Corrective Action Plans

Community Services Block Grant (CSBG)-Federal Assistance Listing Number 93.569 - Material Weakness in Internal Control over Compliance Finding 2021-004 Noncompliance with Activities Allowed or Unallowed and Allowable Costs/Cost Principles Finding 2021-005 Noncompliance with Eligibility Recommendation: We recommend the Organization strengthen its compliance-related internal controls by: • Requiring standardized documentation to support compliance with each requirement. • Implementing periodic reviews of documentation completeness before charging costs to federal awards. • Providing training to staff responsible for grant management on compliance and record retention requirements. • Retain all documentation related to federal awards in a central location. 35 • Reinforcing the approval process by documenting and communicating approval requirements to all staff involved in initiating and processing transactions, providing mandatory training to employees on expense authorization policies, and establishing monitoring procedures to ensure approvals are consistently documented before transactions are processed. Management agrees with the finding and the recommendation. During the audit period in the following years until present, STOP’s clear policy and practice was to only provide service to individuals and families whose annual income does not exceed the established threshold on the federal poverty guidelines as published annually. While documentation was deficient to demonstrate eligibility for a small number of the total files sampled, the missing documentation is not an indicator that ineligible applicants received services. To address the root causes, the following actions have been implemented: The Organization has implemented Bill.com Accounts Payable workflow and document retention platform. Wipfli, LLP was engaged for accounting services in August of 2023 and subsequently, implemented Bill.com to facilitate accounts payable approval processes and document retention. The software has established hierarchies built within the system to ensure all invoices are properly reviewed and approved prior to processing. All staff included in the approval process were trained to utilize the system for processing. Wipfli staff is engaged for the accounts payable processing activities in the system. All STOP staff have or will participate in annual in-service training and will be provided updated eligibility criteria annually. This ensures that all staff have proper information and adheres to the federally published poverty guidelines and that agency practices of only providing services to individuals who meet the established criteria are provided services. Additionally, all files will include an eligibility checklist outlining all documents needed to support eligibility and will also include a compliance reviewer signature. This should ensure that all files are complete and have necessary documentation to support eligibility. Completion Date: December 2025

Agency: National Center for the Advancement of STEM Education, Inc. (nCASE) Person Responsible for Corrective Action: Name: Nancy Priselac Title: Executive Director Anticipated Completion Date: December 8, 2023 Response to Finding: Management concurs with audit recommendation. Correction Action to be Taken: nCASE has reviewed language in subaward agreements. Subaward agreements have been updated to include all relevant stipulations and requirements. DoD has reviewed the matters covered in the audit report thoroughly, and the grant was closed out without any repayment of funds to DoD. Upon subsequent review and reconciliation, amounts were not overcharged.

Finding 2021-006: Subrecipient Monitoring Federal Program: Research and Development Cluster (Education and Human Resources) Assistance Listing Number and Title: 47.076 STEM Education Name of Federal Agency, Pass Through Entity (when applicable), Award Number and Year: National Science Foundation: 1640791 (9/15/2016 – 8/31/2022) Condition: During our audit work over subrecipient monitoring, we were unable to verify that pre-award risk assessment procedures were performed. It is our understanding that AAPT has ongoing relationships with these subrecipients and evaluation of these subrecipients' risk is a continual process; however, these procedures were not documented. Views of Responsible Officials and Planned Corrective Actions: Management will continue to perform risk assessment procedures and will thoroughly document the processes and evaluations. Anticipated Completion Date: 12/31/2022 Responsible Official: Michael Brosnan, CFO

Finding 2021-006: Subrecipient Monitoring Federal Programs: Research and Development Cluster: Stem +C Cause: AAPT's internal policies and procedures governing risk assessment on subrecipient was not performed. Views of Responsible Officials and Planned Corrective Actions: Management will continue to perform risk assessment procedures and will thoroughly document the processes and evaluations. Anticipated Completion Date: December 17, 2021 Responsible Official: Michael Brosnan CFO

Finding 2021-009 Management agrees with the finding and is implementing the accompanying corrective action plan. Views of Responsible Officials: Jessica Martinez, Program Director Joel Rusco, Chief Financial and Administrative Officer Jacy Hyde, Executive Director Contact Person: Jessica Martinez, Program Director Corrective Action Plan: • CFSC has retained Clark Nuber to assist in updating its policies and procedures to include a risk assessment for all subrecipients. The updated procedure includes a review of the subrecipients’ past audits and the development of a thorough monitoring plan based on an assessment of risk and/or audit findings pertaining to federal awards. • CFSC will update its policies and procedures to require subrecipients to report matching funds on a quarterly basis to ensure the matching requirement is met by the end of the grant period. Anticipated Completion Date: CFSC will implement these corrective actions by the end of Quarter 2 of 2024.

Finding 2021-008 Management agrees with the finding and is implementing the accompanying corrective action plan. Views of Responsible Officials: Jessica Martinez, Program Director Jacy Hyde, Executive Director Contact Person: Jessica Martinez, Program Director Corrective Action Plan: • CFSC will update the subaward development procedure to include a review of the subaward agreement to ensure all applicable information and requirements are communicated to subrecipients at the time of the subaward in accordance with 2CFR 200.331(a). • Clark Nuber has reviewed the current subaward management policies and procedures as well as the subaward agreements. Clark Nuber has prepared an updated subaward agreement appendix that will be included with every new subaward. The subaward agreement will include all the necessary information to comply with the Uniform Guidance before the subaward agreement is provided to the subrecipient. After review and approval by CFSC management, the updated subaward shall be used by CFSC staff. Anticipated Completion Date: CFSC will update and implement its policies and subaward agreement by the end of Quarter 2 of 2024.

2020-003 Improve Controls and Documentation Over Subrecipient Monitoring Planned Action: We will ensure that searches are recorded and made available upon request for subrecipients’ proof of their compliance with the federal government. Planned Implementation Date of Corrective Action: August 31, 2026 Person Responsible for Corrective Action: Joseph Sweeney, Director of Finance

Finding 2020-006: Subrecipient Monitoring Federal Program: Research and Development Cluster (Education and Human Resources) Assistance Listing Number and Title: 47.076 STEM Education Name of Federal Agency, Pass Through Entity (when applicable), Award Number and Year: National Science Foundation: 1640791 (9/15/2016 – 8/31/2022)Cause: AAPT's internal policies and procedures governing risk assessment on subrecipient was not performed. Views of Responsible Officials and Planned Corrective Actions: Management will continue to perform risk assessment procedures and will thoroughly document the processes and evaluations. Anticipated Completion Date: 12/31/2022 Responsible Official: Michael Brosnan CFO

Finding 2020-006: Subrecipient Monitoring Federal Programs: Research and Development Cluster: Stem +C Cause: AAPT's internal policies and procedures governing risk assessment on subrecipient was not performed. Views of Responsible Officials and Planned Corrective Actions: Management will continue to perform risk assessment procedures and will thoroughly document the processes and evaluations. Anticipated Completion Date: December 17, 2021 Responsible Official: Michael Brosnan CFO

Federal Agency: U.S. Department of Housing and Urban Development Federal Program: 14.218 Entitlement Grants Cluster: Community Development Block Grants/Entitlement Grants Identification Number: B-15-MC-42-0018; B-16-MC-42-0018; B-17-MC-42-0018; B-18-MC-42-0018; B-19- MC-42-0018 Requirement: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance; Reporting; Special Tests and Provisions Type of Finding: Material weakness in internal control over major program; Noncompliance Description of Finding: The City does not have policies and procedures in place to perform the required risk assessment of subrecipients to determine the extent of monitoring procedures, and then perform and document the monitoring procedures performed. Section 2 CFR 200.331 of the Uniform Guidance states that pass-thru entities must evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. This evaluation may include, but is not limited to, (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a single audit and the extent to which the same or similar subaward has been audited as a major program; and (3) Whether the subrecipient has new personnel or new or substantially changed systems. Based on the results of the evaluation, the City would then have to consider the extent to which monitoring procedures are required. At a minimum, the City must, (1) Review financial and performance reports required by the City, (2) Follow-up and ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the City detected through audits, on-site reviews, and other means, and (3) Issue a management decision for audit findings pertaining to the federal award provided to the subrecipient from the City as required by Section 200.521 of the Uniform Guidance. Additionally, the City must perform monitoring visits as stipulated in the contracts between the City and the subrecipients. Recommendation: We recommend the City implement procedures to ensure risk assessment of subrecipients prior to each subaward is performed in accordance with the Uniform Guidance requirements and thoroughly documented. We further recommend that the required subrecipient monitoring be performed and documented for each subaward. Statement of Concurrence: The City of York, Pennsylvania agrees with audit finding 2019-015. Corrective Action: The City of York’s Bureau of Housing Services, CDBG and HOME have implemented a policy to handle risk assessments of subrecipients. The policy contains monitoring procedures and documentation of subrecipients visits for each subaward. Documentation is located in the financial management system, OpenGov. Name of Contact Person Responsible for the Corrective Action: Contact Full Name: Kimberly Robertson Contact title: Business Administrator for Finance Address: 101 South George Street City: York State: Pennsylvania Zip Code: 17401 Phone: (717) 849-2883 E-mail: KRobertson@yorkcity.org Timetable for Correction: The anticipated date for resolving the audit finding is December 31, 2024.