Corrective Action Plans

Finding: The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with the required monitoring of subrecipients of the Child and Adult Care Food Program. Questioned Costs: Assistance Listing # 10.558 Amount $0 Status: Corrective action in progress Corrective Action: The Office has established and implemented a procedure for tracking subrecipient monitoring activities assigned to staff. The procedure includes expectations of program specialists to complete a minimum number of administrative reviews each month. Progress is regularly reviewed to address workload issues. The Office also identified the need for additional staff resources to provide coverage during absences. However, we were not able to secure funding to move forward with recruitment until fiscal year 2025. The Office is planning on hiring new staff by April 30, 2025. Meanwhile, a temporary position was filled to assist with completing the 23 administrative reviews that were not completed for fiscal year 2024. The Office expects these reviews will be completed by September 1, 2025. The conditions noted in this finding were previously reported in finding 2023-002. Completion Date: Estimated September 2025 Agency Contact: Chaundi Barbosa CACFP Director PO Box 47200 Olympia, WA 98504-7200 (360) 764-0411 Chaundra.Barboza@k12.wa.us

Finding: The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Child and Adult Care Food Program. Questioned Costs: Assistance Listing # 10.558 Amount $0 Status: Corrective action complete Corrective Action: During fiscal year 2025, the Office amended its procedure of sending grant requirements to all subrecipients bi-annually. The current procedures require the program specialist to distribute federal award information and requirements to all subrecipients upon approval of the renewal application. The updated procedure will go into effect for all subrecipients during the fiscal year 2026 renewal cycle. The conditions noted in this finding were previously reported in finding 2023-003. Completion Date: March 2025 Agency Contact: Chaundi Barbosa Director, CACFP PO Box 47200 Olympia, WA 98504-7200 (360) 725-0411 Chaundra.Barbza@k12.wa.us

DEBARMENT- INTERNAL CONTROL OVER VERIFICATION AGAINST THE SYSTEM FOR AWARD MANAGEMENT (“SAM”) Description of Finding: 2 CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, (Uniform Guidance) requires compliance with provisions of procurement, suspension, and debarment. Non-federal entities are required to ensure that they do not award contracts or make subawards to any parties that are suspended or debarred from receiving federal funds. This verification may be accomplished by checking the System for Award Management (SAM). The Town does not have a process in place to check that vendors are not suspended or debarred by checking the System for Award Management (SAM). Statement of Concurrence or Nonconcurrence: The Town agrees with the audit finding. Corrective Action: The Town will establish policies and procedures to ensure vendors are not suspended or debarred by checking the System for Award Management (SAM) and maintain documentation showing that verification. Name of Contact Person: William J. Steglitz, Finance Director, (860) 923-3593. Projected Completion Date: June 30, 2025.

Finding 2024-001: Special Tests and Provisions – CFDA# 94.006 (AmeriCorps State and National): Living Allowance Maximum Threshold Exceeded Audit Finding: Colorado Youth For A Change can only pay AmeriCorps member a living allowance that does not exceed the maximum living allowance threshold per the Uniform Guidance and grant guidelines. In our audit, we found that twenty AmeriCorps members were paid a living allowance that exceeded the maximum threshold by $1,255 individually, and $25,100 in aggregate. This constitutes a violation of federal grant guidelines and is considered an unallowable cost, requiring corrective action and potential reimbursement to the funding agency. Audit Recommendation: We recommend Colorado Youth For A Change to compare their living allowance calculations to the annual maximum threshold amount to ensure no AmeriCorps members are paid a living allowance in excess of the annual maximum threshold amount. Management’s Response and Corrective Action Plan: Colorado Youth For A Change acknowledges the finding and recommendation. Living allowances for the 25-26 program year have been double-checked against the current NOFA and have been confirmed to be under maximum requirements. An annual process for this action will be instituted. Contact and Completion Date: Mary Zanotti (maryz@youthforachange.org) is the primary contact, and the Executive Director at Colorado Youth For A Change. The correction action is expected to be resolved before the end of the next fiscal year-end of December 31, 2025.

2024-004 – 10.558 – Child and Adult Care Food Program –Subrecipient Monitoring Condition Two providers who began Program operations during the period did not undergo a site visit during each new facility’s four weeks of operations. Recommendation Controls should be reviewed and updated to ensure that all new providers undergo a site visit within the first four weeks of operations. Comments on the Finding The Organization is aware of the oversight and will strive to improve the process. Action Taken The Director has added a column to her spreadsheet that tracks site visits. For any new participants to the program, this column will note the first date that they began participating, to better track when their first follow up visit must occur.

RIEMA acknowledges the audit finding regarding incomplete reporting of certain subawards to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) for fiscal year 2024. The reporting gap occurred due to the departure of the staff member previously responsible for FFATA reporting. Unfortunately, this position remained vacant until February of the current year, which contributed to delays and omissions in subaward reporting during that period. To prevent recurrence, RIEMA has filled the vacated position and will ensure the new staff member receives comprehensive training on FFATA requirements and FSRS procedures. Moving forward, we are also reviewing our internal processes to ensure continuity and compliance, even during periods of staffing transitions. RIEMA remains committed to full compliance with federal reporting requirements and transparency in the use of grant funds. Anticipated Completion Date: September 2025 Contact Person: Brian Riggs, Chief Financial Officer, Rhode Island Emergency Management Agency brian.j.riggs@ema.ri.gov

The RIEMA Recovery staff will revise the Federal Audit Clearinghouse tracking form to include the recommended items. We will not only include findings directly related to our program, FEMA 97.036, but all FEMA findings. We will also add any findings that were noted on any program on the tracking form. We are also creating an additional form, Verification of Compliance – FAC.Gov, which will be submitted to the RIEMA fiscal department. This form identifies any findings and requests their recommendation on proceeding with reimbursement to the sub-recipient in our payment package. Also, we will be incorporating our review of the Single Audit Report in both the tracking form and the verification form. Anticipated Completion Date: RIEMA is implementing this for all project reviews. Contact Person: Lawrence Macedo, Recovery Branch Chief, Rhode Island Emergency Management Agency lawrence.macedo@ema.ri.gov

EOHHS amended and updated its guidelines and standard operating procedures leveraging the CMS ‘Delivering Service in School-Based Settings: A Comprehensive Guide to Medicaid Services and Administrative Claiming’ as a source document. In addition to ensuring alignment with CMS requirements, the updated guidelines include a uniform schedule of quarterly submission dates and details the billing responsibilities of participating LEAs. These responsibilities include meeting all Medicaid documentation requirements; submitting the Certification of Local Funds on a quarterly basis; and signing provider agreements and maintaining all other records used to support claims submitted for Medicaid reimbursement. Upon receipt of these submissions a new audit tool will be utilized to ensure each submissions contains the required documentation. Beginning June 2025, EOHHS will initiate on-site reviews of twenty (20) LEAs using a tiered, randomized sample of claims from State Fiscal Year 2023 (SFY23). The sample will include claims with at least 20 claims per LEA, selected to ensure wide geographic representation. If documentation is missing, incomplete, or found to be in error, the LEA and their billing contractor will be notified and corrective action will be implemented. Lastly, EOHHS is also working in partnership with the CMS School-Based Services Technical Assistance Center to ensure continued alignment with federal expectations and the implementation of national best practices in school-based Medicaid claiming and update guidance. Anticipated Completion Date: Administrative Claiming Materials – June 1, 2024; On-site Audit – June 30, 2025 Contact Persons: Tyler McFeeters, Health Program Administrator, Executive Office of Health and Human Services tyler.mcfeeters@ohhs.ri.gov Mark Kraics, Deputy Medicaid Director, Executive Office of Health and Human Services mark.kraics@ohhs.ri.gov

Each health plan reports TPL recoveries to EOHHS in its quarterly financial report (FDCR). These recoveries are used as a direct offset to medical expenses. As such, claims paid by the plans on behalf of a member with TPL will remain in the EOHHS encounter data warehouse. Health plans do not void claims that have previously been paid to account for any TPL liability. Rather, they seek to recover from the third party any amount owed and report that amount to the state. In each of the last two fiscal years, this reduced medical expenditures by just under $8 million. 2025 Update: Following the process from 2023 and 2024, we are requesting a new TPL files from Gainwell that will be shared to each MCO. Anticipated Completion Date: Ongoing Contact Person: Jeffrey Schmeltz, Chief, Family Health Systems, Executive Office of Health and Human Services jeffrey.schmeltz@ohhs.ri.gov

The findings can be grouped into several areas as shown below. The responses are included below each grouping. Each response is included in each category. 1. Licensing a. “Licensing for providers of behavioral healthcare services and home and community-based services to members with developmental disabilities are, by statute, the responsibility of the Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH). BHDDH, in conjunction with evaluations of provider health and safety standards, relicenses providers biennially. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from BHDDH resulting in a weakness in control for this segment of providers.” b. “Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from DCYF resulting in a weakness in control for this segment of providers. c. 4 out of 60 providers sampled noted instances where providers remained active during fiscal 2024 after provider licenses had expired, evidencing a deficiency in internal control relating to timely provider deactivation if provider licensure is not evidenced. No claims were paid to these providers thus noncompliance was not noted.” EOHHS’ Division of Medicaid Compliance is actively working with BHDDH, DCYF, and RIDOH to address the licensing concerns by strengthening the communication of end dates between each agency’s licensing division and Medicaid’s Division of Medicaid Compliance. Anticipated Completion Date: Ongoing. Anticipated June 2025. Contact Persons: Emily Tumber, Implementation Director of Policy and Programs, Executive Office of Health and Human Services emily.tumber@ohhs.ri.gov Nicholas James, Implementation Director of Policy and Programs, Executive Office of Health and Human Services nicholas.james@ohhs.ri.gov 2. Systems a. “Encounter data submitted by managed care organizations is not currently validated for provider enrollment upon acceptance. This deficiency in internal controls over provider eligibility prevents the detection of claiming submitted by unenrolled providers. Our testing noted 4 managed care providers that were not enrolled in the Medicaid Program as required by federal regulations resulting in noncompliance with provider eligibility requirements (questioned costs - $3,371). All 4 providers were out-of-state providers required to be enrolled under federal regulations based on the volume of services billed to RI Medicaid. Implementing this additional edit when processing encounter data would improve controls over compliance. b. For claims representing care furnished to a beneficiary by an out-of-state furnishing provider, the SMA may pay a claim, in limited circumstances, to a furnishing provider that is not enrolled in the reimbursing state’s Medicaid plan. In these circumstances, the State is required to meet several requirements including verification that the provider is enrolled in good standing in Medicare or another state’s Medicaid program. The State is not currently performing such validation for out-of-state providers with limited claiming. c. The State did not have documentation supporting review of the SSA Death Master file for 19 out of the 60 providers we tested. a. EOHHS conducted research on these cases and completed a system upgrade to remedy the issue on 5/1/2024. b. EOHHS conducted research on these cases and completed a system upgrade to remedy the issue on 5/1/2024. c. EOHHS implemented new Provider Screening Tool in February 2025 which will provide dated documentation following the automated search for various screening requirements, including Death Master File. This documentation will be uploaded to the provider file. This will eliminate the manual process of searching for providers individually through the Death Master File and relying on an individual recording the date. Anticipated Completion Date: Ongoing Contact Person: Kimberly Tebow, Senior Medical Care Specialist, Executive Office of Health and Human Services kimberly.tebow@ohhs.ri.gov 3. Provider Surveys a. Federal regulations require the Medicaid agency to execute provider agreements with nursing facility providers and intermediate care facilities for individuals with intellectual disabilities (ICF/IID) upon receiving notification from the State survey and certification unit that the provider has been certified in substantial compliance with federal health and safety regulations. The State Medicaid agency lacked documentation of a finalized provider agreements and approval letters to providers in 6 out of 18 providers reviewed. In respect to the State’s only ICF/IID facility, the State Medicaid agency was not monitoring the RI Department of Health’s (RIDOH) certification process and had no documentation from RIDOH regarding the facility’s health and safety certification. All providers were recertified by RIDOH and compliant with program health and safety requirements. EOHHS/Medicaid implemented tracking protocol for all surveys received by the RIDOH to ensure completeness and timely response. Revisions to the internal standard operating procedure for the review and approval of these surveys are under review. This was completed on February 1, 2024. Regarding the monitoring of RIDOH’s certification process, EOHHS will collaboratively work with RIDOH to implement a monitoring program. Anticipated Completion Date: June 2026 for the monitoring program. Contact Person: Patricia Arruda, Chief of Strategic Planning, Monitoring & Evaluation, Executive Office of Health and Human Services patricia.arruda@ohhs.ri.gov

Management agrees with the findings, with some concerns noted in the corrective actions below. These corrective action steps are separated by specific health and safety finding. Background Checks: DHS will prioritize an emergency reopening of the regulations for both family and child care center regulations to require all providers and staff who work with children to enroll in the workforce registry no later than one month after promulgation. This will allow DHS staff to access employee files in real time to ensure that all staff have appropriate and current comprehensive background checks in their digital files. Until this regulation goes into effect, DHS will implement an immediate policy that all staff who work with children have their staff files audited as part of on-site monitoring visits. Previously, DHS looked only at those staff who were new since this last visit. However, this led to expired background checks being found during the audit. These expired checks also counted as not being able to demonstrate completion of the background check. DHS does want to acknowledge that during this audit, all staff were required to show evidence of a comprehensive background check. This included staff who did not have access to children and/or were not in the building when children were present. This does not align with regulation 218-RICR-70-00-1.12.A.1 which states, “All individuals working or engaging directly with children who are employed or act as a volunteer in the program, must complete all requirements of a comprehensive background check as outlined here: https://dhs.ri.gov/programs-and-services/child-care/child-care-providers/background-checks.” While the auditing team was informed of this, those staff not working with children who were on a payroll sheet were included as a finding against the Department. DHS will send out communication to the field alerting them that the lack of background checks is not tolerated. Staff who do not have these checks on file will be sent home until a background check is received (a practice that already exists, but typically the licensor is not looking at all files for every visit). For center providers, any staff or provider who is found to not have this information will be told to leave the program until this evidence is found. This may result in programs needing to temporarily close due to staff ratio issues. For family child care providers, this will involve a file audit of all received background checks, as well as a visit to ensure that there are no additional or new household members who have not completed this check. Any provider who has not submitted or completed an updated background check will be required to close until received. Any provider who is found to have household members who have not been listed and/or completed appropriate background checks will be closed due to failure to adhere to regulations. Immunizations: DHS recognizes and supports the importance of ensuring children are receiving timely vaccinations. However, DHS also recognizes that providers are only able to gather this data directly from families. Families who do not provide updated immunizations may be excluded from care if they do not provide these records. DHS will communicate with providers that no child should be enrolled without this documentation and that failure to provide updates to this documentation can result in dismissal from the program. DHS does not know if any of the children identified in this finding had medical or religious exemptions for their immunizations but would challenge that this finding could be skewed if this additional information was not ascertained by the auditing team. DHS will continue to partner with the Rhode Island Department of Health to ensure that programs are actively monitored and surveyed regarding immunization documentation. Emergency Preparedness Plan: DHS has been working with providers to ensure they have documented the required components of an emergency preparedness plan as required by federal funding agencies. DHS is requiring providers to include the DHS emergency plan form as part of renewal (for already existing providers) or as part of initial licensure. Absence of this form does not mean that the criteria is not being met. DHS did not train the auditors on what these required areas were and cannot speak to how this was monitored. However, DHS will continue to work with our providers to ensure that these criteria are met as part of the requirements in RISES. DHS has also created a training with The Center for Early Learning Professionals that reviews how to complete this plan and implement through practice. Unallowable Items In Cribs: This audit found that 30% of providers were found to have unallowable items in cribs. For the purposes of this audit, this finding included cribs that did not have children sleeping in them. Per the regulations for both Family and Child Care Centers, “No items are placed in the crib with an Infant except for a pacifier.” (218-RICR-70-00-2.3.3.C.1.k and 218-RICR-70-00-1.10.C.i respectively) DHS requests that only those providers who were found to have children in cribs with items be included in the finding. DHS has worked with The Center for Early Learning Professionals to develop individual trainings related to safe sleep. Providers who are found to be noncompliant regarding safe sleep practices are referred to those trainings with additional monitoring visits occurring to ensure changes have been made. As a result of this audit, DHS will inform providers that any safe sleep violations may result in a probationary status with additional licensing action possible if the continued noncompliance with safe sleep is observed. Toxic Substances unlabeled and accessible: DHS continues to monitor for this in both Family Child Care and Center-based programs. Typically, these are addressed and corrected onsite. Repeated noncompliance in this area can lead to probationary status. DHS will be reviewing the probationary process and use Technical Assistance with our federal funders to evaluate how other states address probation and other licensing actions. The goal is to solidify the current processes to ensure that there is an appropriate escalation review for repeated noncompliance that starts with probation and possibly lead to suspension of license. This will be communicated regularly to all providers. Developmental history: Per regulations, developmental histories are required only for programs serving infants and toddlers. Per Family Child Care regulation (218-RICR-70-00-2.3.6.F.7.a) and Child Care Center regulation (218-RICR-70-00-1.13.F.8.a), only files for infants and toddlers must contain developmental histories. DHS is unable to confirm whether or not this finding is related to this age group or if this finding occurred because age groups beyond that were assessed for compliance. Without this clarification, DHS would contest that this finding is accurate. DHS continues to support the provider community - both Family Child Care and Center providers - ensuring that they have gathered as much information as possible on the children they are enrolling in care. DHS will continue to audit files while on site to ensure that infants and toddlers have these documents completed. In the new RISES system, new providers who identify the desire to be licensed for either age group are required to submit examples of these forms as part of the initial application. For current providers, those serving these age groups will not be able to submit their first renewal in the system without uploading examples of these completed forms. Anticipated Completion Date: Background Checks: DHS will meet with policy staff immediately to discuss the emergency promulgation of new regulations. DHS will also immediately send out an email to the provider community regarding the outcomes of this audit and the responses that DHS intends to implement. Monitoring of programs, including for compliance of this regulation, will be ongoing. All other findings will be addressed in an ongoing fashion. Contact Person: Nicole Chiello, Assistant Director, Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov

2024-053a: The State (EOHHS) receives quarterly user access reports from the MMIS fiscal agent. Anyone identified on the reports that have not logged in for a period of 60 days will have their access terminated. Terminating the users access locks them out and prevents access the system without first requesting a password reset, which is reviewed and approved/denied by EOHHS systems group. In addition, when a user leaves state service or moves to another agency, their access is terminated immediately. An SOP will be implemented with offboarding procedures to assist in timely removal of access. Access is maintained and controlled within the GainwellNow system. Email notifications of pending requests for access are sent to Hector Rivera and Kim Tebow (both EOHHS), who must then review the request and attached form and either grant or deny access. An FTE will be added to the EOHHS/Medicaid Systems team to standardize all user access policies and procedures. Oversight of all IT security activities performed by the MMIS contractor is the responsibility of the EOHHS/Medicaid Project/Contract Manager assigned to the vendor. This individual is supported by the ETSS AIM assigned to support EOHHS/Medicaid. A SOC audit is completed yearly and provides documentation for penetration and vulnerability testing. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov Kimberly Tebow, Senior Medical Care Specialist, Executive Office of Health and Human Services kimberly.tebow@ohhs.ri.gov 2024-053b: The 2025 MARS-E Assessment is underway and will be completed by 4/30/2025. The results will be reviewed to assure the items in the previous MARS-E assessment have been addressed as expected by the state. Documentation lacking to evaluate security controls; Complete pending MARS-E Assessment Continued use of unsupported applications in need of update or patching; major upgrade of the end of life frameworks is planned for SFY2026 start. This expensive upgrade structurally supports most of the modernization platforms that the state is considering. Start SFY 2026; Completion SFY 2027 Lack of contractor tracking of exceptions and risk assessments; Exceptions for vulnerabilities are tracked in JIRA. Risk assessments are performed in all security tests and periodically on security controls. CISO approves all vulnerability exceptions. Complete pending MARS-E Assessment Contractor only sharing partial vulnerability scanning results; Raw report results are provided in Sharepoint in support of the risk assessment process. Complete pending MARS-E Assessment Lack of a robust triage process for security vulnerabilities; Complete pending MARS-E Assessment Inadequate consideration of IT security vulnerabilities with industry best practices. Security vulnerability assessments are performed using the CMS method of impact X probability. The method has been reviewed by state and MARS-E assessor. Complete pending MARS-E Assessment Anticipated Completion Dates: See above Contact Person: Deb Merrill, Security Officer, Enterprise Technology System Services, Department of Administration deb.merrill@doit.ri.gov 2024-053c: The State (EOHHS) collaborates with system vendors (MMIS/Gainwell and Deloitte/RI Bridges) Maintenance & Operations (M&O) and Security teams to ensure annual risk assessment/vulnerability best practices and lessons learned are integrated into annual planning and scope of work for future FYs. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov 2024-053d: Our controls for User Access are in place. Depending on the access requested by the type of user and the program being administered, access are provided accordingly. Anticipated Completion Date: Current and Ongoing Contact Persons: Saurabh Gosai, Director – Technology, Strategy and Innovation, Department Human Services saurabh.u.gosai@dhs.ri.gov Sherri Kennedy, Chief - Human Services Policy and Systems Specialist, Department of Human Services sherri.kennedy@dhs.ri.gov

DHS management has implemented new procedures in SFY25 and anticipates this will not be a finding for the next Single Audit. Preparers of reports have been instructed to do a lookback for any additional entries from prior quarters not previously reported. Each report is now saved with the supporting documentation on a shared drive. Additionally, DHS will document the process of quarterly federal financial reporting. Regarding Federal Funding Accountability and Transparency Act (FFATA) reporting, DHS has started to track reporting by capturing contract execution dates to ensure timeliness. Anticipated Completion Date: June 30, 2025 Contact Person: Ben Quattrucci, Associate Director Financial Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov

System changes to modify the time schedule that RIBridges interfaces with SWICA for processing tasks has already been submitted (RIB-141767). Currently, the interface occurs twice yearly. This will increase the frequency to quarterly. Anticipated Completion Date: October 31, 2025 Contact Person: Donna Rook, Administrator, Family and Adult Services, Department of Human Services donna.m.rook@dhs.ri.gov

RIDE monitors 193 subrecipients – this process is overseen largely by one individual. This individual also monitored COVID era funds such as ESSER. With those programs having passed, more time can be re-allocated to subrecipient monitoring. RIDE does review risk scores for sub-recipient monitoring and considers risk as a basis for onsite visits/monitoring. RIDE disagrees that a higher risk assessment was not given for non-completion of the annual survey; we don’t disagree that a site visit was not performed, but that’s due to resource constraints. RIDE will work on documenting these reviews more formally than the current process, while also documenting decisions for either performing a site visit, or not performing a site visit. Anticipated Completion Date: Ongoing Contact Persons: Brandon Bohl, Finance Director, Department of Elementary and Secondary Education brandon.bohl@ride.ri.gov Crystal Martin, Senior Finance Director, Department of Elementary and Secondary Education crystal.martin@ride.ri.gov

RIDOH agrees with the finding and recommendations and will develop and implement enhanced internal controls over Uniform Grant Spreadsheets (UGSs) to assure that all indirect cost billings and drawdowns of federal funds are appropriate and accurate. The UGS internal controls will include (but are not limited to): • Mandatory refresher training for all staff that complete and/or review UGSs, with focus on areas of potential errors and correct entry of UGS data in the Monthly Federal Grants Tracking spreadsheet used for drawdowns and indirect billing. • Providing a crosswalk of expenditure categories and natural accounts to grants management staff to assure appropriate and consistent assignment of transactions to categories subject to/not subject to indirect costs. • A rotating schedule of monthly in-depth reviews of UGSs to assure that data entry aligns with RIFANS transaction reports, transactions are recorded so natural accounts align with correct expenditure categories, the appropriate indirect cost rate is entered, and formulas for computation of indirect costs are not corrupted. Reviews will be conducted by supervisors of staff completing UGSs, and results will be reported to the Deputy CFO/Federal Grants Manager. • Review of the Monthly Federal Grants Tracking spreadsheets each month before indirect cost billing and federal drawdowns are completed, to assure that expenditures reported align with RIFANS reports and indirect billings and drawdown requests are appropriate. RIDOH credited the ELC Enhancing Detection federal award for the unallowable indirect costs on 3/14/2025 (J25075GMC530). The credit was calculated using RIFANS transaction data from 7/1/2020 through 3/13/2025, not from the UGSs. The UGSs for this award and others are being re-built from the start of the award using RIFANS data in new, less complicated templates to assure correct charging and reporting going forward. Anticipated Completion Date: July 31, 2025 Contact Persons: Alisha Colella, Chief Financial Officer, Department of Health alisha.colella@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Department of Health carla.lundquist@health.ri.gov

2024-044a: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044b: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044c: Management agrees with this finding and will communicate the requirements for subrecipient monitoring; specifically, the documentation of expenses, and meeting notes. Anticipated Completion Date: Completed April 23, 2025 Contact Persons: Paul L. Dion, Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov Brianna Ruggiero, Chief of Staff, Pandemic Recovery Office, Department of Administration brianna.ruggiero@doa.ri.gov

2024-043a: Office of Performance Management will develop internal policies to explain how Grant reporting requirements are met and will adjust accordingly to comply with the FHWA guidance, as it becomes available. 2024-043b: Office of Performance Management will adopt a standard approval form to sign off on the required grant submissions. Anticipated Completion Date: December 31, 2025 Contact Person: Anastasia Wachter, Principal Economic and Policy Analyst, Department of Transportation anastasia.wachter@dot.ri.gov

Quonset Development Corporation (QDC) disputes the finding, asserting that since the MARAD grant funding was provided on a reimbursement basis, QDC did not have custody of Federal funds at any point. QDC was required to meet rigorous documentation standards for reimbursement prior to the release of any funds. QDC has created written policies and procedures specifically referencing Uniform Guidance in the case we receive Federal funding in the future. These policies will be implemented after the Board of Directors approves such policies at the April 2025 meeting. Anticipated Completion Date: Ongoing Contact Person: Patricia Testa, Chief Financial Officer, Quonset Development Corporation ptesta@quonset.com

RIDE is currently evaluating third-party consultants in order to have the following services performed: • A cybersecurity assessment performed of the overall agency using the NIST Framework • A cybersecurity assessment of our internal applications including CNP Connect & Accelegrants • An updated business continuity plan • A Vendor Risk Assessment Program Development Through the above deliverables from the selected consultant, RIDE will be able to have a better understanding of gaps in IT/ Cybersecurity throughout the agency, as well as the applications cited by the Auditor General. Anticipated Completion Date: December 31, 2025 Contact Person: Brandon Bohl, Finance Director, Department of Elementary and Secondary Educationbrandon.bohl@ride.ri.gov

RIDE’s Finance team and Office of School Health & Wellness will develop internal procedures in order to ensure timely reporting of FFATA requirements for Child Nutrition Program subawards. Anticipated Completion Date: June 30, 2026 Contact Persons: Brandon Bohl, Finance Director, Department of Elementary and Secondary Education brandon.bohl@ride.ri.gov Rosemary Reilly-Chammat, Director – Office of School Health & Wellness, Department of Elementary and Secondary Education rosemary.reilly-chammat@ride.ri.gov

Procedures are in process of being reviewed and will be completed prior to the issuance of this report. Underlying reports will be updated with the ERP implementation and corrected to capture all data for all programs in the TSA. Anticipated Completion Date: December 31, 2025 Contact Person: Xiomara Soto, Administrator Financial Management & Reporting, Department of Administration, Office of Accounts & Control xiomara.c.soto@doa.ri.gov

Department of Homeland Security Hazard Mitigation Grant-Assistance Listing No. 97.039 Recommendation: It was noted that improvements were observed compared to the previous year, however, we advise the County to maintain a review process to ensure quarterly reports are thoroughly examined before submission to FDEM. Additionally, monitoring procedures should be established to guarantee the proper submission of close-out reports. Implementing a technology solution could aid the grant manager in gathering the necessary reports for the grantor, facilitating easier oversight and monitoring of grant compliance. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will further strengthen oversight of programmatic reporting by developing and implementing a system of monitoring procedures to guarantee that periodic reports contain the appropriate data, have an adequate review performed by the relative Division Director, and are submitted within the timeframe required by the funder. The proper submission of close-out reports will also be accomplished through the developed monitoring procedures. A grant management software will be purchased and implemented and become a foundational component of the County's grant management infrastructure, allowing for more effective oversight by the County grant manager and ensuring greater compliance with all applicable regulations. Additionally, the County will implement mandatory trainings focusing on 2 CFR Part 200, to ensure fiscal and project managers involved with grant projects are fully educated on uniform administrative requirements, including proper reporting and close-out procedures, cost principles, and audit requirements related to federal and pass-through awards. Name(s) of the contact person(s) responsible for corrective action: Terri Saltzman, Grants and Community Investment Manager. Planned completion date for corrective action plan: September 30, 2025. If the Department of Homeland Security has questions regarding this plan, please call Terri Saltzman at 863-519-2049.

The District will ensure that Additional or Compensatory Special Education or Related Services (ACSERS) funds are not used to fund Substitute Services due to the teacher shortage.

Finding 2024-001: Comments on the Finding and Each Recommendation: The Corporation did not obtain a HUD approved Project Owner's/Management Agent's Certification (Form HUD-9839-B) and the Property paid unapproved management fees to the Agent. The Agent should submit an updated Project Owner's/Management Agent's Certification for HUD's review and approval. Action(s) taken or planned on the finding: Management concurs with the finding and recommendation, and the Agent will submit an updated Project Owner's/Management Agent's Certification for HUD's review and approval.