Corrective Action Plans

Material Weakness Finding No. 2025-002: Subrecipient Monitoring Views of Responsible Officials and Planned Corrective Action The Organization acknowledges 2 CFR§ 200.331 and 2 CFR §200.332 of the Uniform Guidance, and its subrecipient monitoring and management provisions emphasizing accountability and compliance in managing federal funds and subrecipients. The Organization concurs with the prior year (2024-002) and current year renumbered recommendation (2025-002) and highlights its ongoing progressive and corrective implementation of policy and process actions. For context, the Organization’s progressive and corrective actions as of the fiscal year ended (FYE) June 30, 2024 report included the following: A. Subrecipient Monitoring and Management. Implemented internal process changes, effective November 1, 2024, specifically, prospectively, and consistently the: 1. Use of a checklist, to comprehensively assess risk of determining subrecipient or contractor classification, before entering into any subrecipient agreement; 2. Provision of identification details such as CFDA number, amount of federal funds obligated, and the award period for determined subrecipient awards; 3. Submission of programmatic and financial reports as specified in the subrecipient agreement; 4. Review of a single audit in accordance with 2 CFR Part 200, Subpart F for subrecipients that expend $750,000 or more in federal funds during a fiscal year, if applicable; and 5. Review of their audit report(s) and addressing any finding(s) related to their federal award(s), including the related appropriate corrective actions, when applicable. B. Retroactive Subrecipient Portfolio Risk Assessment and Correction(s). Performed a risk assessment of the existing subrecipient portfolio to identify risks, for the audit periods July 1, 2022 – June 30, 2023, and July 1, 2023 – June 30, 2024. The objective of this risk assessment was to identify, evaluate, and prioritize risks that could adversely impact the Organization’s ability to achieve its strategic, operational, compliance and quality assurance goals. The completion of the Organization’s portfolio risk assessment resulted in correction of identified non-compliant subrecipient agreement(s). C. Subrecipient Policies and Procedures. Updated, by December 31, 2024, the implemented financial policies and procedures aligned to the subrecipient monitoring and management provision of 2 CFR §200.331 and 2 CFR §200.332 of the Uniform Guidance, including checklists, flowcharts, samples, data sheets, data sharing agreements, etc. For the year ended June 30, 2025, to the period of the audit report date, the Organization continued the prospective implementation of the above policies and processes, including the following reflective contract review work: A. Reviewed all contracts executed between July 1, 2024 to June 30, 2025. B. Discussed with respective program director(s), the implementation of initiation, consideration, decision, documentation and monitoring phased activities. C. Worked with respective program director(s) to document in memorandum(s) to file (MTF), the basis for decision and documentation on a contract-by-contract basis. D. Initiated work with respective program contract monitors to implement and document consistent Organization wide contract monitoring processes and activities (e.g., contract, term, billing, deliverables, eligible expenditures, data input, frequency). Although as of June 30, 2025 the implementation of the resolution was not completed, the implementation continues and is expected to be fully implemented by the next audit report date. Finding No. 2025-002: Subrecipient Monitoring Contact Person(s) Responsible for Corrective Action: Sheri Daniels, Ed.D., Chief Executive Officer, Marisa Wilson, Director of Administrative Operations and Sylvia Hussey, Ed.D., Chief of Staff.

Management concurs with this finding, in part. As discussed in Finding 2025-001, during the period under audit, CARS had historically classified the affected entities as contractors/vendors based on management’s review and understanding of the nature of those relationships. As a result of those classifications, CARS did not apply all of the formal subrecipient monitoring requirements of 2 CFR § 200.332 to these entities. Specifically, formal subrecipient risk assessments were not performed or documented, verification of required audits under Subpart F was not incorporated into a formal monitoring process, and certain subrecipient agreements contained incorrect Assistance Listing Numbers (ALNs). CARS believes it is important to distinguish the identified deficiencies from an absence of risk evaluation, oversight or monitoring of the entities. Although CARS did not perform or document formal subrecipient risk assessments in accordance with 2 CFR § 200.332, management considered factors relevant to organizational risk during the initial proposal and partner-selection process. These considerations included CARS’ prior experience with the organizations, their demonstrated performance and funding histories, organizational capabilities, and experience administering federally funded programs, as applicable. The basis for partner selection and related considerations were reflected in the proposal documentation. During the period under audit, CARS reviewed and approved reimbursement requests for allowability and performed ongoing programmatic monitoring of performance and progress. However, because the entities were classified as contractors/vendors, these risk evaluation and monitoring activities were performed within CARS’ existing proposal, vendor, and program oversight processes rather than within a formal subrecipient monitoring framework designed to address all requirements of 2 CFR § 200.332. Based on additional training regarding subaward management under 2 CFR Part 200 and the matters identified during the current audit, management recognizes that formal written policies, documented classification determinations, and additional monitoring controls are necessary to ensure that entities determined to be subrecipients are consistently monitored in accordance with applicable Uniform Guidance requirements. CARS began corrective action and, prior to issuance of the audit report, completed the following: 1. Confirmed the correct Assistance Listing Number for the NTTAC federal award and identified subrecipient agreements requiring correction; 2. Issued modifications to affected subrecipient agreements, as necessary, to communicate the correct ALN for the applicable Year 5 modifications; 3. Reviewed available subrecipient SEFA information related to FY2025 expenditures to evaluate the accuracy of the reported ALN and communicated necessary corrections, as applicable; and 4. Obtained and reviewed available Single Audit information for the affected subrecipients and confirmed that no findings related to federal funding received from CARS were identified in the reports reviewed. Corrective Action CARS will formalize and document its existing procedures as they specifically relate to subrecipients and the applicable requirements of 2 CFR § 200.331 and § 200.332. The policy and related procedures will include documented subrecipient-versus-contractor determinations; subrecipient risk assessments; verification of required subaward information, including the Assistance Listing Number (ALN); review of financial and programmatic performance information; verification of applicable Subpart F audit requirements; review and follow-up of audit findings or other significant developments; and documentation and retention of monitoring activities, conclusions, and corrective actions, as applicable. CARS will also establish a documented pre-execution review and approval control for applicable federally funded agreements to verify the appropriate classification of the relationship and the accuracy and completeness of required federal award information before execution. As part of implementation, CARS will review applicable existing federally funded agreements under the new policy. If an existing relationship is determined to meet the criteria of a subrecipient rather than a contractor, CARS will appropriately classify the agreement, correct applicable federal award information, including the ALN, as necessary, and apply and document the required subrecipient monitoring procedures prospectively. Responsible Party: Ranelle Bensch, Director of Finance & Compliance Target Implementation Date: March 2027

Management Response Management concurs with this finding, in part. CARS acknowledges that its SEFA preparation process did not include a formally documented procedure for evaluating and documenting subrecipient-versus-contractor determinations or a documented supervisory review control over the preparation of the SEFA. However, during the period under audit, management did review agreements at the time of award and considered the nature of each relationship in determining the appropriate classification based on its understanding of the subrecipient criteria established under Uniform Guidance, 2 CFR § 200.331. Accordingly, while CARS acknowledges that its evaluation and review processes were not formally documented, management believes it is important to distinguish the absence of formal documentation and controls from an absence of management review or consideration of the appropriate classification. CARS’ classification approach had also been discussed with the auditors during the annual Single Audits conducted for Years 1 through 4 of the current federal award. No exceptions related to the classification of these entities were identified during those prior audits. CARS recognizes, however, that responsibility for determining the appropriate classification of subrecipients and contractors and for ensuring accurate SEFA reporting rests with management. Based on additional training regarding subaward management under 2 CFR Part 200, together with the matters identified and discussed during the current audit, CARS agrees that establishing a formal written policy and documented review process will strengthen its internal controls and help ensure consistent application of the Uniform Guidance requirements. Upon identification of the classification issue during the current audit, CARS evaluated the affected entities and revised the SEFA prior to issuance of the audit report to properly reflect amounts provided to subrecipients. The revision did not change total federal expenditures reported on the SEFA. Corrective Action CARS will develop and implement written procedures for subrecipient-versus-contractor determinations and will establish formal SEFA preparation and review procedures, including documented supervisory review prior to issuance. Responsible Party: Ranelle Bensch, Director of Finance & Compliance Target Implementation Date: January 2027

Program Federal Financial Assistance Listing Number.: 21.027 / 14.239 Federal Grantor: U.S. Department of the Treasury / U.S. Department of Housing and Urban Development Award Number and Year: Affects all grant awards included under assistance listing 14.239 and 21.027 on the Schedule of Expenditures of Federal Awards. Compliance Requirement: Other – Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) §200.510(b) - Schedule of Expenditures of Federal awards Management’s Response: We concur. Views of Responsible Officials and Corrective Action: The finance staff and program manager did not fully understand the distinctions between subrecipient and beneficiary, resulting in inaccurate reporting of these amounts. The City Manager and relevant department managers met to address this issue and recommend that staff undergo appropriate training. The training schedule will be discussed further, taking into consideration availability, location, and budget constraints. This was corrected in the Single Audit Report which will be filed with the Federal Government. Name of Responsible Person: Finance Leadership and Grant Program Managers Projected Implementation Date: August 1, 2026

The auditor compares being a beneficiary to being a sub-recipient instead of is the secondary institution a contractor or a sub-recipient. The organization agrees that policies and procedures should be put in place in the event that funds are going to be passed-through. In addition, the organization feels that it was able to show the funds that were passed-through to the contractor. Responsible Individual: Chief Financial Officer– Scott Korba Estimated Completion Date

2025-004 – Lack of Written Policies and Procedures Auditor Description of Condition and Effect. Although the Organization has processes in place to cover these areas, and drafts of formal written policies covering the above items that address all of the area required by the Uniform Guidance have been developed, these policies have not yet been formally approved and adopted by the Organization. As a result of this condition, the Organization did not fully comply with the Uniform Guidance applicable to the above noted grants. Auditor Recommendation. We recommend that the Organization review and approve the draft policies as soon as practical, but no later than the end of fiscal year 2026. Corrective Action. The Organization has prepared a policies and procedures manual for the federal grant programs, which will be approved by the Board of Directors before the end of fiscal year 2026. Responsible Person. Rob Rafson, Executive Director Anticipated Completion Date: December 2026

Reporting California Department of Social Services CDSS agrees with this finding and has already begun developing appropriate procedures that will support this recommendation, using the CCDF program area as a model. CDSS will implement improved procedures and consider if a grant management solution would be feasible and necessary. CDSS has already begun establishing a process that determines and documents whether funding actions are reportable subrecipients or contractors. CDSS has also begun establishing a field within the CDSS accounting system that identifies subrecipients at the contract level so this data is automatically included when extracted for FFATA reporting, which will ensure reports are submitted accurately and timely. CDSS is also developing a Federal Reporting Dashboard to track all grants with FFATA reporting requirements, including due dates and completion status. Additionally, CDSS will designate a primary point and a backup person within the Federal Reporting Section to monitor all FFATA reporting deadlines. This designated staff member will issue 45 days advance notifications to the grant owner and reviewing manager, set calendar reminders for grant owners, and provide regular status updates to Accounting Management. To strengthen timely compliance, these reminders will also instruct grant owners to complete the FFATA submission 10 days before the federal deadline, ensuring sufficient time to resolve any errors that may occur during the upload process. Estimated Implementation Date: November 2026 Contact: - Jeff Fowler, Child Care Administration Bureau Chief Central Operations Branch, Child Care and Development Division - Rosali Bautista, Chief, Accounting and Reporting Bureau, Accounting and Fiscal Systems Branch, Finance and Accounting Division

The Partnership will develop and implement comprehensive written subrecipient monitoring and procurement policies aligned with Uniform Guidance. Procedures will include verification of suspension and debarment status (e.g., SAM.gov), incorporation of required compliance terms in subaward agreements, tracking of subrecipient funding by program, implementation of a risk-based monitoring framework, and documentation of monitoring activities including financial and programmatic reviews. Staff will be trained on these updated procedures, and compliance reviews will be centralized within the finance and administrative function.

Finding 2025-002 — Subrecipient Monitoring and Required Documentation Corrective Action Plan During fiscal year 2025, the Organization did not consistently obtain or retain: (i) written pre-award risk assessments for subrecipients; (ii) Single Audit reports for subrecipients expending $750,000 or more in federal awards; or (iii) Unique Entity Identifier (UEI) confirmations via SAM.gov, as required under 2 CFR §§200.331–200.333. The affected pass-through activity totaled approximately $542,500 across three major federal programs (CFDA 93.310, 93.137, and 93.185). Management will implement the following corrective actions: • Establish a centralized subrecipient monitoring file for each subaward relationship, organized by program and award year, and confirm each subrecipient’s active UEI registration in SAM.gov at the time of award and annually thereafter. • Conduct and document a formal pre-award risk assessment using the Subrecipient Risk Assessment Questionnaire, covering prior federal experience, financial stability, internal controls, audit history, and SAM.gov registration. Perform and document a written subrecipient-vs.-contractor determination consistent with 2 CFR §200.331 before entering into or renewing any agreement. • Ensure all subaward agreements include the required award information, compliance responsibilities, reporting requirements, record retention provisions, and audit access provisions under 2 CFR §200.332. • Use the Subrecipient Desk Review Checklist to document quarterly monitoring, including review of progress reports, invoices, deliverables, indirect cost calculations, and personnel timesheets. Require supporting documentation before approving payments. • Maintain an annual Single Audit tracking log to verify federal expenditure thresholds and document collection, review, and resolution of any subrecipient audit findings. • Train program managers and accounting personnel on Uniform Guidance subrecipient monitoring requirements and present updated procedures to the Board/Finance Committee for formal adoption. Responsible Party Executive Director; Accounting Manager; Program Managers; Treasurer/Finance Committee. Completion Date Management has already begun implementation. Full implementation of the monitoring checklist and centralized files expected by September 30, 2026. Review of open FY2025/FY2026 subrecipient files and documentation requests by September 30,2026.

Finding Number: 2025-001 Condition: Management concurs with the finding and has implemented a new grant governance committee and process for identifying grant components before entering into grant agreements. Management also created a new grant department with staff devoted to researching, applying for, monitoring, and reporting on all grants. The accounting function for grants will be done by this team as well but with continued oversight by the Executive Director, Accounting. Contact person responsible for corrective action: Stephanie Sessoms, Chief Financial Officer; Lynn Bailey, Executive Director, Accounting Anticipated Completion Date: 1/12/2026

Views of Responsible Officials: The Foundation will retroactively perform a risk assessment of all subrecipients for FY26. Going forward, a pre-award risk assessment will be performed prior to awarding a subrecipient and appropriate monitoring procedures over sub-recipients will be implemented.

2025-004: Subrecipient Monitoring - Contractor vs. Subrecipient Determination (Significant Deficiency in Internal Control) Statement of Condition/Criteria: 2 CFR §200.331 requires pass-through entities to evaluate each subaward to determine whether the recipient is a subrecipient or a contractor. This evaluation should be based on the characteristics outlined in 2 CFR §200.331(a) and (b) and documented to support proper classification. Effective internal control over federal awards also requires documentation of compliance-related judgments to ensure consistent application and oversight. During our testing of internal controls over compliance, we noted that the Organization does not maintain formal documentation supporting its evaluation of whether award recipients are classified as contractors or subrecipients in accordance with Uniform Guidance. Planned Corrective Action: The Council will work to implement requirements at the program level to evaluate and document all contracts to properly identify between contract and subaward. Contact person responsible for corrective action plan: Clayton Kincheloe, Executive Director Anticipated Completion Date: September 2026

Finding #2025-001: #84.048 -Career and Technical Education - Basic Grants to States Federal Grantor Agency: U.S. Department of Education Compliance Requirement: Subrecipient Monitoring Condition: During our audit procedures, we noted that the District does not have formal, written procedures governing subrecipient monitoring. Although the District reviews supporting documentation—such as invoices—submitted by subrecipient schools prior to submitting claims to the Department of Public Instruction (DPI), these practices are not documented in an established policy or procedure. Criteria: Uniform Guidance (2 CFR 200.331–200.332) requires pass-through entities to establish and implement written procedures for monitoring subrecipients to ensure compliance with federal program requirements and achievement of performance goals. Cause: The District has not developed or implemented formal written policies and procedures for subrecipient monitoring. Effect: In the absence of formalized procedures, the District’s monitoring practices may be applied inconsistently, increasing the risk of unallowable costs, noncompliance with federal requirements, or misunderstandings between the District and its subrecipients. This could lead to questioned costs or administrative issues during oversight by DPI or other regulatory bodies. Recommendation: We recommend that the District develop and adopt formal written procedures outlining its subrecipient monitoring activities. These procedures should clearly describe monitoring responsibilities, required documentation, review steps, communication expectations, and follow-up actions. Implementing a formalized process will help ensure consistent oversight and compliance with federal regulations. Grantee Response: The District will develop and implement written procedures that outline the required monitoring steps, documentation standards, communication protocols, and follow-up expectations for subrecipient oversight. These procedures will align with the requirements of Uniform Guidance and DPI expectations.

Program: Congressionally Recommended Awards / HOME Investment Partnerships Program / Homeland Security Grant Program / Epidemiology and Laboratory Capacity for Infectious Disease Federal Financial Assistance Listing Number: 16.753 / 14.239 / 97.067 / 93.323 Federal Grantor: U.S. Department of Justice / U.S. Department of Housing and Urban Development / U.S. Department of Homeland Security / U.S. Department of Health and Human Services Award No. and Year: Multiple Compliance Requirements: Other – Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) §200.510(b) - Schedule of expenditures of Federal awards Type of Finding: Material Weakness in Internal Control Over Compliance Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) §200.510(b) states that the auditee (the County) must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee’s financial statements, which must include the total federal awards expended as determined in accordance with §200.502. §200.331 of the Uniform Guidance states the County is responsible for making case-by-case determinations to determine whether the entity receiving the Federal funds is a subrecipient. In addition, §200.303 of the Uniform Guidance states that the County must establish and maintain effective internal control over the federal awards, including controls over the accuracy of program information and expenditure amounts. Condition: During our audit procedures performed over the SEFA we noted the following: • The Sheriff-Coroner Department did not properly identify the amount expended for the Congressionally Recommended Awards, AL No. 16.753. The expenditures reported by the Department were overstated by $2,638,516. • The Orange County Community Resources Department did not properly identify the amount of Federal funding passed through to subrecipients for the HOME Investment Partnerships Program, AL No. 14.239. The amount passed through to subrecipients reported by the Department was overstated by $4,500,624. • The Sheriff-Coroner Department did not properly identify the amounts expended for the Homeland Security Grant Program, AL No. 97.067. The expenditures reported by the Department were overstated by $715,489. • The Orange County Health Care Agency (HCA) did not properly identify the amount expended for the Epidemiology and Laboratory Capacity for Infectious Disease program, AL No. 93.323. The expenditures reported by the Agency were overstated by $486,000. Cause: As a result, the County lacked adequate internal controls to ensure the SEFA is completely and accurately stated. Specifically, the County’s processes for recording and tracking expenditures of Federal awards are not designed so that expenditures are identified when incurred. In addition, the County’s processes for identifying and reporting subrecipients are not designed to ensure appropriate reporting on the SEFA. Effect: Adjustments to the SEFA were required. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: No sampling was used. Program expenditures and amounts passed through to subrecipients were reconciled to the supporting records. Repeat Finding from Prior Years: No. Recommendation: The County, including all its reporting departments, should follow existing policies, procedures and internal controls to ensure all expenditures and amounts passed through to subrecipients are accurately tracked and reported on the SEFA. Personnel knowledgeable of federal expenditures should review amounts coded to federal programs for completeness and accuracy. The SEFA should be prepared and reviewed in a timely manner and reconciled to underlying records as well as the basic financial statements. Management Response and Corrective Action Plan: Health Care Agency: 1. Person Responsible: David Santalahti, HCA Claims & Financial Reporting Manager 2. Corrective action plan: HCA Accounting will review and enhance its procedures and training for analysis and tracking federal award expenditures to ensure expenditures are reported in the appropriate fiscal year period. 3. Anticipated Implementation date: June 30, 2026 Orange County Community Resources: 1. Person Responsible: Bill Malohn, OCCR Accounting Manager 2. Corrective action plan: Concur. OCCR has established policies and internal controls to ensure all expenditures and amounts passed through to subrecipients are accurately tracked and reported on the SEFA. Appropriate personnel review amounts coded to federal programs for completeness and accuracy. We prepare and review the SEFA in a timely manner and reconcile to underlying records as well as the basic financial statements. In this particular situation, we miscategorized one provider as a subrecipient and reported the related funding as such on the SEFA. This oversight had no impact on the total amount we reported on the SEFA. We will be sure to follow our policies and procedures to ensure accurate SEFA reporting. 3. Anticipated Implementation date: February 2, 2026 Sheriff-Coroner: 1. Person Responsible: Monique Vansuch, Fiscal Administrator 2. Corrective action plan: The Sheriff-Coroner Department acknowledges the finding and recognized federal grant expenditure incurred is defined as when expenditures are delivered and/or services are performed rather than when the expenditures are paid. We will strengthen the internal controls to ensure grant expenditures are reported per the Uniform Guidance. 3. Anticipated Implementation date: June 30, 2026

Finding 2025-006 Subrecipient Monitoring Federal Agency Name: Department of Health and Human Services Pass-Through En􀆟ty: Iowa Department of Health and Human Services Assistance Lis􀆟ng Number: 93.069 Program Name: Public Health Emergency Preparedness Finding Summary: The County did not formally communicate the required informa􀆟on to the subrecipient. No subrecipient agreement was executed. In addi􀆟on, no monitoring ac􀆟vi􀆟es were documented. Responsible Individuals: Amber Shepard, Budget Director Correc􀆟ve Ac􀆟on Plan: Clinton County is working with Genesis Health System on implemen􀆟ng a subrecipient agreement and will put a control process in place to monitor An􀆟cipated Comple􀆟on Date: June 30, 2026

Department will strengthen controls to ensure that the required award information is provided, once available. Certain information such as Federal Award Identification Number and Federal Transit Administration and National Highway Traffic Safety Administration award date are not available at the time of contracting CDOT is working on a process to provide this information, once it is available in a publicly available format on CDOT’s website or on a subrecipient facing grant management site. We will add a note to the contract explaining where the information will be posted on our site when it becomes available. The Department will also identify staff requiring additional training on classification and coding for contractors vs. subrecipients.

Views of Responsible Officials Management concurs with the finding. The Operation Stonegarden grants are managed by Broken Arrow Services, LLC, who is contracted with Otero County for this purpose. Broken Arrow Services, LLC has communicated to all sub-recipients the importance of submitting reports and invoices in a timely manner so that financial and performance reports can be completed and submitted to DHSEM by the required deadlines each quarter. All late submissions by sub-recipients will be tracked and follow-up efforts will be documented. Reimbursement to sub-recipients who are not in compliance will be withheld until all proper documentation and reporting has been submitted and reviewed for accuracy. Finding Resolutions Timeline: June 30, 2026 Designation Of Employee Position Responsible For Meeting This Deadline: Finance Director

RE: Finding 2025-003 Misreporting of Pass-Through Grant Expenditures in Compliance Report In conjunction with our FY25 annual audit, please see the City's corrective action plan below: The City of Sand Springs will strengthen internal controls over federal grant reporting to ensure proper distinction between direct federal awards and federal pass-through grants, in accordance with Uniform Guidance and SLFRF requirements. Specifically, the City will implement the following corrective actions: Separate Tracking of Direct vs. Pass-Through Funds o The Finance Department will revise grant accounting procedures to clearly segregate expenditures related to: Direct SLFRF (ARPA) awards administered by the City, and Federal pass-through grants administered by external entities, including OWRB. o Separate project codes and/or accounting identifiers will be maintained to prevent commingling of expenditures. Revision of SLFRF Reporting Procedures o Written procedures for preparation and review of the SLFRF Compliance Report will be updated to explicitly state that: Only expenditures related to direct federal awards are to be reported by the City, and Expenditures related to pass-through grants are excluded and reported by the pass-through entity. o A documented review step will be added to verify that reported expenditures align with the funding source prior to submission. Staff Training and Awareness o Finance staff involved in grant accounting and reporting will receive targeted training on: Uniform Guidance requirements (2 CFR 200), The distinction between direct federal awards and pass-through grants, and Proper SEFA and SLFRF reporting responsibilities. o Training will be documented and incorporated into onboarding materials for future staff. Coordination with Pass-Through Entity (OWRB) o The City will coordinate with OWRB to confirm: The sequence of fund utilization (pass-through vs. direct ARPA funds), and Roles and responsibilities for federal expenditure reporting. Expected completion date: Procedures will be implemented for the fiscal year ending June 30, 2026, and applied during interim processing and year-end close. Party Responsible: Finance Director and Finance Staff, in coordination with applicable Department Heads and Project Managers. Contact Information: Arlena Barnes 918-246-2646 arlena.barnes@sandspringsok.gov

Finding 2025-010 U.S. Department of Housing and Urban Development (HUD) AL No. 14.241 Housing Opportunity for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2024-014 Auditee’s Corrective Action Plan: MOHS will enhance and formalize subrecipient monitoring procedures to ensure full compliance with Uniform Guidance requirements. Subrecipient agreement templates will be revised to require inclusion of the subrecipient’s Unique Entity Identifier (UEI) and Federal Award Identification Number (FAIN) for all subawards, in accordance with 2 CFR §§25.300 and 200.332. MOHS has previously developed subrecipient risk assessment and monitoring tools for the Continuum of Care (CoC) program. These tools and procedures will be reviewed, updated as needed, and expanded to apply to all MOHS grants, including HOPWA. This includes documented risk assessments, monitoring plans, and verification that required Single Audit reports are obtained, reviewed, and retained when applicable. MOHS will maintain centralized subrecipient monitoring files containing executed agreements, audit reviews, monitoring documentation, and follow-up actions. Program and fiscal staff will receive training on updated subrecipient monitoring policies and documentation standards to ensure consistent implementation across all funding sources. MOHS will utilize the GMO’s subrecipient monitoring templates provided on their centralized SharePoint platform which include risk assessments, reporting forms, expenditure forms, and metrics forms to ensure all required subrecipient monitoring reporting is completed. Additionally, MOHS will require all grant staff to attend GMO monthly trainings and quarterly grant monitoring meetings to ensure subrecipient monitoring is being conducted and completed. MOHS will also require all grant staff to familiarize themselves with Administrative Manual policy 413-51 Subrecipient Monitoring and Management, which specifies all city-wide requirements for subrecipient monitoring. MOHS will maintain copies of all subrecipient monitoring documents in Workday, the City’s financial system. Contact Person: Sade Creighton-Wade, Chief of Fiscal Services Completion Date: September 30, 2026

Corrective Action Plan June 30, 2025 Finding: 2025-001 Name of Responsible Official: Angela Bass Anticipation Completion Date: December 31 , 2025 Mississippi First's Response: 1. Audit Finding Corrective Action Plan The auditor noted that Mississippi First did not submit a FFATA report for a subaward of $30,000 or more in a timely and accurate manner. 2. Root Cause The delay in submitting the FFATA report was due to a personnel transition during the reporting period. The outgoing Executive Director had been executing FFATA filings, and the incoming Executive Director and was not yet aware of this reporting requirement. Because the requirement was not captured in any written procedures or transition documents, the report was inadvertently missed. This was an isolated incident resulting from the timing of the leadership transition and a gap in knowledge transfer. 3. Corrective Action Taken / Planned A. Formal Policy Development - Mississippi First has drafted a comprehensive FFATA Compliance and Subaward Reporting Policy. B. Assignment of Responsibility - The Director of Operations is designated as the FFATA Reporting Officer. C. FFATA Reporting Checklist - A standardized checklist ensures accuracy for each submission. D. FSRS Standard Operating Procedure (SOP) - A detailed, step-by-step SOP has been developed. E. Deadline Tracking & Automated Reminders - FFATA deadlines will be integrated into the grants management calendar. F. Quarterly Internal Reviews - Quarterly internal audits will verify completeness, accuracy, and timeliness. G. Job Description Updates - Relevant staff job descriptions now include FFATA responsibilities. 4. Timeline for Implementation • Finalize and adopt FFATA Policy- by December 31, 2025 • Assign FFATA Reporting Officer role - Completed • Launch FFATA checklist and SOP - by December 31, 2025 • Implement automated reminders - by December 31, 2025 • Conduct first quarterly compliance review - by December 31, 2025 5. Preventive Measures Mississippi First will require FFATA training, include FFATA in onboarding, review the policy annually, and integrate FFATA compliance into grants management protocols.

Finding Summary - There were no formal agreements between the District and its subrecipients as required in 2 CFR 200.331 and no formal subrecipient monitoring procedures were being performed. Responsible Individual - Terry Baesler, Superintendent Corrective Action Plan - The District will maintain formal agreements with the subrecipient entities that include the Uniform Guidance language and implement formal monitoring procedures were being performed. Anticipated Completion Date - 6/30/2026

2025-002 – Lack of Written Policies and Procedures. Auditor Description of Condition and Effect. Although the Village has processes in place to cover these areas, and drafts of formal written policies covering the above items that address all of the area required by the Uniform Guidance have been developed, these policies have not yet been formally approved and adopted by the Village. As a result of this condition, the Village did not fully comply with the Uniform Guidance applicable to the above noted grants. Auditor Recommendation. We recommend that the Village review and approve the draft policies as soon as practical, but no later than the end of fiscal year 2026. Corrective Action. The Village has prepared a policies and procedures manual for the federal grant programs, which will be approved by the Village Council before the end of fiscal year 2026. Responsible Person. Vicki Burrell, Village Clerk. Anticipated Completion Date: February 2026.

2025-003 – Lack of Written Findings and Questioned Costs. Auditor Description of Condition and Effect. Although the Village has processes in place to cover these areas, and drafts of formal written policies covering the above items that address all of the area required by the Uniform Guidance have been developed, these policies have not yet been formally approved and adopted by the Village. As a result of this condition, the Village did not fully comply with the Uniform Guidance applicable to the above noted grants. Auditor Recommendation. We recommend that the Village review and approve the draft policies as soon as practical, but no later than the end of fiscal year 2026. Corrective Action. The Village has prepared a policies and procedures manual for the federal grant programs, which will be approved by the Village Council before the end of fiscal year 2026. Responsible Person. Ross Wilson, Village Clerk/Treasurer. Anticipated Completion Date: February 2026.

1. Person Responsible: County Auditor-Controller 2. Corrective Action Plan: The County agrees with the finding and recommendation. The County has drafted policy and procedures for subrecipients. In addition, the County has drafted a subrecipient agreement template to identify subrecipients based on criteria in § 200.332. The County will provide a comprehensive training to program managers to implement the monitoring program and subrecipient agreement template. In addition, the County will include direction to project managers to review current awards to identify existing subrecipients that were not provided a subrecipient agreement with all of the required elements from CFR § 200.332. 3. Anticipated Implementation date: June 30, 2027

Finding Number 2024-014 Subject Heading (Financial) or AL no. and program name (Federal) EMERGENCY RENTAL ASSISTANCE PROGRAM (ERA) AL #21.019 Planned Corrective Action Oklahoma Office of Management and Enterprise Services (OMES) partially concurs with these findings. • OMES disagrees that they had sufficient and timely notice to make full corrective actions prior to this FY2024 audit for the following reasons: the FY2021 State auditor & Inspector (SAI) audit was released four days prior to the beginning of FY2024, the FY2022 SAI audit was released near the end of FY2025, and the FY2023 audit was released in FY2026; therefore, OMES could not take corrective action prior to the FY2024 audit began. At the beginning of FY2025, OMES began corrective measures as noted in SAI’s Condition and Context in this finding. • OMES acknowledges OMES subrecipient monitoring process lacked the strength and consistency to ensure subrecipients established and maintained effective internal control. However, OMES has taken steps to correct these findings and follow the recommendations set forth by SAI as noted in SAI’s Condition and Context in this finding. Beginning with FY2025, OMES has taken the following measures:  Oversight and management of the ERA program has been transferred to the OMES Grant Management Office (OMES-GMO) which has staff with several years of grant experience. OMES-GMO has recently hired additional staff, and the two staff members dedicated to the management of the ERA program have 20+ years of combined federal grant specific experience.  OMES ensured that the subrecipient agreement included all the required terms under the ERA Program and that the agreement does not expire, OMES-GMO and the Communities of Foundation of Oklahoma (CFO) executed an updated Subrecipient Grant Agreement Amendment that details the responsibilities of OMES to monitor CFO and the duties and processes that CFO must follow in regard to ERA Program, including detailed cash management policies.  OMES-GMO required the return of the remaining ERA2 Program funds from CFO to ensure proper oversight and review of ERA expenditures is performed.  OMES-GMO has in place a multi-level system of internal controls for grant management and oversight that includes routine monitoring, desk review, and site visits for all projects and associated project/administrative expenditures to ensure allowability, accuracy, and assist in the detection of fraud. For example, OMES-GMO’s process for disbursing funds to a subrecipient requires a written request from the subrecipient with supporting documentation, then OMES-GMO assigns a staff lead and secondary grant analyst to perform a primary and secondary review for compliance and to require additional supporting documentation if needed to approve the request. Once those reviews are completed and approved by the OMES-GMO staff, the Director of the OMES-GMO must approve the request before it is sent to the OMES Finance Division, who will then verify the calculated amount(s) before completing the disbursement to the subrecipient. These internal controls and policies have been implemented for the management and oversight of the ERA Program and provide a multilayer review that will prevent fraud and risk factors applicable to the ERA program. Additionally, the OMES-GMO staff assigned to the ERA program have the training and knowledge to ensure compliance with the Federal grant requirements.  Depending on the level of risk, OMES-GMO conducts monthly, bi-weekly or weekly meetings with each subrecipient to monitor the progress of projects and address any issues or changes that might impact the project. For the ERA Program, OMESGMO conducted bi-weekly monitoring meetings with CFO and reviewed documentation provided by CFO to ensure all ERA projects were eligible under the ERA guidelines and that CFO exercised the proper oversight over their subrecipients and spending. Anticipated Completion Date Completed Responsible Contact Person Brandy Manek