40 cases selected for testing, the appropriate caseworker action was not completed. For all of the cases selected, adequate documentation of review of the data exchanges, and system matches, and review of actions taken by the caseworker when required was not provided. In addition, the auditor could not determine if specific action items were completed relating to individual exchange types. Questioned Costs: Unknown 2020?026 SPECIAL TESTS AND PROVISIONS ? INCOME ELIGIBILITY AND VERIFICATION SYSTEM (continued) Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2020, were $80,602,537. Cause: There are insufficient internal controls in place surrounding the generation and review of populations provided to the auditor, the Income Eligibility and Verification System matches, and the caseworker actions required within RAPIDS. Also, insufficient documentation surrounding matches made between the information systems and actions taken after a match is made. Effect: The State of WV may not be coordinating data exchanges with other federally assisted benefit programs as required by the state plan. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. In addition, we also recommend DHHR evaluate their control over the caseworker action requirement within RAPIDS on matches related to the Income Eligibility and Verification System. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? INCOME ELIGIBILITY & VERIFICATION SYSTEM Department of Health and Human Resources (DHHR) CFDA Number 93.558 The DHHR Bureau for Children and Families (BCF) Policy Unit will work with the BCF Division of Training to develop Blackboard Training for staff as a refresh for the Income Eligibility and Verification System. The anticipated date for completion of the training is May 31, 2021. The Policy Unit will also work with Optum and RAPIDS staff to ensure that sample data is correctly gathered by June 30, 2021. Finally, the Policy Unit will continue reviewing WV WORKS cases monthly to ensure accuracy and try to eliminate findings.

2020?027 SPECIAL TESTS AND PROVISIONS ? PENALTY FOR REFUSAL TO WORK (Repeat of Prior Year Finding 2019?026) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558 Grant Award 2019 ? 2019G996115 Grant Award 2020 ? 2020G996115 Criteria: The State agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each State agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the State by an amount not less than one percent and not more than five percent of the SFAG for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60, 261.61, 261.62, 261.63, 261.64, and 261.65). If an individual in a family receiving assistance refuses to engage in required work, a State must reduce assistance to the family, at least pro rata, with respect to any period during the month in which the individual so refuses or may terminate assistance. Any reduction or termination is subject to good cause or other exceptions as the State may establish (42 USC 607(e)(1); 45 CFR sections 261.13 and 261.14(a) and (b)). However, a State may not reduce or terminate assistance based on a refusal to work if the individual is a single custodial parent caring for a child who is less than 6 years of age if the individual can demonstrate the inability (as determined by the State) to obtain child care for one or more of the following reasons: (a) the unavailability of appropriate care within a reasonable distance of the individual?s work or home; (b) unavailability or unsuitability of informal child care; or (c) unavailability of appropriate and affordable formal child care (42 USC 607(e)(2); 45 CFR sections 261.15(a), 261.56, and 261.57). Condition: During testing of the following exceptions were identified: For five of the 60 cases selected for testing, the individuals should not have been included in the overall population of individuals not participating in their assigned activity. The clients appeared to have been participating in their assigned activity or were enrolled in school. For one of the 60 cases selected for testing, the client did not have appropriate documentation in the case file to show if the individual was engaged in an activity and if the benefit was appropriate. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2020, were $80,602,537. Cause: There are insufficient internal controls in place surrounding the generation and review of the population of individuals not participating in an assigned activity provided to the auditor, and caseworker data entry into RAPIDS. 2020?027 SPECIAL TESTS AND PROVISIONS ? PENALTY FOR REFUSAL TO WORK (Repeat of Prior Year Finding 2019?026) (continued) Effect: The State of WV may not be reducing or terminating the assistance grant of those individuals who refuse to engage in work and are not subject to good cause or other exceptions established by the State. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. In addition, we also recommend DHHR evaluate the effectiveness of the current training programs for the TANF program to ensure adequate technical training is provided. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? PENALTY FOR REFUSAL TO WORK Department of Health and Human Resources (DHHR) CFDA Number 93.558 The DHHR Bureau for Children and Families (BCF) will meet with staff members at Optum and RAPIDS by June 30, 2021 to review requirements to ensure accuracy of populations; will review populations when pulled by Optum; will send monthly reminders regarding the information needed in the case record to document engagement in an activity; and will continue reviewing WV WORKS cases monthly to ensure accuracy and try to eliminate findings.

2019-026

2020?028 SPECIAL TESTS AND PROVISIONS ? PENALTY FOR FAILURE TO COMPLY WITH WORK VERIFICATION PLAN Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) 93.558 Grant Award 2019 ? 2019G996115 Grant Award 2020 ? 2020G996115 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the state by an amount not less than one percent and not more than five percent of the SFAG for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60, 261.61, 261.62, 261.63, 261.64, and 261.65). If an individual in a family receiving assistance refuses to engage in required work, a State must reduce assistance to the family, at least pro rata, with respect to any period during the month in which the individual so refuses or may terminate assistance. Any reduction or termination is subject to good cause or other exceptions as the State may establish (42 USC 607(e)(1); 45 CFR sections 261.13 and 261.14(a) and (b)). However, a State may not reduce or terminate assistance based on a refusal to work if the individual is a single custodial parent caring for a child who is less than 6 years of age if the individual can demonstrate the inability (as determined by the State) to obtain child care for one or more of the following reasons: (a) the unavailability of appropriate care within a reasonable distance of the individual?s work or home; (b) unavailability or unsuitability of informal child care; or (c) unavailability of appropriate and affordable formal child care (42 USC 607(e)(2); 45 CFR sections 261.15(a), 261.56, and 261.57). Condition: One of the 40 individuals selected supporting documentation did not support the hours utilized in the compliance calculation for the penalty for failure to comply with work verification requirements. and the auditor was unable to determine if the data was correct in respect to the Work Participation rate and Work Verification Plan. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2020, were $80,602,537. 2020?028 SPECIAL TESTS AND PROVISIONS ? PENALTY FOR FAILURE TO COMPLY WITH WORK VERIFICATION PLAN (continued) Cause: There was insufficient documentation supporting the participation hours entered into RAPIDS and reported to HHS. Effect: The State of WV is not incompliance with its Work Verification Plan, including adequate documentation, verification, and internal control procedures. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS is complete and accurate. In addition, we also recommend DHHR evaluate the effectiveness of the current training programs for the TANF program to ensure adequate technical training is provided. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? PENALTY FOR FAILURE TO COMPLY WITH WORK VERIFICATION PLAN Department of Health and Human Resources (DHHR) CFDA Number 93.558 The DHHR Bureau for Children and Families (BCF) will meet quarterly with RAPIDS staff responsible for TANF Data Reporting to keep lines of communication open and offer technical assistance as needed. The BCF will also work with their Division of Training to develop a webinar on Hours of Participation Refresh for staff. The anticipated date for completion of the training is June 30, 2021. Finally, the BCF will continue reviewing WV WORKS cases monthly to ensure accuracy and try to eliminate findings.

2020?032 ELIGIBILITY (Repeat of Prior Year Finding 2019?034) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ 93.778 & ARRA - 93.778 Grant Award 1905WVINCT Grant Award 1905WV5MAP Grant Award 1905WV5ADM Grant Award 1905WVIMPL Grant Award 2005WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WVINCT Children?s Health Insurance Program (CHIP) 93.767 Grant Award 1805WV5021 Grant Award 1905WV5021 Grant Award 2005WV5021 Criteria: 42 CFR 435.914 states ?(a) The agency must include in each applicant's case record facts to support the agency's decision on his application. (b) The agency must dispose of each application by a finding of eligibility or ineligibility, unless?(1) There is an entry in the case record that the applicant voluntarily withdrew the application, and that the agency sent a notice confirming his decision; (2) There is a supporting entry in the case record that the applicant has died; or (3) There is a supporting entry in the case record that the applicant cannot be located.? 42 CFR 457.965 states ?The State must include in each applicant's record facts to support the State's determination of the applicant's eligibility for CHIP.? 42 CFR 435.945(j) and 457.380(j) require states to develop and submit to the Centers for Medicaid and Medicare Services (upon request) a plan describing the Medicaid and CHIP eligibility verification policies and procedures adopted by the State. The State of West Virginia Modified Adjusted Gross Income (MAGI)-Based Eligibility Verification Plan for Medicaid & CHIP requires the following eligibility factors to be verified: income, residency, age, social security number, citizenship, immigration status, household composition, pregnancy, caretaker relative, Medicare, application for other benefits, and other insurance coverage. These are either required to be verified through electronic data sources or through self-attestation without additional verification or self-attestation with post -eligibility verification. Electronic data sources include: the Internal Revenue Service, Social Security Administration, State Wage Information Collection Agency, State Unemployment Compensation, State Administered Supplementary Payment Program, State General Assistance Programs, Supplemental Nutrition Assistance Program, Temporary Assistance for Needy Family, Bureau for Child Support Enforcement, State Income Tax, TALX, Work Force West Virginia and Families and Children Tracking System Income. State verification plans does not provide specific details. The most recently submitted plan for the State is posted on Medicaid.gov. 2020?032 ELIGIBILITY (Repeat of Prior Year Finding 2019?034) (continued) Condition: The Medicaid program and the CHIP program are required (as described at 42 CFR 435.914) to maintain facts in the case file to support the eligibility determination. During our testing of 60 cases for eligibility for the Medicaid program, we noted five instances where the social security number, age, date of birth, and immigration status were not verified in the Data Exchange system as required by the State?s Medicaid eligibility verification plan; and one instances where documentation of income verification to the electronic data source required by the State?s Medicaid eligibility verification plan was not maintained in the file. During our testing of 60 cases for eligibility for CHIP, we noted 20 instances where documentation of income verification to the electronic data source required by the State?s MAGI-based CHIP eligibility verification plan was not maintained in the file. We also noted seven instances where the social security number, age, date of birth, and immigration status were not verified in the Data Exchange system as required by the State?s MAGI-based CHIP eligibility verification plan; and six instances where income was not verified. Questioned Costs: $16,992 Assistance Listing #93.778 $12,602 Assistance Listing #93.767 Context: The 6 cases in Medicaid represent $16,992 of Medicaid payments out of a population of benefit payments tested for eligibility of $182,420. The 27 cases in CHIP represent $12,602 of CHIP payments out of a population of benefit payments tested for eligibility of $32,879. The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2020, were $3,431,147,286. The federal expenditures for the Children?s Health Insurance Program for the fiscal year ended June 30, 2020, were $73,990,124. Cause: Management indicated that the information was verified in accordance with the Medicaid and CHIP verification plan or State plan, but no documentation was kept in the file of the verification. Effect: Payments were made for ineligible recipients. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that DHHR evaluate the policies and procedures and add a requirement to maintain documentation of the verification of information with the federal data hub. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

ELIGIBILITY Department of Health and Human Resources (DHHR) CFDA Number 93.775, 93.777, 93.778, ARRA 93.778 The WV eligibility system does access the Federal Data Hub (FDH) for verification purposes and the DHHR Bureau for Medical Services (BMS) acknowledges that historical record of the FDH matches were not yet available in the case record for this review cycle. However, regardless of whether the FDH provides necessary verifications, additional electronic data sources may be used (e.g., Workforce WV Quarterly Wage Match, Social Security Administration Data Exchange, IPACT, etc.) to verify income, SSN, DDOB, and citizenship. If electronic sources do not provide necessary verifications, then additional paper documentation may be requested from the client. If the client provides a paper copy of paystubs, a birth certificate, or Social Security Card, then that is also an acceptable verification method for the data element and may be used to complete the eligibility determination. Non-Financial Social Security Number, Age (Date of Birth), and Citizenship/Immigration status are data elements that are required to be verified in the WV Verification Plan. Immigration status would be required only for individuals who do not attest to US citizenship. None of the cases indicated in the finding were non-citizens. Citizenship verification is required for all individuals who declare US citizenship, unless exempt. These data elements may be verified by the Federal Data Hub, another electronic data source, or by paper documentation. In most cases, self-attestation is not acceptable. Paper verifications provided by the client and maintained in the case file are also an acceptable verification method. Financial Earned and Unearned Income are data elements that are required to be verified in the WV Verification Plan. These data elements may be verified by the Federal Data Hub, another electronic data source, or by paper documentation. In most cases, self-attestation is not acceptable. Paper verifications provided by the client and maintained in the case file are also an acceptable verification method. For example, if a client provides paystubs for the application period in question, the eligibility caseworker is required to consider that information when making an eligibility determination. Corrective Action The dates of the eligibility determinations for the cases under review for the West Virginia Single Audit for the Year Ended June 30, 2020 were prior to implementation of the Corrective Action Plan for finding 2019-034 from the West Virginia Single Audit for the Year Ended June 30, 2019. Therefore, most of the corrective actions needed to ensure financial and non-financial information is verified, per policy, and documentation is maintained in the case record, will be the same as for year 2019. Specific dates for measures related to verification of financial data elements and verification of non-financial data elements is as follows: 1. Verification of Financial data elements (Income) In February 2020, the Income verification field guidance was reissued by the Bureau for Children and Families (BCF) Training Program manager for review by all eligibility caseworkers. In February 2020, the BMS requested an enhancement to the eligibility system (through the IT system vendor) to retain historical verification information obtained from the Federal Data Services Hub for financial and non-financial information. The BMS informed the BCF that until the enhancement in the eligibility system is implemented, the BMS will develop a new procedure (verification field guidance) requiring the eligibility caseworker to print a RAPIDS screenshot of the Federal Data Services Hub verification of income and scan it into the OnBase case record. In February 2020, the BMS sent the BCF the new procedure requiring the eligibility Caseworker to print a RAPIDS screenshot of the Federal Data Services Hub verification of income and scan it into the OnBase case record. In April 2020, the State?s IT vendor and the DHHR Office of Management Information Services conducted testing with the Centers for Medicaid and Medicare Services to test the data used for income verification that is received from the Federal Data Hub (?Verify Annual Household Income and Family Size Service? and ?Verify Current Household Income Service?). Analysis of the results was completed June 30, 2020 and necessary enhancements to the system were requested (improved Federal Data Hub income verification procedures and a new FDH verification of Medicare service). In June 2020, the BCF Training Division implemented a Blackboard training course and quiz for eligibility Caseworkers regarding verification procedures, use of the Federal Data Services Hub, and documentation requirements needed to properly process and document income for Modified Adjusted Gross Income (MAGI) Medicaid during the enrollment process. A total of 753 people completed the course and quiz. The average quiz score was 90.69% In December 2020, a reminder was sent to BCF regarding the procedure requiring the eligibility caseworker to print a RAPIDS screenshot of the Federal Data Services Hub verification of income and scan it into the OnBase case record. April 2021, an enhancement will be made to Recipient Automated Payment and Information Data System (RAPIDS), the State?s eligibility system, to retain a historical record of verification of financial information obtained from the Federal Data Services Hub. A new screen (FDH History) is designed in the eRAPIDS -> Web Inquiry -> FDH History to view the Federal Data Hub History Information. This enhancement was originally to be completed in October 2020 but was delayed. 2.Verification of Non-verification of Non-Financial data elements (SSN, Citizenship, Age/DOB) In September 2019, the BCF Training Division released a training blast to eligibility Caseworkers that covered coding citizenship and identity. In July 2020, an enhancement was made to Recipient Automated Payment and Information Data System (RAPIDS), the State?s eligibility system, to automatically code the citizenship verification field when citizenship is verified by the Federal Data Hub. September 2020, the BMS Policy Unit provided guidance for distribution to BCF eligibility Caseworkers regarding the citizenship verification screen in RAPIDS. October 2020, an enhancement was made to Recipient Automated Payment and Information Data System (RAPIDS), the State?s eligibility system, to retain a historical record of verification of non-financial information obtained from the Federal Data Services Hub. A new screen (FDH History) is designed in the eRAPIDS -> Web Inquiry -> FDH History to view the Federal Data Hub History Information effective October 21, 2020. May 2021, the West Virginia Income Maintenance Manual will be reviewed and updated, as needed, to ensure all policies regarding verifying non-financial data elements (Social Security Number, Age (Date of Birth), and Citizenship/Immigration status) align with the WV Verification Plan on file with the Centers for Medicaid and Medicare Services. May 2021, The Bureau for Children and Families Training and Corrective Action Team will develop Payment Accuracy Challenges for BCF eligibility Caseworkers to address non-financial data verification requirements for Social Security Number, Age (Date of Birth), and Citizenship/Immigration status. A report will be made to BCF Regional Directors to address training needs for individuals with scores of less than 70%. ONGOING The BMS will continue to monitor the success of these corrective actions using the Medicaid Eligibility Quality Control (MEQC) audit, the Payment Error Rate Measurement (PERM) audit, and the ongoing Statewide Error Action Team (SEAT) meetings that are held between BMS Policy staff and BCF Field Operations staff.

2019-034

2020?034 SPECIAL TESTS AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY (Repeat of Prior Year Finding 2019?032) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ 93.778 & ARRA - 93.778 Grant Award 1905WVINCT Grant Award 1905WV5MAP Grant Award 1905WV5ADM Grant Award 1905WVIMPL Grant Award 2005WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WVINCT Criteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The state plan must have methods and procedures to safeguard against unnecessary utilization of care and services. In addition, the state must have (1) methods of determining criteria for identifying suspected fraud cases; (2) methods for investigating these cases; and (3) procedures, developed in cooperation with legal authorities, for referring suspected fraud cases to law enforcement officials (42 CFR parts 455, 456, and 1002). Suspected fraud must be referred to the state MFCUs (42 CFR part 455.21). The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23). The SMA must ensure that each managed care organization with which it contracts is evaluated annually on quality, timeliness, and access to the health care services by an external quality review organization (EQRO). The state must ensure that the EQRO conducting such reviews is competent and independent (42 CFR 438, Subpart E). Condition: Non-federal entities receiving federal awards are required to establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. During our testing of internal controls over the special tests and provisions ? utilization control and program integrity, specifically the cases closed within the Office of Program Integrity (OPI), the following items were noted: ? 3 cases had no documentation of review ? 1 case was opened in error and no case closure checklist/form was completed. According to BMS OPI Procedure #107: Case Closure 3.12 ?Cancelled Cases ? In some instances cases numbers are opened in i-Sight that will not result in an actual 2020?034 SPECIAL TESTS AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY (Repeat of Prior Year Finding 2019?032) (continued) case review. These cases may be opened for testing, cases opened in error, etc. These cases are cancelled rather than closed. However, a ?Case Closure Checklist/Form? must still be used. To Cancel a case in i-Sight, staff must: a) Complete the applicable sections on the ?Case Closure Checklist/Form? as follows: i. the case number, ii. ?Provider Info? section, if applicable, iii. Under ?Intake and Case Management? in the ?Family Case? file click on the ?Cancel? button. Enter the reason for cancelling the case using the dropdown box and describe the cancellation reason in the ?Comments? box. b) The reviewer and management will sign and date the ?Case Closure Checklist/Form: as any other case closure.? ? 16 cases had documentation of review, however the review was not completed timely. The 16 cases had closure dates from January 6, 2020 through June 8, 2020, with 15 of the cases not being reviewed until October 26, 2020 and one case not being reviewed until January 26, 2021. Of the 60 closed case files tested, 4 had compliance exceptions as they did not effectuate payment in in the required time frame after notice of overpayment. According to State Medicaid Policy 800.12.1 Recovery of Overpayments ?When a provider is notified of an overpayment by BMS, the provider must enter into a written repayment arrangement within 30 days of such notification. The provider may select one of the follow optional arrangements: Payments to BMS within 60 days after BMS notifies the provider of the overpayment; or placement of a lien by BMS against further payments for Medicaid reimbursements so that recovery is effectuated within 60 days after notification of the overpayment; or a recovery schedule of up to a 12 month period, through monthly payments or placement of a lien against future payments. If the provider selects the monthly restitution option, BMS will charge interest on the overpayment balance after 60 days following notification of the overpayment. The interest rate on overpayments will be the higher of the rate as set by the Secretary of the Treasury after taking into consideration private consumer rates of interest prevailing on the date of demand for payment or by the current value of funds rate. These rates are published quarterly in the Federal Register by the Secretary of the Treasury, subject to quarterly revisions. Each monthly payment must include at least 1/12 of the remaining balance of the overpayment, plus applicable interest (i.e., there can be no "back ending" under the recovery schedule). In the event that the provider fails to submit a written repayment arrangement within thirty days, a lien may be imposed on all future Medicaid payments, effective thirty days after notification of the overpayment. Interest will accrue on any remaining balances commencing thirty days after the date of notification. The lien will remain in effect until the overpayment is recovered with interest. If the provider does not comply in full with the repayment arrangement within 1 year of notification of the overpayment, the provider is subject to all of the sanctions set forth in ?870 of the Medicaid regulations. BMS reserves the right to waive or extend the recovery provisions set forth above in extraordinary circumstances in order to prevent undue hardship. Undue hardship requests must be accompanied by 5 years of financial statements for review by BMS, prior to the decision to waive or extend the recovery provision. If the provider seeks a document/desk review of an overpayment decision, the repayment and interest provisions set forth above will begin 5 days after the date of the document/desk review decision or 60 days after the date of notification, whichever is later. If the provider continues an appeal through an evidentiary hearing, any monetary findings in their favor will result in a refund to the provider?s account after notification of the evidentiary hearing conclusion. If there is further appeal, a refund will be made at the conclusion of the appeal process. 2020?034 SPECIAL TESTS AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY (Repeat of Prior Year Finding 2019?032) (continued) The first case file?s final report was issued March 27, 2019. Payment was due from the provider on May 27, 2019. Payment was not remitted. A lien was to be placed against further payments to effectuate recovery within 60 days of overpayment notification. A lien was placed by the Bureau of Medical Services (BMS) on June 24, 2019, with recovery made on August 27, 2019. The second case file?s final report was issued February 12, 2019. A West Virginia Medicaid Standard Repayment Form was completed by the provider and returned to Medicaid on March 11, 2019 notating payment would be made in 60 days from the date of notification. Payment was due on April 12, 2019, but was not remitted. A lien was to be placed against further payments to effectuate recovery within 60 days of overpayment notification. A lien was placed by BMS on June 24, 2019, with recovery made on August 27, 2019. The third case file?s final report was issued on September 18, 2018. Payment was due from the provider on November 18, 2018. Payment was not remitted. A lien was to be placed against further payments to effectuate recovery within 60 days of overpayment notification. A lien was placed by the Bureau of Medical Services (BMS) on March 6, 2019, with recovery made on August 27, 2019. The fourth case file was a self-report form where the provider selected placement of a lien by BMS against further payments to effectuate recovery within 60 days of notification. The form was recorded May 31, 2019. A lien was requested on May 31, 2019 and again on November 7, 2019. Recovery was made January 31, 2020. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2020, were $3,431,147,286. The total population subject to testing was 494 closed cases with the Office of Program Integrity (OPI). Cause: Management indicated that the while the documentation of management?s review of all closed cases is part of OPI?s policies and procedures, it is a new policy and OPI is working to implement it. Further, management?s policy does not require reviews to be performed in a specified time frame. Effect: Cases may be closed without verification by management that all required elements of closed cases are present. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that Office of Program Integrity establish policies and procedures to ensure that case files are reviewed timely upon closure by a member of management separate from the caseworker and that the review is documented. The Office of Program Integrity?s control policy for case closures should also define a reasonable time period for review of closes cases. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY Department of Health and Human Resources (DHHR) CFDA Number 93.775, 93.777, 93.778, ARRA 93.778 For the three cases that had no documentation of review and the one case that was opened in error and no case closure checklist/form completed, the DHHR Bureau for Medical Services (BMS) concurs. The BMS Office of Program Integrity (OPI) will retrain staff to ensure they know that case files are reviewed upon closure by a member of management separate from the caseworker and that the review is documented. The anticipated completion date for the training is May 30, 2021. Furthermore, during orientation, all new staff will receive training on case closure requirements and procedures. For the 16 cases that had documentation of review, but the reviews were not completed timely, the BMS does not concur. Whether the cases were reviewed timely is a subjective opinion. The OPI policy does not contain specific timeframes on when a case must be reviewed, closed, and subject to final management review. Nonetheless, in response to the auditor?s recommendation, the OPI will clarify and revise its procedures to state that management review of closed cases must be performed within 60 calendar days of initial closing. The anticipated completion date for the new procedures is May 30, 2021. For the 4 cases that did not effectuate payment in the required time after notice of overpayment, the BMS does not concur, as this too is a subjective opinion. There are no written policies that require a date for completion. Once a lien has been required by the OPI, it is the responsibility of BMS Finance to ensure that the lien has been satisfied. The OPI and BMS Finance will explore additional methods for following up on lien requests and will develop procedures that include specific timeframes. The anticipated completion date for the new procedures is May 30, 2021.

2019-032

2020?035 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS INPATIENT HOSPITAL AND LONG-TERM CARE FACILITY AUDITS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ 93.778 & ARRA - 93.778 Grant Award 1905WVINCT Grant Award 1905WV5MAP Grant Award 1905WV5ADM Grant Award 1905WVIMPL Grant Award 2005WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WVINCT Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Non-federal entities receiving federal awards are required to establish and maintain internal control over the federal awards that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. During our testing of audits of long-term care facilities and inpatient hospitals, it was noted that five of the five long-term care facility audits and two of the two inpatient hospital audits did not have documentation of the review and approval of the audits for issuance. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2020, were $3,431,147,286. The total population subject to testing was 28 for the inpatient long-term care facilities and 2 for inpatient hospitals. Cause: Management does not retain adequate documentation of the internal control review process over the inpatient hospital and long-term care facility audits process. Effect: The absence of a documented review process of the inpatient hospital and long-term care facility audits could result in an incomplete or inaccurate audit being issued. Recommendation: We recommend that DHHR enhance policies and procedures to document the review and approval of the long-term care facility audits and inpatient hospital audits for issuance. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS INPATIENT HOSPITAL AND LONG-TERM CARE FACILITY AUDITS Department of Health and Human Resources (DHHR) CFDA Number 93.775, 93.777, 93.778, ARRA 93.778 For long-term care audits and inpatient hospital audits, the DHHR Office of Accountability and Management Reporting (OAMR) conducts some of the audits via internal staff while other audits are contracted to external entities. The five long-term care facility audits and two inpatient hospital audits noted in the condition section of the finding were conducted by contracted auditors or intermediaries. When audits are conducted by internal staff, the OAMR audit files/logs include documentation of a multi-level review and approval process. When audits are conducted by contractors, staff members within the OAMR still review and approve the audits upon receipt; however, the review and approval is not always documented in the audit logs. To address this condition, the OAMR will implement a procedure whereby the Audit Director will sign off on contracted audits or will otherwise document his or her review of the audit prior to issuance.

2020?036 SPECIAL TESTS AND PROVISIONS ? MEDICAID FRAUD CONTROL UNIT INTERNAL CONTROLS (Repeat of Prior Year Finding 2019?033) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ 93.778 & ARRA - 93.778 Grant Award 1905WVINCT Grant Award 1905WV5MAP Grant Award 1905WV5ADM Grant Award 1905WVIMPL Grant Award 2005WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WVINCT Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of cases referred from the Office of Program Integrity (OPI) to the Medicaid Fraud Control Unit, it was noted that the Medicaid Fraud Referral Form was not complete for the five of the five cases selected. The sections of the form noting Bureau of Medicaid Services (BMS) contact information, OPI information, and the final section noting acceptance of the referral and review were incomplete for the five selected cases. The documentation from the Just Ware system of acceptance of the case by the Medicaid Fraud Control Unit was not maintained in the case file. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2020, were $3,431,147,286. The population subject to testing was a total of 5 cases referred to the Medicaid Fraud Control Unit. Cause: Management indicated that the documentation of the completed Form was not part of the OPI?s policies and procedures. Effect: OPI will not have clear direction on whether or not to suspend Medicaid payments to a provider and the status of the case with the Medicaid Fraud Control Unit. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that DHHR create a policy and procedure to ensure that completed Medicaid Fraud Referral Forms are maintained in the OPI files. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? MEDICAID FRAUD CONTROL UNIT INTERNAL CONTROLS Department of Health and Human Resources (DHHR) CFDA Number 93.775, 93.777, 93.778, ARRA 93.778 The Medicaid Fraud Control Unit (MFCU) Referral Form is used by the DHHR Bureau for Medical Services (BMS) Office of Quality and Program Integrity (OPI) to compile and present any information considered necessary to present a potential Medicaid fraud case to the MFCU whereby the MFCU could determine if a fraud investigation is warranted. When the MFCU Referral Form was originally created, MFCU management expected the form to be completed by the OPI, sent to the MFCU for review of the contents, signed as accepted by MFCU management, and a copy returned to the OPI for their files. Over the last few years, the MFCU discontinued signing the form and returning it. Instead, the MFCU sent an email stating the case was accepted or not. For the West Virginia Single Audit for the Year Ended June 30, 2019, attention was drawn to the final page of the MFCU Referral Form, which is the signature page. Since the MFCU no longer signed and returned the form, this resulted in finding 2019-033. In response to the finding, the signature section was removed from the referral form on April 2, 2020. The email received from the MFCU (either accepting or rejecting the case) is documentation of the acceptance or rejection of the case. On February 11, 2021, further modifications were made to the MFCU Referral Form. All OPI staff were informed of the changes and instructed to immediately begin using the new form and retain in the files for audit documentation.

2019-033

2020?037 SPECIAL TESTS AND PROVISIONS ? MEDICAID NATIONAL CORRECT CODING INITIATIVE (NCCI) Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ 93.778 & ARRA - 93.778 Grant Award 1905WVINCT Grant Award 1905WV5MAP Grant Award 1905WV5ADM Grant Award 1905WVIMPL Grant Award 2005WV5MAP Grant Award 2005WV5ADM Grant Award 2005WVIMPL Grant Award 2005WVINCT Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section 6507 of the Affordable Care Act, section 1903 (r) of the Social Security act states, the Secretary is to ``(i) Identify those methodologies of the National Correct Coding Initiative administered by the Secretary (or any successor initiative to promote correct coding and to control improper coding leading to inappropriate payment) which are compatible to claims filed under this title. (ii) Identify those methodologies of such Initiative (or such other national correct coding methodologies) that should be incorporated into claims filed under this title with respect to items or services for which States provide medical assistance under this title and no national correct coding methodologies have been established under such Initiative with respect to title XVIII. (iii) Notify States of? ``(I) the methodologies identified under subparagraphs (A) and (B) (and of any other national correct coding methodologies identified under subparagraph (B)); and ``(II) how States are to incorporate such methodologies into claims filed under this title. The National Correct Coding Initiative (NCCI) Medicaid Technical Guidance Manual Sections 7.1.1 states, ?The state Medicaid agency, its fiscal agent, and its managed-care entities are expected to have confidentiality agreements in place with any contractor or subcontractor (including, but not limited to, COTS software vendors) which is assisting with the implementation of the state?s Medicaid NCCI program to ensure that the restrictions concerning the sharing of Medicaid NCCI edits are clearly understood by all parties. Section 7.1.1 lists the minimum elements that must be included in the confidentiality agreements and must also be followed by the state Medicaid agency. 2020?037 SPECIAL TESTS AND PROVISIONS ? MEDICIAD NATIONAL CORRECT CODING INITIATIVE (NCCI) (continued) Condition: The Medicaid program did not provide documentation and that confidentiality agreements with the required elements were in place or that controls were in place regarding the National Correct Coding Initiative compliance requirements. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2020, were $3,431,147,286. Cause: Management indicated and that confidentiality agreements were in place, but the agreements did not include the required elements regarding the National Correct Coding Initiative. Effect: Claims could be coded incorrectly, there could be coding errors, and code manipulation that could result in improper payments. Recommendation: We recommend that DHHR evaluate their policies and procedures and add a requirement to document evidence of their controls over the the National Correct Coding Initiative compliance requirements. DHHR should also implement confidentiality agreements with all contractors and subcontractors that contain the elements required in the Medicaid Technical Guidance Manual. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

SPECIAL TESTS AND PROVISIONS ? MEDICAID NATIONAL CORRECT CODING INITIATIVE (NCCI) Department of Health and Human Resources (DHHR) CFDA Number 93.775, 93.777, 93.778, ARRA The DHHR Bureau for Medical Services (BMS), Office of Program Integrity (OPI), will evaluate its policies and procedures and add a requirement to document evidence of its controls over the National Correct Coding Initiative compliance requirements. Such efforts and documentation will include the following: ? The OPI will maintain screenshot of the Medicaid Integrity Institute (MII) Regional Information Sharing System (RISSNET) NCCI files when downloaded or documentation from MII, if available, that identifies the NCCI files downloaded by the OPI: a screenshot of the NCCI files after uploaded to the folder shared with the Fiscal Agency (FA); an email of the notice to the FA that the files have been uploaded; an email from the FA that the quarterly files have been received and downloaded for testing; and an email from the FA when the NCCI files are loaded into production. ? The OPI will maintain a copy of the FA?s Change Request documentation for the testing and implementation of the quarterly NCCI edits in the Medicaid Management Information System (MMIS), to include screenshots from Developmental testing (DEV), System Integration Testing (SIT), User Accepted Testing (UAT), and Production (PROD). ? The OPI will develop a process for the NCCI Coordinator to conduct one audit per calendar quarter, after the NCCI edits for that quarter are in production in the MMIS, to validate that a sample of new edits are active and deleted edits are no longer active. By May 31, 2021, the Medicaid program will implement confidentiality agreements with contractors and subcontractors that meet the requirements of the current NCCI Technical Guidance Manual for Medicaid Services, Sections 7.1.1 and 7.1.2. The confidentiality agreements will include the elements specified in Section 7.1.2 of the NCCI Technical Guidance Manual for Medicaid Services. A draft OPI Standard Operating Procedure has been prepared for the BMS NCCI process and will be updated by April 30, 2021, to include verbiage that addresses documenting evidence of controls over the National Correct Coding Initiative compliance requirements and the required confidentiality agreements. The BMS Policy Manual Chapter 800B will be revised by July 1, 2021 to include verbiage that references NCCI compliance. The BMS will discuss [with the FA] the specific inclusion of NCCI within the next System and Organization Controls Report on the WV MMIS.

2019?001 PERIOD OF PERFORMANCE Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Health and Human Resources Special Supplemental Nutrition Program for Women, Infants and Children (WIC) 10.557 Grant Award 191WV701W1003 Criteria: 2 CFR 200.303 requires that a non-Federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework,? issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.309 states that ?a non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance.? Condition: Two of the five transactions tested from grants with performance period beginning dates during the audit period was incorrectly charged to the grant. Expenditures were incurred prior to the period of performance beginning on October 1, 2018. Questioned Costs: $178 ? CFDA #10.557 Grant Award 191WV701W1003 Context: Total federal expenditures for the Special Supplemental Nutrition Program for Women, Infants and Children (WIC) were $31,767,422 for the year ended June 30, 2019. The instance recorded outside the period of performance represents $178 of total expenditures tested for grants with performance period beginning dates during the audit period of $68,030. Cause: WIC does not have adequate internal controls and policies and procedures around the review and approval of transactions to ensure that allowable costs are incurred during the period of performance. Effect: WIC charged unallowable costs to the grant. Recommendation: We recommend that WIC implement more effective internal controls and policies and procedures around the review and approval of transactions to ensure that expenditures charged to the grant are incurred during the period of performance. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

CONTACT PERSON For finding resolution and Single Audit matters, please contact Betsy Chapman, West Virginia Department of Administration, Financial Accounting and Reporting Section, 2101 Washington Street, E., Charleston, WV 25305 (Telephone 304-558-4083 ext. 301). E-mail: Betsy.Chapman@wv.gov. The respective state agency identified in each finding is responsible for the corrective action plan. 2019-001 PERIOD OF PERFORMANCE Department of Health and Human Resources (DHHR) CFDA Number 10.557 The two transactions that were charged to the incorrect period of performance were purchasing card transactions. The DHHR Purchasing Card Reconciliation Guide directs cardholders to provide the date they received an item/service, not the date the invoice was received or paid. In the state?s accounting system, wvOASIS, the received service ?from? and ?to? dates are populated from the receipt date field of the purchasing card transaction during reconciliation. This field is used in the service date validation of the major programs, which is in place to prevent a charge to an inappropriate period of performance. This field can be edited. Additionally, there are sub-coordinator reviews as well as central office approvals. The control in the system was not effective because the incorrect date was auto-populated into the system. Due to the volume of transactions being reviewed, the inappropriate date was not identified. The DHHR will work with the wvOASIS team to assess a potential change to strengthen the control in the system. Additionally, the DHHR will assess the ability to strengthen the control that is in place regarding review of the transactions and provide additional training to cardholders and coordinators related to goods received.

2019?002 MATCHING Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Defense National Guard Military Operations and Maintenance (O&M) Projects 12.401 Grant Award W912L8-19-2-1001 Grant Award W912L8-19-2-1002 Grant Award W912L8-19-2-1003 Grant Award W912L8-19-2-1004 Grant Award W912L8-19-2-1005 Grant Award W912L8-19-2-1007 Grant Award W912L8-19-2-1008 Grant Award W912L8-19-2-1010 Grant Award W912L8-19-2-1014 Grant Award W912L8-19-2-1021 Grant Award W912L8-19-2-1022 Grant Award W912L8-19-2-1023 Grant Award W912L8-19-2-1024 Grant Award W912L8-19-2-1040 Grant Award W912L8-19-2-1041 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 2 CFR 200.306(b) states that ?For all Federal awards, any shared costs or matching funds and all contributions, including cash and third party in-kind contributions, must be accepted as part of the non-Federal entity?s cost sharing or matching.? Per Appendix 1 of the Army National Guard (ARNG) Facilities Program Agreement project repair ratio is to be allocated at 50% federal. Condition: One of the sixty transactions tested from grants with matching requirements was not allocated the appropriate federal share. The federal grant was overcharged by using a 65% rate instead of the required 50%. Questioned Costs: $3,253 ? CFDA #12.401 Grant Award W912L8-19-2-1001 Context: Total federal expenditures for National Guard Military Operations and Maintenance (O&M) Projects program were $28,297,588 for the year ended June 30, 2019. The instance noted where the federal share was incorrect resulted in The National Guard Military O&M overcharging the federal grant by $3,253. The total expenditures tested for the matching requirements was $55,431. Cause: The National Guard Military O&M Projects does not have adequate review and approval controls and policies and procedures in place to ensure that expenditures are being charged appropriately to the grant at the correct matching rate. Effect: The National Guard Military O&M Projects drew down more federal funds than allowable because an incorrect match rate was used. Recommendation: We recommend that the National Guard Military Operations and Maintenance O&M Projects implement more effective review and approval controls and policies and procedures to ensure that appropriate expenditures are matched at the appropriate rate. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-002 MATCHING National Guard Military Operations and Maintenance (O&M) CFDA Number 12.401 In November 2019, O&M Management corrected the error and worked with wvOASIS to make sure the system internal controls were updated to not allow transactions to process with incorrect federal match rates.

2019?003 PERIOD OF PERFORMANCE (Repeat of Prior Year Finding 2018?002) Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Defense National Guard Military Operations and Maintenance (O&M) Projects 12.401 Grant Award W912L8-19-2-1001 Grant Award W912L8-19-2-1002 Grant Award W912L8-19-2-1003 Grant Award W912L8-19-2-1004 Grant Award W912L8-19-2-1005 Grant Award W912L8-19-2-1007 Grant Award W912L8-19-2-1008 Grant Award W912L8-19-2-1010 Grant Award W912L8-19-2-1014 Grant Award W912L8-19-2-1021 Grant Award W912L8-19-2-1022 Grant Award W912L8-19-2-1023 Grant Award W912L8-19-2-1024 Grant Award W912L8-19-2-1040 Grant Award W912L8-19-2-1041 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 2 CFR 200.309 states that ?a non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance.? National Guard Bureau (NGB) 5-1, Chapter 11 requires that ?within 90 days after the end of the Federal fiscal year or upon termination of the CA, whichever is earlier, the recipient shall promptly deliver to the United States Property and Fiscal Office (USPFO) a final accounting of all funding and disbursements under the agreement for the fiscal year.? Condition: Six of the 15 transactions tested from grants with performance period beginning dates during the audit period were incorrectly charged to the grant. Expenditures were incurred prior to the period of performance beginning on October 1, 2018. Questioned Costs: $30,372 ? CFDA #12.401 Grant Award W912L8-19-2-1001 Context: Total federal expenditures for National Guard Military Operations and Maintenance (O&M) Projects program were $28,297,588 for the year ended June 30, 2019. The six instances recorded outside the period of performance represent $30,372 of total expenditures tested for grants with performance period beginning dates during the audit period of $44,309. The total expenditures subject to period of performance testing was $90,011. Cause: The National Guard Military Operations and Maintenance (O&M) Projects does not have adequate review and approval controls and policies and procedures in place to ensure that allowable costs are incurred during the period of performance. Effect: The National Guard Military Operations and Maintenance (O&M) Projects expenditure were charged to the grant that are not allowable causing federal funds to be drawn down for unallowable costs. Recommendation: We recommend that the National Guard Military Operations and Maintenance (O&M) Projects implement more effective review and approval controls and policies and procedures to ensure that expenditures incurred prior to the period of performance beginning date are not charged to the grant. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-003 PERIOD OF PERFORMANCE National Guard Military Operations and Maintenance (O&M) CFDA Number 12.401 In September 2018, O&M started training staff on how to allocate costs to the appropriate grants and grant periods based on the service dates of each transaction. O&M will also work with wvOASIS to establish additional codes within the system in order to track grant expenditures accurately and within the proper grant period. O&M will continue to perform internal audits to ensure accuracy related to the period of performance.

2018-002

2019?006 ELIGIBILITY Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Labor Unemployment Insurance (UI) 17.225 Grant Award UI-31491-17-60-A-54 Grant Award UI-29875-17-55-A-54 Grant Award UI-31628-18-60-A-54 Grant Award UI-32737-19-55-A-54 Criteria: 2 CFR 200.303 requires the non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 20 CFR part 604.3-5 states ?A State may pay UC only to an individual who is able to work and available for work for the week for which UC is claimed; Whether an individual is able to work and available for work under paragraph (a) of this section must be tested by determining whether the individual is offering services for which a labor market exists. This requirement does not mean that job vacancies must exist, only that, at a minimum, the type of services the individual is able and available to perform is generally performed in the labor market. The State must determine the geographical scope of the labor market for an individual under its UC law; The requirement that an individual be able to work and available for work applies only to the week of unemployment for which UC is claimed. It does not apply to the reasons for the individual?s separation from employment, although the separation may indicate the individual was not able to work or available for work during the week the separation occurred. This Part does not address the authority of States to impose disqualifications with respect to separations. This Part does not limit the States? ability to impose additional able and available requirements that are consistent with applicable Federal laws. A State may consider an individual to be able to work during the week of unemployment claimed if the individual is able to work for all or a portion of the week claimed, provided any limitation on his or her ability to work does not constitute a withdrawal from the labor market; If an individual has previously demonstrated his or her ability to work and availability for work following the most recent separation from employment, the State may consider the individual able to work during the week of unemployment claimed despite the individual?s illness or injury, unless the individual has refused an offer of suitable work due to such illness or injury. General application. A State may consider an individual to be available for work during the week of unemployment claimed under any of the following circumstances: The individual is available for any work for all or a portion of the week claimed, provided that any limitation placed by the individual on his or her availability does not constitute a withdrawal from the labor market. The individual limits his or her availability to work which is suitable for such individual as determined under the State UC law, provided the State law definition of suitable work does not permit the individual to limit his or her availability in such a way that the individual has withdrawn from the labor market. In determining whether the work is suitable, States may, among other factors, take into consideration the education and training of the individual, the commuting distance from the individual?s home to the job, the previous work history of the individual (including salary and fringe benefits), and how long the individual has been unemployed.? Condition: During our testing of 60 claimant payments, we noted one claimant payment tested for $114, of the 60 tested for $16,007 was calculated incorrectly. We also noted during our testing that five claimant payments for $1,210, which includes the one claimant payment calculated incorrectly, of the 60 tested for $16,007, were outside the period of eligibility. Questioned Costs: $1,210 ? CFDA #17.225 Context: Total federal disbursements for the UI program was $387,335,731 for the year ended June 30, 2019. Cause: The internal controls over the eligibility process were ineffective and did not prevent or detect the calculation errors or the payment of benefits outside of the period of eligibility. Effect: Workforce West Virginia (WWV) was not in compliance with the eligibility requirements, which state that all benefits paid must be calculated correctly and paid within the period of eligibility. Recommendation: We recommend that management of WWV implement controls over the calculation of benefits paid and establish a process to ensure payments are made within the period of eligibility. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-006 ELIGIBILITY Workforce West Virginia (Workforce) CFDA Number 17.225 WorkForce will implement internal controls to ensure benefits will be calculated and paid correctly. A report will be developed that will provide management a listing of any claims paid outside of the period of eligibility. Workforce will select and test a sample of claims to ensure the system is calculating and paying all payments accurately. In addition, the agency will implement policies and procedures that enhance and monitor payments to ensure they are paid within the period of eligibility. These new internal controls and policies and procedures will be implemented by June 2020.

2019?009 SPECIAL TESTS AND PROVISIONS ? MATCH WITH IRS 940 FUTA TAX FORM Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Labor Unemployment Insurance (UI) 17.225 Grant Award UI-31491-17-60-A-54 Grant Award UI-29875-17-55-A-54 Grant Award UI-31628-18-60-A-54 Grant Award UI-32737-19-55-A-54 Criteria: 2 CFR 200.303 requires that the non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 26 CFR 31.3302(a)-3(a) requires that States annually certify for each tax payer the total amount of contributions required to be paid under State Law for the calendar year and the amounts and dates of such payments in order for taxpayers to be allowed the credit against the FUTA tax. Condition: Five of the five verification requests received from the IRS tested were not properly approved. For five of five field audits tested, the tax payments did not meet the stated criteria for the FUTA tax credit allowance. Questioned Costs: N/A Context: Total federal disbursements for the Unemployment Insurance (UI) program were $387,335,731 for the year ended June 30, 2019. Cause: The internal controls over the IRS 940 FUTA Tax Form matching process were not operating effectively. Effect: Workforce West Virginia (WWV) was not in compliance with the IRS 940 FUTA Tax Form matching requirements, which state that the tax payments must meet the stated criteria for the FUTA tax credit allowance. Recommendation: We recommend that management of WWV implement internal controls over the IRS 940 FUTA Tax Form matching process to ensure all tax payments meet the stated criteria for FUTA tax credit allowance. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-009 SPECIAL TESTS AND PROVISIONS ? MATCH WITH IRS 940 FUTA TAX FORM Workforce West Virginia CFDA Number 17.225 By May 2020, WorkForce West Virginia will provide staff with additional training and implement internal controls and policies and procedures to ensure the 940 IRS forms are completed accurately and meet the stated criteria for FUTA tax credit allowance.

2019?010 SPECIAL TESTS AND PROVISIONS ? UNEMPLOYEMENT INSURANCE PROGRAM INTEGRITY - OVERPAYMENTS Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Labor Unemployment Insurance (UI) 17.225 Grant Award UI-31491-17-60-A-54 Grant Award UI-29875-17-55-A-54 Grant Award UI-31628-18-60-A-54 Grant Award UI-32737-19-55-A-54 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 2 CFR 200.508(d) says an auditee must ?provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part.? Pub. L. No. 112-40 states that States are (1) required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments, and (2) States are prohibited from providing relief from charges to an employer?s UI account when overpayments are the result of the employer?s failure to respond timely or adequately to a request for information. States may continue to waive recovery of overpayments in certain situations and must continue to offer the individual a fair hearing prior to recovery. Condition: For four of the 60 overpayments selected for testing, the UI program did not provide documentation to determine if the State is properly identifying and handling overpayments. Questioned Costs: $8,235 ? CFDA #17.225 Context: Total federal expenditures for the UI program was $387,335,731 for the year ended June 30, 2019. The four instances of noncompliance represent $8,235 of a total population tested of $192,151. Cause: The UI program does not have adequate internal controls and policies and procedures in place over the UI Program Integrity ? Overpayments requirements. Effect: The UI program is not in compliance with the federal rules and regulations regarding the UI Program Integrity ? Overpayments requirements. Overpayment information may be inaccurately reported. Recommendation: We recommend that the UI program enhance its internal controls and policies and procedures in place over the UI Program Integrity ? Overpayments process and that supporting documentation be retained. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-010 SPECIAL TESTS AND PROVISIONS ? UNEMPLOYMENT INSURANCE PROGRAM INTEGRITY ? OVERPAYMENTS Workforce West Virginia CFDA Number 17.225 In January 2020, WorkForce West Virginia strengthened internal controls and policies and procedures to reflect which overpayments are set up by overpayment memorandums or the Board of Review?s decision. In addition, Workforce West Virginia provided Benefit Payment Control Imaging Operator training to ensure images are easily located, accurately detailed and scanned properly for retention. In March 2020, a field will be added to the Automated Benefit Payment System which will categorize the documentation utilized to establish any overpayment. The overpayment memorandum or the Board of Review decision will be retained in the imaging system.

2019?011 FEDERAL HIGHWAYS ADMINISTRATION PERIOD OF PERFORMANCE (Repeat of Prior Year Finding 2018?006) Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Transportation Highway Planning and Construction Cluster 20.205/20.219/ 20.224/23.003 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.309 requires that ?a non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance and any costs incurred before the Federal awarding agency or pass-through entity made the Federal award that were authorized by the Federal awarding agency or pass-through entity.? Condition: The West Virginia Division of Highway (the Division) had project agreements that had no period of performance ending dates (end dates) in the award agreements. Thus, it cannot be determined whether costs incurred pursuant to those agreements were incurred within the period of performance. Questioned Costs: Unknown Context: Total federal expenditures for the Highways Planning and Construction Cluster were $394,921,288 for the year ended June 30, 2019. Management identified program agreements from fiscal 2015 through fiscal 2019 that did not have end dates. Total federal expenditures related to project agreements without end dates for fiscal year 2019 was $22,660,057. Cause: The Division does not have adequate review and approval procedures in place to ensure that all projects had end dates. Effect: The Division may be charging costs which were incurred outside of the period of performance of the federal award which would be unallowable. Recommendation: We recommend that the Division implement review and approval controls and policies and procedures to ensure that all project agreements have end dates and that no additional costs are incurred after such dates. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-011 FEDERAL HIGHWAYS ADMINISTRATION PERIOD OF PERFORMANCE Division of Highways (DOH) CFDA Number 20.205, 20.219, 20.224, 23.003 In March 2019, DOH implemented policies and procedures to address Performance End Dates. DOH will continue to strengthen their procedures to ensure that all project agreements have end dates. Currently, the Project End Date report from Federal Highway Administration/Fiscal Management Information System (FHWA/FMIS) reflecting all projects with impending project end dates is provided to project managers for review. If a revision is required, a request for a project end date extension is then sent to FHWA for approval. DOH worked with wvOASIS to create a new report for program managers to monitor projects and project end dates which is currently being tested. DOH plans to fully roll out the new report to all districts by December 2020.

2018-006

2019?012 WAGE RATE REQUIREMENTS (Repeat of Prior Year Finding 2018?008) Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Transportation Highway Planning and Construction Cluster 20.205/20.219/ 20.224/23.003 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 40 USC 3141-3144 requires that all laborers and mechanics employed by contractors or subcontractors to work on construction contracts more than $2,000 financed by Federal assistance funds must be paid wages not less than those established for the locality of the project (prevailing wage rates) by the U.S. Department of Labor (DOL). The contractor or subcontractor must submit the required certified payrolls. Condition: For one of the forty projects selected for testing, there was no documentation that the certified payrolls were received or reviewed by an individual at the West Virginia Division of Highways (the Division). Questioned Costs: $1,434,600 ? CFDA #20.205 Context: Total federal payroll expenditures and total federal expenditures for the Highway Planning and Construction Cluster program were $63,551,038 and $394,921,288, respectively, for the year ended June 30, 2019. The one project without certified payroll represents $1,434,600 of expenditures out of a total population tested for wage rate requirements of $58,596,615. Cause: The Division does not have adequate internal controls and policies and procedures in place to ensure that certified payrolls are being submitted and reviewed timely. Effect: The Division is not in compliance with federal statutes, regulations, and the terms of the conditions of the federal award. Laborers may not be paid wages at the DOL prevailing wage rate. Recommendation: We recommend that the Division implement more effective policies and procedures to ensure that certified payrolls are being submitted and reviewed timely by program personnel. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-012 WAGE RATE REQUIREMENTS Division of Highways (DOH) CFDA Number 20.205, 20.219, 20.224, 23.003 DOH will provide continued training for current and newly hired engineers and project supervisors to ensure accurately documenting labor compliance enforcement and reviewing certified payrolls.

2018-008

2019?013 SPECIAL TESTS AND PROVISIONS ? UTILITIES - INCORRECT POPULATION Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Transportation Highway Planning and Construction Cluster 20.205/20.219/ 20.224/23.003 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.302(a) states ?(a) each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state?s own funds. In addition, the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award.? Condition: The West Virginia Division of Highways (the Division) was not able to provide a complete and accurate population of utility expenditures charged to the Highway Planning and Construction cluster that agreed to the accounting records. For one of the nine utility expenditures selected for testing at the West Virginia Division of Highway (the Division), the project should not have been included in the overall population. The project was a state project and not a federal project. Questioned Costs: N/A Context: Total federal expenditures for the Highway Planning and Construction Cluster program was $394,921,288 for the year ended June 30, 2019. Cause: The Division does not have adequate internal controls and policies and procedures in place surrounding the generation and review of populations provided to the auditor. Effect: The auditor was unable to determine if the auditee was in compliance with the specified compliance requirement. Recommendation: We recommend that the Division implement more effective policies and procedures to ensure that populations are complete and accurate. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-013 SPECIAL TESTS AND PROVISIONS ? UTILITIES - INCORRECT POPULATION Division of Highways (DOH) CFDA Number 20.205, 20.219, 20.224, 23.003 In January 2020, DOH implemented policies and procedures revising report parameters that pull the populations provided to the auditors to ensure they are complete and accurate.

2019?014 ADMINISTRATION OF ENGINEERING AND DESIGN-RELATED SERVICE CONTRACTS Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Transportation Highway Planning and Construction Cluster 20.205/20.219/ 20.224/23.003 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 48 CFR part 31 indicates that contracting agencies (State DOTs) are required to accept the indirect cost rates for consultants and sub-consultants that have been established by a cognizant agency in accordance with the Federal Acquisition Regulation for 1-year applicable accounting periods, if such rates are not currently under dispute. As noted in 23 CFR section 172.11(c)(3) and 23 USC 112(b)(2)(C), consultants and sub-consultants providing engineering and design-related services contracts must certify to contracting agencies that costs used to establish indirect cost rates are in compliance with the applicable cost principles contained in the Federal Acquisition Regulation by submitting a ?Certificate of Final Indirect Costs?. Condition: For six of the fourteen consultants selected for testing at the West Virginia Division of Highways (the Division), the consultant did not submit a ?Certificate of Final Indirect Costs? to the Division; therefore, the Division did not accept the appropriate indirect cost rates. Questioned Costs: Unknown Context: Total federal expenditures for the Highway Planning and Construction Cluster program was $394,921,288 for the year ended June 30, 2019. Cause: The Division does not have adequate internal controls and policies and procedures in place to ensure that consultants are submitting the ?Certificate of Final Indirect Costs?. Therefore, the Division is not able to accept the appropriate indirect cost rates. Effect: The Division is not in compliance with federal statutes, regulations, and the terms of the conditions of the federal award. Expenditures may be charged to the grant that are unallowable. Recommendation: We recommend that the Division implement policies and procedures to ensure that all consultants submit a ?Certificate of Final Indirect Costs? so that the indirect cost rates can be accepted by the Division. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-014 ADMINISTRATION OF ENGINEERING AND DESIGN-RELATED SERVICE CONTRACTS Division of Highways (DOH) CFDA Number 20.205, 20.219, 20.224, 23.003 In January 2020, DOH implemented policies and procedures related to the verification of indirect cost rates provided by consultants to help ensure that all consultants submit a ?Certificate of Final Indirect Costs?. Training will be provided to individuals, and groups within DOT to ensure compliance. DOH will also amend existing policy to include a ?safe harbor? rate which can be provided to smaller vendors in an effort to further ensure compliance and improve the process.

2019?016 SPECIAL TESTS AND PROVISIONS ? VERIFICATION Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR Section 668.55(b)(1) states, ?(b)(1) An applicant who is selected for verification of the number of persons in his or her household (household size) or the number of those in the household who are attending postsecondary institutions (number in college) must update those items to be correct as of the date of verification, except when the update is due to a change in his or her marital status.? Condition: For one student selected from Marshall University and one student selected from Shepherd University in our compliance sample of 60 students who were selected for verification testing, the household size being verified was incorrect and an updated household size was not submitted to the Department of Education. For one student from Bluefield State College in our compliance sample of 60 students who were selected for verification testing, the child support income was miscalculated. Further the following institutions did not have adequate internal controls in place surrounding the verification process for the selections made: Bluefield State College, Marshall University, and West Virginia University ? Parkersburg. For Shepherd University and West Liberty University, the institutions had controls in place however these were determined to be ineffective. Questioned Costs: $2,390 ? Marshall University CFDA #84.063 Grant Award P063P180425 $1,632 ? Shepherd University CFDA #84.063 Grant Award P063P180426 Context: Total Federal expenditures for the SFA cluster in total were $590,606,881 for the year ended June 30, 2019. The total SFA cluster expenditures for Bluefield State College, Marshall University, Shepherd University, West Virginia University at Parkersburg, and West Liberty University were $8,806,147, $101,935,076, $23,349,372, $9,681,323, and $20,324,530, respectively for the year ended June 30, 2019. Cause: The institutions did not have adequate internal controls in place to ensure that verification changes identified during the process were processed and submitted to the Federal Department of Education. Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Recommendation: Management should develop internal controls to ensure that changes identified during the verification process are submitted to the Federal Department of Education. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-016 SPECIAL TESTS AND PROVISIONS ? VERIFICATION Bluefield State College, Marshall University, West Virginia University at Parkersburg, Shepherd University, and West Liberty University CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 Bluefield State College (Bluefield) response In January 2020, Bluefield strengthened internal controls over the verification process. Verification changes that are identified during the initial verification process will be rechecked prior to submission to the Federal Government. Policies and procedures will be reviewed annually to ensure any changes identified during the verification process are accurately submitted to the Federal Department of Education. Marshall University (Marshall) response In December 2019, Marshall?s Office of Student Financial Aid implemented additional internal controls to include a new step in the internal review process utilizing Ellucian Banner for tracking and documenting the files reviewed. In addition, Marshall will do a secondary review of at least 10% of the files verified by the financial aid staff to ensure all changes identified during the verification process are submitted to the Federal Department of Education. West Virginia University at Parkersburg (WVU-P) response Effective January 2020, WVU-P implemented policies and procedures to ensure adequate separation of responsibility and management oversight to ensure changes identified in the verification process will be submitted to the Department of Education ensuring compliance. Shepherd University (Shepherd) response Beginning July 2019, Shepherd updated policies and procedures for verification to include a second review of all verification files that will be made by the assistant director and, if needed, the director. This will ensure any changes are processed and submitted to the Department of Education. West Liberty University (West Liberty) response In April 2019, West Liberty updated internal controls for the Assistant Director to second check all verifications before completion with the Central Processing System (CPS) and in Banner. Currently, Counselors complete Verification within Banner. Before updating as ?verified? and sending changes to CPS, the Assistant Director checks each verification for accuracy and completeness. Once reviewed and approved, the Counselors complete as verified in Banner and make updates in Financial Aid Administrator Access if needed.

2019?017 SPECIAL TESTS AND PROVISIONS ? DISBURSEMENTS TO OR ON BEHALF OF STUDENTS (Repeat of Prior Year Finding 2018?011) Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR 668.165(a)(2), requires that, ?Except in the case of a post-withdrawal disbursement made in accordance with ? 668.22(a)(5), if an institution credits a student ledger account with Direct Loan, Federal Perkins Loan, or TEACH Grant program funds, the institution must notify the student or parent of? (i) The anticipated date and amount of the disbursement; (ii) The student?s or parent?s right to cancel all or a portion of that loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Secretary; and (iii) The procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. (3) The institution must provide the notice described in paragraph (a)(2) of this section in writing.? Condition: For one disbursement notification selected for testing at West Virginia State University and one disbursement notification selected for testing at Shepherd University, the institutions did not provide all required information in writing. For one of the disbursement notifications selected for testing at West Virginia University at Parkersburg, the institution could not provide documentation of the letter sent to the student. The total sample selected for testing was 60. Questioned Costs: N/A Context: Total Direct Loan, Federal Perkins Loan, and TEACH Grant expenditures for the SFA cluster were $463,621,872 for the year ended June 30, 2019. The total Direct Loan, Federal Perkins Loan, and TEACH Grant expenditures for West Virginia State University, Shepherd University, and West Virginia University at Parkersburg were $11,405,942, $17,821,987, and $4,707,035, respectively for the year ended June 30, 2019. Cause: Internal controls and policies and procedures related to the institutions? disbursement notifications did not encompass all of the required elements. Effect: Institutions were not in compliance with the requirements related to disbursement notification. Policies and procedures related to the institutions? disbursement notifications did not encompass all of the required elements. Recommendation: We recommend that the institutions implement more effective internal controls and policies and procedures to ensure that all required information is part of the disbursement notifications sent to students and that supporting documentation for disbursement notifications is maintained and archived to allow for evidence of the institution?s compliance with federal guidelines. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-017 SPECIAL TESTS AND PROVISIONS ? DISBURSEMENTS TO OR ON BEHALF OF STUDENTS West Virginia State University, Shepherd University, and West Virginia University at Parkersburg CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 West Virginia State University (WVSU) response In December 2018, WVSU implemented a corrective action plan to address this matter. The Office of Student Financial Aid met with the Information Technology Department and updated the student/parent borrower Right to Cancel notification. The updates include borrower specific loan information with the amount and date of disbursement disclosed. All required information is now present on the Right to Cancel notifications. Policies and procedures were updated based upon the corrective action plan. In compliance with the updates, all supporting documentation of sent notifications are maintained and archived by the Office of Financial Aid. WVSU will continue to strengthen internal controls to ensure compliance with federal guidelines. Shepherd University (Shepherd) response In July 2019, Shepherd developed additional policies and procedures to ensure that all Right-To-Cancel Notices (RTCN) are sent to student and parent borrowers. Shepherd implemented internal controls by manually sending out the RTCN to all student and parent borrowers and copying the financial aid manager on all loan disbursement (RTCN) emails in order to maintain documentation evidence. The financial aid manager pulls information from Banner to create a spreadsheet that tracks the student?s name, ID, and date delivered before filing the printed copy in the student?s file. The financial aid director then spot checks the spreadsheet for accuracy. In addition, RUAMAIL is populated with date the email was sent. Emails are also archived as evidence of Shepherd?s compliance. West Virginia University at Parkersburg (WVU-P) response Effective July 2019, policies and procedures were implemented so at the time of disbursement, students are sent a disbursement notification which includes the required information concerning aid disbursement produced by the Banner system. It will be documented, maintained, and tracked by student in the system. This new notification process ensures all students are properly notified and allows for evidence of WVU-P?s compliance with all federal guidelines.

2018-011

2019?018 SPECIAL TESTS AND PROVISIONS ? RETURN OF TITLE IV FUNDS Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 668.173(b) requires timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if - (1) The institution deposits or transfers the funds into the bank account it maintains under ? 668.163 no later than 45 days after the date it determines that the student withdrew; (2) The institution initiates an electronic funds transfer (EFT) no later than 45 days after the date it determines that the student withdrew; (3) The institution initiates an electronic transaction, no later than 45 days after the date it determines that the student withdrew, that informs a FFEL lender to adjust the borrower?s loan account for the amount returned; or (4) The institution issues a check no later than 45 days after the date it determines that the student withdrew. An institution does not satisfy this requirement if - (i) The institution?s records show that the check was issued more than 45 days after the date the institution determined that the student withdrew; or (ii) The date on the cancelled check shows that the bank used by the Secretary or FFEL Program lender endorsed that check more than 60 days after the date the institution determined that the student withdrew. Condition: For eleven Return of Title IV Funds calculations selected from West Virginia University (WVU), the incorrect semester end date was used in the Return of Title IV calculations and the correct amount to be returned was returned after the 45-day requirement. For two Return of Title IV Funds calculations selected from West Virginia University, the funds were not returned to the Department of Education within the 45-day requirement. For one Return of Title IV Fund calculation selected from Marshall University, the institution could not support a revised date of withdrawal which caused the institution to return and then incorrectly draw funds back. For one Return of Title IV Fund calculation selected from West Liberty University, the incorrect refund amount was returned to the Department of Education. For one Return of Title IV Fund calculation selected from Bluefield State College and one Return of Title IV Fund calculation selected from West Virginia School of Osteopathic Medicine (WVSOM), the funds were not returned to the Department of Education within the 45-day requirement. The total number of compliance samples tested was 54. Further, the institutions listed above along with West Virginia Northern Community and Technical College, Fairmont State University, and Pierpont Community and Technical College did not have adequate internal controls in place surrounding the Return of Title IV Funds. Questioned Costs: $1,920 ? Marshall University CFDA #84.268 Grant Award P268K190425 $7,312 ? West Liberty University - $7,011 CFDA #84.268 Grant Award P268K190427; $301 CFDA #84.063 Grant Award P063P180427 $3,178 ? Bluefield College CFDA #84.268 Grant Award P268K190422 $13,100 ? WVSOM CFDA #84.268 Grant Award P268K196656 $32,487 ? WVU - $26,960 CFDA #84.268 Grant Award P268K190429; $5,527 CFDA #84.063 Grant Award P063P180429 Context: Total Student Financial Assistance Cluster expenditures for the year ended June 30, 2019 were $590,606,881. The total Student Financial Assistance Cluster expenditures for the year end June 30, 2019, for West Virginia University, Marshall University, West Virginia Northern Community and Technical College, West Liberty University, Bluefield State College, Fairmont State University, West Virginia School of Osteopathic Medicine, and Pierpont Community and Technical College were $262,461,827, $101,935,076, $4,629,346, $20,324,256, $8,806,147, $24,641,788, $46,387,373, and $7,512,369, respectively. Cause: The institutions do not have adequate internal controls in place to prevent non-compliance. Effect: The institutions are not returning the correct amount of federal student financial assistance required or the funds are not returned within the required time frame. Recommendation: Management should implement internal controls to ensure that the correct amount of federal student financial assistance is returned and returned within the required time frame. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-018 SPECIAL TESTS AND PROVISIONS ? RETURN OF TITLE IV FUNDS West Virginia University, Marshall University, West Liberty University, Bluefield State College, West Virginia School of Osteopathic Medicine, West Virginia Northern Community and Technical College, Fairmont State University, and Pierpont Community and Technical College CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 West Virginia University (WVU) response WVU has enhanced the current Return to Title IV policies and procedures with additional internal controls at key points in the process to ensure accurate and timely returns within the 45-day timeframe. These enhancements were in place for the 2019-2020 academic year. Marshall University (Marshall) response Marshall?s Office of the Bursar and Office of the Registrar have implemented internal controls to include a new ARGOS report to run and be emailed automatically daily to the Registrar?s Office for all withdrawals in which the effective date and entry date do not match. The Registrar?s Office will review all backdated withdrawals to verify the proper documentation is presented and reviewed by the Office of Student Financial Aid and the Bursar?s Office to support the withdrawal date. Marshall will work on developing an ongoing training program for advisors and deans on the importance of withdrawal dates to ensure the correct amount of federal student financial assistance is returned within the required timeframe by May 2020. West Liberty University (West Liberty) response In January 2020, West Liberty Business office implemented a review process related to the return of Title IV funds. West Liberty will reconcile all prepared R2T4 calculations to the list generated by the independent record keeping system (Banner), to all required R2T4 calculations weekly beginning in the fourth week of the term and continuing up to the 45-day point and bi-weekly thereafter until the end of term. West Liberty Controller will review all R2T4 calculations for accuracy, completeness, and timeliness of the return of Title IV funds. Bluefield State College (Bluefield) response Beginning in January 2020, Bluefield will refund students every two weeks, including federal financial aid. The refund account will be monitored to ensure an adequate balance is available for refunds. Training of staff will occur to ensure availability of human resources to complete the tasks within the 45-day requirement. West Virginia School of Osteopathic Medicine response (WVSOM) response In January 2020, WVSOM will review and improve processes to strengthen internal controls to ensure federal funds are returned within the required 45-day time frame. A knowledgeable employee of the Office of Financial Aid will be responsible for tracking the return of Title IV funds. West Virginia Northern Community and Technical College (WVNCC) response In December 2019, WVNCC strengthened internal controls around the unofficial withdraw R2T4 calculations by updating Banner to accept Last Date of Attendance as reported by faculty so that the R2T4 calculation could be processed in Banner based on these dates and meet the 45-day requirement for return of funds. Fairmont State University (FSU) response In January 2020, FSU strengthened internal controls to ensure that the correct amount of federal student financial assistance is returned and is within the required timeframe by adding an additional review of the R2T4 worksheet from COD by a Program Assistant II to ensure the accuracy of data that was input into the worksheet to perform the calculations. The Program Assistant II will also verify the accuracy of the funds in Banner that are returned to the Department of Education by reviewing the TSAAREV form for each student and confirming the funds that were returned from the student?s account match those on the R2T4 worksheet from COD. Pierpont Community and Technical College (PCTC) response Beginning January 2020, PCTC financial aid staff will complete R2T4 calculations. PCTC will follow policies and procedures to including having an individual that performs the calculation and a second individual that reviews the calculation for accuracy. Both employees will provide documentation of completion/review at the time each calculation is performed to ensure the correct amount of federal student financial assistance is returned within the required timeframe.

2019?019 SPECIAL TESTS AND PROVISIONS ? ENROLLMENT REPORTING (Repeat of Prior Year Findings 2018?012, 2017?006, 2016?008, 2015?015, 2014?011, 2013?028, 2012?43, 2012?47, 2012?49, 2011?22) Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 685.309(b) requires that institutions must ?(1) Upon receipt of an enrollment report from the Secretary, a school must update all information included in the report and return the report to the Secretary - (i) In the manner and format prescribed by the Secretary; and (ii) Within the timeframe prescribed by the Secretary. (2) Unless it expects to submit its next updated enrollment report to the Secretary within the next 60 days, a school must notify the Secretary within 30 days after the date the school discovers that - (i) A loan under title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended; or (ii) A student who is enrolled at the school and who received a loan under title IV of the Act has changed his or her permanent address. Condition: For one student selected from West Virginia State University, one student selected from Pierpont Community and Technical College, one student selected from West Liberty University, and three students selected from Marshall University in our compliance sample of 60 students who withdrew, graduated, or enrolled but never attended, the respective institutions did not promptly notify the appropriate entities of a change in the student?s status in a timely and accurate manner. For each of the students noted above from West Virginia State University and West Liberty University, there were timing and status discrepancies between the information reported by the institution to the Clearinghouse and their subsequent reporting of enrollment detail to National Student Loan Data System (NSLDS). Each of the students noted above from Marshall University and Pierpont Community and Technical College were not properly reported as being graduated. Further the following institutions did not have adequate internal controls in place surrounding the enrollment reporting process for the selections made: West Virginia State University, West Liberty University, Marshall University, Mountwest Community and Technical College, West Virginia University, West Virginia University at Parkersburg, Pierpont Community and Technical College, Fairmont State University, Bluefield State College and Concord University. Questioned Costs: N/A Context: Total Direct Loan and Pell expenditures for the SFA cluster in total were $533,437,203 for the year ended June 30, 2019. The total Direct Loan and Pell expenditures for West Virginia State University, West Liberty University, Marshall University, Mountwest Community and Technical College, Pierpont Community and Technical College, West Virginia University, West Virginia University at Parkersburg, Fairmont State University, Bluefield State College and Concord University were $15,946,066, $18,209,225, $100,515,864, $5,814,833, $7,348,587, $224,848,284 $9,505,404, $24,299,118, $8,363,330, and $13,394,531, respectively for the year ended June 30, 2019. Cause: The institutions did not have adequate internal controls in place surrounding the enrollment reporting process. Effect: The institutions are not promptly notifying the NSLDS of changes in student status in an accurate manner; thus, inaccurate information is reported to the NSLDS. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. As institutions are responsible for timely reporting whether they report directly or via a third-party servicer, we recommend that the institutions implement a review process to ensure they are promptly notifying the U.S. Department of Education and NSLDS of changes in a student?s status in a timely and accurate manner. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-019 SPECIAL TESTS AND PROVISIONS ? ENROLLMENT REPORTING West Virginia State University, West Liberty University, Marshall University, Mountwest Community and Technical College, West Virginia University, West Virginia University at Parkersburg, Pierpont Community and Technical College, Fairmont State University, Bluefield State College, and Concord University CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 West Virginia State University (WVSU) response In January 2020, WVSU implemented new internal controls to produce accurate and timely submission of enrollment information to the National Student Loan Data System (NSLDS) and the U.S. Department of Education. Thorough edit checks of student data for each semester will be produced by IT. Any errors discovered will be corrected before each enrollment file is produced. Policies and procedures will be updated in January 2020 regarding producing the enrollment file. West Liberty University (West Liberty) response In January 2020, West Liberty updated reporting to all graduated students within 20 days through Student Clearinghouse to meet all federal requirements. Before reports are sent to the Clearinghouse, the Director of Financial Aid checks for accuracy and completeness. To increase accuracy in reporting, West Liberty has also started manually checking graduated students in NSLDS on day 25 to ensure the federal regulation is met on reporting for graduates. Marshall University (Marshall) response To ensure prompt reporting of student graduation status, Marshall?s Office of the Registrar will review and correct any status discrepancies or rejected records from student degree reporting transmissions to the National Student Clearinghouse within 30 days of receiving the error resolution report. Resolving errors from degree reporting within 30 days of receipt will ensure that graduated student status changes are reported in a timely and accurate manner. All errors identified related to finding 2019-019 have been subsequently corrected. Mountwest Community and Technical College (Mountwest) response In January 2020, Mountwest implemented internal controls for the enrollment reporting process to ensure accurate and timely reporting. All changes to student status are reviewed by multiple employees and all reports are reviewed for any errors before submission to the National Student Loan Clearinghouse. All files are retained electronically and available for audit. West Virginia University (WVU) response WVU?s Office of the University Registrar has verified each enrollment file sent to the National Student Clearinghouse (NSC) every 30 days. The Enrollment Reporting procedure includes a step for the Registrar?s office to compare and verify the enrollment file created by the WVU Information Technology Services office. If any discrepancies are discovered, the issue is identified and corrected. Beginning January 2020, all communications from NSC and reports between WV Information Technology Services and the Registrar will show the verification process has been completed successfully and all errors have been resolved will be retained. The process is conducted for every enrollment file submitted to the NSC. West Virginia University at Parkersburg (WVU-P) response Effective January 2020, WVU-P has implemented policies and procedures of the enrollment reporting process for reviewing and approving the information. In addition, a transmittal form will be completed to document the completion of this procedure to ensure the U.S. Department of Education and NSLDS is notified of changes in student status in a timely and accurate manner. Pierpont Community and Technical College (PCTC) response Effective January 2020, PCTC strengthened policies and procedures regarding the enrollment reporting process. The Registrar will perform a review of each enrollment file by comparing the number of students enrolled in the file to BANNER. In addition, PCTC will spot check the enrollment information for accuracy, correcting any errors before uploading to the Clearinghouse. The Registrar?s office and financial aid will communicate monthly to help ensure that any changes to student?s status is updated timely. Fairmont State University (FSU) response Beginning January 2020, FSU implemented additional internal controls. The reviewer reviews files to identify and correct any errors, verifies the number of records is correct, and selects a few records for testing to ensure the information uploaded to the Clearinghouse is complete and accurate. Bluefield State College (Bluefield) response Beginning January 2020, Bluefield implemented additional internal controls. The enrollment report is reconciled to the student enrollment in BANNER verifying the enrollment numbers are the same. Students will be selected randomly for enrollment and number of hours of enrollment along with withdrawal and graduation dates. Notes will be made on the hard copy of the enrollment reports and errors corrected before uploading to the Clearinghouse. Concord University (Concord) response In January 2020, the Registrar implemented additional internal controls for enrollment reporting to the Clearinghouse. Utilizing a new report from the IT system, the Registrar?s Office performs spot checks of the printed NSC extract report and documents the reviews/approvals for complete and accurate reporting to the Clearinghouse.

2018-012

2019?020 SPECIAL TESTS AND PROVISIONS ?BORROWER DATA TRANSMISSION AND RECONCILIATION (Repeat of Prior Year Findings 2018?013, 2017?007, 2016?006) Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR 685.300(a)(5) states ?On a monthly basis, reconcile institutional records with Direct Loan funds received from the Secretary and Direct Loan disbursement records submitted to and accepted by the Secretary.? Condition: For the two months selected for testing of Direct Loan School Account Statement (SAS) reconciliation requirements at West Virginia University at Parkersburg and Bluefield State College, proper reconciliations were not completed by the institutions. For the two institutions listed above and Pierpont Community and Technical College there were no policies or procedures in place to review the SAS reconciliations. Questioned Costs: N/A Context: Total Direct Loan expenditures for the SFA cluster in total were $423,632,016 for the year ended June 30, 2019. The total Direct Loan expenditures for West Virginia University at Parkersburg, Bluefield State College, and Pierpont Community and Technical College were $4,707,035, $4,948,674, and $4,457,513, respectively for the year ended June 30, 2019. Cause: Written procedures detailing the process to reconcile loans from Common Origination and Disbursement (COD) records to Banner exist, as provided in narrative form during the audit. However, management represented that a formal reconciliation review process has not been successfully implemented. Effect: The absence of proper reconciliations could result in the institution?s financial records for Direct Loan expenditures to be improperly stated. Recommendation: We recommend that management implement a reconciliation process that monthly reconciliations are performed and saved as documented in the institution?s written procedure, including documentation of supervisor review and approval. In addition, management needs to ensure that all data received from COD is maintained within their records to facilitate audit procedures. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-020 SPECIAL TESTS AND PROVISIONS ? BORROWER DATA TRANSMISSION AND RECONCILIATION West Virginia University at Parkersburg, Bluefield State College, and Pierpont Community and Technical College CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 West Virginia University at Parkersburg (WVU-P) response In January 2020, WVU-P implemented new policies and procedures for the Direct Loan process, including usage of SAS reports in a monthly reconciliation. WVU-P utilizes the Direct Loan Reconciliation participant guide provided by the Department of Education to ensure the policies and procedures are compliant and that the approvals will be maintained. Bluefield State College (Bluefield) response Beginning in January 2020, Bluefield will review policies and procedures currently in place to reconcile COD record and Banner. Monthly review of reconciliation will occur within time frame of 45 days by the Financial Aid manager and/or Chief Enrollment Officer. Reports from offices involved will be requested and received within 30 days. These reports will be maintained within the records for audit procedures. Pierpont Community and Technical College (PCTC) response Beginning in July 2019, PCTC?s financial aid staff will complete data transmissions and reconciliations internally. PCTC will follow policies and procedures to have an individual perform the reconciliation and a second individual that reviews for accuracy. Both employees will provide documentation of completion/review at the time each reconciliation is completed. The director of Financial Aid will oversee this process and provide a final review to ensure all data from Common Origination and Disbursement (COD) is maintained within the records.

2018-013

2019?021 SPECIAL TESTS AND PROVISIONS ? PROGRAM ELIGIBILITY INTERNAL CONTROLS Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: West Virginia University ? Parkersburg (WVU-P) and Marshall University have not established internal controls over the attendance recording process related to distance education programs. Questioned Costs: N/A Context: Total expenditures for the SFA cluster were $590,606,881 for the year ended June 30, 2019. The total SFA Cluster expenditures for WVU-P and Marshall University were $9,681,323 and $101,935,076, respectively for the year ended June 30, 2019. Cause: Written policies and procedures have not been established by WVU-P and Marshall University regarding the program eligibility compliance requirement, specifically distance education programs. Effect: The absence of proper controls could result in the institution?s disbursing or returning the improper amount of federal student financial assistance. Recommendation: We recommend that management develop more effective policies and procedures, including internal controls over the distance education program eligibility compliance requirement. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-021 SPECIAL TESTS AND PROVISIONS ? PROGRAM ELIGIBILITY INTERNAL CONTROLS West Virginia University at Parkersburg and Marshall University CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 West Virginia University at Parkersburg (WVU-P) response WVU-P is in the process of implementing new policies and procedures for verifying attendance in the distance education programs. The new policies and procedures are expected to be implemented in February 2020. Marshall University (Marshall) response In January 2020, Marshall modified policies and procedures of the Distance Education Program to include attendance verification by the Online Learning and IT staff utilizing Blackboard Analytics to determine and record in Banner the last day of attendance for students receiving an F or W grade weekly. The last date of attendance will be exacted as the last date a student meaningfully contributed to the course by submitting an assignment, completing a quiz, or posting to an assigned discussion forum. This will ensure program eligibility requirements are met.

2019?022 SPECIAL TESTS AND PROVISIONS ? GRAMM-LEACH-BLILEY ACT ? STUDENT INFORMATION SECURITY Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Education Office of Student Financial Assistance Office of Post-Secondary Education U.S. Department of Health and Human Services Health Resources and Services Administration Student Financial Assistance (SFA) Cluster 84.007/84.033/84.038/84.063/84.268/84.379/93.264/93.342/93.364/93.925 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 16 CFR 314.4 (b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. 16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.? Condition: The following institutions did not perform a risk assessment that addresses the three required areas as noted in 16 CFR 314.4(b), which are 1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures: Marshall University, Mountwest Community and Technical College, West Virginia State University, West Virginia University at Parkersburg, BlueRidge Community and Technical College, Shepherd University, West Virginia Northern Community and Technical College, West Liberty University, Fairmont State University, Pierpont Community and Technical College, Bluefield State College, Concord University, West Virginia School of Osteopathic Medicine and New River Community and Technical College. Further, since risk assessments were not completed, the institutions did not document safeguards as required by 16 CFR 314.4(c). One institution, West Virginia University, performed the required risk assessment and further documented safeguards for the risks identified in February 2019. Further, the institutions identified above do not have internal controls in place around requirements listed in 16 CFR 314.4(b) and (c). Questioned Costs: N/A Context: Total expenditures for the SFA cluster in total were $590,606,881 for the year ended June 30, 2019. Cause: Institutions do not have policies and procedures, including internal controls, addressing the requirements of 16 CFR 314.4(b) and (c). Effect: The absence of policies and procedures could result in the loss or improper storage of student account information. Recommendation: We recommend that management implement policy and procedures, including internal controls, to ensure that they are in compliance with 16 CFR 314.4(b) and (c). Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-022 SPECIAL TESTS AND PROVISIONS ? GRAMM-LEACH-BLILEY ACT (GLBA) ? STUDENT INFORMATION SECURITY CFDA Number 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.264, 93.342, 93.364, 93.925 Marshall University response Marshall will document internal controls and appropriate safeguards to address this finding. Marshall University is currently seeking to hire an external compliance advisor/consultant and will conduct a GLBA risk assessment for the three key data security requirements, which includes: 1) employee training and management; 2) information systems, network and software design, as well as information processing, storage, transmission and disposal; and 3) detecting, and preventing and responding to attacks, intrusions, or other system failures no later than June 30, 2020. Mountwest Community and Technical College response Mountwest will consult with West Virginia Network for Educational Telecomputing and West Virginia University to better understand the requirements listed in 16 CFR 314.4 (b) and (c). Subsequent to these consultations, Mountwest will develop a risk assessment model for identifying reasonable foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction of such information and assesses the sufficiency of the safeguards in place to control these risks. At a minimum, the risk assessment will include consideration of risks in areas such as employee training and management, information management systems, and detecting, preventing and responding to attacks, intrusions, or other system failures. Mountwest will also design and implement safeguards to control the risks identified through risk assessment. This will be implemented by June 2020. West Virginia State University response WVSU modified policies and procedures to include all the GLBA requirements and best practices to identify reasonably foreseeable internal and external risks to the security and integrity of student information that could result in unwarranted disclosure, misuse, or alteration. WVSU will develop a plan to implement risk assessment of the network and a review of data storage methods. Employees who work with the campus student data systems will be trained on data privacy procedures. This will be implemented by June 2020. West Virginia University at Parkersburg response WVU-P will implement policies and procedures to ensure compliance with 16 CFR 314.4(b) and (c). WVU-P has completed and documented a GLBA risk assessment; however, the risk assessment has not been evaluated by a third-party consultant. A quote has been requested to evaluate the cost benefit of conducting an outside review of the risk assessment. BlueRidge Community and Technical College response BlueRidge completed IT risk assessment in August 2019. The risk assessment included all three relevant areas: (1) employee training and management, (2) information systems, and (3) detecting, preventing and responding to attacks. In the future, BlueRidge will complete the risk assessment during the required timeframe. BlueRidge will use this year?s assessment as a baseline for drafting a risk assessment policy that is in compliance with 16 CFR 314.4 (b) and (c) elements.Shepherd University response Effective January 2020, Shepherd University implemented security processes and protocols designed to specifically address risk. Additionally, Shepherd continues to review and improve comprehensive risk assessment plans throughout the year. Each year the IT department works with an independent third-party solutions specialist to review and recommend improvements to a core process. Shepherd will continue to strengthen policies and procedures to ensure compliance with CFR 314.4 (b) and (c). West Virginia Northern Community and Technical College response WVNCC hired an outside vendor to complete a risk assessment and is in the process of responding to the report. WVNCC has scheduled this to be completed again in July 2020, and plans to have the risk assessment done annually. WVNCC has convened the appropriate committees to review written policies and procedures and to document the internal controls and procedures implemented as a result of the security evaluations. WVNCC plans to have internal controls and policies and procedures finalized in May 2020, so it can be fully evaluated by the upcoming Security Scan and evaluation in July 2020. WVNCC is also negotiating a contract for employee training and management program so that training will be better documented. West Liberty University response Beginning in January 2020, an internal discovery and vendor interview process will take place. In March 2020, West Liberty will hire a third-party vendor to assess activities and implement internal controls and policies and procedures ensuring compliance with 16 CFR 314.4 (b) and (c).Fairmont State University response FSU has recently undergone changes in the IT department with a focus on security, including the following actions: (1) changes on the network have been enacted to detect, prevent and report on all attacks, intrusions, or other system failures, and (2) procedural changes have been implemented to ensure all software applications and operating systems are maintained with the latest releases and patches to mitigate potential security issues. Beginning in February 2020, FSU will mandate annual required security training for all employees and is reviewing options to complete the risk assessment. FSU has taken a stronger posture related to security, and commits to investigating problems discovered and implementing new procedures or internal controls to mitigate the risk discovered. Pierpont Community and Technical College response PCTC is amid a network disentanglement with FSU. Until the beginning of the disentanglement PCTC did not have its own Information Technology infrastructure. PCTC was a user of FSU?s network with no administrative privileges. PCTC has addressed the following areas and will continue to develop a comprehensive risk assessment plan through June 2020.PCTC will adhere to the ?least privileged? access philosophy, meaning users will get access to only what is required to perform their job duties. Privileges to student data information system will only be granted with prior approval from the appropriate vice president and justification detailing the reason for the access. PCTC has contracted with a network provider for full on-site and remote network management support. PCTC will implement policies and procedures including internal controls related to information system security to ensure compliance with 16 CFR 314.4 (b) and (c). PCTC hopes to have all internal controls implemented by June 2020. Bluefield State College response Bluefield has designated the Chief Technology Officer (CTO) to coordinate the information security program. The CTO is developing an ?Information Security Plan? for the institution which will be completed in February 2020. The CTO will perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Bluefield is working with an outside company to perform an overall IT security assessment which includes employee training, identifying information systems which an or would be impacted, and intrusion testing and will be completed in Spring 2020. Policies and procedures and documented safeguards are being developed and will be completed in May 2020. Concord University response Concord will design and implement standard IT Risk Management practices to be performed throughout the calendar year to include: specify the scope to satisfy audit and best practice requirements, determine specific assessments to be performed, schedule assessments on centralized IT calendar, perform scheduled internal audits and assessments, identify risks and assess their criticality, resolve and mitigate discovered risks, prepare documentation and reports of IT Risk Management activities for internal and external auditor consumption, and monitor the IT environment for continued and changing risks. This will ensure Concord is in compliance with 16 CFR 314.4 (b) and (c). This will be completed by March 2020. West Virginia School of Osteopathic Medicine response In January 2020, WVSOM revised policies and procedures to ensure design and implement information safeguards to control the risk identified through risk assessment. WVSOM will regularly test and monitor the effectiveness of the safeguards? key controls, systems, and procedures through the use of internal and external resources. New River Community and Technical College response In August 2019, New River management implemented KnowBe4 as a cybersecurity and privacy awareness training solution. In January 2020, New River management completed a risk assessment of enterprise systems using the Federal Financial Institutions Examination Council (FFIEC) Cybersecurity Assessment Tool. New River is now working to assess cybersecurity maturity (and will complete it by May 2020 to bring New River into compliance with 16 CRF 314.4 (b) and (c)). Prior to May 2020, New River will complete the development of the following policies and procedures: information security procedures, cybersecurity procedures, incident response forms, telework memorandum of agreement, telework procedures, and GLBA compliance training. West Virginia University response WVU formed a project team in December 2019 to begin developing a detailed remediation plan for addressing findings in the GLBA risk assessment. The team is made up of representatives from WVU Financial Aid, WVU Office of Admissions and WVU END

2019?023 PERIOD OF PERFORMANCE Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Education Special Education Cluster (IDEA) 84.027/84.173 Grant Award H027A180075-18A Grant Award H173A180071 Grant Award H027A170075-17B Grant Award H173A170071 Grant Award H027A160075-16A Grant Award H173A160071 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 2 CFR 200.309 states that ?a non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance.? Condition: One of the six transactions tested from grants with performance period beginning dates during the audit period was incorrectly charged to the grant. Expenditures were incurred prior to the period of performance beginning on July 1, 2018. Questioned Costs: $20,833 ? CFDA #84.027 Grant Award H027A180075-18A Context: Total federal expenditures for the Special Education Cluster were $79,859,626 for the year ended June 30, 2019. The instance recorded outside the period of performance represents $20,833 of total expenditures tested for grants with performance period beginning dates during the audit period of $45,799. Cause: The Special Education Cluster does not have adequate internal controls and policies and procedures in place to ensure that allowable costs are incurred during the period of performance. Effect: The Special Education Cluster is not in compliance with federal statutes, regulations, and the terms of the conditions of the federal award. Expenditures were charged to the grant that are not allowable. Recommendation: We recommend that the Special Education Cluster implement more effective internal controls and policies and procedures to ensure that expenditures charged to the grant are incurred during the period of performance. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-023 PERIOD OF PERFORMANCE Department of Education CFDA Number 84.027, 84.137 In April 2020, the Department of Education will implement internal controls and policies and procedures to ensure the pre-processing stage service date validation is performed to mitigate this type of occurrence and will work with wvOASIS to add these controls with the IT system.

2019?025 SPECIAL TESTS AND PROVISIONS ?CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE (Prior Year Findings 2018?019, 2017?010, 2016?016, 2015?024, 2014?018, 2013?036, 2012?56, 2011?44, 2010?41) Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) Cluster 93.558 Grant Award 2018 ? 2018G996115 Grant Award 2019 ? 2019G996115 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The West Virginia Department of Health & Human Resources (DHHR) has policies and procedures in place surrounding the issuance and removal of sanctions; however, DHHR could not provide adequate documentation that the control was operating effectively. Questioned Costs: N/A Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2019, were $74,761,419. Cause: There is lack of sufficient documentary evidence to rely on controls surrounding the issuance or removal of sanctions against TANF recipients. Effect: Recipient benefits may potentially be reduced or increased in error or without appropriate cause. Recommendation: We recommend that DHHR management maintain sufficient documentation to evidence its review prior to the issuance or removal of sanctions. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-025 SPECIAL TESTS AND PROVISIONS ? CHILD SUPPORT NON-COOPERATION, PENALTY FOR REFUSAL TO WORK, AND ADULT CUSTODIAL PARENT OF CHILD UNDER SIX WHEN CHILD CARE NOT AVAILABLE Department of Health and Human Resources (DHHR) CFDA Number 93.558 The DHHR Bureau for Children and Families (BCF) Policy Unit sent TANF Reminders regarding the sanction process to field staff in March 2018 and September 2019. The Policy Unit will continue to send those TANF Reminders. The Policy Unit also sent a Sanction Flow Chart / Desk Guide to field staff on October 4, 2019 as a refresh of policy. The Policy Unit will redistribute the Sanction Flow Chart / Desk Guide and will provide additional access to it via SharePoint. Management within the BCF will provide additional training to all staff, with an emphasis on maintaining adequate documentation surrounding the issuance and removal of sanctions against TANF recipients. Finally, The BCF will send a checklist to field staff to include with all TANF sanction. The checklist will be scanned into the OnBase information platform. In addition, reviews of the sanction process will take place through supervisory, peer and BCF Division of Planning and Quality Improvement (DPQI) reviews.

2018-019

2019?026 SPECIAL TESTS AND PROVISIONS ? PENALTY FOR REFUSAL TO WORK (Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) Cluster 93.558 Grant Award 2018 ? 2018G996115 Grant Award 2019 ? 2019G996115 Criteria: The State agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each State agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the State by an amount not less than one percent and not more than five percent of the SFAG for violation of this provision (42 USC 601, 602, 607, and 609); 45 CFR sections 261.60, 261.61, 261.62, 261.63, 261.64, and 261.65). If an individual in a family receiving assistance refuses to engage in required work, a State must reduce assistance to the family, at least pro rata, with respect to any period during the month in which the individual so refuses or may terminate assistance. Any reduction or termination is subject to good cause or other exceptions as the State may establish (42 USC 607(e)(1); 45 CFR sections 261.13 and 261.14(a) and (b)). However, a State may not reduce or terminate assistance based on a refusal to work if the individual is a single custodial parent caring for a child who is less than 6 years of age if the individual can demonstrate the inability (as determined by the State) to obtain child care for one or more of the following reasons: (a) the unavailability of appropriate care within a reasonable distance of the individual?s work or home; (b) unavailability or unsuitability of informal child care; or (c) unavailability of appropriate and affordable formal child care (42 USC 607(e)(2); 45 CFR sections 261.15(a), 261.56, and 261.57). Condition: During testing of this special test and provision, we noted the following: For two of the 40 cases selected for testing, the individuals should not have been included in the overall population. The clients were either never recipients of TANF benefits or had elected to be removed from receiving benefits prior to the date selected for testing. For four of the 40 cases selected for testing, there were a variety of issues related to the compliance of recipients and documentation within Recipient Automated Payment Information Data System (RAPIDS). There were two instances in which individuals were not enrolled in an activity, yet their benefits were not properly reduced. There was one case in which the individual had a job, yet no monthly participation hours were recorded. The final case involved an individual who did not complete any type of hours, was not considered exempt, yet received benefits when they were ineligible. This individual was not referred for repayment. This conflicting data caused the auditor to be unable to determine if benefits were (im)properly reduced. Questioned Costs: Unknown Context: Total federal expenditures for TANF for the fiscal year ended June 30, 2019 were $74,761,419. Cause: There are insufficient internal controls in place surrounding the generation and review of populations provided to the auditor, and caseworker data entry into RAPIDS. Effect: The auditor was unable to determine if the auditee was in compliance with the specified compliance requirement. Recommendation: We recommend that management implement policies and procedures to ensure that information in RAPIDS and populations are complete and accurate. In addition, we also recommend DHHR evaluate the effectiveness of the current training programs for the TANF program to ensure adequate technical training is provided. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-026 SPECIAL TESTS AND PROVISIONS ? PENALTY FOR REFUSAL TO WORK Department of Health and Human Resources (DHHR) CFDA Number 93.558For the cases selected for testing whereby there were a variety of issues related to the compliance of recipients and documentation within the Recipient Automated Payment Information Data System, the DHHR Bureau for Children and Families (BCF) Policy Unit will use data from county reviews conducted by the BCF DPQI to determine the areas of policy they need to analyze and the technical assistance they need to provide. The Policy Unit will then coordinate with the DPQI and the Division of Training to ensure technical assistance is provided to field staff through monthly reminders, webinars, and office visits as deemed necessary. For the cases selected whereby the individuals should not have been included in the overall population, the DHHR Office of Internal Control and Policy Development will evaluate the manner by which populations are prepared, reviewed, and approved within the DHHR. Prior to the start of fieldwork for the West Virginia Single Audit for the Year Ended June 30, 2020, the Office of Internal Control and Policy Development will revise the internal process in an effort to increase overall accountability and ensure that populations are complete and accurate. Also, reviews of the participation will be completed through supervisory, peer, and DPQI reviews.

2019?028 ELIGIBILITY (Repeat of Prior Year Finding 2018?021) Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Health and Human Services Low-Income Home Energy Assistance 93.568 Grant Award G-1901WVLIEA Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? The eligibility compliance requirements of LIHEAP require the West Virginia Department of Health and Human Resources (DHHR) to determine whether federal monies are spent in accordance with the eligibility guidelines promulgated by 42 USC 8624(b)(2). Condition: During our testing of 72 benefit payments for eligibility, we noted the following: For one of the 72 cases reviewed, an application was not provided. For six of the 72 cases, there was not adequate documentation surrounding the caseworker?s verification of the recipient?s utility bill or wood/coal receipt. Questioned Costs: $1,736 ? CFDA #93.568 Grant Award G-1901WVLIEA $80 ? CFDA #93.568 Grant Award G-18B1WVLEA Context: The six instances (six of 72 case files) represent $1,816 of benefit payments out of total benefit payments $19,379. Total payments for benefit assistance for the LIHEAP program for the fiscal year ended June 30, 2019 were $19,414,839. The federal expenditures for the LIHEAP program for the fiscal year ended June 30, 2019, were $30,965,802. Cause: Management indicated that the errors were due to caseworker oversight. Effect: A payment may have been made for ineligible recipients and some payments were not properly approved and/or supported with appropriate documentation. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that DHHR evaluate the effectiveness of the current training programs for the LIHEAP program to ensure adequate technical training is provided. Furthermore, DHHR should follow established policies and procedures to ensure that necessary approvals are obtained, and the necessary documentation is maintained in the recipient case files. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-028 ELIGIBILITY Department of Health and Human Resources (DHHR) CFDA Number 93.568 The DHHR Bureau for Children and Families will conduct a random sampling of LIHEAP applications and documentation checklists (described below) during heating season. The LIEAP Coordinator will randomly sample cases from the Pending/Approved/ Denied Report WRRP295A. Samples will be pulled from each of the categories on the report and any errors will be directed to local office supervisors and Community Service Managers. Prior to the start of the LIHEAP season, the BCF will update the wording on the LIHEAP application to match the policy manual. To reinforce the processing and documentation requirements, the BCF will send a desk guide and Blackboard Course to field staff prior to peak season for LIHEAP applications and will send a checklist to field staff to ensure the documentation is present in the file. The checklist for LIHEAP will be tailored to the requirements of the LIHEAP Program and will be scanned into the OnBase information platform.

2018-021

2019?030 SPECIAL TESTS AND PROVISIONS ? FRAUD DETECTION AND REPAYMENT INTERNAL CONTROLS (Repeat of Prior Year Findings 2018?022, 2017?014, 2016?021) Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Health and Human Services Child Care and Development Fund (CCDF) Cluster 93.575/93.596 Grant Award G1701WVCCDF Grant Award G1801WVCCDF Criteria: 2 CFR 200.303 states that the non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Child Care payments resulting from fraud are identified and documented within quarterly reconciliation spreadsheets, however documentation of review of the listing of cases referred for investigation, including the status, and the quarterly reconciliations was not provided. Questioned Costs: N/A Context: Total federal expenditures for the CCDF Cluster for fiscal year ended June 30, 2019, were $52,050,056. Cause: The DHHR Bureau for Children and Families and the Office of Inspector General have not coordinated their efforts surrounding the fraud detection and repayment process within the DHHR. Effect: Payments resulting from fraud may not be identified, and the proper procedures to establish repayment or recovery may not occur in a reasonable amount of time. Recommendation: DHHR should ensure its internal controls and policies and procedures are robust enough to ensure fraudulent claims are identified and tracked through the reconciliation process beginning in the year of identification and continuing through the establishment and enforcement of repayment agreements. Additionally, status monitoring of cases referred for investigation should be documented, and follow-up completed timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-030 SPECIAL TESTS AND PROVISIONS ? FRAUD DETECTION AND REPAYMENT INTERNAL CONTROLS Department of Health and Human Resources (DHHR) CFDA Number 93.575, 93.596 To resolve this finding, in September 2018, DHHR implemented a new tracking tool developed by the Bureau for Children and Families (BCF), along with the update to Section 2.3 (Operational and Administrative Requirements) of the Policy and Procedure Manual for Child Care Resource and Referral Services. The purpose of the BCF?s tracking tool is to ensure, among other things, that all fraudulent claims are identified in the appropriate fiscal year and that all fraudulent payments identified in a fiscal year are included within the population provided to the State?s independent auditors, irrespective of whether any repayments have been received and added to the expenses claimed for the fiscal year. Furthermore, the tracking tool utilized by the BCF relates to all improper payments regardless of whether the payment is deemed fraudulent or not. Since the finding repeated for the year ended June 30, 2019, the DHHR Office of Internal Control and Policy Development (OICPD) will reach out to the DHHR Office of Inspector General (OIG) in an effort to learn more about the OIG?s process for identifying and recovering payments resulting from fraud. If the OIG?s system and procedures are more authoritative and thorough than the tracking tool and procedures in place at the BCF, the OICPD will work with the OIG to document BCF?s internal controls and compliance with this special test and provision during fieldwork for the West Virginia Single Audit for the year ended June 30, 2020.

2018-022

2019?031 ELIGIBILITY DOCUMENTATION (Repeat of Prior Year Findings 2018?023, 2017?015, 2016?022, 2015?029, 2014?024, 2013?040, 2012?59) Federal Program Information: Federal Agency and Program Name CFDA # U.S. Department of Health and Human Services Adoption Assistance 93.659 Grant Awards 1801WVADPT Grant Awards 1901WVADPT Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section 473 of the Social Security Act requires that the Adoption Assistance Agreement must be in effect prior to the adoptive parents? receipt of the Adoption Subsidy. Also, 45 CFR 1356.40 requires the Adoption Assistance Agreement must be signed and in effect at the time of or prior to the final decree of adoption, and a copy of the signed agreement must be given to each party. Further, the eligibility compliance requirements of the Adoption Assistance program require the West Virginia Department of Health and Human Resources (DHHR) to determine whether federal monies are spent in accordance with the eligibility guidelines promulgated by the Adoption Assistance and Child Welfare Act of 1980. West Virginia State Code ? 49-3-1 states that consent by an agency or department to adopt a child must be given and a statement of relinquishment and termination of parental rights must be obtained from the birth parents. The Adoption Assistance Policy Manual states that an Adoption Placement Agreement (SSADP48) must be completed and signatures obtained as part of the preliminary adoption procedures after the parental rights have been terminated if the child is not registered on the Adoption Resource Network (ARN). Condition: Four of the 60 cases reviewed for eligibility did not have documents on file to determine eligibility: ? For one case, the Adoption Agreement was not signed or dated by the Regional Director/Designee. The total payment amount associated with this case was $600, charged to Grant Award 1901WVADPT. ? Two cases were missing the signature and date of the respective DHHR worker on the Adoption Placement Agreement. The total payment amount associated with these cases was $1,497, with $600 charged to Grant Award 1901WVADPT and $897 charged to Grant Award 1801WVADPT. ? One case was missing the Release and Consent Form. The total payment amount associated with this case was $535, charged to Grant Award 1901WVADPT. Questioned Costs: $2,632 ? CFDA #93.659; $1,735 related to Grant Award 1901WVADPT and $897 related to Grant Award 1801WVADPT Context: The four instances represent $2,632 of adoption payments out of a total population of benefit payments tested for eligibility of $37,894. Total federal expenditures for the Adoption Assistance program were $45,344,175 for the year ended June 30, 2019. Cause: Management indicated that the lack of inclusion of the proper forms in the case files and lack of sign-offs were oversights by the caseworker. Effect: Documentation supporting the original eligibility determination could not be located. Potentially ineligible claims were paid using federal funds. Recommendation: We recommend that DHHR review the current staffing and training programs of the Adoption Assistance Office to ensure sufficient staff levels are maintained and adequate technical training is provided. Furthermore, the DHHR should establish policies and procedures to ensure that necessary documentation is filed in the adoption case files. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-031 ELIGIBILITY DOCUMENTATION Department of Health and Human Resources (DHHR) CFDA Number 93.659 Children and Adult Services Adoption Assistance Program Specialists and Adoption Policy Specialists will work on an updated Standard Operating Procedure to be distributed to the field no later than March 30, 2020. The updated procedure will highlight each required document, the reason for the document, and the steps needed in order to correctly complete the document. Prior to March 1, 2020, the Adoption Policy Specialist will update Section 11.1.1 - Placement Day of the Adoption Policy to reflect the need of a signature and date on the Adoption Placement Agreement. The phrase ?completed and signed? will be changed to ?signed and dated.? The Adoption Assistance Program Specialist and/or the Adoption Policy Specialist will continue to attend ?new worker trainings? as they occur. These trainings will cover pre-adoption services as well as post-adoption services and will be a mandatory training for all DHHR workers as well as Specialized Agency workers. During these trainings, these Specialists will go over the forms required in order to have a complete adoption packet and answer any questions these new workers may have. For DHHR workers, the trainings are conducted by the DHHR Bureau for Children and Families, Division of Training. For Specialized Agency Workers, the trainings are conducted by the Specialized Agencies. Trainings occur as needed but occur at least twice a year. The Adoption Assistance Program Specialist will continue to work with the Office Assistants who archive files to ensure that new files are complete, scanned into the FACTS file cabinet, and archived properly. This will occur immediately with ongoing training as needed. The Adoption Assistance Program Specialist will continue to discuss the findings of these audits as well as the importance of proper documentation at each quarterly Adoption Management Oversite Meeting. It is expected that the attendees of this meeting will pass this information on to their employees at the county/regional level. The new Statewide Automated Child Welfare Information System (SACWIS), PATH, is currently being developed. The Adoption Assistance Program Specialist has been part of the team responsible for ensuring that PATH meets required benchmarks and documentation. During these meetings, the Adoption Assistance Program Specialist discussed the importance of adoption documents being complete and accurate prior to submitting to the Post-Adoption Unit. PATH is currently being built to require workers to complete, scan, and upload these documents prior to submission to the Post-Adoption Unit. After submission, if the documents are not complete and accurate, the case will be returned to the regional worker for correction and/or explanation. Currently, it is estimated that PATH will ?go live? in the fall of 2021. Adoption Assistance Program Specialist will continue to work with Policy Program Manager and Social Services Director to continue developing and making changes to the current Timely Adoption SOP as needed. While the DHHR continues to receive audit findings for missing documentation, we are confident that the trainings, policy changes, and memorandums to the field are ensuring that adoption documents are processed correctly. It should be noted that the continuing audit errors are from cases prior to these implementations.

2018-023

2019?032 SPECIAL TESTS AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY INTERNAL CONTROLS Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ 93.778 & ARRA 93.778 Grant Award 1805WV5MAP Grant Award 1805WV5ADM Grant Award 1805WVINCT Grant Award 1805WVIMPL Grant Award 1905WVINCT Grant Award 1905WV5MAP Grant Award 1905WV5ADM Grant Award 1905WVIMPL Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of internal controls over the special testes and provisions ? utilization control and program integrity, specifically the cases closed within the Office of Program Integrity (OPI), no documentation existed of the review of the required elements of a closed case being maintained in the case file for the seven of the seven cases selected for testing. Questioned Costs: N/A Context: The federal expenditures for the Medicaid Cluster for the fiscal year ended June 30, 2019, were $3,263,461,305. The total population subject to testing was 65. Cause: Management indicated that the documentation of management?s review of all closed cases was not part of OPI?s policies and procedures. Effect: Cases may be closed without verification by management that all required elements of closed cases are present. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that DHHR establish policies and procedures to ensure that case files are reviewed upon closure by a member of management separate from the caseworker and that the review is documented. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-032 SPECIAL TESTS AND PROVISIONS ? UTILIZATION CONTROL AND PROGRAM INTEGRITY INTERNAL CONTROLS Department of Health and Human Resources (DHHR) CFDA Number 93.775, 93.777, 93.778, ARRA The Bureau for Medical Services, Office of Program Integrity (OPI), will implement policies and procedures to ensure that case files are reviewed upon closure by a member of management separate from the caseworker and that the review is documented. The policy and review of case closures by management, with documentation, are being implemented as of January 1, 2020. In addition, during the first quarter of 2020, management will retro-review case closures that occurred between July 1, 2019 and December 31, 2019 and document the review.

2019?033 SPECIAL TESTS AND PROVISIONS ? MEDICAID FRAUD CONTROL UNIT INTERNAL CONTROLS Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Health and Human Services Medicaid Cluster 93.775/93.777/ 93.778 & ARRA 93.778 Grant Award 1805WV5MAP Grant Award 1805WV5ADM Grant Award 1805WVINCT Grant Award 1805WVIMPL Grant Award 1905WVINCT Grant Award 1905WV5MAP Grant Award 1905WV5ADM Grant Award 1905WVIMPL Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our internal control testing of cases referred from the Office of Program Integrity (OPI) to the Medicaid Fraud Control Unit, the Medicaid Fraud Referral Form was not complete for the five of the five cases selected. The final section of the form noting acceptance of the referral and review was incomplete for the five selected cases and documentation from the Just Ware system of acceptance of the case by the Medicaid Fraud Control Unit was not maintained in the case file. Questioned Costs: N/A Context: The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2019, were $3,263,461,305. The total population subject to testing was 14. Cause: Management indicated that the documentation of the completed form was not part of OPI?s policies and procedures. Effect: OPI will not have clear direction on whether or not to suspend Medicaid payments to a provider and the status of the case with the Medicaid Fraud Control Unit. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that DHHR create a policy and procedure to ensure that completed Medicaid Fraud Referral Forms are maintained in the OPI files. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-033 SPECIAL TESTS AND PROVISIONS ? MEDICAID FRAUD CONTROL UNIT INTERNAL CONTROLS Department of Health and Human Resources (DHHR) CFDA Number 93.775, 93.777, 93.778, ARRA For acceptance of cases, the process of being informed by the Medicaid Fraud Control Unit (MFCU) changed in 2013, from completion of the last section (page 4) of the Medicaid Fraud Referral Form to automated email notifications from the MFCU?s Justware system. The Justware email includes Medicaid case identification, the date the MFCU accepted the case, the MFCU case number, the decision regarding law enforcement exception, and the federal reporting code. Justware emails are attached to the i-Sight case when received by the DHHR Bureau for Medical Services (BMS), OPI. For one of the five cases selected by the state?s independent auditors for review (FAM-19-05-00013-003), the Justware email, dated 5/29/19, was attached to the i-Sight case on 5/30/19 (screenshot available upon request). For two of the referred cases selected by the auditors for review, there is a note and date accepted by the MFCU (FAM-19-02-00005, 2/19/19 and PRV-19-03-0002, 9/25/18) in the Medicaid Fraud Referral log (de-identified excerpt available upon request). An OPI fraud referral spreadsheet has been maintained since at least 1997 and currently includes a ?Current Status? text field for information regarding receipt of Justware emails denoting case exception, closure, etc. For the fourth case selected by the auditors, the MFCU declined it during a MFCU/OPI monthly meeting and a note was entered on 07/08/19 into the i-Sight case by the OPI reviewer (documentation available upon request). The fifth case selected by the auditors does not have a note in the Fraud Referral log nor a Justware email in the i-Sight case, despite a 12/13/19 email from the MFCU Director indicating that the case has been accepted. Effective January 2020, the OPI will remove page 4, the last section of the Medicaid Fraud Referral form, and use the Justware email as notification of acceptance of a referred case by the MFCU. The Justware email will be attached to the i-Sight case upon receipt. For a referred case that is declined by the MFCU, no Justware email is generated, thus the OPI reviewer will note this decision in the i-Sight case and discuss any further action with the OPI Program Manager. For a referred case that is integrated into an existing MFCU case, no Justware email is generated, thus the OPI reviewer will note the case integration in the i-Sight case. Beginning January 28, 2020, the current status of referred cases not yet accepted will become a specific topic on the OPI/MFCU monthly meeting agenda with a list of the cases to be reviewed. Effective February 1, 2020, the OPI procedures will be revised, to submit Medicaid referrals to MFCU via email with delivery receipt requested, or via hand delivery of data on CD with signature receipt requested. Beginning in February 2020, the OPI will request an update from the MFCU every 30 days on referred cases not yet accepted. Furthermore, prior to April 1, 2020, the OPI will revise the Fraud Referral log to designate specific columns for some of the information currently noted in the ?Current Status? text field, to include but not be limited to specific date of a declined case, date of receipt of Justware email, whether a law enforcement exception was invoked by MFCU, and the date of the law enforcement exception. The OPI policy in Chapter 800B of the Medicaid Policy Manual will be updated to support these changes. Draft changes are already underway. The revised policy will be submitted to the BMS Policy Committee at the next earliest opportunity in 2020. Lastly, during 2020, the BMS will revisit the current Memorandum of Understanding with the MFCU to identify additional opportunities to improve internal controls.

2019?034 ELIGIBILITY Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Health and Human Services Children?s Health Insurance Program (CHIP) 93.767 Grant Award 1805WV5021 Grant Award 1905WV5021 Medicaid Cluster 93.775/93.777/ 93.778 & ARRA 93.778 Grant Award 1805WV5MAP Grant Award 1805WV5ADM Grant Award 1805WVINCT Grant Award 1805WVIMPL Grant Award 1905WVINCT Grant Award 1905WV5MAP Grant Award 1905WV5ADM Grant Award 1905WVIMPL Criteria: 42 CFR 435.914 states ?(a) The agency must include in each applicant's case record facts to support the agency's decision on his application. (b) The agency must dispose of each application by a finding of eligibility or ineligibility, unless?(1) There is an entry in the case record that the applicant voluntarily withdrew the application, and that the agency sent a notice confirming his decision; (2) There is a supporting entry in the case record that the applicant has died; or (3) There is a supporting entry in the case record that the applicant cannot be located.? 42 CFR 457.965 states ?The State must include in each applicant's record facts to support the State's determination of the applicant's eligibility for CHIP.? 42 CFR 435.945(j) and 457.380(j) require states to develop and submit to the Centers for Medicaid and Medicare Services (upon request) a plan describing the Medicaid and CHIP eligibility verification policies and procedures adopted by the State. The State of West Virginia Modified Adjusted Gross Income (MAGI)-Based Eligibility Verification Plan for Medicaid & CHIP requires the following eligibility factors to be verified: income, residency, age, social security number, citizenship, immigration status, household composition, pregnancy, caretaker relative, Medicare, application for other benefits, and other insurance coverage. These are either required to be verified through electronic data sources or through self-attestation without additional verification or self-attestation with post -eligibility verification. Electronic data sources include: the Internal Revenue Service, Social Security Administration, State Wage Information Collection Agency, State Unemployment Compensation, State Administered Supplementary Payment Program, State General Assistance Programs, Supplemental Nutrition Assistance Program, Temporary Assistance for Needy Family, Bureau for Child Support Enforcement, State Income Tax, TALX, Work Force West Virginia and Families and Children Tracking System Income. State verification plans does not provide specific details. The most recently submitted plan for the State is posted on Medicaid.gov. Condition: The 2019 Compliance Supplement states that ?the auditors should re-determine eligibility to ensure beneficiaries qualify for the Medicaid program and are in the appropriate enrollment category.? During our testing of 60 cases for eligibility for the Medicaid program, we noted seven instances where no documentation of the verification of assets was maintained in the file; and two instances where no documentation of disability was maintained in the file. During our testing of 60 cases for eligibility for CHIP, we noted 13 instances where documentation of income verification to the electronic data source required by the state?s MAGI-based CHIP eligibility verification plan was not maintained in the file. We also noted one instance where the social security number, age, date of birth, and immigration status were not verified in the Data Exchange system as required by the state?s MAGI-based CHIP eligibility verification plan; one instance where the age, date of birth, social security number, and citizenship were verified after benefits were paid; and one instance where income was not verified. Questioned Costs: $12,566 ? CFDA #93.778 Grant Award 1905WV5MAP $3,782 ? CFDA #93.767 Grant Award 1905WV5021 Context: The eight cases in Medicaid represent $12,566 of Medicaid payments out of a population of benefit payments tested for eligibility of $26,115. The 15 cases in CHIP represent $3,782 of CHIP payments out of a population of benefit payments tested for eligibility of $11,126. The federal expenditures for the Medicaid program for the fiscal year ended June 30, 2019, were $3,263,461,305. The federal expenditures for the Children?s Health Insurance Program for the fiscal year ended June 30, 2019, were $74,715,584. Cause: Management indicated that the information was verified in accordance with the Medicaid and CHIP verification plan or the State plan, but no documentation was kept in the file of the verification. Effect: A payment may have been made for ineligible recipients. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that DHHR evaluate the policies and procedures and add a requirement to maintain documentation of the verification of information with the federal data hub. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-034 ELIGIBILITY Department of Health and Human Resources (DHHR) CFDA 93.775, 93.777, 93.778, ARRA, 93.767 For the information system, the DHHR Bureau for Medical Services (BMS) requested an enhancement to the eligibility system to retain historical information obtained from the Federal Data Services Hub. From the policy perspective, the West Virginia Income Maintenance Manual requires eligibility workers within the DHHR Bureau for Children and Families (BCF) to obtain all pertinent and necessary information through verification, when appropriate, and maintain a case record of all information used to determine eligibility for benefits, including such documentation related to Medicaid and the Children?s Health Insurance Program. Until such time as the hub information is retained in the eligibility system, the BMS will develop a new policy/procedure requiring the eligibility worker to print a system screenshot of the hub verification and scan it into the OnBase information platform. The BMS will distribute the new policy to the BCF by February 29, 2020. In January 2015, the BMS, Medicaid Eligibility Policy Unit, issued income verification field guidance to BCF Management for distribution to all eligibility workers. The field guidance will be revisited and issued again by February 7, 2020. From the training perspective, by February 7, 2020, the BMS will submit a request to the BCF Division of Training to develop a training course for caseworkers regarding the verification procedures, use of the Federal Data Services Hub, and documentation requirements related thereto. From the legal perspective, in December 2019, the DHHR Office of Internal Control and Policy Development attempted to verify from several sources as to whether the information that the DHHR obtains from the Federal Data Services Hub is considered federal tax information by Internal Revenue Service standards and whether the DHHR can share such information with the independent auditors. The Office of Internal Control and Policy Development will continue with those efforts in February 2020.

2019?035 MATCHING, LEVEL OF EFFORT, EARMARKING Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Health and Human Services State Targeted Response to the Opioid Crisis 93.788 Grant Award 6H79TI080256-02M001 Grant Award 6H79TI080256-02M002 Grant Award 3H79TI081724-01W1 Grant Award 1H79TI08256-01 Grant Award 1H79TI081724-01 Grant Award 3H79TI080256-01S1 Grant Award 5H79TI080256-02 Criteria: 2 CFR 200.303 requires that the non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.508(d) says an auditee must ?provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part.? Condition: During our testing of the State Targeted Response to the Opioid Crisis Program, the West Virginia Department of Health and Human Resources was unable to provide timely supporting documentation. Missing documentation includes: ? Internal calculations demonstrating compliance with earmarking requirements. ? Populations of earmarking transactions. Questioned Costs: $473,317 CFDA #93.788 Context: The federal expenditures for the State Targeted Response to the Opioid Crisis program for the fiscal year ended June 30, 2019, were $6,091,464. Cause: Support was not provided timely in order to test the compliance requirement. Effect: The auditor was unable to determine if the program was in compliance with earmarking requirements. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that DHHR establish policies and procedures requiring proper documentation and maintenance of supporting information. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-035 MATCHING, LEVEL OF EFFORT, EARMARKING Department of Health and Human Resources (DHHR) CFDA 93.788 Although the DHHR did not provide the independent auditors with timely documentation surrounding earmarking, the DHHR does indeed comply with the 5% cap for administrative costs and can document that fact. The DHHR isolates administrative costs for the State Targeted Response to the Opioid Crisis (STR) grant by unit (i.e., cost center). A budget is also established that prevents spending more than 5% of the award for administrative costs. The administrative units for the STR Grant and the State Opioid Response (SOR) grant are 2849, 2899, and 2837. Limiting the budget for those units to no more than 5% of the award ensures that administrative costs do not exceed 5% of the award.

2019?037 SPECIAL TESTS AND PROVISIONS ? KEY PERSONNEL Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Health and Human Services State Targeted Response to the Opioid Crisis 93.788 Grant Award 6H79TI080256-02M001 Grant Award 6H79TI080256-02M002 Grant Award 3H79TI081724-01W1 Grant Award 1H79TI08256-01 Grant Award 1H79TI081724-01 Grant Award 3H79TI080256-01S1 Grant Award 5H79TI080256-02 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.508(d) says an auditee must ?provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part.? Condition: During our testing of the key personnel requirement, which requires prior approval for any changes in key staff including level of effort involving separation from the project for more than three months or a 25 percent reduction in time dedicated to the project, we noted that there was no internal control policies and procedures in place to ensure that management was in compliance with the key personnel requirement in the grant agreement. Additionally, information was not provided timely to the auditor to test compliance with the key personnel requirement. Questioned Costs: Unknown Context: The federal expenditures for the State Targeted Response to the Opioid Crisis program for the fiscal year ended June 30, 2019, were $6,091,464. Cause: Management has not established internal control policies and procedures around the key personnel requirement in the grant agreement. Effect: Changes in key personnel or changes in level of effort may not be appropriately reported to the grantor, and we were unable to determine if the Department of Health and Human Services (DHHR) was in compliance with the requirements. Recommendation: Management should develop an effective corrective action plan to address this matter in a timely manner. We recommend that DHHR establish policies and procedures around internal control of changes in key personnel or level of effort. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-037 SPECIAL TESTS AND PROVISIONS ? KEY PERSONNEL Department of Health and Human Resources (DHHR) CFDA 93.788 The DHHR will implement a process whereby the DHHR spending unit must provide a certification to the DHHR Office of Grants Management on a quarterly basis indicating the project director/key personnel for the grant. This will allow the Office of Grants Management to review and determine if any changes need to be submitted to the awarding agency based on the Notice of Award.

2019?042 EARMARKING (Repeat of Prior Year Finding 2018?039) Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Homeland Security Emergency Management Performance Grants 97.042 Grant Award EMW-2015-EP-00050 Grant Award EMP-2016-EP-00002 Grant Award EMP-2017-EP-00005 Grant Award EMP-2018-EP-00003 Grant Award EMP-2019-EP-00001 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? OMB Circular A-133 section 300b states that the non-federal entity is responsible for maintaining ?internal control over Federal programs that provides reasonable assurance that management is managing Federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs.? The U.S. Department of Homeland Security?s Notice of Funding Opportunity for the Emergency Management Performance Grant (EMPG) allows that a State Emergency Management Agency ?may use up to five percent (5%) of the EMPG award for M&A purposes.? Management and Administration (M&A) activities are those directly related to managing and administering the EMPG award. Condition: The West Virginia Division of Homeland Security and Emergency Management (DHSEM) charged M&A expenditures to EMPG grants, but DHSEM management did not track these expenditures to ensure compliance with applicable earmarking requirements noted in the award. Questioned Costs: Unknown Context: Total federal expenditures for the Emergency Management Performance Grant program were $4,867,344 for the year ended June 30, 2019. Cause: DHSEM does not have adequate internal controls and policies and procedures in place over the earmarking process. Effect: DHSEM may not be in compliance with the federal rules and regulations regarding earmarking. M&A expenditures could exceed maximum allowable thresholds. Recommendation: We recommend that DHSEM implement internal controls and policies and procedures regarding earmarking and M&A tracking process. At a minimum, DHSEM should implement a tracking system with a documented review and approval process that ensures M&A expenditure amounts do not exceed maximum allowable thresholds. We recommend that the review be performed by an individual independent of the data entry process and evidence of such review be maintained. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-042 EARMARKING Division of Homeland Security and Emergency Management (DHSEM) CFDA Number 97.042 Effective January 2020, DHSEM developed a method of tracking management and administrative expenses for Emergency Management Performance Grant (EMPG) grants, to ensure they don?t exceed 5% of the grant award, as set by the Notice of Funding Opportunity (NOFO). DHSEM will review both the work plan and budget for EMPG and identify personnel and other expenditures directly attributable to management costs. The noted EMPG accountant will detail these costs and correlate them to the budget during each fiscal year. These calculations will be reviewed and approved by a supervisor.

2018-039

2019?043 PERIOD OF PERFORMANCE MISSING POPULATION Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Homeland Security Emergency Management Performance Grant 97.042 Grant Award EMW-2015-EP-00050 Grant Award EMP-2016-EP-00002 Grant Award EMP-2017-EP-00005 Grant Award EMP-2018-EP-00003 Grant Award EMP-2019-EP-00001 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? 2 CFR 200.508(d) says an auditee must ?provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part.? Condition: DHSEM was not able to provide a listing of transactions in the latter part of the period of performance for grants whose period of performance ended during the audit period testing. Questioned Costs: Unknown Context: Total federal expenditures for the Emergency Management Performance Grant program were $4,867,344 for the year ended June 30, 2019. Cause: DHSEM was not able to provide a timely population for period of performance to the auditors. Effect: Critical data supporting the period of performance compliance requirement is not adequately maintained by DHSEM for use by management to effectively run the program. Recommendation: We recommend that DHSEM ensure that all populations for compliance requirements subject to audit be maintained and readily available if requested. Timely receipt of accurate populations is crucial for the completion of the audit. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-043 PERIOD OF PERFORMANCE MISSING POPULATION Division of Homeland Security and Emergency Management (DHSEM) CFDA Number 97.042 DHSEM is working to establish Period of Performance codes (PPC) within wvOASIS in order to track all transactions by grant year for the EMPG grants. During fiscal year 2020, all PPC codes will be entered for the current year?s existing transactions. Effective January 2020, a written policy was implemented requiring all transactions associated with EMPG grants that are entered into wvOASIS, the State?s accounting system, have all required accounting codes entered on the document. At the time of request to make a purchase, the full accounting code must be entered on the requested document, and the appropriate program manager must initial to show approval for the purchase to be made. This will also include State of WV Purchasing card (P-Card) transactions.

2019?046 SPECIAL TESTS AND PROVISIONS - TRAINING AND EXERCISE PLAN REQUIREMENTS (Repeat of Prior Year Finding 2018?044) Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Homeland Security Emergency Management Performance Grant 97.042 Grant Award EMW-2015-EP-00050 Grant Award EMP-2016-EP-00002 Grant Award EMP-2017-EP-00005 Grant Award EMP-2018-EP-00003 Grant Award EMP-2019-EP-00001 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? OMB Circular A-133 section 300b states that the non-federal entity is responsible for maintaining ?internal control over Federal programs that provides reasonable assurance that management is managing Federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs.? The U.S. Department of Homeland Security?s Notice of Funding Opportunity for the Emergency Management Performance Grant (EMPG) requires that recipients ?develop a multi-year Training and Exercise Plan (TEP) that identifies a combination of exercises and associated training requirements identified in the Training and Exercise Plan Workshop (TEWP). The recipient must ?conduct no less than four quarterly exercises of any type and one full-scale exercise within a 12-month period.? The recipient must submit an After Action Report/Improvement Plan (AAR/IP) to report on the required exercises to the Regional EMPG Program Manager no later than 90 days after completion of the exercise or submit all exercises at the end of the 12-month period. The U.S. Department of Homeland Security?s Notice of Funding Opportunity for the Emergency Management Performance Grant (EMPG) also states that ?all EMPG Program funded personnel shall complete the following training requirements and record proof of completion: NIMS Training, Independent Study (IS) 100, IS 200, IS 700, and IS 800. In addition, personnel shall complete either the Independent Study courses identified in the Professional Development Series or the National Emergency Management Basic Academy delivered either by the Emergency Management Institute (EMI) or at a sponsored State, local, tribal, territorial, regional or other, designated location.? Furthermore, ?all EMPG-funded personnel shall participate in no fewer than three exercises in a 12-month period.? Condition: Although the required exercises were completed and are tracked by the State Exercise Coordinator, there is no documentation of the review of the AAR/IP reports submitted to the Regional EMPG Program Manager. Additionally, the AAR/IP reports were not submitted to the Regional EMPG Program Manager For four of the eight employees selected for testing, DHSEM was not able to provide documentation that the employees met the required training and exercise requirements noted above. Questioned Costs: N/A Context: Total federal expenditures for the Emergency Management Performance Grant program were $4,867,344 for the year ended June 30, 2019. Cause: DHSEM does not have adequate internal controls and policies and procedures in place over the Training and Exercise Plan requirements. The West Virginia Division of Homeland Security and Emergency Management (DHSEM) does not have internal controls and policies and procedures in place to ensure that all EMPG-funded personnel complete the required training or participate in at least three exercises in a 12-month period. Effect: DHSEM is not in compliance with the federal rules and regulations regarding the Training and Exercise Plan requirements. The required AAR/IP reports documenting the exercises are not reviewed and submitted timely. EMPG-funded personnel may not be participating in the required number of exercises or receiving adequate training since sufficient policies and procedures are not in place to track the training received by each employee. Recommendation: We recommend that DHSEM implement internal controls and policies and procedures regarding the Training and Exercise Plan requirements, including implementing policies and procedures over the submission of the AAR/IP reports and over employee training and exercise participation. At a minimum, DHSEM should document review and approval of the AAR/IP reports to ensure they are in compliance with the requirements of the grant award and submitted timely. DHSEM should also implement a tracking system with a documented review and approval process that ensures all EMPG-funded personnel complete the required training and participate in the required number of exercises. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-046 SPECIAL TESTS AND PROVISIONS ? TRAINING AND EXERCISE PLAN REQUIREMENTS Division of Homeland Security and Emergency Management (DHSEM) CFDA Number 97.042 DHSEM has identified and required all staff whose payroll is directly funded by EMPG or could be charged to EMPG funding to complete FEMA?s Emergency Management Institute?s Professional Development Series by December 2019, to ensure compliance with EMPG training requirements. Further, DHSEM will establish policies and procedures to ensure all EMPG-funded personnel complete training and exercise minimum requirements established by the relevant Notice of Funding Opportunities (NOFOs) for all open grants. DHSEM has also developed a spreadsheet to track all applicable DHSEM personnel and each of the courses for the required core training currently identified in the NOFO. Once an employee completes each of the online training courses required by the NOFO, they receive a certificate from FEMA. The Program Coordinator records when the required course is complete. Exercises will also be tracked on this spreadsheet. Once the State Exercise Officer announces a required exercise, the Coordinator will add it to the spreadsheet to track in the same manner as the training. Attendance records will be kept at the exercise and provided to the Coordinator for recording. The Coordinator will follow up on noncompliance and will report quarterly the status of employee training and exercises based on the tracker to DHSEMs? Deputy Director. Effective July 2019, management implemented a Reporting Best Practices policy which states that all DHSEM reports, whether programmatic or financial in nature, must be signed and dated by the preparer and by a separate reviewer/approver. If the report is submitted in an electronic format or otherwise does not provide for such signatures, a printed copy of the report or a screen shot will be made, signed, and a copy retained as evidence of the review procedure.

2018-044

2019?047 SPECIAL TESTS AND PROVISIONS - CLOSEOUT REPORTING REQUIREMENTS (Repeat of Prior Year Finding 2018?043) Federal Program Information: Federal Agency and Program Name CFDA# U.S. Department of Homeland Security Emergency Management Performance Grant 97.042 Grant Award EMW-2015-EP-00050 Grant Award EMP-2016-EP-00002 Grant Award EMP-2017-EP-00005 Grant Award EMP-2018-EP-00003 Grant Award EMP-2019-EP-00001 Criteria: 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).? OMB Circular A-133 section 300b states that the non-federal entity is responsible for maintaining ?internal control over Federal programs that provides reasonable assurance that management is managing Federal awards in compliance with laws, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its Federal programs.? 44 CFR 13.50(b) states that ?within 90 days after the expiration or termination of the grant, the grantee must submit all financial, performance, and other reports required as a condition of the grant.? 2 CFR 200.343(a) states that ?the non-Federal entity must submit, no later than 90 calendar days after the end date of the period of performance, all financial, performance, and other reports as required by the terms and conditions of the Federal award. The Federal awarding agency or pass-through entity may approve extensions when requested by the non-Federal entity.? The U.S. Department of Homeland Security?s Notice of Funding Opportunity for the Emergency Management Performance Grant (EMPG) requires that grantees must submit a final closeout reporting package once a grant is closed. Condition: The West Virginia Division of Homeland Security and Emergency Management (DHSEM) did not submit the required closeout reporting package within 90 days of the expiration of the grant award. Further, the required qualitative narrative summary was not submitted. Questioned Costs: N/A Context: Total federal expenditures for the Emergency Management Performance Grant program were $4,867,344 for the year ended June 30, 2019. Cause: DHSEM does not have adequate internal controls and policies and procedures in place over the closeout reporting process. Effect: DHSEM is not in compliance with the federal rules and regulations regarding the closeout reporting requirements. The grant may not be properly closed out resulting in FEMA having to administratively close the award; if this action is taken, consideration for subsequent awards to DHSEM may be impacted or restricted. Recommendation: We recommend that DHSEM review its internal controls and policies and procedures in place over the close out reporting process. At a minimum, controls should be in place to ensure that all required reports are submitted within the 90 days of the expiration or termination of the grant award. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.

2019-047 SPECIAL TESTS AND PROVISIONS ? CLOSEOUT REPORTING REQUIREMENTS Division of Homeland Security and Emergency Management (DHSEM) CFDA Number 97.042 During fiscal year 2020, DHSEM will establish a method of tracking the period of performance for these reports to ensure timely submission. All grants will be reviewed at least quarterly to track the status and ensure that are reports are submitted within the 90 days of expiration or termination of the grant award. This review will be performed by someone independent from the staff responsible for generating the reports.

2018-043

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2017-006

GSA_MIGRATION

GSA_MIGRATION

2017-007

GSA_MIGRATION

GSA_MIGRATION

2017-008

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2017-010

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2017-014

GSA_MIGRATION

GSA_MIGRATION

2017-015

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

2016-010

GSA_MIGRATION

GSA_MIGRATION

2016-008, 2015-015, 2014-011, 2013-028, 2012-043, 2012-047, 2012-049, 2011-022

GSA_MIGRATION

GSA_MIGRATION

2016-006