Corrective Action Plans

Finding 1201438 (2025-003)

Material Weakness 2025

CA

Subrecipient Monitoring Material Weakness Reporting

Program: Community Development Block Grant Federal Financial Assistance Listing Number: 14.218 Federal Grantor: U.S. Department of Housing and Urban Development Award No. and Year: B-24-UC-06-0504 and 2025; B-20-UW-06-0504 and 2021 Compliance Requirements: Reporting Type of Finding: Material Weaknes...

Program: Community Development Block Grant Federal Financial Assistance Listing Number: 14.218 Federal Grantor: U.S. Department of Housing and Urban Development Award No. and Year: B-24-UC-06-0504 and 2025; B-20-UW-06-0504 and 2021 Compliance Requirements: Reporting Type of Finding: Material Weakness in Internal Control over Compliance and Material Instance of Noncompliance Criteria: CFR Appendix A to Part 170I(a)(2), Reporting Requirements, states the recipient must report each subaward to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward was issued. Condition: During our testing of the County’s compliance with reporting requirements, we noted the County did not submit the required subaward data to FSRS. Cause: The department was unaware of this compliance requirement. Effect: Reports were not submitted to FSRS in accordance with the reporting requirements per Appendix A to Part 170I(a)(2). Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling : We identified that the FFATA reporting was not completed as required by 2 CFR Part 170 for the following instances: (Refer to Chart/Table to Finding 2025-003) Repeat Finding from Prior Years: No. Recommendation: We recommend that the County adhere to their policies and procedures in accordance with 2 CFR Appendix A to Part 170I(a)(2). Management Response and Corrective Action Plan: 1. Person Responsible: Francisco Padilla, Community Development Analyst 2. Corrective action plan: Concur. We will adhere to our policies and procedures to ensure reports are submitted to FSRS in accordance with 2 CFR Appendix A to Part 170I(a)(2). 3. Anticipated Implementation date: April 30, 2026

View Audit 395982

Finding 1201404 (2025-004)

Material Weakness 2025

City of Perris

CA

Subrecipient Monitoring Reporting

The City has commenced the preparation of the FFATA report and is working toward full compliance with reporting requirements. The corrective action is expected to be fully implemented by Fiscal Year 2025/2026. The contact persons for this corrective action are Sabrina Chavez, Director of Public Serv...

The City has commenced the preparation of the FFATA report and is working toward full compliance with reporting requirements. The corrective action is expected to be fully implemented by Fiscal Year 2025/2026. The contact persons for this corrective action are Sabrina Chavez, Director of Public Services, and Martin E. Martinez, Principal Management Analyst, of the City of Perris.

View Audit 395981

Finding 1201396 (2025-005)

Material Weakness 2025

Eastern Carolina Human Services Agency, Inc.

NC

Allowable Costs / Cost Principles HUD Housing Programs Reporting

Finding: 2025-005 Name of Contact Person: Linda Higuet, Interim Finance Director Corrective Action: Management will make organizational changes as needed to ensure that each program is self-sustaining. Upper level management will obtain training for allowable costs/cost principles and activities all...

Finding: 2025-005 Name of Contact Person: Linda Higuet, Interim Finance Director Corrective Action: Management will make organizational changes as needed to ensure that each program is self-sustaining. Upper level management will obtain training for allowable costs/cost principles and activities allowed/unallowed under the Uniform Guidance and specific program regulations. Additionally, all upper level management will obtain training for financial and program specific reporting. Financial reports will be reviewed monthly by program directors, and program specific reporting will undergo monthly review by program directors. Proposed Completion Date: As soon as possible.

View Audit 395970

Finding 1201312 (2025-001)

Material Weakness 2025

University of San Diego

CA

Special Tests & Provisions Student Financial Aid Reporting

Corrective Action Plan – Management concurs with this finding. The exceptions resulted from two distinct scenarios: 1) An official withdrawal processed manually outside the standardized workflow. 2) An unofficial withdrawal triggered by a grade change submitted after the final grade deadline. In Fal...

Corrective Action Plan – Management concurs with this finding. The exceptions resulted from two distinct scenarios: 1) An official withdrawal processed manually outside the standardized workflow. 2) An unofficial withdrawal triggered by a grade change submitted after the final grade deadline. In Fall 2024, an undergraduate student’s official withdrawal was completed late in the semester. The Dean requested a Torero Hub Counselor to manually remove the course, bypassing the standardized workflow. While the Counselor notified the Registrar’s Office, the Office of Financial Aid was not included in the communication chain. To address this gap, the Office of Financial Aid will implement a biweekly report to monitor and verify any changes to student withdrawal statuses that fall outside the automated workflow. Management believes this enhancement will effectively prevent similar errors in the future. The second exception involved a Professional and Continuing Education (PCE) student. After the final grade submission deadline, the instructor updated the student’s grade to an ‘F’, which retroactively classified the student as an unofficial withdrawal. This change occurred after the Office of Financial Aid had already run the final Fall 2024 unofficial withdrawal report. PCE has been notified that grade changes are not permitted after the final grade deadline. Additionally, the Office of Financial Aid will now run the unofficial withdrawal report biweekly beyond the final grade due date to identify and verify any late changes to student withdrawal statuses. Management believes these measures will mitigate the risk of future occurrences. Completion date: September 2025 Persons responsible: Kellie Nehring, Director of Financial Aid and Diana Hannasch-Haag, Director of Retention – Online Degree Programs

View Audit 395955

Finding 1201299 (2025-007)

Material Weakness 2025

State of Hawaii, Department of Accounting and General Services

HI

Procurement, Suspension & Debarment Subrecipient Monitoring Material Weakness

Finding No. 2025-007 ALN No. 11.419 Program Title: Hawaii Coastal Zone Management Program Grant Award No.: NA22NOS4190022 NA23NOS4190139 NA24NOSX419C0023 NA22NOS4190065 Condition Accuity noted that the State did not submit FFATA reports for most of the active grant agreements open for the program. C...

Finding No. 2025-007 ALN No. 11.419 Program Title: Hawaii Coastal Zone Management Program Grant Award No.: NA22NOS4190022 NA23NOS4190139 NA24NOSX419C0023 NA22NOS4190065 Condition Accuity noted that the State did not submit FFATA reports for most of the active grant agreements open for the program. Corrective Action Plan DBEDT OPSD will strengthen internal controls over subaward identification and reporting. This will include hiring and training staff to support federal grant administration and management-level review of all subawards to ensure FFATA reporting is complete and timely. Person Responsible Mary Alice Evans, Director of Office of Planning and Sustainable Development Anticipated Date of Completion April 1, 2026

View Audit 395953

Finding 1191772 (2025-007)

Material Weakness 2025

Northeastern Illinois University

IL

Subrecipient Monitoring Reporting

Condition: Northeastern Illinois University (University) did not report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) for the Higher Education Institutional Aid grants. Planned Corrective Action: The University wil...

Condition: Northeastern Illinois University (University) did not report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) for the Higher Education Institutional Aid grants. Planned Corrective Action: The University will review applicable guidelines and assign the responsibility to the appropriate office. Contact person responsible for corrective action: Jannica Henry, Controller’s Office Anticipated Completion Date: 6/30/2026

View Audit 395581

Finding 1191771 (2025-008)

Material Weakness 2025

Northeastern Illinois University

IL

Subrecipient Monitoring Cash Management Reporting § 200.305

Condition: Northeastern Illinois University (University) did not pay reimbursements within 30 days for certain subrecipients in the Research and Development Cluster. Planned Corrective Action: The University will explore procedures to address this issue. Contact person responsible for corrective act...

Condition: Northeastern Illinois University (University) did not pay reimbursements within 30 days for certain subrecipients in the Research and Development Cluster. Planned Corrective Action: The University will explore procedures to address this issue. Contact person responsible for corrective action: Jannica Henry, Controller’s Office Anticipated Completion Date: 6/30/2026

View Audit 395581

Finding 1191769 (2025-003)

Material Weakness 2025

Northern Manhattan Improvement Corporation

NY

Reporting

Management agrees with the finding. Although reports were submitted timely, certain required programmatic data (units completed) was not included, resulting in unsupported expenditures and disallowed costs. This reflects a breakdown in coordination between program and finance, and the absence of a s...

Management agrees with the finding. Although reports were submitted timely, certain required programmatic data (units completed) was not included, resulting in unsupported expenditures and disallowed costs. This reflects a breakdown in coordination between program and finance, and the absence of a structured process to ensure complete and accurate reporting prior to submission. The root cause is lack of defined roles, standardized workflows, and formal review controls governing integration of programmatic and financial reporting. The corrective actions are: (1) Define roles and responsibilities across program, finance, and Controller; (2) Implement standardized reporting checklists by program; (3) Establish pre-submission review and signoff process with cross-functional validation; (4) Formalize handoffs between program and finance, including timelines and escalation protocols; and (5) Provide training on grant reporting requirements and compliance. The parties responsible are the CFAO, Director of Finance, and Program Leadership. We expect to complete initial implementation in 30 days and full implementation in 120 days.

View Audit 395580

Finding 1191764 (2025-001)

Material Weakness 2025

City of Huntington Park

CA

Reporting Procurement, Suspension & Debarment Internal Control / Segregation of Duties

Management Response and Corrective Action Plan City’s Response: The City concurs with the recommendation. Corrective Action Plan: The City’s finance department has taken over reporting duties and has ensured all reporting related to CSLFRF is done on a timely basis. Planned Implementation Date: Reso...

Management Response and Corrective Action Plan City’s Response: The City concurs with the recommendation. Corrective Action Plan: The City’s finance department has taken over reporting duties and has ensured all reporting related to CSLFRF is done on a timely basis. Planned Implementation Date: Resolved, implemented in December of 2024. Responsible Person: Director of Finance

View Audit 395569

Finding 1191761 (2025-003)

Material Weakness 2025

County of Los Angeles

CA

Subrecipient Monitoring Internal Control / Segregation of Duties Special Tests & Provisions

Views of Responsible Officials and Planned Corrective Action 1. Person responsible: Deputy Director, Department of Public Health 2. Corrective action plan: DPH agrees with the finding and recommendation. VPDCP will develop and implement written procedures for the centralized and secure storage of do...

Views of Responsible Officials and Planned Corrective Action 1. Person responsible: Deputy Director, Department of Public Health 2. Corrective action plan: DPH agrees with the finding and recommendation. VPDCP will develop and implement written procedures for the centralized and secure storage of documentation supporting grant deliverables and required progress reports. The procedures will include, at a minimum, the following: • Define required documentation, storage location, staff responsibilities, and retention requirements. • Require all supporting documentation to be maintained in a designated centralized repository and ensure documentation is complete, organized, and readily accessible for review. • Detail the steps during staff transitions that new staff must follow to access, maintain, and update grant-related documentation, ensuring consistency and completeness of records. VPDCP will perform periodic reviews of the centralized repository and formally document and sign-off on the reviews to verify that required documentation is maintained. 3. Anticipated implementation date: June 19, 2026

View Audit 395559

Finding 1191750 (2025-008)

Material Weakness 2025

School District of the City of St. Louis

MO

Subrecipient Monitoring Cash Management Reporting

Personnel Responsible For Corrective Action: Kelly Dobell, Controller, Square Watson, Chief Operations Officer, and Spencer Winn, Director of Food and Nutrition Services Anticipated Completion Date: June 30, 2026 Corrective Action Plan: Food and Nutrition Services along with Finance will implement p...

Personnel Responsible For Corrective Action: Kelly Dobell, Controller, Square Watson, Chief Operations Officer, and Spencer Winn, Director of Food and Nutrition Services Anticipated Completion Date: June 30, 2026 Corrective Action Plan: Food and Nutrition Services along with Finance will implement procedures for review and reconciliation of lunch count data with claims reports in accordance with the Uniform Guidance.

View Audit 395555

Finding 1191748 (2025-001)

Material Weakness 2025

Woodridge Nonprofit Corporation 044-11116

MI

Reporting Significant Deficiency Internal Control / Segregation of Duties

Condition: The Organization paid out management fees in excess of allowable amount per the Management Agent’s Certification agreement. Planned Corrective Action: The excess management fees will be reversed out of the Corporation for the year ended December 31, 2026, thus adjusting the fees to the al...

Condition: The Organization paid out management fees in excess of allowable amount per the Management Agent’s Certification agreement. Planned Corrective Action: The excess management fees will be reversed out of the Corporation for the year ended December 31, 2026, thus adjusting the fees to the allowable amount. Management acknowledges noncompliance in the current year and is currently reviewing internal controls related to management fees going forward. Contact person responsible for corrective action: Michael McMillan, Director of Finance / President Anticipated Completion Date: 12/31/2026

View Audit 395543

Finding 1191747 (2025-001)

Material Weakness 2025

Talbot County, Maryland

MD

Reporting

Response to Finding 2025-001 Timely Filing of SF-425, Federal Financial Report (FFR) (Federal Award Finding) An SF-425 annual report, covering the period ending September 30th, is due within 90 days of the reporting period for each open Airport Improvement Program (AIP) that receives funding from th...

Response to Finding 2025-001 Timely Filing of SF-425, Federal Financial Report (FFR) (Federal Award Finding) An SF-425 annual report, covering the period ending September 30th, is due within 90 days of the reporting period for each open Airport Improvement Program (AIP) that receives funding from the Federal Aviation Administration (FAA). Prior to submission, Talbot County ensures the accuracy of each financial report by reconciling amounts between various sources, including vendor invoices, SF-271 forms, Talbot County’s ERP/accounting system, and the FAA’s web-based electronic invoicing and grant payment portal system (Delphi). While this multi-step verification process supports the accuracy of financial reports, it remains highly manual and is constrained by increasing workloads, limited resources, and a lean workforce. This challenge has intensified and become more apparent over the last few years due to the recent surge in the number of open and active AIPs. Further compounding the issue were delayed responses from the FAA and the Federal government shutdown that occurred from October 1, 2025 to November 12, 2025. During this 43-day period, Talbot County staff were unable to effectively communicate with the FAA to verify essential financial data necessary to complete the SF-425 reports. Auditee’s Corrective Action Plan: Talbot County’s corrective action plan focuses on evaluating the current workflow to identify bottlenecks (points of constraint) and opportunities to leverage technology and improve efficiency. Ultimately, a clearly defined grant process will be implemented that establishes roles, responsibilities, and expectations for staff. Increasing the frequency of grant tracking and reconciliation activities throughout the year will be a key component, as this will mitigate the potential for reporting delays and minimize the burden on staff when SF- 425 reports are due subsequent to the Federal fiscal year ending each September 30th. The improved grant procedures will expand the role of Talbot County’s Finance Office and allow for the consistent timely filing of SF-425 reports. This is an evolving process that will show marked improvement for the 2026 Single Audit. Sincerely, Martha Darling Sparks Finance Director

View Audit 395539

Finding 1191734 (2025-003)

Material Weakness 2025

Change, Inc.

MN

Reporting Significant Deficiency Internal Control / Segregation of Duties

Finding 2025-003 Significant Deficiency Medical Billing Revenue Recognition Internal Controls Finding Summary: Regular reconciliation between the medical billing system and the accounting system was not conducted throughout the year, leading to a significant discrepancy between the end of year trail...

Finding 2025-003 Significant Deficiency Medical Billing Revenue Recognition Internal Controls Finding Summary: Regular reconciliation between the medical billing system and the accounting system was not conducted throughout the year, leading to a significant discrepancy between the end of year trail balance and the billing software report. Responsible Individuals: Jill Johnson, Executive Director Corrective Action Plan: We are developing formal procedures to include monthly reconciliation between accounting and billing systems. Anticipated Completion Date: March 31, 2026

View Audit 395531

Finding 1191716 (2025-002)

Material Weakness 2025

Change, Inc.

MN

Allowable Costs / Cost Principles Material Weakness Reporting

Finding 2025-002 Material Weakness Inadequate Documentation and Training for CECL Calculation Process Finding Summary: The staff member responsible for the CECL calculation left during FY25. The replacement staff member did not have adequate understanding of the prior calculations or the supporting ...

Finding 2025-002 Material Weakness Inadequate Documentation and Training for CECL Calculation Process Finding Summary: The staff member responsible for the CECL calculation left during FY25. The replacement staff member did not have adequate understanding of the prior calculations or the supporting workpapers. Therefore, the CECL adjustment was not recorded at the beginning of the audit and required multiple attempts before a reasonable estimate was determined and recorded. Responsible Individuals: Jill Johnson, Executive Director Corrective Action Plan: We will capture detailed documentation of the CECL calculation process, including training and detailed written procedures. Anticipated Completion Date: January 1, 2026

View Audit 395531

Finding 1191680 (2025-001)

Material Weakness 2025

Discovery Science Center of Orange County and Subsidiaries

CA

Subrecipient Monitoring Reporting Internal Control / Segregation of Duties § 200.329

Management’s Plan for Corrective Action: Management agrees with the finding and plans to implement procedures to ensure timely submission of required performance reports. We will ensure that the grant administrator develops processes for a reporting calendar, preparing required reports, and document...

Management’s Plan for Corrective Action: Management agrees with the finding and plans to implement procedures to ensure timely submission of required performance reports. We will ensure that the grant administrator develops processes for a reporting calendar, preparing required reports, and documenting submission. Management expects these procedures to be implemented beginning in the next reporting cycle. Management has subsequently completed and submitted all of the required performance reports to remedy the identified deficiency.

View Audit 395528

Finding 1191676 (2025-001)

Material Weakness 2025

M. Carter Plaza

OR

Internal Control / Segregation of Duties Subrecipient Monitoring HUD Housing Programs § 200.512

Finding no.: 2025-001 Contact person(s) responsible: Kymberly Horner, Executive Director for PCRI and Matthew Wrigley, Accounting Financial and Audit Manager for Cascade Management Corrective action planned: The closing of books and preparation for audit procedures is being addressed via improvement...

Finding no.: 2025-001 Contact person(s) responsible: Kymberly Horner, Executive Director for PCRI and Matthew Wrigley, Accounting Financial and Audit Manager for Cascade Management Corrective action planned: The closing of books and preparation for audit procedures is being addressed via improvements in internal controls related to property accounting, month and year end closing procedures which include a new property management accounting software package. It is also being addressed via the hiring of more experienced staff during fiscal year 2024-2025. The organization anticipates that these improvements will allow for the audit to be completed within the required timeframe in the upcoming cycle. Anticipated completion date: October 2026

View Audit 395527

Finding 1191675 (2025-004)

Material Weakness 2025

Kalamazoo Valley Community College

MI

Student Financial Aid Subrecipient Monitoring Reporting

Condition: Of the 40 students selected for enrollment reporting, the College did not update the student enrollment information for 3 students accurately. Planned Corrective Action: The College will modify its process and update its documented procedures to include periodically running an Enrollment ...

Condition: Of the 40 students selected for enrollment reporting, the College did not update the student enrollment information for 3 students accurately. Planned Corrective Action: The College will modify its process and update its documented procedures to include periodically running an Enrollment Reporting Graduated/Withdrawn Report from NLSDS and review for accuracy and make timely corrections, if necessary. Contact person responsible for corrective action: Director of Financial Aid Anticipated Completion Date: June 30, 2026

View Audit 395523

Finding 1191673 (2025-003)

Material Weakness 2025

Kalamazoo Valley Community College

MI

Student Financial Aid Subrecipient Monitoring Reporting

Condition: The College did not have appropriate segregation of duties in place to ensure the reporting to COD is being reviewed by an individual separate from the process of preparing the reconciliations. Planned Corrective Action: The College will modify its process and update its documented proced...

Condition: The College did not have appropriate segregation of duties in place to ensure the reporting to COD is being reviewed by an individual separate from the process of preparing the reconciliations. Planned Corrective Action: The College will modify its process and update its documented procedures to include an appropriate review of the reconciliation by an individual separate from the process of preparing the reconciliations. Contact person responsible for corrective action: Director of Financial Aid Anticipated Completion Date: June 30, 2026

View Audit 395523

Finding 1191659 (2025-001)

Material Weakness 2025

Asian University for Women (auw) Support Foundation

MA

Reporting Internal Control / Segregation of Duties § 200.303 § 200.510

Finding: 2025-001 Reimbursable federal grant revenue Responsible Person: Cecilia Frerotte Title: Contract CFO Phone Number: 617-261-8186 Anticipated Completion Date: June 30, 2026 Corrective Action: Management will enhance grant review and reconciliation procedures to ensure that reimbursable expend...

Finding: 2025-001 Reimbursable federal grant revenue Responsible Person: Cecilia Frerotte Title: Contract CFO Phone Number: 617-261-8186 Anticipated Completion Date: June 30, 2026 Corrective Action: Management will enhance grant review and reconciliation procedures to ensure that reimbursable expenditures incurred under cost-reimbursement grants are properly recognized as contribution revenue and federal expenditures in the appropriate period. These procedures will include a grant-by-grant reconciliation of reimbursement requests, refundable advances, award terms, general ledger balances, amounts reported on the Schedule of Expenditures of Federal Awards (SEFA) and amounts reported in all other grant-related compliance reports, as applicable. Management will also formalize and expand supervisory review and approval controls over all grant compliance reporting and year end financial reporting, including the SEFA. In addition, the Board plans to increase the size of the Audit Committee to include members with substantial experience in auditing and grant program oversight. The Audit Committee will meet regularly with both the external auditors and the outsourced accounting firm to provide enhanced governance and oversight of grant accounting and compliance matters.

View Audit 395510

Finding 1191652 (2025-003)

Material Weakness 2025

Hawaii Pacific University

HI

Student Financial Aid Special Tests & Provisions Reporting

At the end of the 2023–24 award year, responsibility for generating Return of Title IV (R2T4) withdrawal lists transitioned from the Business Office to the Financial Aid Office. The Financial Aid Office began producing both official withdrawal and unofficial (non-passing grade) reports through Elluc...

At the end of the 2023–24 award year, responsibility for generating Return of Title IV (R2T4) withdrawal lists transitioned from the Business Office to the Financial Aid Office. The Financial Aid Office began producing both official withdrawal and unofficial (non-passing grade) reports through Ellucian Banner. Because the two reports produced nearly identical student listings, it was assumed that the Banner-generated unofficial withdrawal report was effectively identifying all students who had received non-passing grades.During an internal audit conducted at the end of the Spring 2025 semester, the University identified one student who had failed all courses and was not included on either of the R2T4 lists. Upon further review, the issue was traced to a reporting limitation within Banner that excluded some students with all failing grades from the population used for R2T4 review. To resolve this, the Financial Aid Office coordinated with the Registrar’s Office to obtain a complete list of students who officially withdrew and students with all non-passing grades once final grades were submitted. R2T4 calculations were subsequently performed for applicable students identified in this additional list. Since Spring 2025, the University has institutionalized this revised procedure. The Registrar’s Office now provides the Financial Aid Office with a list of all students with non-passing grades at the end of each semester once grades are submitted. The Financial Aid Office reviews both reports to identify potential unofficial withdrawals and performs R2T4 calculations as required. To strengthen oversight and prevent future omissions during staffing transitions or process changes, the University will: • Document the revised R2T4 identification and review process in the Financial Aid operations manual. • Clearly assign responsibility for report generation, review, and follow-up between the Registrar’s Office and Financial Aid Office. • Implement a quarterly internal cross-check to confirm all required R2T4 reviews are completed. Person(s) Responsible: Associate Director of Financial Aid and Director of Financial Aid. Correction Date: January 31, 2026. This issue is resolved.

View Audit 395499

Finding 1191651 (2025-002)

Material Weakness 2025

Hawaii Pacific University

HI

Subrecipient Monitoring Student Financial Aid Reporting

The University has made substantial progress toward completing the remaining elements required under the Gramm-Leach-Bliley Act (GLBA) and aligning its program with the FTC Safeguards Rule. Full implementation timelines are primarily constrained by current staffing capacity within ITS/Cybersecurity ...

The University has made substantial progress toward completing the remaining elements required under the Gramm-Leach-Bliley Act (GLBA) and aligning its program with the FTC Safeguards Rule. Full implementation timelines are primarily constrained by current staffing capacity within ITS/Cybersecurity and Legal, as well as certain technical tool limitations (e.g., data discovery and validation). Despite these constraints, notable progress has been achieved across the required FTC Safeguards Program elements as summarized below: • Element 1 – Designate a Qualified Individual: Completed. Qualified individual appointed to implement and supervise the company’s information security program; reporting mechanisms to the Board established. Completion is confirmed based on oversight and execution of subsequent program elements. • Element 2 – Conduct a Risk Assessment: Completed. Initial risk assessment conducted to identify reasonably foreseeable threats; controls and priorities for Elements 3–9 is being guided by this assessment. • Element 3 – Access Controls & Data Classification: 70% complete. Policies finalized; multi- factor authentication (MFA) implemented; initial asset inventory completed. Data owner assignments and detailed access reviews are in progress. • Element 4 – Vulnerability Management: Complete. Latest penetration testing identified no critical findings. • Element 5 – Information Security Policies: Drafted and pending Legal review; Board acceptance scheduled for March 2026. • Element 6 – Third-Party Oversight: 70% complete. Policy and workflow developed; Board acceptance scheduled for March 2026. • Element 7 – Periodic Risk Assessments: 80% complete. Updated risk assessment currently in progress. • Element 8 – Incident Response Plan: 90% complete. Final reporting and approval scheduled for March 2026. • Element 9 – Qualified Individual & Board Reporting: 90% complete. Annual report scheduled for March 2026. • Red Flags Rule (Identity Theft Prevention): 50% complete. Policy drafted, complete comprehensive program, formal procedures and additional trainings still required. Next Steps: Remaining actions will be completed as Legal and Board approvals are obtained and staffing capacity allows. HPU will continue to develop and retain documentation supporting the completion and implementation of each safeguard element, as prescribed by GLBA. Periodic internal assessments of the Information Security Program will be scheduled following full implementation, with consideration given to engaging an independent third party for future reviews. Person(s) Responsible: Information Security Officer; Vice President of Operations and Chief Information Officer. Targeted Correction Date: March 31, 2026.

View Audit 395499

Finding 1191630 (2025-002)

Material Weakness 2025

Aleutian Pribilof Islands Association, Inc.

AK

Reporting Significant Deficiency Internal Control / Segregation of Duties

Finding 2025-002: Significant Deficiency in Internal Control over Compliance and Other Matters – Application of Indirect Cost Rates Programs: 93.224 and 93.527 Health Centers Program Cluster 64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program Planned Corrective Action: See above...

Finding 2025-002: Significant Deficiency in Internal Control over Compliance and Other Matters – Application of Indirect Cost Rates Programs: 93.224 and 93.527 Health Centers Program Cluster 64.055 Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program Planned Corrective Action: See above Anticipated completion date: April 30, 2026 Contact Information: Louise Chikigak, Chief Financial Officer, (907) 222-4250

View Audit 395488

Finding 1191583 (2025-005)

Material Weakness 2025

Municipality of Catano

PR

Subrecipient Monitoring Reporting Significant Deficiency § 200.302 § 200.328 § 200.329

COMMONWEALTH OF PUERTO RICO MUNICIPALITY OF CATAÑO Corrective Action Plan For the Fiscal Year Ended June 30, 2025 _____________________________________________________________________________________________________________________ Audit Report: Reports on Compliance and Internal Control in Accordan...

COMMONWEALTH OF PUERTO RICO MUNICIPALITY OF CATAÑO Corrective Action Plan For the Fiscal Year Ended June 30, 2025 _____________________________________________________________________________________________________________________ Audit Report: Reports on Compliance and Internal Control in Accordance with Government Auditing Standards and OMB Super Circular Uniform Guidance Audit Period: July 1, 2024 – June 30, 2025 Fiscal Year: 2024-2025 Principal Executive: Hon. Julio Alicea Vasallo, Mayor Contact Person: Mrs. Honoris Machado, Finance Director Phone: (787) 788-0404 Original Finding Number: 2025-005 Statement of Concurrence or Nonconcurrence: We concur we the finding. Corrective Action: Adopted Measures • Expense Synchronization: A protocol will be implemented requiring contracted consultants to record and report incurred expenses only when a validated disbursement voucher is available, thereby ensuring the integrity of the financial flow. • Reconciliation: The office will conduct a detailed comparison between the draft quarterly report and the general ledger to identify and correct any discrepancies prior to final submission. • Compliance Timeline: An internal deadline will be established for the submission of the report, ensuring attainment of the minimum percentage required under the Quality Activities category through accurate financial data. Expected Outcome To ensure that all financial information submitted is complete, accurate, and fully aligned with the Municipality’s accounting records, thereby eliminating the risk of audit findings. Implementation Date: March 2026. Responsible persons: • Person responsible for the implementation: Mr. Carlos Flores, Federal Program’s Subdirector • Person responsible for the supervision: Mrs. Yolanda Maldonado, Federal Program’s Director

View Audit 395450

Finding 1191581 (2025-003)

Material Weakness 2025

Municipality of Catano

PR

Subrecipient Monitoring Allowable Costs / Cost Principles Reporting

COMMONWEALTH OF PUERTO RICO MUNICIPALITY OF CATAÑO Corrective Action Plan For the Fiscal Year Ended June 30, 2025 _____________________________________________________________________________________________________________________ Audit Report: Reports on Compliance and Internal Control in Accordan...

COMMONWEALTH OF PUERTO RICO MUNICIPALITY OF CATAÑO Corrective Action Plan For the Fiscal Year Ended June 30, 2025 _____________________________________________________________________________________________________________________ Audit Report: Reports on Compliance and Internal Control in Accordance with Government Auditing Standards and OMB Super Circular Uniform Guidance Audit Period: July 1, 2024 – June 30, 2025 Fiscal Year: 2024-2025 Principal Executive: Hon. Julio Alicea Vasallo, Mayor Contact Person: Mrs. Honoris Machado, Finance Director Phone: (787) 788-0404 Original Finding Number: 2025-003 Statement of Concurrence or Nonconcurrence: We concur with the finding. Corrective Action: Corrective Action Implemented 1. Request for Technical Assistance Technical assistance was requested from the corresponding state agency and all municipal components involved in the process, with the purpose of: • Establishing a structured work plan. • Aligning compliance processes. • Clearly defining the documentation required for quarterly reports. • Reviewing the processes of the Fiscal Monitoring System Portal. • Incorporating technical recommendations issued by the agency. 2. Measures Adopted by This Office As a result of the technical assistance, the following corrective actions were implemented: • Development of a Required Documentation Checklist to standardize the collection of information. • Clear definition of the scope of collaborative work among offices. • Formal establishment of tasks, roles, and responsibilities. • Assignment and monitoring of the limited staff designated by the office. • Update of the Fiscal Monitoring System Portal to grant access to newly authorized personnel. Results Achieved As a result of the implementation of the corrective action plan: • The required information from the various municipal offices was collected completely and in a timely manner. • The quarterly report was submitted by the established deadline (01/15/2026). • The agency validated compliance (01/30/2026). • The disbursement of funds was successfully received (02/04/2026). Evidence of Effectiveness • Compliance with the established deadline. • Confirmation of receipt and approval of the report. • Disbursement processed without findings or additional requirements. • Strengthened interdepartmental coordination. • A documented and standardized process for future quarterly cycles. Standardization and Prevention • The Checklist was adopted as an official tool of the process. • The assignment of roles and responsibilities was formally established. • Access to the Fiscal Monitoring System Portal is kept up to date. • Continuous monitoring was established to ensure compliance in future quarters. Observation Regarding Human Resources Although the corrective action proved effective and allowed for the timely submission of the report and receipt of the disbursement, the personnel currently assigned to the process also support multiple additional programs. While the situation was corrected following internal reorganization, the shared operational workload could pose a risk to the long-term sustainability of the control. It is recommended that the allocation of additional human resources be evaluated to strengthen operational continuity and prevent recurrence of the previously identified issue. Conclusion and Closure The corrective action implemented proved to be effective and sustainable, eliminating the deficiencies identified in the process of collecting and submitting quarterly reports. Regulatory compliance and strengthened administrative management are evidenced, ensuring continuity in the timely receipt of future disbursements. Implementation Date: Fiscal Year 2025-2026. Responsible persons: • Person responsible for the implementation: Mr. Carlos Flores, Federal Program’s Subdirector • Person responsible for the supervision: Mrs. Yolanda Maldonado, Federal Program’s Director

View Audit 395450

Corrective Action Plans

Filters