Virginia Health Workforce Development Authority Internal Control Questionnaire Review Results as of January 2023.  The Authority is working on corrective action for the following areas from the prior review. The Authority should perform a risk assessment to analyze potential events that would keep the Authority from achieving its objectives.  The Authority should track federal funds separately from other sources of funding.  The Authority should implement an appropriate information security framework and develop information security policies and procedures to govern its information security program.  The Authority should document its review and evaluation of its third-party service provider audit report.  Finally, the Authority should draft and implement formalized policies and procedures over all key business areas.  In addition, we identified one new area during this review: the Authority should complete and review monthly progress reports for Area Health Education Centers.