Corrective Action Plans

Finding 2023-048 – Corrective Action Plan RIDE recognizes that CTE Program Monitoring did not reflect US DOE format and therefore developed a monitoring tool that meets USDOE layout and functionality. Using district provided CTE data, RIDE will review written documentation provided by the secondary/postsecondary districts being monitored. The monitoring will consist of both a desk audit and an onsite inspection of the subrecipients. After the review process is complete a report for subrecipients will be sent back to the subrecipients that were monitored. This may include next steps and the need (if any) for corrective action. Anticipated Completion Date: On May 1, 2024, and May 3, 2024, RIDE will begin monitoring a secondary and postsecondary Perkins recipient. RIDE will continue with subrecipient monitoring visits in each subsequent fiscal year to satisfy the requirements of the USDOE. Contact Person: Paul McConnell, Career & Technical Education Data Specialist, Department of Elementary & Secondary Education paul.mcconnell@ride.ri.gov

Finding 2023-044 – Corrective Action Plan 2023-044a – RIDE has developed written policies and procedures for the maintenance of AcceleGrants user accounts that will have all inactive users removed after 12 months of inactivity. Anticipated Completion Date: October 31, 2024 2023-044b – RIDE finance and IT offices will review the user complementary controls noted in the vendors most currently available SOC2 report and implement suggested controls that are deemed appropriate, reasonable, and necessary by the joint RIDE team. RIDE will have this finding resolved by December 31,2024. Anticipated Completion Date: December 31, 2024 2023-044c – Finance and IT at RIDE are working together to determine the correct schedule for regular IT risk assessments. The departments are also in the process of reviewing the disaster recovery plans for the vendor, and a vendor management plan. Anticipated Completion Date: December 31, 2024 Contact Person: Mark Dunham, Chief Financial Officer, Department of Elementary & Secondary Education mark.dunham@ride.ri.gov

Finding 2023-043 – Corrective Action Plan Parameters regarding charter management organizations are in the charter school application, but additionally, Charter Management Organizations applicants will be asked to file a plan with the Office of School Opportunities on how they will avoid conflicts of interest and related party transactions or insufficient segregation of duties between the Charter School and CMO. This request will be made by the Office of School Opportunities to the applicant after the applicant has received an approved completeness check. This answer will be reviewed by RIDE’s legal office before anything proceeds forward with the application". Under current practice, all application teams need to complete an RFP, with a full public comment period and public hearings and approval by the Council on Elementary and Special Education, in order to open a charter. RIDE has included a question in this year's annual subrecipient monitoring survey (which feeds into the annual risk assessment), asking Charters if they have a relationship with a Charter Management Organization (CMO). If they respond 'yes', we ask if they have written internal controls, policies and procedures specific to the CMO relationship and how the Charter School mitigates potential conflicts of interest, related party transactions and/or insufficient segregation of duties. We request that they upload a any written internal control, policies and procedures specific to the CMO relationship (if any). The survey with this revised language was sent out to subrecipients on April 19, 2024. Anticipated Completion Date: September 30, 2024 Contact Person: Mark Dunham, Chief Financial Officer, Department of Elementary & Secondary Education mark.dunham@ride.ri.gov

Finding 2023-040 – Corrective Action Plan There is no disagreement with the audit finding. The College has designated the Director of Information Security to oversee the information security function. The College has contracted with a firm to function as a virtual Certified Information Security Officer (vCISO) to support compliance as well as provide training and consulting services. The Assistance Vice President, Chief Information Officer is tasked with ensuring that the Written Information Security Program is updated annually and that compliance is maintained. Anticipated Completion Date: June 2024 Contact Person: Pamela Christman, Assistance Vice President, Chief Information Officer, Rhode Island College pchristman@ric.edu

Finding 2023-038 – Corrective Action Plan Auditee Views: SFRF reporting utilized physical posted date pulled from PowerBI environment. The issue with physical posted date is that the report can change based on when pulled. PRO project was not detailed in Annual Report. The blank sections of the downloaded reports are due to a US Treasury system issue that affects all States, not just Rhode Island. PRO began taking screenshots once it became aware of the problem and will continue to do so. There is a tedious review process that is completed for reporting on this data and information supplied to PRO by the entities. Corrective Actions: Modify the U.S. Treasury reporting process to utilize cash date to align with RIFANS federal transaction register both cumulatively and quarterly. Anticipated Completion Date: May 15, 2024 Add PRO project description to SFRF Annual report to U.S. Treasury. Anticipated Completion Date: July 31, 2024 Collect additional information from component unit agency to support provided reporting data. Anticipated Completion Date: June 30, 2024 Contact Person: Paul L. Dion, Ph.D., Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov

Finding 2023-037 – Corrective Action Plan Auditee Views: PRO met with the Department of Housing and the legal services vendors. The Department of Housing is collecting backup documentation for the vendors to support payment. This has been shared with PRO via SharePoint. The Department may also request additional backup documentation from the vendors to further support these costs. Corrective Action: Obtain additional documentation from the legal services vendors and maintain SharePoint to ensure PRO has access to supporting documentation. Anticipated Completion Date: Completed and Ongoing Contact Person: Tara Booker, Executive Director of Homelessness and Community Supports, Department of Housing tara.booker@housing.ri.gov

Finding 2023-030 – Corrective Action Plan We agree with the finding and are actively working to address the underlying issues impacting inconsistent subrecipient monitoring activities by state agencies acting as pass-through entities. The Grants Management Office developed and provided a 3-part in person (and recorded available on our website) training class on subrecipient monitoring in the fall of 2023. The training classes included monitoring best practice, in-person exercises and scenarios and an in-depth training and demonstration of the subrecipient monitoring module in the eCivis grant management system (GMS). As more subawards are issued through the GMS, we expect the monitoring module to be used to conduct subrecipient monitoring as required by federal rules/regulation. The training and new module in the GMS support the Grant-Making Regulation 220-RICR-20-00-2 which took full effect 7/1/23 and requires state agencies to issue subawards through the GMS. The regulation also specifically outlines the requirement of a risk assessment as part subaward issuance and informs agencies on the relationship between the risk assessment results and subrecipient monitoring. We believe these steps will significantly improve subrecipient monitoring activities conducted by state agencies and address this finding. Anticipated Completion Date: Completed. GMO continues to train and supporting/reinforcing control; expect to see improvements/results in the coming FY. Contact Person: Steve Thompson, Chief of Strategic Planning, Monitoring, and Evaluation, Grants Management Office, Office of Accounts and Control steve.thompson@doa.ri.gov

Finding 2023-032 – Corrective Action Plan RIDOH agrees with the finding and recommendation. This finding is centered around some local agency staff being inactive for longer periods of time (60+ days) and the security risk around them not being terminated or made inactive in our Crossroads system. While RI WIC is routinely notified of terminations and transfers of local agency staff, there are instances of people with varying degrees of access going over 60 days without accessing the system. It is sometimes due to a local agency staff person who is in more of an administrator role and not routinely working in the Crossroads system. RI WIC will review policies and procedures regarding user access to the Crossroads System and will work to strengthen and monitor controls for system access. Policies and procedures will be updated as needed, and internal controls will be implemented and documented. Anticipated Completion Date: December 31, 2024 Contact Persons: Ann Barone, Chief, Office of Women, Infants & Children, Rhode Island Department of Health ann.barone@health.ri.gov Anthony Manzi, WIC Fiscal Manager, Rhode Island Department of Health anthony.manzi@health.ri.gov

Re: Finding 2023-001 Significant Deficiency and Compliance with Special Tasks and Provisions Energy Northwest Management understands it is our responsibility to have adequate controls to ensure compliance with all provisions of a federal grant contract. To further enhance our internal controls, Energy Northwest will establish the following Corrective Action Plan: Corrective Action Plan to Be Taken – Management will develop a checklist process to be utilized for all federal grants that will outline the specific provisions of each contract, who is responsible for the provision and the due date of each provision. Prior to finalization of the checklist, a review of the checklist will be done to ensure it encompasses all the provisions of the contract. Energy Northwest’s procedures will be updated to include the checklist process. Responsible Parties to Ensure Corrective Action Is Taken – Accounting Manager and Accounting & Budgets Director. The Corrective Action Timeline –  Checklists for existing federal contracts completed – September 30, 2024  Procedure updated with checklist process – September 30, 2024

Name of Responsible Individual: Vice President of Finance and Administration (David Byrd) Corrective Action: The University concurs with the finding. The University will enhance and strengthen internal controls and procedures. As the university tightens internal controls and procedures, financial statement reporting will be completed in a timely manner. Also, appropriate documentation retention will be maintained. This will result in compliance audits completed before the required deadline. Anticipated Completion Date: June 30, 2024

Condition: Obligations were overstated by approximately $800,000 on the March 31, 2023 Project and Expenditure report. Corrective Action Planned: Will adjust on March 31, 2024 Project and Expenditure report. Anticipated Completion Date: April 30, 2024 Contact: Nicole Pearsall, Town Accountant

Since taking over the financial management of ELFHCC in December 2022 we have reorganized the financial reporting process and have been able to ensure meaningful analysis on a regular and continual basis. Policies and procedures have been created, changed, updated and Board approved. All financial reporting is prepared, analyzed and presented each month without delay.

FRLS shared that as part of the corrective action plan, improved PAI services by changing pro bono coordinators from paralegals to attorneys to better work with private attorneys and respective bar associations throughout our service areas. FRLS has also reestablished connections with our respective service partners throughout the pandemic, rebuilding and providing excellent services through our pro bono partners. PAI remains one of our top priorities in expanding our program services. Our program improvements, including pro bono assistance via virtual and courthouse clinics have resulted in more PAI services to our client communities. We have increased attendance at our annual bench and bar events to raise PAI awareness in our service communities. FRLS is in the process of creating a “low bono” program to expand our network of private attorneys and meet our required 12.5% spending requirement. FRLS will continue to evaluate its policies and procedures surrounding monitoring of PAI compliance to ensure that only allowable pro bono cases are accepted. This will be completed by December 31, 2024.

Finding #2023-001 Prior Year Reporting Package and Data Collection Not Filed Timely: Recommendation: We recommend that management implement procedures to ensure that reporting packages and data collection forms are filed timely in the future. Action taken: Kaaterskill Commons, Inc. agrees with the auditor’s recommendations and will implement procedures to ensure timely filing in the future. For questions regarding this corrective action plan, please contact Bryan Mahoney, Chief Financial Officer, at (518) 828-8090.

2023-001-Reporting Federal Agency: U.S. Department of the Treasury Federal Program Name: Covid-19 Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Recommendation: We recommend corrections to quarterly reports be made in subsequent quarterly reports to ensure obligations match actuality. We recommend timely reconciliation of accounting transactions to allow for accurate reporting of expenditures through the quarter. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The findings noted on the FY 22/23 audit regarding expenditures and obligations were in direct correlation with the findings noted on the FY 21/22 audit. At the close of the FY 21/22 audit, quarter one and quarter two reports had been filed with Treasury. Leading into quarter three, corrections to reporting obligations were being addressed and corrected. As of the fourth quarter reporting cycle, all expenses and obligation issues were corrected. Name(s) of the contact person(s) responsible for corrective action: Christia Johnson, Budget and Management Services Director Planned completion date for corrective action plan: As mentioned above, this has already been addressed as part of the FY 21/22 audit that was finalized in April 2023, 7 months into FY 2022/23. The Budget Office will continue to follow the procedures that were put into place more than halfway through FY 22/23.

Condition: As of the June 30, 2023 reporting date, the City’s Project and Expenditure Reports understated expenditures by $629,040. Also, obligations were overstated by approximately $15,000,000. Corrective Action Planned: The City has implemented reconciliation procedures with the City Auditor and the City ARPA Director to reconcile the general ledger with the US Treasury portal prior to submission on a quarterly basis. The ARPA Director reached out to the US Treasury and communicated concerns that obligations cannot be edited on the portal and received guidance on remedies to edit obligations. Anticipated Completion Date: April 30, 2024 Contact: Bridget Almon, Director of Financial Services Kara Humm, ARPA Director Sedryk Sousa, City Auditor

Reference Number: 2023-003 Prior Year Finding: No Federal Agency: U.S. Department of Treasury Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: ARP17SL1 (5/23/2021 – 12/31/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: 2 CFR §200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Passthrough entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means. (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521 Management decision. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters. (2) Performing on-site reviews of the subrecipient's program operations. (3) Arranging for agreed-upon-procedures engagements as described in § 200.425 Audit services. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501. Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Prince George’s County (the County) was unable to provide support that subawards it issued contained all required federal information nor that it properly monitored its subrecipients. Context: Five subrecipients were selected for testing, and the following exceptions were noted: For one of five subrecipients, the County did not have a subaward agreement in place with the subrecipient. As such, all required information was not furnished to the subrecipient. Five of five subaward agreements were missing the following required information: o Federal Award Identification Number (FAIN) For two of five subrecipients, the County was unable to provide support that it conducted during the award monitoring. For one of five subrecipients, the County was unable to provide support that it had verified that the subrecipients were audited as required by Subpart F. Questioned costs: Undetermined. Cause: The County did not establish effective internal controls and procedures over subrecipient monitoring. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific programs and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Not conducting during the award monitoring may result in a failure of the Division to detect that its subrecipients used subawards for unauthorized purposes, managed them in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. Without ensuring subrecipients have obtained audits as required by Subpart F, there is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Division personnel on a timely basis. Recommendation: The County should review and enhance internal controls and procedures to ensure that all required information is included in all subawards, that proper subrecipient monitoring is conducted, and that evaluation of independent audits is performed. Action taken in response to findings: OCR has submitted the subaward agreement to include all required information for review and approval in SPEED. The subaward agreement is awaiting approval and will be sent to the Office of Finance in April 2024. Name of the contact person responsible for corrective action: Ameria Williams, Budget and Human Resources Manager. Planned completion date for corrective action plan: April 30, 2024. Explanation of disagreement with audit findings: There is no disagreement with the audit findings. Views of responsible officials: The Office of Community Relations (OCR) is reviewing and working to enhance internal controls and procedures to ensure all required information is included in the subaward, that proper subrecipient monitoring is conducted, and the evaluation of independent audits are performed. OCR is working with the subrecipient to gather payroll receipts and proof of the disbursement of funds to grantees selected through the RFPs managed by the subrecipient. Any questions concerning the findings or corrective action plan can be directed to Euniesha Davis, Director, OCR, at 301-952-4729.

Reference Number: 2023-001 Prior Year Finding: 2022-002 Federal Agency: U.S. Department of Housing and Urban Development Federal Program: Community Development Block Grants/Entitlement Grants Assistance Listing Number: 14.218 Award Number and Year: B-19-UC-24-0002 (7/31/2019 – 9/1/2027), B-20-UC-24- 0002 (8/17/2020 – 9/1/2028), B-21-UC-24-0002 (10/27/2021 – 9/1/2029), B-22-UC-24-002 (7/1/2022 – 9/1/2029) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Recommendation: We recommend that the County develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the County develop controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: DHCD will review and update procedures to ensure the department is in full compliance with the FFATA guidelines. In addition, DHCD will review all remaining balances from prior year grant awards and record the awards in FSRS. Name(s) of the contact person(s) responsible for corrective action: Edren Lewis, Chief Budget, Accounting and Loan Servicing Manager Planned completion date for corrective action plan: June 30, 2024 Any questions concerning the findings or corrective action plan can be directed to Aspasia Xypolia, Director, DHCD at 301-883- 5531.

Gramm-Leach-Bliley Act (GLBA) Compliance Planned Corrective Action: The University will proceed with approval and implementation of draft policies and procedures and will expand the information security program to address identified issues. The University will allocate necessary resources and will contract with necessary third-party providers to meet existing resource and technology gaps. Person Responsible for Corrective Action Plan: Jeff Lundblad, AVP and Chief Information Officer Anticipated Date of Completion: October, 2024

FINDING 2023-007: Misclassification of Capital Purchases Response: District Clerk and Business Manager will ensure all capital purchases are correctly classified and coded within the 730 [major equipment-new] or 740 [major equipment- replacement] object line items. It will also be the Clerk's responsibility to ensure capital purchase expenditure lines arc built within annual budgets.

Reference Number 2023-001 Quality Assurance Program Verification Activities (ALN 20.205) Corrective Action: Upon notification by TxDOT of the non-compliance on the 365 Tollway Project, the Authority took the following action: 1. Suspended work with consultant on November 10, 2023, and subsequently terminated their contract on December 21, 2023, for non-compliance with quality assurance requirements. 2. Enforced the contract with its Owner’s Independent Assurance Program (IAP) consultant to provide continuous monitoring of all technician certifications/accreditations for the life of the project. 3. Procured services to perform forensic investigation and evaluation of the work performed by the non-compliant technicians to confirm materials meet quality assurance standards. Proposed Completion Date: The IAP is monitoring all technician certifications/accreditation and will continue monitoring for the life of the project. The forensic investigation and evaluation of the work performed by the non-compliant technicians will be completed by December 2024. Name of contact person: Pilar Rodriguez, P.E., Executive Director Contact Information: (956) 402-3762 prodriguez@hcrma.net

Finding Number: 2023-005 Assistance Listing, Federal Agency, and Program Name 10.558, U.S. Department of Agriculture, Child Care and Adult Food Program Federal Award Identification Number and Year 15-016-271P-00 Pass through Entity Illinois State Board of Education Finding Type Material weakness Repeat Finding No Criteria Per 2 CFR 200.303(a), the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government," issued by the Comptroller General of the United States, or the "Internal Control Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Other requirements include: a) Per 7 CFR 226.10(c)(1), prior to submitting its consolidated monthly claim to the State agency, each sponsoring organization must perform edit checks on each facility's meal claim; per 7 CFR sections 226.16(g) and (h), a sponsoring organization must disburse advance and meal reimbursement payments to centers and day care homes under its sponsorship within five working days of receiving them from its state agency. b) Per 7 CFR 226.15(f), each sponsoring organization of day care homes shall determine which of the day care homes under its sponsorship are eligible as tier I day care homes c) Communication from the passthrough entity to return to pre COVID 19 monitoring, as required under 7 CFR 226.16(d)(4)(iii), effective October 1, 2022, where sponsoring organizations are required to perform onsite monitoring of each of its facilities three times every year, which includes requirements to ensure the amount of time between reviews does not exceed six months (unless review average is used). Condition A lack of documented controls as evidence of supervisory review and segregation of duties to ensure compliance with Federal program requirements, specifically over: a) monthly expenditure reports submitted to the passthrough entity b) tier (day care home eligibility) determinations c) subrecipient monitoring Questioned Costs None Identification of How Questioned Costs Were Computed N/A no instances of material noncompliance noted that would result in questioned costs Context a) During testing a sample of 5 monthly expenditure submissions, we noted no formally documented supervisory review in place. Additionally, during testing of 40 disbursements to providers, we noted no formally documented supervisory review to ensure disbursements to providers are made within 5 working days of receipt from the State passthrough entity. b) While gaining an understanding of controls over tier (day care home eligibility) determinations, we noted no controls established to ensure supervisory review of these determinations. c) While testing a sample 40 provider monitoring visits, we noted 3 visits without evidence of supervisory review and 6 visits where the visit was completed and validated in the software by the same individual. Additionally, we noted 16 day care homes and 2 day care centers with less than the required 3 annual on site monitoring visits for the year, and 15 day care homes and 2 day care centers where onsite monitoring performed were more than the required 6 months apart. Cause and Effect A lack of effectively designed, implemented, and operating controls in any of these areas could result in a material noncompliance with program requirements or Uniform Guidance. Recommendation We recommend management formalize documentation of a supervisory review of: a) monthly expenditure submissions before submitting to the passthrough entity, including documented supervisory controls to ensure disbursement timeliness is met within 5 working days as part of this review; b) of data used in making tier/eligibility determinations for accuracy and completeness; and c) of subrecipient monitoring. Additionally, we recommend management work with its passthrough entities to confirm compliance requirements, especially when compliance requirements change as the result of ending or expiring waivers and flexibilities. Planned Corrective Action Plan –Organization will document process that is used for second review of the monthly expenditure submissions by 04/30/2024. There are no instances of the Organization not providing funds to provider within the mandated 5 days, however, the Organization will document the process for provider payments within 5 days by 04/30/2024. The software required to be used by the funder for management of the program does have limitations on how the data input for making tier/eligibility determinations second review is documented. Organization will design process to document this second review has occurred by 04/30/2024. Staffing shortages coming out the COVID-19 waivers resulted in the inability to perform all required Subrecipient monitoring. This staffing shortage was rectified by 08/31/2023. Contact person responsible for corrective action: Loukisha Pennex, Chief of Youth and Family Potential, Anjanette Brown, CFO and Teresa Rodriguez, Senior Director of Grants and Contracts. Anticipated Completion Date: April 2024

FINDING 2023-004 Compliance Requirement(s): Reporting Audit Finding(s): Material Weakness and Other Matters Summary of Finding: An effective internal control system, which would include segregation of duties, was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the following compliance requirements: Reporting The Unit has not separated incompatible activities within the managing of the federal award programs. The failure to establish these controls could enable material misstatements and noncompliance to be undetected. Management reviews award agreements, contracts and DOE reporting dates and requirements and submits the Annual report to IDOE. Management reviews report for accuracy between the Treasurer and Grant Manager (Asst. Superintendent). A second approval could not be verified. Segregation of duties during the process of entering, approving, and submitting the Annual Reports failed. Views of Responsible Officials: We Concur with this finding. Description of Corrective Action Plan: In the future, the Required DOE Reports will be prepared by the assistant superintendent, who oversees all grant management. Then, the Business Manager will review the prepared reports; upon review, both the business manager and the assistant superintendent will sign/initial the signifying their review of the documents. The report will also be shared with the Superintendent, who will sign off as well. Anticipated Completion Date: Effective Immediately

In  the  future,  the  Hospital  will  maintain  adequate  financial  records  and  supporting  documentation for federal awards. The Hospital will use a spreadsheet to track all federal awards. The spreadsheet will be prepared by the accountant and reviewed by the Chief Financial Officer. The spreadsheet will be included in the monthly financial information provided to the Board of Directors for review and approval. Responsible Individuals: Stephani Tipton, Accountant and Ken Fisher, CFO Anticipated Completion Date: Ongoing

·         Equipment and Real Property Management