Corrective Action Plans

The Department Concurs with paragraph A – Since this same finding was reported in March of 2023 for FY22, items a, c, and d are now included on all federal subaward contracts and policies have been updated to reflect this. The Department will ensure b is also included going forward. The Department concurs with paragraph B - The finding was a result of personnel turnover and medical issues. The Department has hired and trained additional program staff and updated policies to ensure programmatic monitoring and subsequent reports are done in a timely manner. The Department partially concurs with paragraph C. Fiscal monitoring was done for all 3 subrecipients during the federal program year. However, 1 subrecipient monitoring fell outside the state fiscal year so was not covered during the audit period. The Department has changed the wording on its risk assessment procedures to ensure no misinterpretation of the timeframe each subrecipient will be monitored in accordance with its risk assessment. The Department has also changed the requirements of the frequency of fiscal monitoring in each of the risk assessment categories. The Department Concurs with paragraph D – The Department is reviewing policies and procedures and will update them to ensure compliance with 2 CFR section 200.332(a), 2 CFR section 200.332(b) and 2 CFR section 200.521. The Department also created a tracking mechanism to ensure we receive, review, and issue management decisions (if required) in a timely manner. The Department concurs with Paragraph E - The Department is reviewing policies and procedures for both reporting and subrecipient monitoring to ensure data is tested and verified. The Department has already gained increased access to data in current software and is in the process of selecting a vendor for new software that will provide more testing and enhanced internal controls.

Corrective Action Planned (Condition A): The DAS analyzed the six items erroneously reported as subawards and noted the errors were isolated to two specific agencies, the Department of Health and Human Services and the Department of Environmental Services. In response to the prior year finding 2022-002, the DAS had strengthened internal controls related to the review and validation of amounts reported by individual state agencies as pass through expenditures. This included an additional control specifically verifying SLFRF pass through expenditures reported by each agency. The DAS will offer additional training relative to identification and reporting of subaward expenditures in its annual statewide Single Audit training and re-evaluate the precision of execution of controls over the validation of pass through reporting in assembling the SEFA for fiscal year 2024. Corrective Action Planned (Conditions B through E): The State largely concurs with the findings and recommendations and has implemented procedures to address the identified conditions already or will do so. With regards to condition B, The State will work with the individual agencies to ensure that individual agencies entering into such agreements clearly indicate the terms required by Uniform Guidance, including permitted indirect cost rates and whether the award is for R&D. The State has already begun this corrective action plan with the agencies. With regards to condition C, for a. and b. for payments by agencies, there are standard procedures for review and authorization of invoices and payments and those payments are documented. For c. The State has already implemented an agency wide framework for subrecipient monitoring. The State will provide re-training for those agencies that had not properly documented monitoring as outlined by the subrecipient risk assessments and ensure monitoring reports are documented. With regards to condition D, The State has already implemented an agency wide framework to help ensure policies and procedures are in place concerning Uniform Guidance Reports. We will work those agencies that had not documented the date received and the review of the Uniform Guidance Reports to ensure written documentation occurs. Where findings have been reported in the Uniform Guidance Report, ensure timely Management Letters are documented and provided with the summary review of Uniform Guidance Report.

The Department Concurs with paragraph A – Since this same finding was reported in March of 2023 for FY22, items a, c, and d are now included on all federal subaward contracts and policies have been updated to reflect this. The Department will ensure b is also included going forward. The Department concurs with paragraph B - The finding was a result of personnel turnover and medical issues. The Department has hired and trained additional program staff and updated policies to ensure programmatic monitoring and subsequent reports are done in a timely manner. The Department partially concurs with paragraph C. Fiscal monitoring was done for all 3 subrecipients during the federal program year. However, 1 subrecipient monitoring fell outside the state fiscal year so was not covered during the audit period. The Department has changed the wording on its risk assessment procedures to ensure no misinterpretation of the timeframe each subrecipient will be monitored in accordance with its risk assessment. The Department has also changed the requirements of the frequency of fiscal monitoring in each of the risk assessment categories. The Department Concurs with paragraph D – The Department is reviewing policies and procedures and will update them to ensure compliance with 2 CFR section 200.332(a), 2 CFR section 200.332(b) and 2 CFR section 200.521. The Department also created a tracking mechanism to ensure we receive, review, and issue management decisions (if required) in a timely manner. The Department concurs with Paragraph E - The Department is reviewing policies and procedures for both reporting and subrecipient monitoring to ensure data is tested and verified. The Department has already gained increased access to data in current software and is in the process of selecting a vendor for new software that will provide more testing and enhanced internal controls.

Corrective Action Planned (Condition A): The DAS analyzed the six items erroneously reported as subawards and noted the errors were isolated to two specific agencies, the Department of Health and Human Services and the Department of Environmental Services. In response to the prior year finding 2022-002, the DAS had strengthened internal controls related to the review and validation of amounts reported by individual state agencies as pass through expenditures. This included an additional control specifically verifying SLFRF pass through expenditures reported by each agency. The DAS will offer additional training relative to identification and reporting of subaward expenditures in its annual statewide Single Audit training and re-evaluate the precision of execution of controls over the validation of pass through reporting in assembling the SEFA for fiscal year 2024. Corrective Action Planned (Conditions B through E): The State largely concurs with the findings and recommendations and has implemented procedures to address the identified conditions already or will do so. With regards to condition B, The State will work with the individual agencies to ensure that individual agencies entering into such agreements clearly indicate the terms required by Uniform Guidance, including permitted indirect cost rates and whether the award is for R&D. The State has already begun this corrective action plan with the agencies. With regards to condition C, for a. and b. for payments by agencies, there are standard procedures for review and authorization of invoices and payments and those payments are documented. For c. The State has already implemented an agency wide framework for subrecipient monitoring. The State will provide re-training for those agencies that had not properly documented monitoring as outlined by the subrecipient risk assessments and ensure monitoring reports are documented. With regards to condition D, The State has already implemented an agency wide framework to help ensure policies and procedures are in place concerning Uniform Guidance Reports. We will work those agencies that had not documented the date received and the review of the Uniform Guidance Reports to ensure written documentation occurs. Where findings have been reported in the Uniform Guidance Report, ensure timely Management Letters are documented and provided with the summary review of Uniform Guidance Report.

View of Responsible Officials The Department of Energy recognizes the need to include all required information to be communicated to sub-recipients, and that all sub-recipients? risk assessments are thoroughly completed. In addition, uniform guidance reports need to be collected and reviewed to ensure that management letters be issued within the required timeframe. Anticipated Completion Date: Ongoing Contact Person Eileen Smiglowski, NH LIHEAP Administrator

agreement. View of Responsible Officials A. We concur with this finding. The Department utilized an internally available copy of the Management Log, which lists vendor?s determinations. This is a copy of the log, not the original, official copy. There is a delay in updating this copy from the original, and incorrect information had been initially entered. The Department is moving this log to software which allows all Department employees to view the same log, while limiting the number of individuals who have access to make changes. Implementation has been completed as of March 2023. B. We concur with this finding. However, we believe this was an isolated incident as the TANF CFDA number (93.558) used was very similar to correct CFDA number (93.778) that should have been documented. C. 200.332 requirements a. We do not concur with this finding. The contract for Mt Prospect became effective 8/4/21, prior to the 4/22 inception of the UEI. The DUNS number, as in effect at that time, is noticed in Exhibit J of the contract. b. We concur with three of the four findings. Two of the four contracts pre-date the template update requiring the notice an indirect cost rate. Indirect cost rate for federal awards (including if the de minimis rate is charged per 2 CFR section 200.414) were added to Exhibit C of the Department?s contracts in April 2020. One of the contracts did not indicate an indirect cost rate as required. One of the contracts notes the indirect cost rate in the Notes of their financial details. c. One of the two contracts pre-dates the template update requiring the notice the identification of R&D. R&D identifications for federal awards were added to Exhibit C of the Department?s contracts in April 2020 One of the two contracts did not identify whether the contract was R&D as required. D. Subrecipient Risk Assessment ? We concur with the finding. We consider the finding to be fully resolved through Department policy Department policy and Department wide implementation. However, it should be noted full compliance will not be achieved for one to two contact cycles due to timing. The Department began addressing the issue of Subrecipient Monitoring issue in June 2017 when the first Grants Administrator was hired. The Department finalized the Subrecipient Monitoring Policy, which encompasses the financial and programmatic risk assessments as well as the subrecipient monitoring, on June 1, 2018. The Department provided user training on the subject in February and September 2018, training over one hundred forty-six staff. However, only brand new procurements utilized this policy during the initial roll out of this policy. The Department hired a new Grants Administrator in May 2019. The full Subrecipient Monitoring policy rolled out to all procurements, including sole source, amendments, and renewals, effective August 1, 2020. The Contracts Unit received specialized subrecipient monitoring training on May 13 and October 28, 2020. Department wide training to all staff occurred weekly between September 8 and November 3, 2020. The Grants Office provided additional targeted training to Program staff through team meetings. Over one hundred fifty Program and Finance staff received training. Annual training will be held in September each year. Refresher training or training for new staff is available upon request from the Grants Office. The Grants Office website offers Program, Finance, and Contracts Bureau staff access to the subrecipient monitoring policy, as well as training modules, slides, and tools. The training has also been recorded and is available on this site. The Subrecipient Monitoring Policy requires Program to determine whether any vendor which receives funds in exchange for goods or services is a Contractor or Subrecipient. Determined subrecipients receive a Management Questionnaire, which includes a ten question questionnaire and requirements for submitting financial data. This information is used to populate the Risk Assessment Tool, which shows any risks pertinent to a subrecipient and the subaward. Based on the risks shown, Program chooses monitoring activities to mitigate the risks and the Contracts Bureau memorializes these choices in the contract. The Grants Office continues to work closely with the Contracts Bureau to ensure compliance with the Subrecipient Monitoring policy. C. and D. It is also important to note that between April 2020 and June 2022 the Department was involved in the State?s strategic response to the COVID-19 pandemic. During this time, New Hampshire was under a state of emergency (Executive Order 2020-04), processes were rapidly converted to fully digital overnight, the State?s standard approval processes were suspended and non-standard templates, which did not include the required notifications under 200.332, were utilized to respond to the COVID-19 pandemic. The Department worked with other State Departments and the National Guard to create a record number of amendments, contracts, and other agreements (approximately 200% more than standard). The Department is in the process of instituting a new contract life cycle management solution that will utilize conditional logic to include the required notifications for agreements involving federal funds in order to ensure compliance. Implementation is anticipated to be complete in July 2023. As the COVID-19 pandemic strategic response has wound down, the Department has not suspended its regular standard approval or subrecipient risk assessment and monitoring processes and has not used non-standard templates to award federal funding. E. We concur there was no formal documentation of any monitoring activity. Due to staff turnover a new administrator has been hired and unable to furnish the monitoring that took place during FY22. However, a program site review during FY23 was performed and financial monitoring of invoices has also taken place. Anticipated Completion Date: July, 2023 Contact Person: Melissa Kelleher, Administrator Rejoinder As documented above in Bullet B of the condition found, the Department did not properly communicate all required award information to the subrecipient. Once aware of the noncompliance, the Department should have timely communicated this information to its subrecipients.

View of Responsible Officials The State largely concurs with the findings and recommendations and has either implemented procedures to address the identified conditions already or will do so. With regard to condition A(a) and (b), although the State illustrated that it includes clauses related to allowed costs in its subawards, including direct and indirect costs, it will work to ensure that agencies entering into such agreements clearly indicate the terms required by Uniform Guidance, including permitted indirect cost rates and whether the award is for R&D. With regard to condition B, the State agrees that risk assessments should have been completed and has since implemented a framework to help ensure that agencies are more consistently conducting and documenting subrecipient risk assessments. With regard to condition C, the State concurs and has already implemented an agency-wide framework to help ensure procedures and policies are in place concerning Uniform Guidance Report review and the issuance of any necessary management decision letters, to the extent required. It is worth noting that the State in most cases has timely conducted risk assessments of subrecipients and reviewed relevant Uniform Guidance Reports, but its corrective actions will result in better documentation and more consistent and timelier follow through. Anticipated Completion Date: The corrective actions indicated above relative to conditions B and C have already been implemented as of the date of this response. The State will work to address Condition A before the end of the current Fiscal Year. Contact Person: Chase Hagaman and Steve Giovinelli

View of Responsible Officials The State concurs in part with the findings and recommended action. The State?s HAF program fully launched in March 2022 of the Fiscal Year under review, which ended June 30, 2022. On the whole, a more robust subrecipient monitoring framework and process is being implemented during the current Fiscal Year for this program. However, the State has engaged in thorough monitoring of its subrecipient, receiving and reviewing recurring biweekly and quarterly reports. As noted, discussion of those reports takes place during weekly conversations with the subrecipient. However, the State has acknowledged that it needs to more formally memorialize the substance of such conversations to demonstrate such review. This change in protocol and procedure has already been implemented during this Fiscal Year. The State has also engaged in a subrecipient risk assessment and review of audited financials for the purposes of uniform guidance report review. However, its process and protocols will be revised to better demonstrate when such reviews/assessments take place moving forward. Moreover, the State relies on its subrecipient to facilitate the State?s HAF program, which includes collecting and processing data, as outlined in the program?s policy guide manual. A key feature of that process is a detailed quality control protocol. Additionally, during this Fiscal Year, the State engaged in a robust, on-site review of the subrecipient?s quality control protocols and methods, including applicant file review, and found them satisfactory and reliable. The State also works closely with its subrecipient during the quarterly and annual U.S. Treasury reporting processes, which involves reviewing and analyzing data provided by the subrecipient for reporting purposes. This review and the resulting communications can result in corrections to data prior to submission to U.S. Treasury. Corrective Action and Anticipated Completion Date: As of this response, the State has already implemented several corrective actions that align with the recommendations above, including documentation of report review during weekly calls with the subrecipient, timestamping procedures for uniform guidance report review, and on site, detailed review of quality control protocols that involved applicant file review. The State will further ensure that such updated protocols and procedures are memorialized in the Programs? transaction processing memo during its Q1 2023 update, including any protocols necessary to ensure timely issuance of any required management decisions relative to the subrecipient. Contact Person: Chase Hagaman, Lisa Cota-Robles, and Michele Zangri-Crean

View of Responsible Officials The State concurs in part with the findings and concurs in part with the recommendations. Given that CARES Act CRF is a funding source that is no longer eligible for use because program obligations were required to be entered into by December 31, 2021, and program expenditures complete by September 30, 2022, there are no ongoing CRF funded projects or programs. As a result, any corrective actions would relate to ensuring any other federal funding sources are achieving compliance requirements. With regard to condition A, the State partially concurs. Federal guidance concerning CARES Act CRF did not allow for charging indirect costs. That guidance indicated ?Payments from the Fund are not administered as part of a traditional grant program and the provisions of the Uniform Guidance, 2 CFR part 200, that are applicable to indirect costs do not apply. Recipients may not apply their indirect costs rates to payments received from the Fund.? Thus, awardees and recipients of funds were not permitted to charge indirect costs against CARES Act CRF. However, the state acknowledges inclusion of language specifically acknowledging the disallowance of indirect costs could have been included in the agreements. With regard to condition B, the State concurs. The four identified subrecipients were awardees of a program that was facilitated at the very end of CARES Act CRF eligibility for the period of performance. This program was run due to updated guidance by U.S. Treasury on December 14, 2021, that extended the deadline for expenditure of funds so long as obligations were entered into by December 31, 2021. That program largely resulted in direct beneficiary awards, but due to the nature of some expenditures awarded some entities received a subaward. Those subawards identified a brief timeline for project completion, between December 2021 and September 2022. Most projects were completed in February and March, with two of the subrecipients finalizing projects in September. Given the nature and timing of the program, those subawardees were closely monitored and regularly interacted with the State in order to receive reimbursement for eligible expenses and complete projects. The State can provide documentation of that monitoring and expense review. However, formal risk assessments were not initially done for those entities. Since then, the State has implemented policies and procedures that help ensure risk assessments are completed for all subrecipients, regardless of the nature of the program. With regard to condition C, the State concurs and has already implemented corrective actions to ensure procedures and policies are in place concerning Uniform Guidance Report review and the issuance of any necessary management decision letters to the extent required and where this deficiency could impact any other sources of federal funding. It is worth noting that the State in most cases has timely conducted risk assessments of subrecipients and reviewed relevant Uniform Guidance Reports, but its corrective action will result in better documentation of that process and protocol. Anticipated Completion Date: The corrective actions indicated above have already been implemented as of the date of this response. Contact Person: Steve Giovinelli and Chase Hagaman