Corrective Action Plans

Management concurs with KPMG’s assessment that the risk assessment and monitoring control activities were not sufficiently designed to ensure adequate segregation of duties or to provide evidence of control operation. These gaps were primarily due to limited staffing and processes that have not evolved to meet all compliance requirements. Management will implement new control policies and procedures that ensure proper segregation of duties and introduce review mechanisms at a sufficient level of precision to detect and prevent noncompliance. These policies and procedures will be implemented by December 31, 2025.

Corrective Action Plan: Due to operational management turnover and restructuring experienced in 2024 and 2025, this corrective action plan has been delayed. Atrium Health CMHA management has engaged with outside consultants in the third quarter of 2025 to examine and redesign various processes and work flows. This project is expected to address the gap in SFA transactional review and approval internal controls that are arising due to the SFA program size, limited number of subject matter experts, and the management turn; and result in mitigating controls and policies being implemented to ensure the accuracy and completeness of all SFA transactions. Proposed Completion Date: By December of 2025, Atrium Health CMHA management will complete the corrective action.

Corrective Action Plan: Due to operational management turnover and restructuring experienced in 2024 and 2025, this corrective action plan has been delayed. Atrium Health CMHA management has engaged with outside consultants in the third quarter of 2025 to examine and redesign the reporting structures, process work flows, and procedures within the Student Financial Aid (SFA) office, the Business office, and Student Services specifically as those areas relate to student status and records. It is expected this engagement will ensure that the internal controls within the entire SFA office will improve, including that the SFA IT Systems are documented and tested and that any compensating controls identified as needed are implemented. Proposed Completion Date: By December of 2025, Atrium Health CMHA management will complete the corrective action plan. .

Program Name - STOP Violence Grant- Victim Services CFDA Number - 16.588 Pass-through Entity - Michigan Department of Health and Human Service Condition and Description - For 4 out of 20 samples tested, during our testing of participant eligibility under the STOP Violence against Women Formula Grants, the Organization was unable to provide enrollment forms or supporting documentation. These forms are necessary to verify that participants met the program's eligibility criteria. YWCA Response- The YWCA Victim Services acknowledges this finding and has implemented the following corrective action plan to ensure compliance. Corrective Action Plan - Procedures exist to ensure all clients are enrolled and eligible for services under the STOP grant. In addition to documentation in the Apricot system, an additional legal screening process and intake forms are used to determine eligibility and complete client enrollment within a Victim Services application called MyCase. During the audit, documentation for the four identified cases from MyCase was erroneously excluded, causing the finding. As a subsequent event, the documentation for intake and eligibility for the four identified cases was provided to the external auditors. This process will continue, and future audits will include client documentation for both systems. Additionally, Enforcement of enrollment procedures within Apricot, and oversight from department Directors, has been made a priority. Time Frame for Correction -Appropriate procedures were in place during the full audit year of 2024 and will continue into future years. Corrective action related to documentation within the Apricot system was implemented in August 2025. Individuals Responsible - Jessica Glynn, Vice President of Victim Services and Kellie Swikoski, Grant Manager.

View of Responsible Officials and Planned Corrective Action Plan: Going forward, all Adoption Subsidy case files will include Criminal Background Checks and Statewide Central Registry (SCR) clearances, in accordance with the updated OCFS-4401. Each Adoption Subsidy determination will be reviewed by the Senior Caseworker in charge of the FAHD Unit and subsequently verified by a Services Eligibility Unit Social Services Specialist to ensure that all required documentation is included prior to case opening.

Federal Award Findings and Questioned Costs – Year ending December 31, 2024 Finding 2024-001 – Internal control deficiency and noncompliance over activities allowed or unallowed, allowable costs/cost principles, reporting, and special tests and provisions related to amounts reimbursed for the project worksheets. Identification of the federal program: Assistance Listing Number 97.036: • COVID-19 – Disaster Grants – Public Assistance (Presidentially Declared Disasters) • U.S. Department of Homeland Security • Federal award identification number: o Project number 699651 – CV-727 2020 Q2 PPE and Screening Thermometers • Federal award year – January 20, 2020 to May 11, 2023 • Pass-through entity – Arizona Department of Emergency and Military Affairs (Arizona DEMA) Condition: During the testing over the expenditures included in the project worksheets, management did not have effective internal controls in place to ensure expenditures reported for reimbursement in the FEMA project worksheets were actual paid expenditures. This resulted in an overstatement of the amount reimbursed by FEMA. Management performed an analysis of all expenditures submitted to FEMA and determined there were 4 expenditures reported for reimbursement in the FEMA project worksheets that were not based on actual paid expenditures resulting in an overstatement of the amount reimbursed by FEMA in the amount of $1,406,446. Cause: Management did not have effective internal controls in place over the compliance requirements as stated in the criteria or specific requirement section of the report. Effect or potential effect: Management was reimbursed by FEMA for expenditures that were not based on actual paid expenditures which resulted in an overstatement of the amount reimbursed by FEMA. Without sufficient internal controls, other compliance matters could occur in the future. Questioned costs: $1,406,446 – Assistance Listing Number 97.036 – Federal award identification number – Project number 699651 – CV-727 2020 Q2 PPE and Screening Thermometers Questioned costs were computed by calculating the difference between the expenditures submitted for reimbursement in the FEMA project worksheets and the actual paid expenditures. Context: During the testing over the expenditures included in the project worksheets, the auditors obtained a listing of expenditures submitted for reimbursement to FEMA and selected a sample of 67 for testing the compliance requirements. There was 1 out of 67 selections where the expenditure reported for reimbursement was not based on actual paid expenditure. The sampling was a statistically valid sample. Management performed an analysis of all expenditures submitted to FEMA and determined there were 4 expenditures reported for reimbursement in the FEMA project worksheets that were not based on actual paid expenditures resulting in an overstatement of the amount reimbursed by FEMA in the amount of $1,406,446. Management’s control regarding the review of the project worksheet expenditures did not identify this matter when submitting the project worksheet for reimbursement to FEMA. Identification as a repeat finding, if applicable: No. Recommendation: Management should develop and implement effective internal controls to ensure expenditures reported for reimbursement in the FEMA project worksheets are actual paid expenditures. Management should refund the questioned costs to FEMA and work with FEMA to determine the extent of additional courses of action. Views of responsible officials: Management concurs with the audit finding and has implemented a corrective action plan to address the identified issue. Management has notified Arizona DEMA of the identified expenditures and has begun the process of reimbursing the $1,406,446 to FEMA. For all future FEMA project applications, Management will conduct a comprehensive reconciliation process prior to submission. This process will include a detailed review of invoice documentation and verification of payment to ensure compliance with applicable federal requirements. Responsible Parties: Heather Mahoney, Network Controller Anticipated Date of Completion: September 30, 2025

Planned Corrective Action: To strengthen internal controls over this program, the Tribe will implement a quarterly reivew of participants compared to those included in indirect cost pools. Name of Responsible Party: Serge Davis, Controller and Stephanie Moyers, Operations Director HHS Anticipated Completion Date: 12/31/2025.

Federal Single Audit Finding: 2024-001 - Significant Deficiency in Internal Control and Noncompliance with Special Tests and Provisions in Application of Organization's Sliding Fee Discounts Policy Name of Contact Person: Jennifer Youngberg, Chief Financial Officer Corrective Action: We have reviewed our Sliding Fee Discount Policy to ensure alignment with HRSA requirements. Staff responsible for eligibility and billing will receive refresher training. Supervisory reviews of a sample of applications will occur quarterly, with results tracked and reported to the Leadership Team. Each individual involved in the process will be made aware of their role, with clear separation of duties between operational and accounting functions. These actions will strengthen internal controls and ensure consistent application of the Sliding Fee Discount Policy going forward. Proposed Completion Date : December 31, 2025

Housing Voucher Cluster-Assistance Listing No. 14.871/14.879/14.EHV Recommendation: We recommend the Authority review their process and internal controls for new tenants to ensure compliance with HUD requirements and their administrative plan. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Director of Housing will review our process and internal controls for new tenants to ensure compliance with HUD requirements and our administrative plan. Name(s) of the contact person(s) responsible for corrective action: Director of Housing Planned completion date for corrective action plan: December 31 , 2025

2024-001: Eligibility – Community Service Block Grant - Assistance Listing #s 93.569 - Grant Period - Year Ended December 31, 2024 Criteria: Only individual households that fall under the 200% Poverty Guideline based on family size would be eligible to receive benefits from the Community Service Block Grant. Condition: During our Eligibility Compliance testing, we noted two incorrect eligibility calculations out of our sample of forty applicants. We consider this Single Audit finding to be an instance of noncompliance relating to the Eligibility Compliance Requirement. Corrective Action Plan: Additional review of eligibility will be performed by management to assure proper eligibility going forward. The program Director will also be conducting additional training with the program staff on calculating income and required documentation. Responsible Person for Corrective Action Plan: Darlene Johnson, Deputy Director Implementation Date of Corrective Action Plan: November 1, 2025

Corrective Action Plan Provided by Management: Philadelphia Legal Assistance Center, Inc. (PLA) agrees with the finding. In November 2024, PLA hired a Legal Compliance Specialist whose full-time job is to review open and closed cases for compliance mistakes. The Legal Compliance Specialist did not have time to review every case closed in 2024. However, the Legal Compliance Specialist has been reviewing cases all year in 2025 and catching issues with missing citizenship attestations, which should reduce the chances of a case being reported to LSC without the documentation required by 45 C.F.R. 1626. In the summer of 2025, we required all case handlers to watch compliance training videos and answer multiple-choice questions to test their knowledge. The videos and questions included content related to 45 C.F.R. 1626. We plan to require staff to complete a similar training process in 2026, which will include additional content related to 45 C.F.R. 1626 compliance.

Recommendation: The Company should consider reevaluating their established procedures and controls currently in place to ensure full compliance with regard to eligibility and proper maintenance of tenant information, including policies for handling missing files during management transitions to ensure compliance with HUD requirements. Action Taken: The Company will start randomly testing a small sample of tenant files, as part of our quarterly site inspection. Additionally, Kay-Kay Realty, a third-party vendor is already engaged to review tenant move-in and recertification files, but the prior resident manager was selecting the files to review. We will now ask Kay-Kay Realty to randomly select tenant files for their review process. Contact person: Patrick Delaney; (808) 523-5681, ext. 693 Anticipated Completion Date: October 1, 2025

Ref. No. 2024-001: Missing Signatures Recommendation: The Company should consider reevaluating their established procedures and controls currently in place to ensure full compliance with regard to eligibility and proper maintenance of tenant information, including policies for handling missing files during management transitions to ensure compliance with HUD requirements. Action Taken: The Company will start randomly testing a small sample of tenant files, as part of our quarterly site inspection. Additionally, Kay-Kay Realty, a third-party vendor is already engaged to review tenant move-in and recertification files, but the prior resident manager was selecting the files to review. We will now ask Kay-Kay Realty to randomly select tenant files for their review process. Contact person: Patrick Delaney; (808) 523-5681, ext. 693 Anticipated Completion Date: October 1, 2025

2024-002 Program: Crime Victim Assistance Federal Agency: Department of Justice AL #: 16.575 Federal Award Identification Number and Year: Various – See SEFA Pass-through Entity: Missouri Department of Social Services Type of Compliance Finding: E - Eligibility Internal Control Impact: Material Weakness Finding: When a participant arrives at the Shelter, the admission checklist, procedures, and forms must be completed by program staff. During our audit of the Organization’s fiscal year ended December 31, 2024 federal award program, we noted the Organization did not have necessary supporting documentation, such as admission checklists for eligibility, to evaluate twenty-one out of twenty- five participants in their files. Corrective Action Plan: All supporting documentation for client eligibility will be maintained for the period required by the grant. Person(s) Responsible for Implementation: Danielle Brown, CEO, dbrown@ywcasj.org, 816-232-4481

Moving to Work Demonstration Program – Assistance Listing No 14.881 Recommendation: We recommend that HABC staff review the controls in place to ensure that required eligibility determination documentation is complete, accurate, and available for audit. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Housing Choice Voucher Program response: Out of 40 files reviewed, one exception was noted where recertification was not performed in a timely manner. HABC developed a strategy to verify that all existing recertifications are processed on time. The goal is to catch up by January 2026 and maintain timely processing going forward. HABC has updated its recertification tracking system as part of this plan. This includes measures for weekly progress monitoring, tracking upcoming deadlines, and implementing quality control to support the timely processing of recertifications. Housing Operations response: Housing Operations response: Out of 40 files reviewed, there were two exceptions noted: (1) Documentation was not provided to support the rent amount showing on the rent roll; in that instance, the transaction was corrected after the rent roll had been generated, and the rent amount billed was corrected. The resident was not responsible for paying an incorrect rent amount; Exception (#2) and (#3) are related to same file folder: (2) one requested resident file folder was not submitted for testing; and (3) Third party income verification documentation (including the resident’s signed personal declaration) could not be identified; the file folder was not properly scanned into the electronic document management system and select documents were not otherwise maintained. HABC’s Housing Operations Department will require that all transactions have two levels of review/approval to ensure complete and accurate documentation is scanned into the electronic document management system. Name(s) of the contact person(s) responsible for corrective action: Stefanie Beale, Senior Manager, Continued Assistance & Site Based (HCVP), and Rhonda VanDyke, Senior Manager of Public Housing Administration (LIPH). Planned completion date for corrective action plan: 01/31/2026 for HCVP and 12/31/2025 for LIPH

Finding #2024-006 – Eligibility – Material Weakness and Other Noncompliance. Applicable federal program: U. S. Department of Agriculture, Passed through The Houston Food Bank, Emergency Food Assistance Program – Food Commodities (Food Distribution Cluster), Assistance Listing #: 10.569, Contract Number: 30517, Contract Year: 01/01/24 – 12/31/24. Condition and context: In a sample of 40 clients served during the year, we noted nine served clients had no documentation to support their eligibility to receive food assistance. Recommendation: Strengthen policies and procedures to ensure the documentation and retention of eligibility determinations. Planned corrective action: An internal audit performed in January 2025 identified deficiencies in internal controls for the calendar year 2024, primarily due to elevated personnel turnover. In response, corrective measures were implemented in April 2025, including the establishment and documentation of formal internal controls and procedures. New management has assumed oversight responsibilities and is actively monitoring compliance to ensure sustained effectiveness of these controls. Controls have been strengthened to ensure eligibility determinations are properly supported and that support is reviewed and retained. Responsible officer: Virginia Gonzalez, Chief Executive Officer. Estimated completion date: Completed as of April 30, 2025.

Department of Housing and Urban Development 2024-001 Public Housing Tenant Files Federal Program: Public and Indian Housing, Federal Assistance Listing No. 14.850 Criteria: The PHA is required to conduct re-examinations of tenant eligibility on an annual basis. The PHA can elect to conduct complete re-examinations every three years using the streamline method. When using the streamline method, the tenant must be on a fixed income and certify that there have been no additional sources of income. The tenant income is adjusted by a cost of living adjustment (COLA) factor. Condition: During our review of twenty-two public housing tenant files, we noted the following: • Seven files were participating in the streamline re-examination process. On these seven files, the income was not adjusted for the COLA. Questioned Costs: None Context: Under 24 CFR 982.16, the PHA is required to adjust the income used in the rental computation by a COLA. The PHA thought that the rent did not have to be adjusted annually under the streamline method. They were adjusting the rent at the end of the three-year period. Effect: Rent amounts charged to the tenants that were participating in the streamline process were incorrect. Cause: The PHA thought that the rent did not have to be adjusted annually under the streamline method. They were adjusting the rent at the end of the three-year period. Recommendation: The PHA should adjust the amounts used in the rental computation on an annual basis. A complete re-examination is not required but the COLA should be reviewed and the rent amount adjusted if required. View of responsible officials and planned actions: We will modify our procedures to adjust the rent as required on an annual basis. Expected correction date is December 31, 2025.

FISCAL YEAR OF FINDING: December 31, 2024 AUDITOR FINDING: 2024-001 The Authority is responsible for determining client eligibility and entering data into the State of Colorado’s WIC COMPASS system. Although the Medicaid ID number is required for individuals with adjunct eligibility, it is not a mandatory field in COMPASS. Therefore, eligibility can be processed without entering this number. Testing revealed that the Authority did not consistently follow established controls requiring documentation of the state case ID for individuals deemed eligible based on participation in other state programs. Since the Medicaid ID number is not a required field in the COMPASS system, eligibility determinations can be processed without it. The system lacks reporting capabilities to identify missing entries in this field. Additionally, due to a high caseload, the Authority does not have the capacity to conduct 100% case reviews for all clients served. It is recommended that the Authority expand existing case reviews to include five participant records per month per staff member. The results should be incorporated into annual performance evaluations. Additionally, we recommend enhanced training for all staff involved in eligibility determinations. CLIENT PLANNED ACTION: The Authority will implement the following corrective actions: • Denver Health WIC leadership will perform random record reviews of 5 participant records per month per staff member to ensure compliance with Colorado WIC Policies, including accurate income and eligibility documentation. • Include the results of the reviews, including adjunctive eligibility screen, from the 5 reviews per month in the annual employee performance evaluation and communicate the importance of documenting the Medicaid ID. • All Denver Health WIC staff will complete a new training on income determination and documentation. This training will be released by the state WIC office by the end of October 2025 and all staff should complete this training by the end of December 2025. Completion of this training will be documented with an acknowledgment signed by the WIC staff and maintained by the Denver Health WIC Program Manager. CLIENT RESPONSIBLE PARTY: Kate Bennett, WIC Program Manager COMPLETION DATE: 12/31/2025

US Department of Agriculture Federal Financial Assistance Listing #10.558 Child and Adult Food Care Program (CACFP) Applicable Federal Award Number and Year – 28-1183-000 7/1/2023 – 6/30/2024 and 7/1/2024 – 6/30/2025 Cash Management Material Weakness in Internal Control Over Compliance Criteria: CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over federal awards that provides reasonable assurance that the Organization is managing the federal awards in compliance with federal statutes, regulations and terms and conditions of the federal award. Condition: The Organization was unable to provide adequate documentation to support the number of meals claimed for reimbursement. Corrective Action Plan: Management is in the process of reviewing its existing controls over the tracking and submitting of its meal counts included in its attendance records for reimbursement. Individual Responsible For Corrective Action: Veronica Jones, Fiscal Services Director Anticipated Completion Date: December 31, 2025

Name of Contact Person Responsible for Corrective Action: Karen Warmack, Social Services Director Corrective Action Planned: The County will implement additional procedures, including reviews, to provide reasonable assurance that all necessary documentation to support eligibility determination exists and is properly input into MAXIS. County Comment: A Corrective Action Plan has been established with an anticipated completion date of December 31, 2025. Anticipated Completion Date: December 31, 2025.

2024-002 – Allowable Activities – Moving to Work Demonstration Program - 14.881 Significant Deficiency Statement of Condition and Criteria The Authority does not appropriately evaluate and settle inter-program balances on a periodic basis. The Authority is required to implement and utilize HUD program funds in accordance with activities approved in the annual MTW plan. Recommendation We recommend the Authority evaluate and update the system coding of interfund transactions to assist with periodic settlement of balances. In addition, operating transfers should be identified and differentiated from the routine, reciprocal transactions and treated according to their purpose to assist with management of cash balances. Corrective Action The Authority is converting its accounting software to better enable it to manage the various activities of the Authority. Upon conversion, all program balances are to be formally settled. In addition, a process is being developed to capture and identify transactions generated by MTW funded activities to assist with timely and accurate recording.

The Just One Project's CSFP team will maintain a filing system organized by service site, alphabetical client name, and month and year of registration. The team will also utilize the Salesforce system to track registered clients, recertification dates, and services provided each day. Effective immediately, designated CSFP staff will visit all active distribution sites each business day to collect new registration and recertification forms, cross-check them and previously filed forms against the day's Salesforce distribution list, and file new forms in the designated system. This will ensure every client record is complete and current. In addition, the team will conduct an internal audit at least annually to confirm that all participant files contain required documents and certifications, promptly address any deficiencies, and document corrective steps. Staff will also receive periodic refresher training to reinforce record-keeping standards and sustain compliance.

Corrective Action: The finding was a result of prior staff that was replaced in the current fiscal year. Management has designated a resident intake and compliance manager to be responsible for monitoring tenant recertification schedule across all HOME-assisted unites. Any exceptions will be corrected immediately and reported to management.

Management Response #2024-004: Due to staff turnover, the Corporation did not consistently enforce segregation of duties between the individual responsible for determining income eligibility and the one completing the medical risk assessment. Corrective Action Plan: All eligibility verification data, including screenshots and signed Rights and Obligations statements, will be stored in a centralized, secure shared drive maintained and managed by the WIC Director to ensure it is protected with limited access and password protection. The drive will be organized using a de-identified naming convention to ensure privacy while maintaining ease of access for authorized staff. To maintain a robust system of checks and balances, tasks related to eligibility verification and documentation will be divided among different team members. This separation will prevent any one individual from having full control over the process, reducing the risk of oversight or potential errors. The WIC Department’s policy and procedure manuals will be revised and updated to include the new eligibility verification process. To ensure adherence to the new protocols, periodic audits and review sessions will be conducted by the WIC Director or designated compliance staff to verify that documentation is being properly maintained and that all procedures are followed. Staff will be required to undergo refresher training sessions as needed to reinforce the updated protocols and best practices. Management expects to be completed by December 31, 2026. Responsible Party: Tracy Harrison, COO

We have hired an outside independent company, Infinity File Compliance, LLC to work with us on updating and maintaining all HUD documentation requirements. We are working on applying all the new policies and procedures and will be implementing trainings to ensure future compliance.