Corrective Action Plans

Program:HOME Investment Partnerships Program (HOME) Finding:2025-001 Contact Person:April Apodaca Administrative & Financial Services Bureau Manager Community Development Department Phone: (562) 570-6611 Email: April.Apodaca@longbeach.gov Planned Actions: The City has exercised its rights to enforce compliance with the terms of its contractual arrangement for this standalone developer/owner, which has resulted in the highest levels of legal action. Through its established monitoring and review procedures, City staff identified documents submitted by the developer that appeared to be inaccurate or falsified. This discovery prompted a multi-year investigation and subsequent litigation, undertaken in direct collaboration and response to instructions as directed by HUD. Throughout this period, the City’s investigative and litigation activities have not been historically viewed as compliance concerns, particularly given their necessity in preserving the integrity of the legal process. At every stage, the City has acted consistently with HUD’s directives and the requirements of the applicable contractual framework. During the multi‑year investigation, HUD expressly instructed the City to continue normal program operations to avoid alerting the developer and to maintain the integrity of the ongoing inquiry. The City respectfully asserts that the audit finding is inconsistent with HUD’s guidance and the historical practices necessary to ensure effective enforcement. Since the initial identification of the finding, the City has taken all reasonable corrective actions within its authority to address the issue and mitigate associated risks. These actions include following established monitoring procedures to ensure compliance with HOME program requirements, making repeated documented requests for tenant eligibility records from the developer/owner, and escalating efforts through the City Attorney. This issue is isolated to one developer/owner and sampling for other developers/owners has not identified similar concerns. The City has been transparent about the ongoing litigation involving the standalone developer/owner responsible for maintaining the records and remains committed in resolving this matter and in pursuing additional actions available once the legal proceedings have been concluded.

Federal Agency Name: Department of Agriculture Program Name: Community Facilities Loans and Grants Federal Financial Assistance Listing Number: 10.766 Finding Summary: As a part of the audit process, a reclassification entry was made to move an additional 12 months of reserve funds from the cash sweep general fund to a separate bookkeeping account. The Hospital had excess cash available to cover the required reserve amount for the fiscal year. Responsible Individuals: Renae Karst, Chief Financial Officer Corrective Action Plan: Management will fund the reserve account from the cash sweep general fund and will monitor the separate bookkeeping account throughout the year to ensure the reserve is properly funded throughout the year as required by the loan documents. Anticipated Completion Date: June 30, 2026

Finding 2025-001- Material Weakness related to Procurement and Suspension and Debarment Information on the federal program: Federal Agency: Department of Health and Human Services, Department of Homeland Security, Department of Defense, Department of Justice, National Science Foundation, Department of Agriculture, US Agency for International Development Program Name: Research and Development Cluster Assistance Listing Number: Various Planned corrective action: The Medical Center has updated the reporting logic of the vendor report submitted to the third-party service provider for suspension and debarment evaluation. The Medical Center has also implemented an internal control where a member of Research Finance management will review the vendor report for accuracy and completeness and sign-off prior to submitting to the third-party service provider for suspension and debarment evaluation. Name of responsible official: Michael Brennan Director, Research Finance Michael.Brennan@childrens.harvard.edu Anticipated completion date: May 11, 2026

Management Response and Corrective Action Plan Finding 2025-001 – Allowability Federal Agency: United States Department of Health and Human Services Program Name: Research and Development (R&D) Assistance Listing Number: 93.859 Responsible Individual: BIDMC – Jarod Kohr, Director, Research Finance or The Center - Roy Bourne, Director, Research Finance and Operations Contact Information: BIDMC - jkohr@bidmc.harvard.edu; 617-216-7479 The Center - rbourne2@joslin.harvard.edu; 617-309-5741 A review of Beth Israel Deaconess Medical Center’s (BIDMC) salary allocation process revealed 53 instances out of approximately 11,000 records of allocation in excess of NIH Salary Cap limits (0.04%). BIDMC acknowledges discovery of system limitations that will correct future instances. Accordingly, management has concluded that controls are operating as intended, but will be enhanced to limit human errors. Corrective Action Plan: - Management will implement a calculation control that will prevent the ability to save changes to salary allocation that exceeds the salary cap for the respective period. (Completed) - Management will implement a calculation control that will prevent the ability to reflect a percent salary higher than the percent effort for any salary cap controlled grant. (Completed) - Management will monitor monthly changes to effort/salary allocations in the Time and Effort system for calculated variances. (Ongoing) Expected Completion Date: October 1, 2026 Status of Completion: In process The Center’s management acknowledges that an invoice was incorrectly matched to a purchase order; however, this was not reflective of the overall control environment. The Center maintains established controls over purchase order invoice processing, including system-generated duplicate invoice detection, cost matching tolerances, and restrictions preventing matching to closed purchase orders. Transactions outside established parameters are automatically flagged for manual review. Management performed a targeted review of these transactions, noting expenditures were properly allocated with the exception of the item noted in this finding. Accordingly, management has concluded that controls are operating effectively overall, Accordingly, management has concluded that controls are operating effectively overall, while continuing to evaluate and enhance processes to further mitigate the risk of recurrence. Corrective Action Plan: - Management will reinforce matching requirements through targeted training and communication with Accounts Payable and Purchasing (Completed) - Periodic reconciliation reviews will be performed to identify and correct any misallocated costs as necessary (Completed) - The Center’s planned implementation of a new ERP system on October 1, 2026 will introduce enhanced automated matching controls, further reducing the likelihood of recurrence Expected Completion Date: October 1, 2026 Status of Completion: In process

Special Tests and Provisions Significant Deficiency in Internal Control over Compliance and Instance of Noncompliance Department of Agriculture Federal Financial Assistance Listing #10.766 Community Facilities Loans and Grants Finding Summary: The Hospital did not maintain the required debt service coverage ratio for the year ended December 31, 2025. Additionally, the Hospital does not have a control process in place to ensure that the monitored debt service coverage ratio is accurate and non-compliance is reported timely. Responsible Individuals: Eric J. Price, CFO Corrective Action Plan: Management has enhanced internal control policies and processes to monitor compliance with debt covenants, including the periodic calculation of debt service coverage ratio, documentation of management review and approval, and timely communication with the lender if noncompliance is identified. Anticipated Completion Date: September 30, 2026

Finding Number: 2025-001 Finding Title: Procurement Controls (Significant Deficiency) Name of Contact Person: Janice Clark, Chief Finance & Operations Officer Corrective actions implemented or in process include the following: 1. Enhanced Procurement Oversight and Centralized Review The Organization, building on its established procurement policies, implemented stricter headquarters oversight and approval requirements for higher-risk and higher-dollar procurements, including defined approval thresholds for procurement solicitations, evaluation activities, and contract execution. Specialized and international procurements now require additional senior-level review and involvement, regardless of value. 2. Strengthened Vendor Due Diligence and Market Research Procedures The Organization updated procurement procedures to require expanded documentation of vendor due diligence and market research activities, including enhanced validation of vendor qualifications, procurement support documentation, and vendor representations associated with federal procurements. 3. Enhanced Monitoring of Procurement Documentation and Compliance Requirements Management implemented strengthened review procedures over procurement advertisements, vendor certifications, geographic code compliance documentation, and other supporting procurement records. The revised procedures also require additional review and escalation for identified procurement irregularities or inconsistencies. 4. Advance Payment and Approval Controls The Organization implemented revised controls governing advance payments, including enhanced approval requirements for significant prepayments and additional supporting documentation requirements for high-risk payment arrangements. 5. Procurement Evaluation and Technical Assistance The Organization enhanced procurement evaluation oversight by requiring additional Headquarters participation in evaluation activities for procurements exceeding defined thresholds. In addition, the Organization engaged specialized procurement and logistics resources to provide technical assistance and support for international procurement activities. 6. Personnel Actions and Training The Organization took personnel actions in response to the investigation findings and implemented enhanced procurement and compliance training for relevant personnel involved in procurement and grants management activities. Management believes these corrective actions appropriately address the control deficiencies identified in the finding and strengthen the Organization’s internal control over compliance related to procurement activities under federally funded programs. Anticipated Completion Date: Substantially completed as of April 6, 2026, with ongoing monitoring and training activities continuing through fiscal year 2026.

At the time of the audit, we did not have a policy to require managers sign off on credit card payments in the way that they sign off on check payments. We did not require management approval because receipts were required to be submitted with every credit card purchase and reviewed by the finance team monthly. The policy to require management approval for credit card payments has since been adopted, however, after the fiscal year under audit.

Almost Home, Inc. has formalized this through our required client file checklist and related policy. The policy was in place and was applied improperly. Staff members who failed to apply the policy were given corrective action at the time. Our quality/compliance control processes did not catch this mistake in time, and our management corrective action plan will include improvements on the quality/compliance control to ensure that all necessary documentation is maintained. Also necessary to note is the fact that Almost Home, Inc. will no longer receive TANF funding as of December 31, 2025.

There is no direct guidance detailing steps to update the FMAP rate in STAARS. Changes are made in the STAARS cost allocation test environment and then implemented in the production environment via STAARS Support. Cost allocation runs quarterly. While we initiate the entering of statistics from work sampling and other sources, we are at the mercy of STAARS Support to actually run cost allocation for DHR.

DHR has added additional steps related to Adult Day Care services entered in FACTS. This will ensure entered services reconcile to the approved invoice prior to approval in FACTS.

The Alabama Emergency Management Agency (AEMA) will strengthen its subrecipient monitoring procedures to ensure compliance with the audit requirements outlined in 2 CFR 200.501. AEMA will implement formal written procedures requiring the identification of subrecipients subject to Single Audit requirements and the timely collection, review, and retention of applicable audit reports. AEMA will establish a centralized tracking system to monitor the receipt of required audit reports and identify subrecipients that have not submitted audits by the required due date. Designated personnel will be responsible for conducting and documenting reviews of all received audit reports to determine whether any findings, questioned costs, or deficiencies impact federally funded programs administered by AEMA. In instances where audit findings are identified, AEMA will follow up with subrecipients to obtain corrective action plans and monitor the implementation of corrective actions to ensure identified deficiencies are adequately addressed. Management will also implement periodic supervisory reviews to verify that audit reports are obtained, reviewed, and documented in accordance with federal requirements.

Finding Number: 2025-003 Finding Title: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Reporting Program: 93.658 Foster Care Title IV-E, 93.778 Grants to States for Medicaid Name of Contact Person Responsible for Corrective Action: Ryan DuMond, Supervisor, Accounting Corrective Action Planned: Staff will conduct thorough reviews of all Quarterly Fiscal Memos and attachments issued by DHS to ensure that reporting requirements are fully understood and applied consistently. The County will also develop and document a comprehensive procedure for preparing the DHS‑2550 and DHS‑2556 reports, including detailed instructions for entering adjustments, processing reversing entries, reporting amortization, properly coding capital purchases, and handling MAXIS‑related costs. A mandatory review process will be implemented before submission of each report to verify accuracy and compliance with DHS guidance. As part of this review, staff will closely examine expense classifications to ensure that capital outlay expenditures are accurately coded and reported, and that all required amortization expenses are correctly included. These actions will help prevent misclassification and report errors in future submissions. Anticipated Completion Date: July 2026

Management Response: Management acknowledges Finding 2025-004 and agrees that weaknesses in the review and approval of expenses represent a material weakness in internal control over compliance. The reimbursement of personal credit card expenses and the charging of those transactions to federal awards resulted in unallowable costs and demonstrated a breakdown in the review process for employee reimbursements and supporting documentation. Although the known questioned costs total only $46, the broader risk is that additional unallowable, unsupported, or improperly coded expenses could be charged to federal awards if review controls are not strengthened. Management determined that the root causes included insufficiently detailed procedures for reviewing employee reimbursement requests, inconsistent verification of business purpose and allowability before reimbursement, and inadequate supervisory review of expense documentation before costs were posted to federal awards. Existing controls were not precise enough to identify personal or otherwise unallowable charges embedded within reimbursement activity, particularly when descriptions were incomplete or reviewers did not independently confirm that the expense was necessary, reasonable, properly documented, and allowable under Uniform Guidance. To address this material weakness, management is implementing a corrective action plan focused on strengthening pre-payment and pre-posting review of employee reimbursements and other expense transactions charged to federal awards. The plan includes four key actions: revising reimbursement and accounts payable procedures to require detailed support for every request; requiring documented secondary review by supervisory or finance personnel independent of the submitter; implementing exception-based review procedures for higher-risk transactions; and performing periodic post-payment monitoring to confirm that review procedures are operating effectively and that unallowable costs are promptly identified and corrected. Under the revised process, no employee reimbursement or expense charged to a federal award will be approved unless the request includes sufficient supporting documentation to allow the reviewer to determine that the cost is necessary, reasonable, allocable as applicable, consistently treated, and adequately documented in accordance with Uniform Guidance cost principles. Reviewers will be required to confirm the business purpose of the transaction, assess whether the type of cost is allowable under the terms of the award and applicable federal regulations, and verify that no personal items, duplicate charges, sales tax errors, or unsupported amounts are included. If documentation is incomplete or a charge appears questionable, the transaction will be held pending clarification, recoded to a non-federal source, or denied reimbursement as appropriate. Any unallowable expense identified after reimbursement will be promptly removed from the applicable federal award and reported through management’s corrective follow-up procedures. Management will also reinforce accountability through targeted training and oversight. Employees who prepare, review, approve, or process reimbursements and expense reports affecting federal awards will receive training on allowable cost principles, documentation expectations, and the importance of careful review under 2 CFR Part 200, including the requirement that costs be adequately documented and necessary and reasonable for the performance of the federal award. In addition, Finance will generate periodic exception reports highlighting reimbursement activity charged to federal awards, personal credit card reimbursements, and other transactions meeting defined risk criteria. These reports will be reviewed by management to identify trends, address control failures, and implement additional corrective measures when needed. Management believes these corrective actions directly address the auditors’ recommendations and strengthen controls over the review and approval of expenses charged to federal awards without repeating the corrective actions already established for pre-award costs, allocation methodology, or broader financial close procedures. Responsibility for implementation will rest primarily with the Finance Director, in coordination with accounts payable, grants, and program leadership. Management expects enhanced documentation standards, independent review requirements, exception-based oversight, and monitoring activities to reduce the risk of personal or otherwise unallowable expenses being reimbursed and charged to federal awards in future periods. Corrective Action Plan Summary Corrective Action Responsible Staff/Role Target Completion Date Evidence of Completion Revise and adopt written expense reimbursement and accounts payable review procedures requiring itemized receipts, documented business purpose, funding source identification, and explicit confirmation that requested costs are not personal in nature. Finance Director; Accounts Payable Supervisor June 30, 2026 Approved procedures; updated reimbursement forms; staff distribution records. Implement a standardized reimbursement review checklist requiring reviewer validation of allowability, Accounts Payable Supervisor; July 15, 2026 Completed checklist template; sample reviewed reimbursement business purpose, receipt support, coding accuracy, and identification of any personal or unsupported charges before reimbursement or posting to a federal award. Finance Director packages; approval signoff documentation. Require independent supervisory review and approval for all employee reimbursements and any expense transaction charged in whole or in part to a federal award, including personal credit card reimbursement requests. Finance Director Effective immediately Supervisor approval records; signed reimbursement packages; workflow evidence showing independent review. Provide targeted training for employees, supervisors, accounts payable, and grants personnel on allowable cost principles, documentation standards, and reviewer responsibilities for expenses affecting federal awards. Compliance Officer; Finance Director August 31, 2026 Training materials; attendance logs; completed acknowledgements or knowledge checks. Create periodic exception reports for reimbursement activity charged to federal awards, missing receipt transactions, unusual merchants, and other higher-risk expense patterns, and require documented management review of the results. Accounting Manager; Finance Director September 30, 2026 Exception report format; monthly or quarterly review logs; documented follow-up on exceptions. Perform quarterly post-payment monitoring of a sample of reimbursed expenses charged to federal awards to verify compliance with documentation, Compliance Officer; Finance Director Quarterly, beginning September 30, 2026 Quarterly monitoring reports; exception logs; evidence of recoding, recovery, or corrective follow-up. approval, and allowability requirements and to ensure prompt correction of any identified exceptions.

Item 2025.003 - Cash Management Recommendation The Organization should develop written procedures to review all drawdowns that occur in order to ensure accuracy. Repeat Finding Not a repeat finding. Action Taken The Health Center has engaged Cambire Consulting, a grant and contracts consulting firm. A drawdown policy will be established for the July 2026 Board Meeting for approval.

Persons responsible for corrective action: Patience Teboe, Grants Administrator Corrective action planned: A) During the initial kickoff meeting for all new grants, the Grants Department will identify and document all reporting requirements, deadlines, and compliance obligations associated with the grant award. B) The Grants Department will enter all reporting deadlines into the grant management calendar system. Automated email notifications will be generated to provide timely reminders to the responsible operational manager and their direct supervisor prior to reporting due dates. C) Operational managers will be required to submit all grant reports electronically to their direct supervisor, or designated approver, for review prior to submission to the funding agency. D) The reviewing supervisor or designated approver will provide documented electronic approval (email approval will serve as evidence) to both the operational manager and the Grants Department. The Grants Department will maintain the approval documentation and update the grant management calendar to reflect completion of the reporting requirement. E) Any required report that has not received documented approval and been returned to the Grants Department at least five (5) business days prior to the reporting deadline will be escalated to the appropriate Executive-level leader and the Chief Financial Officer (CFO) for immediate follow-up. Implementation date: July 1, 2026 If you have any questions regarding the Tribe's Corrective Action Plan, please contact Chief Financial Officer, Greg Gunderson at 402-315-2760 ext. 4116 or ggunderson@poncatribe-ne.gov.

Persons responsible for corrective action: Keith Morrow, Health Services Chief Executive Officer Corrective action planned: Developed and implemented process by which Business Services staff in Health Services review documents provided by non-Ponca Native Americans upon initial request for services and on an annual basis to follow to confirm and verify their capacity to receive health services from the Ponca Tribe. Steps have been taken to see the staff verifying are independent from those who initially collect such documents. Additionally, confirmed such process is consistent with existing verification review of Ponca members requesting services. Implementation date: December 1, 2025.

Corrective Actions to Be Implemented: The organization is moving from MIP Fund Accounting to QuickBooks online Advanced which will remove the multi-step data entry process currently used for time capture and payroll processing. Simultaneously, we are implementing Hourtimesheet, a Defense Contract Audit Agency (DCAA) compliant time tracking system which does not allow time entries outside of each employee assigned grant allocations. It has a native integration with Quickbooks and is the gold standard for government contract compliance. • QuickBooks Online Advanced anticipated completion: June 1, 2026 • Hourtimesheet anticipated completion: September 1, 2026 Responsible Parties: Brandi Senters, Finance Director, will be responsible for implementation, with oversight from the Executive Director, Erin Broussard.

Finding 2025-061 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), ALN 93.323 and Block Grants for Prevention and Treatment of Substance Abuse, ALN 93.959 Management Views MDHHS agrees with the finding. Planned Corrective Action MDHHS is actively pursuing the implementation of an API for the submission of FFATA data to the federal system, SAM, to improve both timeliness and accuracy through automation. This API will connect EGrAMS with SAM, enabling backend communication between the systems and allowing SAM to automatically retrieve data directly from EGrAMS. To ensure accurate reporting until the API is established, MDHHS will continue reviewing validation errors when submitting web-based information to SAM and will work with the SAM federal helpline to report federal system issues and identify interim alternatives to submit the required data. Also, MDHHS implemented an enhancement in August 2025 that validates federal funding sources in EGrAMS against their effective dates, reducing coding errors and improving data reliability. In addition, the query used to obtain certain FFATA data elements was modified during fiscal year 2026 to improve accuracy of reporting. Anticipated Completion Date December 31, 2027 Responsible Individual(s) Matt Blackburn, MDHHS Jeanette Hensler, MDHHS Rebecca Jones, MDHHS

Finding 2025-004 Bridges Security Management and Access Controls Management Views MDHHS agrees with the finding. Planned Corrective Action For parts a., b., c., and d., MDHHS implemented the Database Security Application (DSA) on October 2, 2023, which includes documenting incompatible role exception requests and user access request approvals, semi-annual review of privileged users, and annual review for all users. Security management and access control processes will continue to be a standing agenda item for ongoing quarterly training sessions with local office security coordinators (LOSC). For parts a., c., and d., the Access Management Section began implementing a process to conduct quarterly reconciliations of the DSA to the Bridges Integrated Automated Eligibility Determination System (Bridges) during March 2025. Due to the complexity of the reconciliations and time constraints, MDHHS requested the Bridges technical team to develop a consolidated Excel based report to add a level of automation to the process. The report is now available on an ad hoc basis, and the Access Management Section began utilizing it during April 2026 to conduct reviews and provide remediation with the LOSCs and end users. Full automation of the report remains in progress due to significant competing priorities and limited resources. For part b., MDHHS implemented the automated DSA periodic access review process (PAR) during January 2026 to review all users every 90 days, instead of the current 180 days for privileged users. MDHHS updated its policy to require initiation of the PAR in the DSA for all users every 90 days, without exception, to comply with State standards. For part e., MDHHS local office directors, district managers, or designees review a monthly sample of high-risk Bridges transactions to ensure documentation was properly maintained. Beginning September 2024, MDHHS Business Service Centers (BSC) implemented a monitoring process to ensure monthly reviews are completed by the local offices timely and that the documentation is properly maintained. To strengthen compliance, MDHHS will reinforce expectations through manager training and emphasize the requirement to maintain complete records and to sign and date all review reports within 30 days of the report run date. Additional training sessions will be repeated as needed to ensure consistent adherence to documentation and timeliness standards across all local offices. Anticipated Completion Date a., c., and d. Ongoing b. Completed e. September 30, 2026 Responsible Individual(s) a., b., c., and d. Tim Kwast, MDHHS e. Tim Kwast and Veronica Maxson, MDHHS

Finding 2025-003 Bridges Interface Controls Management Views DTMB agrees with the finding. Planned Corrective Action DTMB will establish a process to verify that the total number of processed, exception, and skipped records matches the number of records read from the data source. DTMB will investigate discrepancies identified through this validation process and implement appropriate corrective measures to resolve the issues. Anticipated Completion Date September 30, 2026 Responsible Individual(s) Nathan Buckwalter, DTMB

Finding 2025-002 DTMB, IT General Controls Management Views The Department of Technology, Management, and Budget (DTMB) agrees it did not perform the annual review of privileged accounts for the operating system servers. As stated in the finding, DTMB performed the recertification process after the issue was brought to its attention. Planned Corrective Action DTMB performed its user access recertification processes in November 2025. Anticipated Completion Date Completed Responsible Individual(s) Manny Rosales, DTMB

Finding 2025-006 ADP Security Program Management Views MDHHS and DTMB agree with the finding. Planned Corrective Action For 2 of the 3 systems cited, the Authority to Operate (ATO) was successfully re-established on July 8, 2025, and October 10, 2025, respectively. For the remaining system, MDHHS and DTMB will complete a comprehensive update to the System Security Plan, incorporate all missing control assessments into the risk analysis, and implement the ATO by August 30, 2026. Anticipated Completion Date August 30, 2026 Responsible Individual(s) Nathan Buckwalter, DTMB Heather Frick, DTMB Veronica Maxson, MDHHS Jim Bowen, MDHHS Kasi Hunziger, MDHHS Lyndia Deromedi, MDHHS

Finding 2025-010 MDE, Change Management Process Management Views MDE partially agrees with the finding. MDE agrees that testing results were not fully documented. However, MDE does not agree that post implementation validation could be performed. The scan-vulnerability process could not be performed in the production environment in this instance without significantly impacting system performance for users, making post implementation validation infeasible. Planned Corrective Action MDE management will review the testing documentation maintained in DevOps for all tickets classified as tasks and associated with change management activities and deployments and will remind staff of the required documentation standards for all DevOps tickets linked to a deployment. Additionally, MDE will evaluate whether an alternative method of validating the scan-vulnerability process in production is feasible. If no alternative method is identified, MDE will document that post implementation validation cannot be performed due to system constraints. Anticipated Completion Date December 31, 2026 Responsible Individual(s) Monica Butler, MDE

Finding 2025-009 MDE, Security Management and Access Controls Management Views MDE agrees with the finding. Planned Corrective Action For part a., management will review the exceptions with the team responsible for processing security forms to reinforce appropriate review and processing. MDE will also implement an automated security access request process, which will eliminate any human error as a result of processing forms. For part b., management will refine the NexSys annual recertification process to reduce errors. NexSys staff will improve internal user list reviews and confirm completeness during the upcoming recertification cycle prior to management’s final review. MDE is currently developing an automated process to handle the annual recertification of the Grant Electronic Monitoring System/Michigan Administrative Review System (GEMS/MARS) users and anticipates implementation in September 2026. For part c., MDE updated the procedure for disabling accounts in April 2026 to strengthen and clarify the process to ensure MDE disables inactive user accounts after 18 months. Anticipated Completion Date a. May 2027 b. NexSys: October 2026 GEMS/MARS: September 2026 c. Completed Responsible Individual(s) Monica Butler, MDE Joshua Long, MDE Drew Finkbeiner, MDE

Finding 2025-060 Coronavirus Capital Projects Fund, ALN 21.029 Management Views LEO agrees with the finding. Planned Corrective Action The LEO Finance Division and the LEO Grants Division have identified the deficiencies that led to the audit finding. LEO will correct the internal FFATA reporting process to ensure that new and amended subaward contract information is received by the LEO Finance Division in a timely manner and in accordance with FFATA requirements. LEO will utilize the EGrAMS vendor to update software functionality that will generate an email notification to the LEO Finance Division when a grant agreement is finalized or amended. This notification will ensure communication with the LEO Finance Division occurs in a timely manner and in accordance with FFATA requirements. Anticipated Completion Date June 30, 2026 Responsible Individual(s) Jennifer Duffey, LEO Heidi Parker, LEO