Corrective Action Plans

2024-005 Subreicipient Monitoring Compliance - SSVF Person responsible for corrective action - Andrea Olson, executive Director Responsible official's response - Management is in agreement with this finding. Corrective acction planned - CAPND has a comprehensive monitoring plan to monitor all grant supported activities in accordance with program rules relative to SSVF program including rules established by the program, those established by CAPND. Planned implementation date of corrective action - 2025

2024-004 Allowable Costs Compliance - SSVF Person responsible for corrective action - Andrea Olson, executive Director Responsible official's response - Management is in agreement with this finding. Corrective acction planned - CAPND has a comprehensive monitoring plan to monitor all grant supported activities in accordance with program rules relative to SSVF program including rules established by the program, those established by CAPND. Planned implementation date of corrective action - 2025

Finding 2024-028 U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Programs Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-024 Auditee’s Corrective Action Plan: BCHD has developed a subrecipient monitoring policy currently routing internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. E. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. F. Subrecipient contract agreement templates are being updated to ensure subaward is clearly identified and includes the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2024-025 U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-021 Auditee’s Corrective Action Plan: BCHD has developed a subrecipient monitoring policy currently routing internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. E. Update subrecipient contract agreement templates ensure subawards are clearly identified and include the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2023-022 U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-017 BCHD has developed a subrecipient monitoring policy currently routed internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2 CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. E. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. E. Update subrecipient contract agreement templates ensure subawards are clearly identified and include the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2024-014 U.S. Department of Housing and Urban Development AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-011 Auditee’s Corrective Action Plan: Condition #1 Response MOHS acknowledges the finding that 2 out of 2subrecipient files did not have evidence that subrecipient was monitored. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM, Unique Entity Identification #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports. Condition #2 Response MOHS acknowledges the finding that 2 out of 2 selections did not have information related to the funding source and pass through entity on the notice of award. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM, Unique Entity Identification #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports. Contact Person: Lakeysha Williams, Director of Programs, Mayor’s Office of Homeless Services Completion Date: April 7, 2025

2024-003 – Subrecipient Monitoring Compliance Person responsible for corrective action: Nicole Meland, Vice President of Finance and Operations Responsible official’s response: Management is in agreement with this finding. Corrective action planned: The Chamber Foundation has subsequently requested all audit reports from all subrecipients. Additionally, the Chamber Foundation has changed subaward formatting to ensure that all required information is included within the award. Planned implementation date of corrective action: May 27, 2025

SD 2024‐003 SUBRECIPIENT MONITORING Recommendations: If the most recent subrecipient audit report is not yet available, management should request the prior fiscal year if not already obtained. Management’s Response: The IRL Council put controls in place to be more effective at subrecipient monitoring following the FY 2023 finding which included the following actions: The IRL Council reviewed all projects and activities currently allocated and funded by federal sources to ensure the Uniform Guidance was in place within their respective agreements, and they were amended as needed. All new subrecipient agreements funded by federal sources were not executed until the respective federal award was in place and the Uniform Guidance language was included. The IRL Council did request audit reports from subrecipients and made statements on them, however for the ones who had not completed their FY 2024 audit, a prior year audit report was not immediately requested and statements for those subrecipients had not yet been made. The IRL Council will implement a control to request prior year Financial Statements/audit reports from subrecipients who have not yet completed their report for the year being requested during the Council’s monitoring. Responsible Party: Daniel Kolodny, COO Anticipated Completion Date: June 1, 2025.

Views of Responsible Officials: Over the past three (3) years, the organization has increased the skill set and capacity among teams for risk assessment and awards management. Subaward policies have been reviewed and all subaward recipients are required to complete pre-award surveys (which include the risk assessment unless the subrecipients are pre-approved by USAID and exempted from such policies). The Associate Director of Grants and Compliance continues to work with members of the Program team to monitor all subrecipient awards for full compliance with 2 CFR 200.516(a). After the FY2022 findings, Astraea sought documentation from federal agencies where risk assessment exemptions applied. The inception of some of these subawards predated FY2022. While we had intended to perform new retroactive risk assessments, the suspension of the federal awards as of January 24, 11:59PM and subsequent termination of the awards had clear instructions to stop work, and therefore made such requests impossible.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored. Management Response: The agency agrees with the finding. During state fiscal year 2024, the division was in the process of implementing controls for subrecipient determination or contractors, required reporting, risk assessment, and monitoring plan. Since this period, the division has fully implemented the internal controls to ensure compliance with the federal requirements as identified in prior audits. The division recognizes that there are opportunities to strengthen the controls for subrecipient contractor determination, risk assessments and monitoring activities are accurate, complete, and documented and will refine these tools. The division also recognizes the opportunity to continue to improve controls that ensure that corresponding disbursements of federal funds are appropriately reported. The division will collaborate with agency financial services to develop enhanced controls that will ensure prevention, detection, and correction of payment reporting. Contact Person: Mick Kincaid Business Operations Manager Behavioral Health Division

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored. Management Response: The agency agrees with the finding. During state fiscal year 2024, the division was in the process of implementing controls for subrecipient determination or contractors, required reporting, risk assessment, and monitoring plan. Since this period, the division has fully implemented the internal controls to ensure compliance with the federal requirements as identified in prior audits. The division recognizes that there are opportunities to strengthen the controls for subrecipient contractor determination, risk assessments and monitoring activities are accurate, complete, and documented and will refine these tools. The division also recognizes the opportunity to continue to improve controls that ensure that corresponding disbursements of federal funds are appropriately reported. The division will collaborate with agency financial services to develop enhanced controls that will ensure prevention, detection, and correction of payment reporting. Contact Person: Mick Kincaid Business Operations Manager Behavioral Health Division

Federal Agency: U.S. Department of Housing and Urban Development Program/Cluster: Housing Voucher Cluster Federal Assistance Listing Number: 14.871, 14.879 Pass‐through: n/a – direct award Award No. and Year: CA131, 2023/2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Instance of Noncompliance Views of Responsible Officials and Corrective Action Plan: Due to the subrecipient’s low-risk status, another site visit is not due until FY2025/26. When that visit takes place, the County will formally document and communicate the results of the site visit. The department has created a subrecipient monitoring checklist to be completed quarterly which includes review of quarterly reports and will serve as documentation. Additionally, the department has a standing quarterly meeting with the subrecipient and will add an agenda item for quarterly report review discussion. The department will begin taking meeting minutes for documentation. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2025

Subrecipient Monitoring Non-compliance with its inconsistent documented monitoring procedures. Corrective Action Plan: AMHD will review and revise their monitoring procedures to ensure that subrecipient expenditures are monitored and single audit reports are reviewed, as applicable. Implementation Date: July 1, 2025 Responding Official: Chanel Daluddung, Performance, Information, Evaluation and Research Branch Chief, Adult Mental Health Division

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 21.027 Coronavirus State and Local Fiscal Recovery Funds State Agency: NH Governor’s Office of Emergency Relief and Recovery Audit Contact: Michele Thibault Title: Director of Finance and Compliance Telephone: (603)-271-7951 E-mail address: Michele.Z.Thibault-G@goferr.nh.gov Audit Report Reference: 2024-011 – Procurement Anticipated Completion Date: April 30, 2025 View of Responsible Officials: The State’s vendor determination policy is consistently applied across all Department’s within the State. The State’s vendor determination policy does not identify or vary for subrecipient, beneficiary, or contractor payments, however, federal reporting requirements dictate stratification of subawards as defined within 2 CFR 200. Accordingly, state agencies utilize various methods to differentiate payments to subrecipients from payments made to beneficiaries or contractors. Although there may be requirements to stratify beneficiary payments from procurement contracts specific to individual program requirements, there is no unifying requirement for States to otherwise stratify these populations within uniform grant guidance codified within 2 CFR 200. For this reason sampling of payment data to differentiate beneficiaries from contractors can be difficult for test work purposes. As stated in 2 CFR 200.331, the State is responsible for making a case-by-case determination to determine whether the entity receiving federal funds is a subrecipient or a contractor. As such, the State has provided training and documentation to all Departments to utilize for determining if a program/project is for a subrecipient or contractor. While this determination will not impact the procurement process in the State, it does impact the monitoring process for subrecipients versus contractors and the State has followed the procedures to ensure the proper determination for oversight. Per 2 CFR section 200.303, the State has established and maintained effective internal control over federal awards to provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award by providing Departments training, information and processes for Departments to determine if federal funds are utilized for a subrecipient or contractor and how the use of those funds shall be monitored. The State will review the selections determined to be misclassified per 2 CFR 200.331 to evaluate their classification and where necessary make adjustments to considerations made in the application of the specified criteria of 200.331

Department of Public Instruction Response/Corrective Action Plan: DPI agrees with the finding. We have split the duties of subrecipient review among two employees. One person does the administrative functions and responses to subrecipients who have no findings. The other employee works on the more complex audit reviews. We feel that this change along with the increase to the audit threshold and the end of the COVID related federal funding will allow us to stay in compliance of federal regulations. Contact Person: Jamie Mertz, CFO Anticipated Completion Date: This was implemented January 2, 2025

Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance (Modified Opinion) Condition: Kansas Division of Emergency Management (Management) did not issue subawards to subrecipients until after the fiscal year ended. Recommendation: We recommend that Management reviews and enhances its internal controls and procedures to ensure that subawards are issued timely to subrecipients, and that subawards include all required federal award information. Views of responsible officials: Management partially agrees with this finding. Although the 2023 2 CFR § 200.332 does state that the award letters should be sent at the time of the award, there needs to be some reasonableness to the interpretation of this regulation. KDEM currently has 13 open disasters with over 100 open projects and more being written. It is not reasonable to interpret that the award letters be sent on the date that the award is granted. Action taken in response to finding: Management will utilize the report run for FFATA to send award letters to sub-recipients. Name(s) of the contact person(s) responsible for corrective action: Jennifer Deal, Fiscal & Grants Management Section Chief Planned completion date for corrective action plan: Ongoing

Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance (Modified Opinion) Condition: Subawards issued by the Kansas Department of Health and Environment (Department) did not include all required subaward information. Recommendation: We recommend that the Department develop a subaward template that includes all required federal award information and update its procedures and internal controls to ensure that all required federal award information is included in subawards at the time of issuance. Views of responsible officials: Management disagrees with the finding. Multi-year subrecipient agreements executed prior to March 2024 did not include the Sub-Recipient Agreement Submission Form. The agreements were not re-executed after March 2024 to include the form. The audit findings should only pertain to agreements newly executed after March 2024; however, because the audit included agreements executed prior to March 2024, the audit found that information is missing. Action taken in response to finding: All subrecipient agreements executed after March 2024 include the Sub-Recipient Agreement Submission Form. Name(s) of the contact person(s) responsible for corrective action: Farah Ahmed and Sheri Tubach, Bureau of Epidemiology and Public Health Informatics Planned completion date for corrective action plan: Completed

Responsible Contact Person(s): Kimberly Boehme, OPGS Director Corrective Action Planned: Policies and procedures for grant management - to include subrecipient monitoring and FFATA reporting - will be revised. Oversight responsibilities will be determined for the Office of Grant Management, Office of Purchasing and General Services, and Office of Financial Management. Employees responsible for managing grants and subrecipients will receive training on the new process. Estimated Completion Date: 12/31/2025

Finding: 2024-002 - Subrecipient Monitoring Auditor Description of Condition and Effect: We noted that the Organization did not compile any risk assessments or perform adequate subrecipient monitoring during the fiscal year. The lack of monitoring failed to provide reasonable assurance that the subrecipients complied with the provisions of the grant. Auditor Recommendation: We recommend that the Organization create a subrecipient policy to ensure that all subrecipient grant awards are monitored in compliance with the Uniform Guidance requirements. Corrective Action: Management will create and adopt a subrecipient monitoring policy that ensures compliance with the Uniform Guidance requirements by June 30, 2025. Responsible Person: Joe Sobieralski, President and CEO Anticipated Completion Date: June 30, 2025

We acknowledge that the timing of these actions did not fully align with the requirements of Uniform Guidance, which specifies that subaward information must be communicated with the subrecipients in writing at the time the subaward is made. However, the Organization worked diligently to address the issue once identified. To prevent recurrence of this issue, the Organization has taken corrective actions. As soon as we were made aware of the status of the recipients of the awards as subrecipients, we informed them of their status orally and outlined the general terms and compliance requirements associated with their subaward. We formalized this notification process by providing written agreements detailing the subaward terms, as required, in June 2024. These agreements were subsequently signed and returned by the subrecipients in July 2024. To avoid similar compliance challenges, the Organization worked with the Commonwealth of Massachusetts to revise its agreement. Effective September 30, 2024, the Organization no longer serves as a pass-through entity and does not pass federal funds through to subrecipients. For the remaining period during which the Organization acted as a pass-through entity, we implemented procedures to ensure timely and accurate communication of subaward information in writing, aligning with Uniform Guidance requirements. Management believes these actions fully address the cause of the finding and ensure compliance with federal regulations in the future.

U.S. Department of Health and Human Services, Family Planning Services, AL #93.217 Subrecipient Monitoring: Noncompliance and Significant Deficiency in Internal Control over Compliance Finding Summary: The Organization does not have a formalized policy. Additionally, audit report findings were not reviewed and followed‐up on. Responsible Individuals: Joanna Murray, Executive Director Corrective Action Plan: Procedures will be developed to ensure proper subrecipient monitoring. Additionally, audit findings will be followed‐up on. Anticipated Completion Date: June 2025

Program: Emergency Rental Assistance Program Federal Agency: US Department of Treasury AL #: 21.023 Federal Award Identification Number and Year: Various – See SEFA Pass-through Entity: N/A Type of Compliance Finding: M – Subrecipient Monitoring Internal Control Impact: Material Weakness Finding: Management did not annually monitor “all” subrecipients as required by the Federal regulations and City policy. Status: In progress – The Housing Department anticipates this will be completed by April 30, 2025 for subrecipient contracts. The City Grants Manual is being updated by the Finance Department grant staff currently and the anticipated completion is January 31, 2025. Corrective Action Plan: The Housing Department will have procedures in place to ensure the subrecipient monitoring is completed for each subrecipient contract annually. Information regarding subrecipient monitoring will be included in the updated City Grants Manual. Person(s) Responsible for Implementation: LaToya Jones, Financial Manager, Housing and Community Development, Telephone: (816) 513-8436; Email: LaToya.Jones@kcmo.org Dion Lewis, Deputy Director, Housing and Community Development, Telephone: (816) 513-8494; Email: Dion.Lewis@kcmo.org Robin Flaherty, Financial Manager, Finance Department, Telephone: (816) 513-1202; Email: Robin.Flaherty@kcmo.org

Federal Program: Coronavirus State and Local Recovery Funds Assistance Listing No. 21.027 Recommendation: Our auditors recommended that the Organization create an internal policy over sub-grant recipient procedures and create effective internal controls and procedures over subrecipient monitoring and tracking that allow for compliance with all applicable Federal laws, regulations, and compliance requirements of various Federal grants Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Organization has accepted the recommendation and will add language to the existing Grant Funds Tracking Policy and Procedure outlining the Organization’s responsibilities for establishing effective internal controls and procedures over subrecipient monitoring. The updated policy will also include reference to the Information to Provide to Every Subrecipient for Each Subaward form. This form outlines details of the pass-through grant, and subrecipient responsibilities, and will be signed by each subrecipient prior to any pass-through fund disbursement. Also, the Organization will educate supervisors on this policy update at an upcoming training meeting no later than October 31, 2024.

Trailhead is establishing a new Contract and Compliance Coordinator role to oversee contract compliance processes and to ensure that Trailhead’s policy on subrecipient monitoring is followed. This role will be responsible for ensuring that compliance requirements are integrated at the outset of each grant. This role will be responsible for internal monitoring and auditing. This role will ensure that all grant kick-off meetings follow a standard procedure and include: 1) A clear understanding of federal requirements for all involved fiscal, program, and compliance staff 2) Delegated assignments to program staff for implementing and documenting: a) Suspension and debarment prior to contracting with subrecipients b) Subrecipient vs contractor determinations c) Evaluation of each subrecipient’s risk of noncompliance i) Establish the appropriate subrecipient monitoring level based on risk. This compliance role will have the authority to ensure the procedures are completed by the assigned staff. Evidence of the completed procedure must be documented and saved in a newly created contracts database. This database will be a centralized storage that will be reviewed during internal compliance checks to ensure all required steps have been completed and documented. These documents and associated grant and contract documents will be part of an official repository.

With the support of a new leadership team, Jefferson Parish is committed to strengthening oversight and monitoring federal grants financial and compliance activities. To enhance reliability, the Parish has engaged Deloitte & Touche LLP as a consultant to assist with improving documentation procedures and strengthen internal controls supporting financial and compliance activities going forward. As part of this effort Jefferson Parish and Deloitte are working across Finance, Accounting, and programmatic departments to establish improved federal grants governance and policy. This includes quarterly oversight and review processes and procedures to monitor the use of federal funds and confirm that compliance activities are occurring. This also includes improved preventative controls to require the performance of due diligence activities for each federal fund sub-recipient or individuals receiving federal assistance prior to the awarding or disbursement of federal funds. The Parish will also develop a policy and communicate annually to all departments the requirements to report to the appropriate authorities, including the Louisiana Legislative Auditor's Office and the Jefferson Parish District Attorney's Office. Community Development Director Stephanie Brumfield, Interim Finance Director Victor LaRocca and Risk Management Director Maria Leon will develop and communicate the policy for reporting fraud which should be enacted by January of 2026.