Corrective Action Plans

State of Missouri Single Audit Corrective Action Plan Year Ended June 30, 2024 State Agency: Office of Administration Audit Finding Number: 2024-007, SLFRF Program Subrecipient Monitoring Name of the contact person responsible for corrective action: Stacy Neal Anticipated completion date for corrective action: November 1, 2025 Recommendation A.: Develop policies and procedures to determine whether recipients of SLFRF program funds are subrecipients or contractors. Continue to work with the state agencies to ensure accurate and documented determinations are prepared for all recipients and modify subrecipient records as needed. OA partially agrees with the auditor’s finding. Corrective action planned is as follows: OA did complete a training for all agencies regarding subrecipient monitoring and the agencies responsibilities. OA also distributed a memo instructing agencies where to find information regarding subrecipient monitoring and instructing agencies to develop policies and procedures for their agency. To avoid confusion, OA will pursue Memorandums of Understandings (MOU) with agencies to ensure agencies understand their responsibilities for sub-recipient monitoring including sub-recipient specific risk assessments and monitoring. Finally, OA will implement random reviews of the sub-recipient monitoring compliance. Recommendation B.: The OA did not implement an effective subrecipient monitoring program to monitor the SLFRF subrecipients. As a result, some subrecipient monitoring procedures were not performed as required by the UG. OA agrees with the auditor’s finding. Corrective action planned is as follows: OA will pursue Memorandums of Understandings (MOU) with agencies to ensure agencies understand their responsibilities for sub-recipient monitoring including sub-recipient specific risk assessments and monitoring. Finally, OA will implement random reviews of the sub-recipient monitoring compliance.

The audit highlighted insufficient monitoring of subrecipients. To address this, a subrecipient monitoring policy has already been drafted and is being reviewed by the Executive Director. In addition to this, a subrecipient framework is being developed. This framework will standardize risk assessments, routine monitoring procedures and reporting requirements to ensure compliance with federal guidelines. Staff training on these monitoring practices will be completed prior to implementation.

Corrective Action Plan – Hamilton County Economic Development Corporation (dba Invest Hamilton County) Public Accounting Firm CliftonLarsonAllen LLP Audit Period Year ended December 31, 2024 The finding from the December 31, 2024 consolidated schedule of findings is discussed below. The findings is numbered consistently with the numbers assigned in the schedule. Section III 2024-001: Condition: The Organization did not clearly communicate the required federal award information and applicable requirements to the subrecipients. The Organization did not evaluate the risk of non-compliance of the subrecipients in order to identify the appropriate monitoring procedures. Statistical sampling was not used in making sample selections. Response: The response to this finding in 2023 was provided less than one month prior to the end of the grant activity period, and therefore adaptation to the management period was not feasible for this project. The Organizations’ Board and Chief Executive OMicer (CEO) and key HCEDC StaM recognize the need to further refine subrecipient monitoring. Subrecipients within the identified project are all school districts already under single audit with associated levels of financial controls and reporting. Participating districts, via their appropriate elected boards, were informed the conditions of the grant and individually voted to accept obligations and requirements. HCEDC management, in alignment with outsourced controller services via CliftonLarsonAllen LLP, have now further increased controls and monitoring activity. Through the onboarding of a new Grants Management System (GMS) in Fall 2024, subrecipient monitoring activity and profiles are now created for each eligible award. In 2024 and 2025, the HCEDC has also been much more active in communicating reporting and grants management requirements to subrecipients, including multiple amendments to the ESSER grant program. The new GMS system is built specifically to assist organizations with single audit compliance and has multiple features specific to subrecipient reporting and monitoring. If there are any questions regarding this plan, please contact the undersigned at 317-663-4457. Mike Thibideau PRESIDENT & CEO – INVEST HAMILTON COUNTY 37 East Main Street Carmel, IN 46032

2024-003 – Subrecipient Monitoring Auditor Description of Condition and Effect. We noted that the County did not compile any risk assessments or perform adequate subrecipient monitoring during the fiscal year. The lack of monitoring failed to provide reasonable assurance that the subrecipients complied with the provisions of the grant. Auditor Recommendation. We recommend that the County create a subrecipient policy to ensure that all subrecipient grant awards are monitored in compliance with the Uniform Guidance requirements. Corrective Action. The County will create a subrecipient monitoring policy to ensure that all subrecipient grant awards are monitored in compliance with the Uniform Guidance. Responsible Person. Eric Smith, Director of Finance & Budget Anticipated Completion Date. December 31, 2025

August 15, 2025 United States Department of Agriculture National Institute of Food and Agriculture Awards Management Division 805 Pennsylvania Ave Kansas City, MO 64105 Attention: Federal Audit Clearinghouse (FAC) Subject: Corrective Action Plan Submission – Finding #4 – Sovereign Equity Fund – Fiscal Year End 12/31/2024 To Whom It May Concern: Subrecipient Monitoring - Subrecipient agreements lacked required federal clauses and were not monitored according to risk assessments. Corrective Actions: • Develop a subrecipient monitoring policy aligned with 2 CFR §200.331-333. • Standardize agreement templates to include all required clauses for federal award subrecipient agreements (e.g., audit requirements, FFATA, termination provisions). • Implement a subrecipient risk assessment tool to determine monitoring frequency and risk level identification. • Assign staff for annual subrecipient desk reviews or site visits based on risk levels. Responsible Party: Executive Director / Legal & Compliance Team Target Completion Date: Risk assessment and financial monitoring tool in use and agreement templates updated within 45 days. Sincerely, Courtney Chavis Executive Director

Management agrees with the finding. The Center is currently in the process of updating its fiscal policies and procedures to align with the requirements of 2 CFR Part 200. The Finance Committee is leading this effort and is reviewing each policy area identified, including conflict of interest, allowable costs, subrecipient monitoring, and record retention. Updated policies and procedures will be finalized and presented for Board approval by August 30, 2025. Once approved, the Center will ensure implementation across all departments and provide internal guidance to promote consistent application. Anticipated Completion Date: August 30, 2025 Responsible Party: Finance Committee, with support from Executive Director, Nichole Henry.

Person responsible for corrective action: Nicole Meland, Vice President of Finance and Operations Responsible official’s response: Management is in agreement with this finding. Corrective action planned: The Chamber Foundation has subsequently requested all audit reports from all subrecipients. Additionally, the Chamber Foundation has changed subaward formatting to ensure that all required information is included within the award. Planned implementation date of corrective action: Ongoing

Recommendation: We recommend that the Parish establish and implement formal policies and procedures for subrecipient monitoring in accordance with 2 CFR § 200.331. This should include conducting and documenting pre-award risk assessments, developing a subrecipient monitoring plan (e.g., site visits, desk reviews), reviewing subrecipient performance and audit reports on a regular basis. Corrective Action: The Parish has established a subrecipient checklist to assess risk and compliance. The checklist will be completed as an additional measure to ensure the standards outlined in the “Grant Administration Policies & Procedure” are met.

THE ORGANIZATION WILL USE EXPENDITURE REPORTS BY CLASS TO SUPPORT BASE EXPENDITURES FOR THE PERIOD. WILL BE IN PLACE FOR THE 2025 SINGLE AUDIT AND BEGAN THIS PROCESS IN 2024. KAREN SHARPNACK, EXECUTIVE DIRECTOR KJS@IDAHOIMMUNE.ORG AND NEW CPA FIRM TO BE DETERMINED. THE ORGANIZATION THROUGH ITS BOARD OF DIRECTORS WILL CREATE A “FINANCIAL POLICY COMMITTEE” WHICH WILL BE RESPONSIBLE TO WORK WITH THE EXECUTIVE DIRECTOR, THE NEW CPA TO OUTLINE AND CREATE NEW POLICIES, PROCEDURES AND PROCESSES, ALONG WITH OVERSIGHT OF THE FINANCIAL WELL-BEING OF THE ORGANIZATION AND REPORT TO THE BOARD OF DIRECTORS. IMMEDIATELY, THE PROCESS WILL BEGIN TO RECRUIT THE COMMITTEE ON JUNE 25, 2025.

DMPSJ: While the Office of the Deputy Mayor for Public Safety and Justice (DMPSJ) doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. Nicole Peckumn, Chief of Staff, DMPSJ August 30, 2025 DMPSJ will ensure compliance with standard operation procedures to ensure monthly and performance reports are submitted, as well as ensure follow-up related to corrective action plans is documented. While DMPSJ doesn’t agree with the finding regarding the debarment check, DMPSJ will implement a practice of capturing a screenshot and maintaining a copy of the screenshot in the file for a grantee(s) receiving federal funding. ONSE: The Office of Neighborhood Safety and Engagement (ONSE) acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. ONSE has created a monitoring team and plan to ensure that all subrecipients are in compliance with submissions of their financial and performance reports. Contact: Yasha Williams Robinson, Chief Operating Officer, ONSE Estimated Completion Date: September 30, 2025 See Corrective Action Plan for chart/table

Finding #2024-002 – Significant Deficiency and Other Noncompliance. Applicable federal program: U. S. Environmental Protection Agency, Assistance Listing #66.456, National Estuary program, Passed through Texas Commission on Environmental Quality: Contract period: 09/01/23 – 08/31/25, Contract number: 582-24-50165. Condition and context: We reviewed one of the two subrecipient awards for the required information described in the criteria above and noted such provisions were not included in the subrecipient agreement. Recommendation: Policies and procedures should be implemented to ensure all required information is included in the subrecipient agreement before issuance. Planned corrective action: Management agrees with the finding and would like to provide additional context to this situation. This agreement occurred during the early implementation phase of a multi-year grant in 2023, when the Foundation was still establishing internal processes for managing subawards under federal funding requirements. At the time of this transaction: The federal award had not yet been formally executed, though the federal agency provided authorization to begin incurring expenses. The subrecipient, a partner organization, drafted and issued the agreement using their standard contract template. Since that time, the Foundation has updated its procedures for subsequent subrecipient agreements to include the required Uniform Guidance information as outlined in 2 CFR §200.331(a). This was an isolated incident during a transitional period, and management is confident that current processes address this issue. To prevent recurrence, the Foundation will: Continue to follow updated subrecipient agreement templates, which include all required award and federal compliance language. Provide refresher training to staff involved in grant and contract administration on subrecipient vs. vendor classifications and associated federal requirements. Perform an annual compliance review of all subrecipient agreements to ensure ongoing adherence. Responsible officer: Dawn Asbury, Controller. Estimated completion date: July 31, 2025.

Finding 2024-003: SEFA Preparation – Subrecipient vs. Subcontractor Determinations Name of Responsible Official: Nikolos Oakley, CFAO Anticipated Completion Date: 09/30/2025 Condition: Subcontractor amounts were improperly included in the Amounts Provided to Subrecipients column on the Schedule of Expenditures of Federal Awards (SEFA). Context: Management made improper subrecipient vs. subcontractor determinations, resulting in inaccurate SEFA preparation. This resulted in $2.6 million being removed from the Amounts Provided to Subrecipients column in the original SEFA provided to the auditors by management. Views of Responsible Officials and Planned Corrective Action: IntraHealth acknowledges the finding regarding the improper inclusion of subcontractor amounts in the Amounts Provided to Subrecipients column on the Schedule of Expenditures of Federal Awards (SEFA). We will improve our reporting and review processes to ensure subcontractor amounts are not incorporated under Amounts Provided to Subrecipients column in SEFA. Corrective Action: • Implement a more rigorous review process to ensure that only true subrecipients are included in the Amounts Provided to Subrecipients column of the SEFA. Subcontractor amounts will be reported separately as required. We will also improve training for the finance and grants management teams to ensure they fully understand the regulations. IntraHealth is committed to ensuring the accuracy of future SEFA reports and will complete the corrective actions by 09/30/2025. We will also continue to monitor the effectiveness of these changes to prevent future misclassifications.

2024-006 Subrecipient Monitoring Compliance - CSBG Person responsible for corrective action - Andrea Olson, executive Director Responsible official's response - Management is in agreement with this finding. Responsible official's response - Management is in agreement with this finding. Corrective action planned - CAPND has changed subaward formatting to ensure that all required information is included within the award. Planned implementation date of corrective action - July 1, 2024

2024-005 Subreicipient Monitoring Compliance - SSVF Person responsible for corrective action - Andrea Olson, executive Director Responsible official's response - Management is in agreement with this finding. Corrective acction planned - CAPND has a comprehensive monitoring plan to monitor all grant supported activities in accordance with program rules relative to SSVF program including rules established by the program, those established by CAPND. Planned implementation date of corrective action - 2025

2024-004 Allowable Costs Compliance - SSVF Person responsible for corrective action - Andrea Olson, executive Director Responsible official's response - Management is in agreement with this finding. Corrective acction planned - CAPND has a comprehensive monitoring plan to monitor all grant supported activities in accordance with program rules relative to SSVF program including rules established by the program, those established by CAPND. Planned implementation date of corrective action - 2025

Finding 2024-028 U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Programs Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-024 Auditee’s Corrective Action Plan: BCHD has developed a subrecipient monitoring policy currently routing internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. E. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. F. Subrecipient contract agreement templates are being updated to ensure subaward is clearly identified and includes the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2024-025 U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-021 Auditee’s Corrective Action Plan: BCHD has developed a subrecipient monitoring policy currently routing internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. E. Update subrecipient contract agreement templates ensure subawards are clearly identified and include the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2023-022 U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-017 BCHD has developed a subrecipient monitoring policy currently routed internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2 CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. E. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. E. Update subrecipient contract agreement templates ensure subawards are clearly identified and include the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2024-014 U.S. Department of Housing and Urban Development AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-011 Auditee’s Corrective Action Plan: Condition #1 Response MOHS acknowledges the finding that 2 out of 2subrecipient files did not have evidence that subrecipient was monitored. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM, Unique Entity Identification #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports. Condition #2 Response MOHS acknowledges the finding that 2 out of 2 selections did not have information related to the funding source and pass through entity on the notice of award. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM, Unique Entity Identification #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports. Contact Person: Lakeysha Williams, Director of Programs, Mayor’s Office of Homeless Services Completion Date: April 7, 2025

2024-003 – Subrecipient Monitoring Compliance Person responsible for corrective action: Nicole Meland, Vice President of Finance and Operations Responsible official’s response: Management is in agreement with this finding. Corrective action planned: The Chamber Foundation has subsequently requested all audit reports from all subrecipients. Additionally, the Chamber Foundation has changed subaward formatting to ensure that all required information is included within the award. Planned implementation date of corrective action: May 27, 2025

SD 2024‐003 SUBRECIPIENT MONITORING Recommendations: If the most recent subrecipient audit report is not yet available, management should request the prior fiscal year if not already obtained. Management’s Response: The IRL Council put controls in place to be more effective at subrecipient monitoring following the FY 2023 finding which included the following actions: The IRL Council reviewed all projects and activities currently allocated and funded by federal sources to ensure the Uniform Guidance was in place within their respective agreements, and they were amended as needed. All new subrecipient agreements funded by federal sources were not executed until the respective federal award was in place and the Uniform Guidance language was included. The IRL Council did request audit reports from subrecipients and made statements on them, however for the ones who had not completed their FY 2024 audit, a prior year audit report was not immediately requested and statements for those subrecipients had not yet been made. The IRL Council will implement a control to request prior year Financial Statements/audit reports from subrecipients who have not yet completed their report for the year being requested during the Council’s monitoring. Responsible Party: Daniel Kolodny, COO Anticipated Completion Date: June 1, 2025.

Views of Responsible Officials: Over the past three (3) years, the organization has increased the skill set and capacity among teams for risk assessment and awards management. Subaward policies have been reviewed and all subaward recipients are required to complete pre-award surveys (which include the risk assessment unless the subrecipients are pre-approved by USAID and exempted from such policies). The Associate Director of Grants and Compliance continues to work with members of the Program team to monitor all subrecipient awards for full compliance with 2 CFR 200.516(a). After the FY2022 findings, Astraea sought documentation from federal agencies where risk assessment exemptions applied. The inception of some of these subawards predated FY2022. While we had intended to perform new retroactive risk assessments, the suspension of the federal awards as of January 24, 11:59PM and subsequent termination of the awards had clear instructions to stop work, and therefore made such requests impossible.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored. Management Response: The agency agrees with the finding. During state fiscal year 2024, the division was in the process of implementing controls for subrecipient determination or contractors, required reporting, risk assessment, and monitoring plan. Since this period, the division has fully implemented the internal controls to ensure compliance with the federal requirements as identified in prior audits. The division recognizes that there are opportunities to strengthen the controls for subrecipient contractor determination, risk assessments and monitoring activities are accurate, complete, and documented and will refine these tools. The division also recognizes the opportunity to continue to improve controls that ensure that corresponding disbursements of federal funds are appropriately reported. The division will collaborate with agency financial services to develop enhanced controls that will ensure prevention, detection, and correction of payment reporting. Contact Person: Mick Kincaid Business Operations Manager Behavioral Health Division

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored. Management Response: The agency agrees with the finding. During state fiscal year 2024, the division was in the process of implementing controls for subrecipient determination or contractors, required reporting, risk assessment, and monitoring plan. Since this period, the division has fully implemented the internal controls to ensure compliance with the federal requirements as identified in prior audits. The division recognizes that there are opportunities to strengthen the controls for subrecipient contractor determination, risk assessments and monitoring activities are accurate, complete, and documented and will refine these tools. The division also recognizes the opportunity to continue to improve controls that ensure that corresponding disbursements of federal funds are appropriately reported. The division will collaborate with agency financial services to develop enhanced controls that will ensure prevention, detection, and correction of payment reporting. Contact Person: Mick Kincaid Business Operations Manager Behavioral Health Division

Federal Agency: U.S. Department of Housing and Urban Development Program/Cluster: Housing Voucher Cluster Federal Assistance Listing Number: 14.871, 14.879 Pass‐through: n/a – direct award Award No. and Year: CA131, 2023/2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Instance of Noncompliance Views of Responsible Officials and Corrective Action Plan: Due to the subrecipient’s low-risk status, another site visit is not due until FY2025/26. When that visit takes place, the County will formally document and communicate the results of the site visit. The department has created a subrecipient monitoring checklist to be completed quarterly which includes review of quarterly reports and will serve as documentation. Additionally, the department has a standing quarterly meeting with the subrecipient and will add an agenda item for quarterly report review discussion. The department will begin taking meeting minutes for documentation. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2025