Corrective Action Plans

EOHHS understands that this finding stems from two items. 1. Current limitations of the MMIS and the volume of manual transactions, including retroactive capitation adjustments and corrective journal entries related to CHIP funding 2. Lack of internal controls regarding CHIP draw downs and reporting. Management’s correction action plans for each item are below. 1. EOHHS will improve SOPs to include additional review of source data, collation of source data, and review of formula calculations for manual adjustment activities. These steps will be built into analyst training, and measures have been taken to include training and the creation/improvements of internal SOPs before the upcoming SFY 2026 closing activities occur. EOHHS will include within its forthcoming procurement of specific MMIS modules requirements to reduce the number of manual calculations and related entries. 2. Medicaid finance has and will take the following actions. a. Staff training. i. In May 2026, Medicaid Finance sent two employees to internal control training, which was sponsored by the Office of the Auditor General (OAG) ii. In July 2027, these two employees will train all Medicaid finance staff members on the importance of risk and internal controls using material from the OAG sponsored training. b. SOP tracker and dedicated work time i. Medicaid finance created an inventory of all finance-related SOPs to track assignments to ensure timely completion of high priority SOPs. ii. The Associate Director (Financial Management) has weekly worktime dedicated to the completion of high priority SOPs. iii. Each fiscal close, one staff member has been assigned to work with analysts to draft six SOPs (two from each finance unit—fee for service, managed care, and federal reporting) to continue to document all year end closing procedures. c. Post FFY-quarter end reconciliations i. Beginning in FFY 2026, the Associate Director (Financial Management) completes a post-quarter reconciliation of Medicaid draw down accounts (benefits, administrative claiming, and CHIP). ii. Staff email the Associate Director (Financial Management) after each federal draw down and include verification of the PMS draw down amount and account. iii. The Associate Director (Financial Management) enters this into a tracking sheet to ensure sufficient federal funds remain in each account during the quarter. Should additional funds be needed, Medicaid finance submits a supplemental budget request to CMS to prevent the shifting of funds between federal accounts benefits, administrative claiming, and CHIP accounts. iv. Shortly after the end of each FFY year quarter close, the Associate Director (Financial Management) completes the following: 1. Receives staff-run reports form the PMS system showing all draw downs in the previous quarter. 2. Checks that Medicaid Finance internal trackers (high level and detail trackers) accurately capture correct federal accounts and amounts. If variances, research is completed to reconcile to PMS. v. Associate Director (Financial Management) ensures that all CMS adjustments, such as Parts A, B, and D adjustments and TPL/AOR adjustments are included in the high-level fund tracker to match and verify CMS’ quarterly account balances. d. EOHHS acknowledges that many of the new checks and reviews implemented have not been formally codified. It will work to codify controls to document these reviews and checks. Anticipated Completion Date: Additional SOP and internal control development is ongoing and the date of procurement/implementation of the MMIS Finance module is still be determined. Contact Persons: Storm Lawrence, Chief of Strategic Planning, Monitoring & Evaluation, Executive Office of Health and Human Services storm.lawrence@ohhs.ri.gov Dezeree Hodish, Associate Director (Financial Management), Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov

i. Comments on the Finding and Each Recommendation – We acknowledge the finding. The Organization utilized an informal practice to address processing timing di􀆯erences for rental assistance payments; however, the practice was not formally documented and was not applied consistently. Management recognizes the need for written policies and adequate supporting documentation when adjustments are made a􀆯ecting the timing of rental assistance payments and will review and revise its current policies and procedures to ensure appropriate documentation when future programs of similar nature exist. Additionally, this federal funding program has come to an end. ii. Actions Taken on the Finding – We will review our internal processes and procedures to ensure adequate and consistent processes and procedures are followed for programming and appropriate supervisory review exists across program areas.

2025-003: Period of Performance Compliance Action Taken/Planned: Management acknowledges the instances identified in which disbursements were processed after the award's period of performance. While no questioned costs were noted, the University recognizes that timely processing of expenditures and drawdowns is critical to ensuring compliance with federal requirements governing grant periods. To Strengthening Grant Closeout Procedures management will establish a formal grant closeout timeline to begin 90 days prior to the award end date, require principal investigators (PIs) and grant administrators to review all outstanding obligations and ensure timely submission of final expenses and implement a standardized closeout checklist to confirm all costs are recorded within the allowable period To Enhanced Monitoring of Grant Periods management will develop and maintain a centralized tracking system for all federal awards, including start and end dates, generate monthly reports identifying grants nearing expiration (within 90, 60, and 30 days) and distribute reports to Pis, Grants Accounting, and Finance leadership for proactive management. For timely processing and drawdown controls management will require all invoices and expenditures to be submitted within a defined timeframe (e.g., within 30 days of service or project completion), establish internal deadlines for processing disbursements and drawdowns prior to the grant end date and implement a review step within Grants Accounting to verify that expenses fall within the period of performance before payment is released. The grants department will conduct mandatory training for PIs, grant managers, and finance staff on period of performance requirements and federal compliance expectations and reinforce accountability for timely submission and processing of expenditures Management will also put in place for any costs identified outside the period of performance will require, documented justification, review and approval by the Director of Grants Accounting and CFO, and verification of allowability under award terms or sponsor approval, if applicable. Anticipated Completion Date/Date Completed: This will be implemented immediately with an anticipated completion date of June 30, 2026

Finding 2025-001 – Internal control deficiency over Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance, Reporting, and Special Tests and Provisions. Condition: Management did not design effective internal controls to retain documentation to evidence the operating effectiveness of the internal controls over the project and related expenses submitted to FEMA for reimbursement. Resolution: Management will develop and implement additional internal controls to ensure that adequate documentation is retained to evidence the design and operating effectiveness of controls over FEMA-related expenditures. These internal controls will be designed to ensure that expenses included in FEMA grant applications are complete, accurate, and allowable in accordance with program requirements. Specifically, management will implement a reconciliation process comparing detailed application expenses to the corresponding final paid invoices or payroll expenditures. As part of this process, each expense will be reviewed and annotated to confirm its allowability under FEMA guidelines. The reconciliation will be subject to review and approval by the Cottage Health Vice President of Finance prior to submission of the FEMA application. Evidence of this review and approval will be formally documented and retained. Contact Person: Lawrence Thomas, Vice President of Finance Anticipated Completion Date: December 31, 2026 (The entity has not incurred expenditures under the FEMA program subsequent to the period under audit. Accordingly, the corrective actions described above will be implemented on a prospective basis, contingent upon the entity incurring future FEMA-related expenditures).

Internal Controls over Compliance and Compliance with the Period of Performance Compliance Requirement Contact: Katie Queen Dossinger Title: Chief Operating Officer Phone Number: 202-785-0072 Estimated Completion Date: Ongoing Corrective Action The results of the 2025 audit will be shared with appropriate PSI and EGPAF staff and reinforced through training to ensure adequate attention and clear guidance on the allowability of trailing costs and the unallowability of newly incurred costs.

The Finance Department staff will review all items prior to completing the report. Personnel responsible for implementation: Carmen Tsui, Grant Accountant Completion Date: June 30, 2026

Finding 2025-002 – Significant Deficiency and Noncompliance - Lack of Required Uniform Guidance Policies and Procedures Condition: The City did not update their federal policies and procedures to be in full compliance with Uniform Guidance. Corrective Action: The City is in the process of updating and adopting written policies and procedures that are in compliance with Uniform Guidance. Anticipated Completion Date: December 31, 2026 Responsbile Official: John Szymanski, City Manager

Finding #2025-011 14.267 Continuum of Care Period of Performance Views of Responsible Officials and Planned Corrective Action Management’s Position: Condition 1, 2, & 4 Management concurs with the finding. The questioned cost relates to a payroll charge that was initially assigned to a subsequent CoC Planning Grant during the payroll reimbursement process because funding was available under that grant after the prior funding source had been exhausted. During the drawdown review, management identified that the pay period occurred prior to the start of the grant’s period of performance and therefore was not eligible to be charged to that federal award. Upon identification of the issue, the payroll cost was excluded from the reimbursement request and was not included in a federal drawdown. The appropriate corrective action was to reclassify the expense from the CoC Planning Grant to a local funding source. However, at the time the issue was identified, the accounting staff responsible for overseeing payroll reimbursements and related accounting adjustments were in the process of transitioning responsibilities. As a result, while the ineligible cost was not reimbursed with federal funds, the required accounting reclassification was not completed until the subsequent fiscal year. Corrective Actions: Management has strengthened and formalized its payroll reimbursement review procedures to ensure that grant period-of-performance requirements are verified prior to classification of payroll expenses. Management has also established procedures for documenting and tracking identified exceptions to ensure that required accounting adjustments are completed timely and reviewed by supervisory personnel. The RPE Accounting Department will be responsible for ensuring payroll reimbursement classifications are reviewed for compliance with applicable grant period-of-performance requirements. Accounting personnel responsible for payroll reimbursements and related accounting adjustments will maintain documentation of identified exceptions and ensure required adjustments are completed and reviewed by supervisory personnel. Condition 3 Management does not concur with the finding. Explanation of Disagreement: The Manual Journal Voucher (MJV) referenced by the auditor reflects a reclassification of payroll costs between federal grants. While the payroll expenditure relates to a pay period ending June 14, 2025, the expenditure was not ultimately charged to the grant with a period of performance ending December 31, 2024. The purpose of the MJV was to remove the payroll expenditure from the original grant and reclassify it to the appropriate federal grant. The corresponding entry within the same journal voucher charged the expenditure to a grant whose period of performance encompassed the payroll pay period. As a result, the payroll expenditure was not charged to a federal award outside of its period of performance. Management believes the exception resulted from reviewing only one side of the reclassification entry rather than the complete transaction. The supporting MJV demonstrates that the expenditure was removed from the grant with the expired period of performance and reassigned to the appropriate federal award. Accordingly, management respectfully requests reconsideration of this exception. Responsible Party: Katherine Taitano, Chief Planner Anticipated Date of Completion: Condition 1, 2, & 4 The enhanced payroll reimbursement review procedures and exception tracking procedures have been implemented.

Subject: 2025 Single Audit Finding 2025-004 2025-004 Management Response: Management acknowledges the finding. DEMRS did not submit the required quarterly financial and performance reports to the Illinois Emergency Management Agency (IEMA) for the Homeland Security Grant Program during the fiscal year. Root Cause Analysis: Over multiple years, DEMRS experienced significant turnover in key finance and grant management positions, which created gaps in continuity and delayed the department's transition to IEMA's Amplifund reporting system. As prior management departed and new staff were onboarded, the department faced operational challenges that affected the consistency of its grant reporting processes. Due to Amplifund's requirement that reimbursement requests be submitted sequentially before performance reports can be filed, the delays in prior period submissions prevented DEMRS from accessing and submitting the quarterly reports. Statewide pauses in FEMA and IEMA grant processing further contributed to the backlog. Corrective Action: DEMRS will complete and submit all outstanding reimbursement requests and performance reports for UASI 2022, UASI 2023, and UASI 2024 to bring the County into full compliance with grantor requirements. Preventive Action: DEMRS will implement a grants compliance calendar that tracks all reporting deadlines. Future reports will be prepared by the Manager of Grants & Contracts and reviewed and approved by the Associate Director of Finance, with documented evidence of review. Responsible Party: Damian Albert, Associate Director of Finance, damian.albert@cookcountyil.gov. 312.603.8177 Tina Bhaga, Manager, Grants & Contracts, tina.bhaga@cookcountyil.gov, 312.603.8543 Planned Completion Date: January 1, 2027

Memo: Cause and Corrective Action Plan for Finding 2025-003 This correspondence serves as Cook County Health (CCH) and Cook County Department of Public Health (CCDPH) response to Finding 2025-003. During the FY2025 Single Audit, one audit finding was identified by Washington, Pittman & McKeever, LLC. The root cause and corrective action plan is identified below. Condition During the current audit period, the Cook County Department of Public Health (DPH) did not comply with federal regulations regarding the use and reporting of program income as it relates to funds awarded through the RWHAP Root Cause Analysis The HIV grants transitioned to CCH from an external organization in July 2025. Award amounts were granted in multiple phases, requiring four budget revisions, with the final revision approved in December 2025. The contractual period covered March 2025 through December 2025. During the transition period, CCH lacked formal operational procedures to identify, record, and track program income. Several operational and administrative challenges contributed to this issue, including: • No written internal procedures were in place to define or track program income requirements. • No formal transition teams were established to identify core grant obligations, resulting in unclear interpretation of sponsor requirements. • CCH had not yet identified the appropriate internal systems or interdepartmental collaborations necessary to retrieve and reconcile program income data. • Organizational priorities during the transition focused on maintaining existing deliverables, including vouchering, budget compliance, hiring, and onboarding of direct and administrative staff. • Staffing Shortages, CCH onboarded personnel quickly as contractual employees, direct staff transitioned onboard as CCH employees in phases upon execution of grant contracts. Corrective Action Plan CCH Director of Grants Accounting is implementing formal written processes and procedures to ensure compliance with Federal Uniform Guidance requirements related to program income. The corrective action plan includes: • Developing standardized written procedures that clearly define program income requirements and tracking responsibilities. • Establishing shared roles and responsibilities across departments to support consistent data collection, reconciliation, and reporting. • Identifying the specific data elements required to accurately record and monitor program income. • Formalizing interdepartmental collaboration processes necessary to retrieve and validate program income information. • Defining the systems and reporting tools that will be used to track and maintain program income records. • Providing staff training on program income requirements, documentation standards, and compliance expectations. These actions will strengthen internal controls and ensure timely, accurate identification and tracking of program income moving forward, official approval/implementation is expected December 2026

Corrective Action Plan: Management concurs with the findings. Sheltering Arms has strengthened its grant accounting, financial close and reporting controls to ensure that grant revenue, receivables, expenses, refundable advances and SEFA amounts are recorded accurately and in the appropriate reporting period. During fiscal year 2025, the Finance department experienced significant personnel changes. New management performed a transaction review to determine whether transactions were properly allocated and recorded. During this review, several transactions totaling $741,113 were identified as having been allocated to the incorrect fiscal period. In addition, the $357,774 liability resulted from an adjustment made by a contractor in March 2025 that incorrectly allocated CACFP revenues and related expenses to fiscal year 2024. Responsible Party: Chief Financial Officer, with support from the Finance Team. Anticipated Completion Date: Updated processes have been implemented and are currently in operation to mitigate the risk of future findings. Monitoring Plan: Management will perform monthly reviews of grant reconciliations, cost transfers, and significant grant-related journal entries to ensure transactions are recorded accurately, supported by appropriate documentation, and recognized in the proper reporting period.

Due to inadequate monitoring of grant deadlines and project implementation timelines, the Organization did not obligate certain federal funds before the expiration of the award period. As a result, a portion of the awarded funds remained unused and was no longer available for program activities. The Organization will implement enhanced grant management procedures to ensure that federal funds are obligated and utilized within the approved period of availability. Corrective actions include: 1. Maintaining a centralized grant tracking system that identifies award periods, obligation deadlines, expenditure deadlines, and closeout requirements. 2. Requiring quarterly reviews of grant balances and project progress by program and finance personnel. 3. Establishing written procedures for monitoring unobligated balances and addressing delays in project implementation. Providing training to program managers and fiscal staff regarding federal grant requirements, including obligation and period-of-performance requirements. Requiring management review of all federal awards at least 90 days prior to expiration to identify and address any risk of unexpended or unobligated funds. Anticipated Completion Date: Immediately

Camillus House acknowledges the finding and has implemented and is continuing to enhance corrective actions as follows: Control Procedures • Verify costs fall within grant period prior to posting Review Controls • Require supervisory approval Monitoring • Quarterly compliance testing

The University of the District of Columbia (UDC) agrees with the conditions and recommendations of this finding. The Office of Financial Aid experienced staff turnover, which impacted the timeliness of reporting submissions to the Common Origination and Disbursement (COD) system. This challenge was further compounded by the need to train and cross-train staff to ensure continuity in reporting responsibilities. To address this issue, the office has identified and trained two staff members who are capable of originating and submitting enrollment reporting to COD. Additionally, we have implemented enhanced internal controls, including weekly reporting processes, to ensure compliance with all required deadlines. These measures are designed to ensure that records are submitted within the mandated 15-day timeframe.

FINDING – Federal Award Finding 2025-001: Agency: U.S. Department of Health and Human Services (CSBG) Program: Community Service Block Grant (AL No. 93.569) Significant Deficiency and Noncompliance over Allowable Costs / Period of Performance Repeat Finding: No Condition: During our testing over allowable costs, we identified 2 transactions in the amount of $38,225 that were incurred in fiscal years 2022 and 2023; however, those costs were recorded as federal expenditure and revenue in fiscal year 2025. The current CSBG grant covering fiscal year 2025 covers the period October 1, 2024 – September 30, 2025, as such, those costs were recorded outside of the period of performance and as such are unallowable. Recommendation: We recommend that management strengthen controls over the timing of federal expenditure recognition to ensure costs are recorded in the proper period of performance. Additionally, the entity should implement procedures to review and reconcile expected expenses to actual invoices received on a periodic basis to ensure all vendor invoices have been timely received. Auditee Response and Corrective Action Plan: UPO has recently implemented two methods for procuring goods and services to address the noted condition. Use of the P-Card for micropurchases and the Purchase Request for larger purchases. P-Card purchases will allow recurring vendor invoices and payments to be captured in real time and recorded in the appropriate billing and funding period. Mandatory use of Purchase Request/PO for all other purchases, to allow the program and finance team to monitor invoices and obligations, and record them within the funding period.

Management’s Action Plan: Management concurs with the findings. The deficiency was due to a lapse in management oversight related to the review and approval of independent contractor timesheets. To strengthen internal controls and ensure compliance with federal requirements, management has implemented corrective actions through the full implementation of a new enterprise resource planning system, Fusion. Under this process, all timecards are now entered, reviewed, and approved directly within Fusion and cannot be processed for payment unless they have been formally approved by appropriate management personnel. This ensures proper documentation, accountability, and adherence to internal control policies. Name of Person Responsible for the Plan: Katherine Hill, Manager of Accounting Jason Lynn, Vice President of Finance and Controller Anticipated Completion Date of the Plan: Completed – fully implemented with the rollout of the Fusion system (May 2025).

We concur with the finding and are implementing procedures to address all issues. The untimely submission of the SF-425 resulted from deficiencies in internal controls during the fiscal year end closeout process. Specifically, responsibilities for tracking and submitting required federal reports were not sufficiently defined, and monitoring procedures did not ensure that reporting deadlines were met. CAP is implementing corrective actions to strengthen its reporting processes. These actions include establishing a formal reporting calendar that identifies all required federal reporting deadlines, clearly assigning responsibility and backup responsibility for report preparation and submission, and implementing a documented supervisory review process to verify that reports are submitted timely. These corrective measures are intended to ensure compliance with reporting requirements and improve accountability. CAP expects these actions to be fully implemented by 30 September 2026.

The Alabama Law Enforcement Agency will strengthen its procedures to ensure expenditures are charged only within the approved period of performance for each federal grant. Grant period dates will be monitored and reviewed by multiple divisions, including the Grants Section, Payroll Section, and Programs Office, to provide additional oversight and verification. Because payroll expenditures are reported and reimbursed on a cash basis and the State payroll expense is in arrears, payroll funding allocations will be reviewed and updated prior to the end of the grant period. Specifically, grant-funded payroll charges will be evaluated at least 30 days before the grant expiration date to ensure that costs incurred after the period of performance are not charged to the grant. These enhanced monitoring and review procedures will help ensure compliance with federal grant requirements and prevent future charges outside the approved grant period.

Finding: 2025-002 Reportable finding considered a material weakness-Expenses incurred outside of the period of performance Effect: The organization claimed and was reimbursed for unallowable costs under 2 CFR 200.458. Failure to maintain effective controls over cost allowability increases the risk of noncompliance questioned costs, and potential repayment of federal funds. Questioned costs: Known questioned costs of $403,805 were identified by reviewing each transaction prior to the date and for the month after the award began to ensure there are no likely questioned costs. Recommendation for the organization from the auditor: • Formalize and implement written policies and procedures governing identification, approval, and accounting for pre-award costs. • Require documented written approval from the federal awarding agency prior to charging any pre-award costs to federal awards. • Provide training to program and finance personnel on Uniform Guidance cost allowability requirements, including 2 CFR 200.458 and 2 CFR 200.403. • Implement supervisory review controls to ensure costs charged to federal awards are incurred within the approval period of performance or have documented prior approval. Corrective Action Plan for Pre-award costs Management acknowledges the audit finding that pre-award costs were charged to multiple federal awards for expenses incurred before the approved period of performance beginning October 1, 2024. The costs were incurred without the required written prior approval from the Maryland Department of Labor (MD DOL), the pass-through entity. As a result, unallowable costs were reimbursed and later removed from the Schedule of Expenditures of Federal Awards (SEFA). Management determined that the issue resulted from insufficient internal controls, the absence of formal written procedures for pre-award costs, and gaps in staff understanding of Uniform Guidance requirements. To address these root causes, the organization adopted a formal written policy governing the identification, approval, documentation, and accounting of pre-award costs. The policy requires written prior approval from MD DOL before any pre-award costs may be incurred or charged to a federal award and establishes documentation, retention, and accounting standards to support compliance with 2 CFR 200.458 and 2 CFR 200.403. Third, the organization also implemented a mandatory written approval workflow requiring program and grants staff to prepare and submit a formal request to MD DOL whenever pre-award costs are anticipated. No costs may be incurred until written approval is received. Approval documentation must be retained in both the official grant file and the accounting system. This workflow is now part of the grant start-up process for all federal awards. Fourth, the organization strengthened supervisory review controls to ensure that all costs charged to federal awards fall within the approved period of performance or have documented prior approval. These controls include a pre-posting cost allowability checklist, supervisory review and approval of all federal charges, and accounting system alerts that flag costs incurred outside the period of performance. Additionally, the Compliance Officer will conduct quarterly internal compliance reviews to verify adherence to federal requirements and internal policies. Finally, the organization implemented preventive measures to ensure long-term compliance. These include maintaining a centralized grant calendar with period-of-performance dates, requiring dual review of costs charged during the first 90 days of new awards, and conducting semi-annual internal audits of federal expenditures. Any discrepancies identified will be reported to senior leadership within five business days. Management is committed to ensuring full compliance with Uniform Guidance and MD DOL requirements. All corrective actions described above have been implemented or will be fully implemented by July 31, 2026. The organization believes these actions sufficiently address the audit findings and significantly strengthen internal controls over federal award management. Corrective Action Plan Summary Corrective Action Responsible Staff/Role Target Completion Date Evidence of Completion Develop and implement formal Pre-award Cost Policy Finance Director June 1, 2026 Final approved policy; distribution email; policy posted to shared drive Establish mandatory written prior approval workflow Finance Director June 30, 2026 Completed approval request template; sample approval documentation; updated grant file checklist Conduct Uniform Guidance training Compliance Officer July 31, 2026 Training materials; attendance logs; post-training assessments Implement supervisory review controls Finance Director June 30, 2026 Completed checklists; system screenshots; supervisor sign-offs Perform quarterly internal compliance reviews Compliance Officer Quarterly, ongoing Quarterly review reports; corrective action memos (if applicable) Maintain centralized grant calendar Director of Performance and Compliance June 30, 2026 Updated grant calendar; access logs or distribution email Conduct semi-annual internal audits Compliance Officer Semi-annual, ongoing Internal audit reports; follow-up documentation Dual review of early-period charges Finance Director; Grants Manager July 1, 2026 Dual-review sign-off forms; documented approvals

Audit Finding Reference: 2025-003 Improve Controls over Period of Performance Planned Corrective Action: The District has strengthened its grant management and closeout procedures to ensure that all expenditures charged to federal awards are incurred, processed, and paid within the applicable period of performance. Specifically, the District will: 1. Implement a formal grant closeout checklist that includes a review of all open purchase orders, encumbrances, unpaid invoices, and outstanding obligations prior to submission of final expenditure reports. 2. Require reconciliation of grant expenditures between the Grants Office, Special Education Department, and Business Office before final grant reports are submitted. 3. Establish periodic reviews of open encumbrances throughout the year to identify outstanding obligations and ensure timely processing of invoices. 4. Designate backup personnel and document grant management procedures to ensure continuity during staffing transitions or vacancies. 5. Require supervisory review and approval of all grant closeout documentation to verify that all allowable expenditures have been recorded and reported appropriately. 6. Provide training to personnel responsible for grant administration and financial reporting regarding federal period-of-performance requirements and grant closeout procedures. Planned Implementation Date of Corrective Action: The revised grant monitoring and closeout procedures have been implemented for all active federal grants and will be fully incoiporated into the District's grant management process beginning with the current fiscal year. Person Responsible for Corrective Action: Grants Manager Signature Derek Pinto, Assistant Superintendent of Finance

Views of Responsible Officials and Planned Corrective Actions: The Crossett Housing Authority Director will immediately seek guidance from HUD officials and MRI/Lindsey to remedy this problem.

Finding 2025-047 Refugee and Entrant Assistance State/Replacement Designees Administered Programs, ALN 93.566 - Salesforce Security Management and Access Controls Management Views LEO agrees with the finding. For part a., the LEO Office of Global Michigan (OGM) maintains a limited number of internal Salesforce user licenses. As a result, internal user access is inherently constrained and proactively monitored based on employment status. LEO OGM’s existing process for validating continued need is tied to personnel changes: internal user access remains appropriate as long as the employee occupies a position with assigned Salesforce responsibilities, and access is removed when employees separate or move to roles that do not require use of the system. Because license allocation is strictly managed and user roles are position-based, LEO OGM has considered this process to constitute ongoing monitoring rather than an annual recertification process. However, LEO OGM acknowledges that this practice does not fully meet the specific requirement for a documented annual review as noted in SOM Technical Standard 1340.00.020.01 (Access Control Standard). Planned Corrective Action For part a., LEO OGM will formalize and implement an internal user account review process, including conducting and documenting an annual review of all user access accounts in accordance with the Access Control Standard. For part b., LEO OGM will work collaboratively with program and system administrators to strengthen controls around identifying and timely deactivating inactive internal and external user accounts. LEO OGM will establish clearer procedures, increase review frequency, and document the actions taken to ensure accounts exceeding inactivity thresholds are disabled consistently and timely. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Ben Cabanaw, LEO Nicole Adams, LEO

Finding 2025-026 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - Insufficient Respite Payment Controls Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS implemented a post payment review process for the final respite payments issued through the Medical Services Administration Manual Payment System during fiscal year 2025 and finalized the review during fiscal year 2026, noting no improper payments. As all respite payments concluded at the end of fiscal year 2025, this review is no longer applicable moving forward. Anticipated Completion Date Completed Responsible Individual(s) Crystal Kline, MDHHS

Finding 2025-025 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - PTMS Security Management and Access Controls Management Views MDOT agrees that security management and access controls should be fully established for the Public Transportation Management System (PTMS). Planned Corrective Action Because PTMS is a legacy system that is being retired, MDOT will not re-create historical user data that was deleted due to a system limitation. Rather, MDOT EIM and the MDOT Office of Passenger Transportation (OPT) will collaborate and provide oversight to ensure that the new system, the Public Transportation Information Management System (PTIMS), which is scheduled for full implementation August 31, 2026, has fully established security management and access controls and that there is pertinent documentation regarding users’ roles. Also, EIM and OPT will continue to ensure that PTMS, and PTIMS after its implementation, user access is reviewed at least annually in accordance with SOM Technical Standard 1340.00.040.01 (Audit and Accountability Standard). Under the existing process, the designated system security administrators obtain, verify, and document the written approval for all identified users, and access is modified/removed timely and as appropriate based on responses received or removed when no response is received. Anticipated Completion Date September 2026 Responsible Individual(s) Sandy Lovell, MDOT Gina Huhn, MDOT Jean Ruestman, MDOT Kyle Nelson, MDOT Andy Esch, MDOT

Finding 2025-024 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027 - MiSSG Security Management and Access Controls Management Views MiLEAP agrees with the finding. Planned Corrective Action For part a., for the exceptions noted in the finding, MiLEAP had the contractors complete the access forms and has approved their access. MiLEAP also updated its procedures to ensure that contractors complete the Michigan Student Aid Scholarships and Grants (MiSSG) access forms before access is granted to the system. For part b., MiLEAP updated its procedures to ensure that it maintains sufficient documentation of its recertification review of internal users. Anticipated Completion Date Completed Responsible Individual(s) Diann Cosme, MiLEAP