Corrective Action Plans

The City has will develop written procedures for determining the allowability of costs in accordance with 2 CFR 200, Subpart E—Cost Principles and the terms and conditions of the Federal award.

Significant deficiency in internal control over compliance and compliance as it relates to allowable costs and activities. Federal Agency: All awards within the Research and Development Cluster Program Title: All awards within the Research and Development Cluster Assistance Listing Number: All awards within the Research and Development Cluster Award Number: All awards within the Research and Development Cluster Award Period: All awards within the Research and Development Cluster Criteria 2 U.S. Code of Federal Regulations (CFR) 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards Section 200.303 requires that each recipient of federal awards “Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition/Context for Evaluation During our audit, we tested nonpayroll costs charged to the federal awards for adherence to necessary compliance requirements and internal control over compliance requirements. Out of 25 sample selections, we noted the following related to seven sample items: - Five of seven sample items selected involved overcharges to the grants. All five showed management approval for the incorrect amounts. - One of seven sample items selected had no supporting documentation. - One of seven sample items had no management approval. Questioned Costs $1,790 Effect or Potential Effect AAHI may have charged unallowable or incorrect costs to the federal awards. Repeat Finding No. Recommendation We recommend AAHI implement the necessary internal controls to (1) ensure documentation is retained to support costs spent on federal awards and (2) ensure all costs are properly approved and for the correct amounts. Views of Responsible Officials of Auditee Management concurs with the finding and has provided the accompanying corrective action plan.

Finding 2024-002 Information on the federal program: Federal Agency: Federal Transportation Administration Pass-Through Entity: N/A Federal Program: Federal Transit Cluster Assistance Listing Number: 20.507 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs – Cost Principles Audit Findings: Material Weakness Criteria: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable, under federal awards, cost must meet certain criteria: a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. c) Be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the non-Federal entity. d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally financed program in either the current or a prior period. g) Be adequately documented. h) Cost must be incurred during the approved budget period. Additionally, 2 CFR 200.303 indicates that non-Federal Entities receiving Federal awards must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the nonfederal entity is managing the Federal award in compliance with Federal statutes, regulations and terms and conditions of the Federal award. The Corporation should have controls in place to document that salaries and overtime paid with federal funds were allowable. Timecards supporting hours worked should be approved and pay rates reviewed. Condition and Context: A summary of allowable charges for the grant was prepared for submission. Within the sample of 42, we noted that 9 timecards for bus operators did not have documented review. Documented review was implemented in September 2024. All instances of the error were prior to September 2024. We also noted 1 timecard showed 2 hours more than reflected on the pay register, resulting in a net underpayment. Views of Responsible Officials and Planned Corrective Actions: Management acknowledges the finding. Each department is responsible for ensuring proper timecard records with approval are maintained. A documented review process for bus operators was implemented over timecard records in September 2025. Payroll is responsible for ensuring that the appropriate number of hours are paid to each employee. Additional review will be performed prior to issuance of pay checks to ensure that the appropriate number of hours are being paid.

Finding 2024-002: Allocation of Payroll Costs - Significant Deficiency in Internal Control Over Compliance and Instance of Noncompliance – Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services – Medicaid Cluster Response and Corrective Action Plan: Management acknowledges that documentation supporting payroll allocations for PATH CITED-related activities did not fully align with Uniform Guidance expectations for federal awards. However, similar to Finding 2024-001, the Organization was not aware that PATH CITED funding constituted federal assistance during FY2024 due to the absence of federal identifiers in grant documentation and related communications from DHCS. As such, payroll costs were managed under the Organization’s standard operational practices rather than federal compliance-specific requirements. The Organization applied a reasonable and consistent allocation methodology based on supervisory oversight and expected levels of effort, which management believes appropriately reflected the work performed, given the nature of the program at that time. Upon confirmation of the federal nature of the funding, management will take the following corrective actions which includes enhancing a time attestation/time studies process for personnel working on federal awards and strengthening policies requiring periodic after-the-fact review of payroll allocations and documentation retention requirements for supervisory approvals. Anticipated Completion Date: by June 30, 2026 Responsible Person: Virginia Lui VP, Controller

Planned Corrective Action: The Division will implement their control of ensuring that they only charge allowable costs incurred during the approved budget period of a federal award’s period of performance or will obtain authorization from the grantor for any costs incurred before the grant's approved budget period. Anticipated Completion Date: 9/30/2026 Responsible Contact Person: Al Agpoon, Golden State Division Controller

Planned Corrective Action: The Division will design and implement a precise control to ensure that the amount of food distributed is properly reviewed and that the Division maintains such evidence. Anticipated Completion Date: 9/30/2026 Responsible Contact Person: Al Agpoon, Golden State Division Controller

VIDCOE will establish and document capitalization thresholds and procedures for identifying, recording, and depreciating capital assets, including maintaining a fixed asset register with periodic reconciliations. Procedures will also be implemented to ensure prepaid expenses are recorded appropriately and amortized over the periods benefited. In addition, grant accounting policies will be strengthened to ensure that funds received in advance are recorded as refundable advances and recognized as revenue only as allowable expenditures are incurred, in compliance with grant agreements and federal requirements. To further strengthen internal controls, VIDCOE will implement formal supervisory review and reconciliation procedures, including routine account reconciliations and financial statement reviews, to ensure transactions are properly classified, supported, and recorded. VIDCOEs’ Management expects to fully implement all corrective actions by July 30, 2026.

Finding No.: 2024-053 Special Test and Provisions – Project Accounting Responding Agency: Guam Homeland Security (GHS) Responsible Personnel: Esther Aguigui, Director GHS will create a Standard Operating Procedure (SOP) to establish internal policies and procedures in compliance with applicable special tests and provision requirements. GHS will also identify department personnel responsible.

Finding No.: 2024-051 Period of Performance Responding Agency: Guam Homeland Security (GHS) Responsible Personnel: Esther Aguigui, Director GHS will create a Standard Operating Procedure (SOP) to establish internal policies and procedures over compliance with applicable period of Performance requirements, as well as retention of all grant agreements. GHS will also identify department personnel responsible.

Finding No.: 2024-049 Activities Allowed or Unallowed: Allowable Costs/Cost Principles Responding Agency: Guam Homeland Security (GHS) Responsible Personnel: Esther Aguigui, Director Guam Homeland Security (GHS) will make sure that proper supporting documentation is available. GHS will also identify department personnel responsible.

Finding No.: 2024-046 Period of Performance Responding Agency: Department of Public Health and Social Services (DPHSS) Responsible Personnel: Theresa Arriola, Director DPHSS disagrees with this finding and provided documentation of grantor approval to use the FY 2024 award to pay prior year obligations. The enclosed communication from Linda Gee, CMS, dated July 1, 2021, provides more information. 45 CFR 95.7 (https://www.ecfr.gov/cgi-bin/text-idx?node=pt45.1.95&rgn=div5#se45.1.95_17) provides that a state Medicaid agency (i.e. Guam Medicaid Agency) has up to two years to file for a claim that it made. DPHSS welcomes the opportunity to discuss and collaboratively identify the relevant information and guidance during an entrance conference for each year’s audit.

Finding No.: 2024-040 Activities Allowed or Unallowed: Allowable Costs/Cost Principles Responding Agency: Department of Public Health and Social Services (DPHSS) Responsible Personnel: Theresa Arriola, Director The Bureau of Child Care Services (BCCS) disagrees with this finding. The questioned transactions relate to a major system migration from the AS400 to the D365 system, which temporarily impacted the traceability of certain records. During this transition, some data identifiers were reformatted to fit the new system's structure. However, this was a synchronization issue rather than a lack of oversight, and BCCS maintains that all costs are allowable, necessary, and reasonable under CCDF requirements. Supporting documents exist and were provided after a subsequent request on February 9, 2026, via One Drive link.

Finding No.: 2024-038 Period of Performance Responding Agency: Department of Public Health and Social Services (DPHSS) Responsible Personnel: Theresa Arriola, Director DPHSS ELC Program disagrees with the findings. Condition 1: The questioned labor costs of $16,668 align with payment of Core funded staff during that approved budget period for BP01. The PPE coincides with two draws for the ending and beginning of those fiscal years. Supporting documents were submitted twice, once on February 9, 2026, and February 20, 2026, including the Notice of Award (NOA) for this grant with issue date of July 9, 2024. Condition 2: The question of compliance with period of performance was justified through supporting documentations as reflected in the NOAs and extensions of NOAs which were provided twice February 9, 20206 and February 23, 2026. Program also noted that core funds have expanded authority to be utilized in subsequent budget periods throughout the 5-year cycle of the Cooperative Agreement. Upon auditor’s review, a correspondence email noted that the documents were received and findings were removed for all but on expense. Although all supporting NOAs were submitted for every expenditure amount, a follow up email with the last NOA for 6NU50CK000561-05-00 was provided again as an attachment.

Finding No.: 2024-035 Program Income Responding Agency: Guam Environmental Protection Agency (GEPA) Responsible Personnel: Michelle Lastimoza, Director Guam EPA has implemented processes relevant to the monitoring and reconciliation of program income. As part of our Correction Action for the FY2023 audit, which is a repeat finding in FY2024, Guam EPA is attaching a sample report of all program income collected through the Transaction Processing System (TPS) to include external payments received by DOA. Also, variances not captured by this report, consisting of payments/transactions submitted directly to DOA via electronic method of payments, are being reconciled by our staff and DOA.

Finding No.: 2024-034 Period of Performance Responding Agency: Guam Environmental Protection Agency (GEPA) Responsible Personnel: Michelle Lastimoza, Director Request to DOA will require immediate collaboration between Guam EPA and DOA to gather, reconcile, and provide all supporting documentation to support compliance with the period of performance in question.

Finding No.: 2024-032 Activities Allowed or Unallowed: Allowable Costs/Cost Principles Responding Agency: Guam Environmental Protection Agency (GEPA) Responsible Personnel: Michelle Lastimoza, Director Request to DOA will require immediate collaboration between Guam EPA and DOA to gather, reconcile, and provide all documentation supporting compliance of allowable costs incurred during the federal award period of performance as specified in the terms and conditions of the federal award or in the approved extension.

Finding No.: 2024-025 Activities Allowed or Unallowed: Allowable Costs/Cost Principles Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director The Agency disagrees with this finding. Please refer to a letter dated March 31, 2026, regarding Reports on Compliance September 30, 2024.

Finding No.: 2024-021 Activities Allowed or Unallowed: Allowable Costs/Cost Principles Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director The Agency disagrees with this finding. Please refer to a letter dated March 31, 2026, regarding Reports on Compliance September 30, 2024.

Finding No.: 2024-018 Eligibility Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director The Agency is reviewing the management of Federal Grants to ensure robust handover and succession plans are in place for future programs. The sudden passing of the ERA Program Coordinator directly impacted overall management of the program.

Finding No.: 2024-013 Allowable Costs/Cost Principles: Procurement, Suspension, and Debarment Responding Agency: Department of Administration (DOA) Responsible Personnel: Edward M. Birn, Director Agency disagrees with 2 out of the 3 findings. • Condition 1 regarding the Authorization To Proceed (ATP), as per the Grant and Cooperative Agreement and the Grant Terms and Conditions, it did not state that an ATP is required to begin work on the grant for D20AP00048 and D21AP10145.The Government complies with ATP requirements for grants which mandate such compliance. If the grant is silent, no ATP is required.. • Condition 2 GSA will continue to verify vendor eligibility through SAM.gov prior to contract award. Documentation of the verification will be retained in the procurement file for each transaction. • Condition 3 The necessary controls will be strengthened when the updated Federal Grant module is fully implemented.

Finding No.: 2024-011 Period of Performance Responding Agency: Department of Public Health and Social Services (DPHSS) Responsible Personnel: Theresa Arriola, Director (DPHSS) The DPHSS WIC Program disagrees with the findings. All supporting documents related to the findings were provided promptly on March 3,2026 when request was received on February 26,2026. In accordance with WIC FY 2024 Closeout Guidance and the requirements under 2 CFR 200.344, the WIC Program is allowed 90 days after the end of the period of performance to submit all final financial reports, as well as 90 days to liquidate all obligations incurred during the period of performance. For FY 2024, the closeout timeline required that all obligations be liquidated no later than January 31, 2025. The program adhered to these federal requirements. All obligations were liquidated prior to the close of the fiscal year grant, and obligations were reported in the fiscal year in which they occurred, consistent with 7 CFR 246.17. Furthermore, the final closeout report was submitted within 120 days after the end of the fiscal year, fully complying with WIC closeout procedures. Based on the timely submission of all supporting documentation and adherence to federal closeout regulations, the DPHSS WIC Program maintains that the questioned costs were appropriately obligated, liquidated, and reported.

93.767 Children's Health Insurance Program (CHIP) 93.778 Medical Assistance Program (Medicaid; Title XIX) 2024-023 Strengthen Controls to Ensure Compliance with Provider Eligibility Requirements of CHIP and the Medical Assistance Program DOM Response: Two instances of no documentation that required fee were collected. DOM Partially Concurs. After a review of the 2 files, DOM has found in one instance an application fee was collected and sent to DOM for processing; however, the receipt of the application fee was not indicated by comments in the system. DOM will work with Gainwell to ensure remedial training is conducted to reduce errors in the future. One (1) instance correlates to an application received before DOM began requiring the fee on October I, 2022. Thirty-eight instances of no documentation that provider's medical license was current and free of limitations. DOM Partially Concurs. After a review of the 38 files, DOM has found in thirty-one (31) instances the license from the board was attached and the checklist completed after the license was not verified by LexisNexis . Two (2) instances were applications approved prior to the Gainwell implementation; however, the licenses remain valid in SFY 2024 and reflect correct effective dates in the system. One (1) instance is a group and does not require license. Four (4) instances the license from the board was manually verified and attached after the license was not verified by LexisNexis; however, there were typographical errors or omissions in the license fields in the system. DOM will ensure Gainwell conducts remedial training to mitigate these errors in the future. Thirty-one instances of no documentation of review prior to approval of provider's application. DOM Does Not Concur. After a review of the 31 files, DOM has verified all applications identified within this finding as being approved by DOM without review have documented comments in the system of record to show a review of each application was conducted prior to approval. This would include Fifteen (15) instances with review notes, requests for missing information (if applicable), etc. entered by reviewers since the Gainwell Go-Live. Sixteen (16) instances with review notes, requests for missing information (if applicable), etc. entered by reviewers prior to the Gainwell Go-Live. Ten instances of no documentation of verified identity and exclusion status of providers using required federal databases prior to application approval. DOM Partially Concurs. After a review of the 10 files, DOM has found in five (5) instances the LexisNexis report indicated the NPI was verified. One (I) instance of the NPI not verified by LexisNexis, but the Gainwell Analyst performed a manual search in NPPES and attached the verification results on 11/14/24. Four (4) instances before Gainwell began processing applications. The provider was sent to Digital Harbor for screening. DOM's contractual relationship with Digital Harbor ended in 2016 and the data is no longer available. Agency began revalidation in 2017 by stratifying all providers; however, due to PHE all revalidations were paused. As a result, not all revalidations have been completed. At this time, revalidation dates have been assigned in alignment with CMS guidance and will be completed within CMS required timelines, i.e. 44 months from end of the PHE. One (I) instance has a note indicating revalidation occurred in 2017, but no documentation can be located in the system, which potentially could be attributed to data conversion from the legacy system to the new system. Four instances of no documentation of OIG exclusion checks prior to application approval. DOM Concurs. After a review of the 4 files, DOM has found in three (3) instances contain a comment within EDMS that verifies the providers were sent to Digital Harbor for screening. DOM's contractual relationship with Digital Harbor ended in 2016 and the data is no longer available. Please note: Agency began revalidation in 2017 by stratifying all providers, however due to PHE all revalidations were paused. As a result, not all revalidations have been completed. At this time, revalidation dates have been assigned in alignment with CMS guidance and will be completed within CMS required timelines, i.e., 44 months from end of the PHE. One (1) instance has a note indicating revalidation occurred in 2017, but no documentation can be located in the system, which potentially could be attributed to data conversion from the legacy system to the new system. Two instances of no documentation of collection of the provider's NPI. DOM Concurs. After a review of the 2 files, DOM has found all instances contain a comment within the system which verifies the provider was sent to Digital Harbor for screening. DOM's contractual relationship with Digital Harbor ended in 2016 and the data is no longer available. Eight instances of missing or incomplete documentation of required disclosure details. DOM Partially Concurs. After a review of the 8 files, DOM has found in two (2) instances where the individual provider's date of birth is in the system. Two (2) instances where the individual provider's date of birth is not available as it was not a required element at the time of application. DOM will ensure the date of birth is obtained from the provider and added to the system. Three (3) instances where the organizational provider has all required elements. One (1) instance where the organizational provider's address is not available as it was not a required element at the time of application. The missing data is now required and will be collected at the next revalidation. Four instances of no documentation required screening procedures in accordance with provider's designated risk level. DOM Partially Concurs. After a review of the 4 files, DOM has found in three (3) instances where the individual provider's file contains a comment within EDMS verifies provider was sent to Digital Harbor for screening. DOM's contractual relationship with Digital Harbor ended in 2016 and the data is no longer available. Please note: Agency began revalidation in 2017 by stratifying all providers, however due to PHE all revalidations were paused. As a result, not all revalidations have been completed. At this time, revalidation dates have been assigned in alignment with CMS guidance and will be completed within CMS required timelines, i.e., 44 months from end of the PHE. One ( l) instance the individual provider was screened, and a site visit was conducted (as this provider type was deemed moderate risk at that time) and the documentation is available in the system. DOM Corrective Action Plan: a. In response to the audit findings, the Division of Medicaid (DOM) will collaborate with its Fiscal Agent, Gainwell Technologies, to review all identified issues and implement corrective measures. As part of this effort, mandatory refresher and remedial training will be conducted for Gainwell Provider Enrollment staff. This training will emphasize the requirement for comprehensive and accurate documentation within provider files, including clear, detailed, and supportive comments that fully reflect all actions taken during the enrollment and maintenance processes. Additionally, DOM will implement enhanced oversight and quality assurance monitoring to ensure sustained compliance with documentation standards. DOM notes that certain discrepancies identified in the audit may predate the implementation of the MESA system and the transition to Gainwell Technologies as the Fiscal Agent. Due to system conversion constraints, data limitations, and the absence of complete historical documentation within the current system, DOM's ability to retrospectively validate or remediate these pre-implementation discrepancies is limited. As such, corrective actions will be applied prospectively, with a focus on ensuring accuracy, completeness, and compliance within the current MESA environment moving forward. b. Bill Hardin c. March 31, 2026

Rndlng 2024-017: Spedal Tests and Provisions Significant Defldency In Internal Control over Compliance Crit eria: Per 45 CFR 1356.2l (ml(l ), in meeting the requirements of section 47l(a)(ll) of the Act, the tilie IV·E agency must review at reasonable, specifi c, tim e-limi tedperiods, to be established by the agency, the amount of the payments made for foster care maint enance to assure their continued appropriateness , and that the amount made to a licensed or approved relative or kinship foster famil y home is the same as th e amount that would have been made if the child was placed in a licensed or appr oved non-relative foster family home. Based on the Olicia Y. Lawsuit' s Mi ssissippi Sett.lem ent Agreement and Reform Plan, MOCPS is requ ired to review and publi sh u pdated! foster boardpayment rates every two years. Per 45 CFR 75.303(a), non-Federal entities expending HHS awards must establish and maintain effective internal contro ls over comp liance with Federal states, regulations, and the terms and conditions of the Federal award. Condit ion: Our audit procedures over foster care board payments disclosed that the approved payment board rates were unattai nable . The rates had not been updated from the rate approved in 2019 and no documentation could be provided for the required biannual review. Furt her, therate applied for children aged 0- 8 were not the most recent approved rates resulting in underpayments to foster families. Perspective: Below are the exceptions noted in our testing of foster care board payments for proper allocation of the rates and their approval. The samples were not statistically valid. • One of tenrate categories did not have the proper rateappliedbased on provided board rates resulting in twenty-six of forty sample payment Items being underpaid. • MDCPS did not maintain adequate documentation for the required rate review. Personnel Responsible for Corrective Action: Name: A/asha King Title: Grants Accounting Team Lead Email: Aiasha.King@mdcps.ms.gov Phone Number: 601-359-4016 Co rr ective Acti on Plan: Prior to lhe Single Audit, MDCPS im plemented the Foster Board Payment Review Standard Operating Proce dure (2.15.9.1) to ensure payment rates are verified and approved prior to issuan ce. Annual reviews of board payment rates will be conducted to ensure alignment with approved rates. Antldpatecl Completion Date: Completed as of March 19, 2026.

Finding 2024- 015: Allowable Costs/ Cost Principle Signifi cant Deficiency In Internal Contro l Over Compliance Criteria: Per 45 CFR 1355.57(d), a title N·E agency must allocate project costs in accordance with applicab le HHS regulations and other guidance. Per 45 CFR 75.303(a), non-Federal entities expending HHS awards must establish and maintain effective internal con trols over compliance with Federal sta tes, regu lations, and the terms and conditionsof the Federal award. Condition: Our audit procedures over administrative services disclosed that MDCPS lacked proper policies and procedures over data editing or modification of the cost allocation system. Perspe ctive: Per discussion with management, it was determined that no formal policies and procedures were established for data editing or modifications. Personnel Responsible for Corrective Action : Name: Christopher Roy Title : Deputy Director to the CFO Email: Christopher.Roy@mdcps.ms.gov Phone Number: 601-359-4043 Corrective Action Plan: MDCPS Is strengthening segregation of duties within the Cap Plus system by limiting administrative privileges and ensuring supervisory approval is documented for all cost allocation changes. AntJdpated Completion Date: Permissions were corrected and completed as of March 31, 2026. Documented process and policy anticipated completed May 30, 2026.

Finding 2024 - 014: Allowable Costs/ Cost Prlnclple Significant Defldency In Internal Control Over Compliance Criteria: Per 45 CFR 1355.57(d), a title IV-E agency must allocate project costs in accordance with applicable HHS regulati ons and other guidance. Per 45 CFR 75.303(a), non-Federal entities expending HHS awards must establish and maintain effective internal controls over compliance with Federal states, regulations, and the terms and conditions of the Federal award. Condition: Our audit procedures over administrative services disclosed that MDCPS lacked proper controls over employee training costs expended through a specific vendor. Perspective: Below are the exceptions noted in our testing of administrat ive services for appropriate review over cost allocation . The samples were not stat ist ically valid. One hundred percent of the costs charged for employeetraining using a specific vendor (four transactions) were te.ste d, and four out of four transactions lacked appro priate review. Personnel Responsible for Corrective Action: Name: Christopher Ray Title : Depuly to 1he Chief Financial Officer Email: christoher.Roy@mdcps.ms.gov Phone Number: 601-359-4043 Corrective Action Plan: MDCPS will enforce our policy requiring approval of the grant management's team's review of appropriate detailed documentation provided by vendor payments. Antldpated Completion Date: Completed as of March 31, 2026.