Corrective Action Plans

Recommendation: We recommend that the Parish establish and implement formal policies and procedures for subrecipient monitoring in accordance with 2 CFR § 200.331. This should include conducting and documenting pre-award risk assessments, developing a subrecipient monitoring plan (e.g., site visits, desk reviews), reviewing subrecipient performance and audit reports on a regular basis. Corrective Action: The Parish has established a subrecipient checklist to assess risk and compliance. The checklist will be completed as an additional measure to ensure the standards outlined in the “Grant Administration Policies & Procedure” are met.

THE ORGANIZATION WILL USE EXPENDITURE REPORTS BY CLASS TO SUPPORT BASE EXPENDITURES FOR THE PERIOD. WILL BE IN PLACE FOR THE 2025 SINGLE AUDIT AND BEGAN THIS PROCESS IN 2024. KAREN SHARPNACK, EXECUTIVE DIRECTOR KJS@IDAHOIMMUNE.ORG AND NEW CPA FIRM TO BE DETERMINED. THE ORGANIZATION THROUGH ITS BOARD OF DIRECTORS WILL CREATE A “FINANCIAL POLICY COMMITTEE” WHICH WILL BE RESPONSIBLE TO WORK WITH THE EXECUTIVE DIRECTOR, THE NEW CPA TO OUTLINE AND CREATE NEW POLICIES, PROCEDURES AND PROCESSES, ALONG WITH OVERSIGHT OF THE FINANCIAL WELL-BEING OF THE ORGANIZATION AND REPORT TO THE BOARD OF DIRECTORS. IMMEDIATELY, THE PROCESS WILL BEGIN TO RECRUIT THE COMMITTEE ON JUNE 25, 2025.

DMPSJ: While the Office of the Deputy Mayor for Public Safety and Justice (DMPSJ) doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. Nicole Peckumn, Chief of Staff, DMPSJ August 30, 2025 DMPSJ will ensure compliance with standard operation procedures to ensure monthly and performance reports are submitted, as well as ensure follow-up related to corrective action plans is documented. While DMPSJ doesn’t agree with the finding regarding the debarment check, DMPSJ will implement a practice of capturing a screenshot and maintaining a copy of the screenshot in the file for a grantee(s) receiving federal funding. ONSE: The Office of Neighborhood Safety and Engagement (ONSE) acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. ONSE has created a monitoring team and plan to ensure that all subrecipients are in compliance with submissions of their financial and performance reports. Contact: Yasha Williams Robinson, Chief Operating Officer, ONSE Estimated Completion Date: September 30, 2025 See Corrective Action Plan for chart/table

Finding #2024-002 – Significant Deficiency and Other Noncompliance. Applicable federal program: U. S. Environmental Protection Agency, Assistance Listing #66.456, National Estuary program, Passed through Texas Commission on Environmental Quality: Contract period: 09/01/23 – 08/31/25, Contract number: 582-24-50165. Condition and context: We reviewed one of the two subrecipient awards for the required information described in the criteria above and noted such provisions were not included in the subrecipient agreement. Recommendation: Policies and procedures should be implemented to ensure all required information is included in the subrecipient agreement before issuance. Planned corrective action: Management agrees with the finding and would like to provide additional context to this situation. This agreement occurred during the early implementation phase of a multi-year grant in 2023, when the Foundation was still establishing internal processes for managing subawards under federal funding requirements. At the time of this transaction: The federal award had not yet been formally executed, though the federal agency provided authorization to begin incurring expenses. The subrecipient, a partner organization, drafted and issued the agreement using their standard contract template. Since that time, the Foundation has updated its procedures for subsequent subrecipient agreements to include the required Uniform Guidance information as outlined in 2 CFR §200.331(a). This was an isolated incident during a transitional period, and management is confident that current processes address this issue. To prevent recurrence, the Foundation will: Continue to follow updated subrecipient agreement templates, which include all required award and federal compliance language. Provide refresher training to staff involved in grant and contract administration on subrecipient vs. vendor classifications and associated federal requirements. Perform an annual compliance review of all subrecipient agreements to ensure ongoing adherence. Responsible officer: Dawn Asbury, Controller. Estimated completion date: July 31, 2025.

Finding 2024-003: SEFA Preparation – Subrecipient vs. Subcontractor Determinations Name of Responsible Official: Nikolos Oakley, CFAO Anticipated Completion Date: 09/30/2025 Condition: Subcontractor amounts were improperly included in the Amounts Provided to Subrecipients column on the Schedule of Expenditures of Federal Awards (SEFA). Context: Management made improper subrecipient vs. subcontractor determinations, resulting in inaccurate SEFA preparation. This resulted in $2.6 million being removed from the Amounts Provided to Subrecipients column in the original SEFA provided to the auditors by management. Views of Responsible Officials and Planned Corrective Action: IntraHealth acknowledges the finding regarding the improper inclusion of subcontractor amounts in the Amounts Provided to Subrecipients column on the Schedule of Expenditures of Federal Awards (SEFA). We will improve our reporting and review processes to ensure subcontractor amounts are not incorporated under Amounts Provided to Subrecipients column in SEFA. Corrective Action: • Implement a more rigorous review process to ensure that only true subrecipients are included in the Amounts Provided to Subrecipients column of the SEFA. Subcontractor amounts will be reported separately as required. We will also improve training for the finance and grants management teams to ensure they fully understand the regulations. IntraHealth is committed to ensuring the accuracy of future SEFA reports and will complete the corrective actions by 09/30/2025. We will also continue to monitor the effectiveness of these changes to prevent future misclassifications.

2024-006 Subrecipient Monitoring Compliance - CSBG Person responsible for corrective action - Andrea Olson, executive Director Responsible official's response - Management is in agreement with this finding. Responsible official's response - Management is in agreement with this finding. Corrective action planned - CAPND has changed subaward formatting to ensure that all required information is included within the award. Planned implementation date of corrective action - July 1, 2024

2024-005 Subreicipient Monitoring Compliance - SSVF Person responsible for corrective action - Andrea Olson, executive Director Responsible official's response - Management is in agreement with this finding. Corrective acction planned - CAPND has a comprehensive monitoring plan to monitor all grant supported activities in accordance with program rules relative to SSVF program including rules established by the program, those established by CAPND. Planned implementation date of corrective action - 2025

2024-004 Allowable Costs Compliance - SSVF Person responsible for corrective action - Andrea Olson, executive Director Responsible official's response - Management is in agreement with this finding. Corrective acction planned - CAPND has a comprehensive monitoring plan to monitor all grant supported activities in accordance with program rules relative to SSVF program including rules established by the program, those established by CAPND. Planned implementation date of corrective action - 2025

Finding 2024-028 U.S. Department of Health and Human Services AL No. 93.940 HIV Prevention Activities Health Department Based Programs Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-024 Auditee’s Corrective Action Plan: BCHD has developed a subrecipient monitoring policy currently routing internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. E. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. F. Subrecipient contract agreement templates are being updated to ensure subaward is clearly identified and includes the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2024-025 U.S. Department of Health and Human Services AL No. 93.914 HIV Emergency Relief Project Grants Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-021 Auditee’s Corrective Action Plan: BCHD has developed a subrecipient monitoring policy currently routing internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. E. Update subrecipient contract agreement templates ensure subawards are clearly identified and include the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2023-022 U.S. Department of Health and Human Services AL No. 93.686 Ending the HIV Epidemic: A Plan for America Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-017 BCHD has developed a subrecipient monitoring policy currently routed internally for approval that addresses the assessment, monitoring and documentation portions of subrecipient monitoring as well as other key elements to ensure adherence to 2 CFR 200. The following tools have been created and implemented or in progress to use during monitoring: A. Subrecipient vs. Contractor Determination Checklist that must be completed by staff when submitting contract request to the contract unit to ensure subrecipients are properly identified and to develop a comprehensive monitoring schedule for the agency. B. Comprehensive risk assessment tool to determine monitoring plan for subrecipient. C. Both programmatic and fiscal baseline monitoring tools. Programmatic tools are at the beginning stages of implementation and continue to be customized for specific grant award requirements when necessary. D. Updated expense tracker for the accountants to utilize for review of subrecipient invoices. E. Updated monitoring and risk assessment tools to include requesting and documenting both single audit reports and SAMS.gov status. E. Update subrecipient contract agreement templates ensure subawards are clearly identified and include the Federal Award Identification Number, subrecipient’s UEI, along with clear monitoring expectations. Contact Person: Unyime Ekpa, Chief Financial Officer, Baltimore City Health Department Completion Date: June 30, 2025

Finding 2024-014 U.S. Department of Housing and Urban Development AL No. 14.241 Housing Opportunities for Persons with AIDS Material Weakness in Internal Controls and Noncompliance over Subrecipient Monitoring Repeat Finding: Yes; 2023-011 Auditee’s Corrective Action Plan: Condition #1 Response MOHS acknowledges the finding that 2 out of 2subrecipient files did not have evidence that subrecipient was monitored. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM, Unique Entity Identification #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports. Condition #2 Response MOHS acknowledges the finding that 2 out of 2 selections did not have information related to the funding source and pass through entity on the notice of award. Corrective Action: MOHS will follow the City’s Grant Management office’s established process of establishing and maintaining a hardcopy audit file. This file will include: a. Federal System Registrations: SAM, Unique Entity Identification #s, Grants.gov information; b. Federal Financial Accountability and Transparency (FFATA) information; c. FFR Submissions (SF-425 Federal Financial Report); d. Grant Agreements; and, e. Prior Year Single Audits/Monitoring Reports. Contact Person: Lakeysha Williams, Director of Programs, Mayor’s Office of Homeless Services Completion Date: April 7, 2025

2024-003 – Subrecipient Monitoring Compliance Person responsible for corrective action: Nicole Meland, Vice President of Finance and Operations Responsible official’s response: Management is in agreement with this finding. Corrective action planned: The Chamber Foundation has subsequently requested all audit reports from all subrecipients. Additionally, the Chamber Foundation has changed subaward formatting to ensure that all required information is included within the award. Planned implementation date of corrective action: May 27, 2025

SD 2024‐003 SUBRECIPIENT MONITORING Recommendations: If the most recent subrecipient audit report is not yet available, management should request the prior fiscal year if not already obtained. Management’s Response: The IRL Council put controls in place to be more effective at subrecipient monitoring following the FY 2023 finding which included the following actions: The IRL Council reviewed all projects and activities currently allocated and funded by federal sources to ensure the Uniform Guidance was in place within their respective agreements, and they were amended as needed. All new subrecipient agreements funded by federal sources were not executed until the respective federal award was in place and the Uniform Guidance language was included. The IRL Council did request audit reports from subrecipients and made statements on them, however for the ones who had not completed their FY 2024 audit, a prior year audit report was not immediately requested and statements for those subrecipients had not yet been made. The IRL Council will implement a control to request prior year Financial Statements/audit reports from subrecipients who have not yet completed their report for the year being requested during the Council’s monitoring. Responsible Party: Daniel Kolodny, COO Anticipated Completion Date: June 1, 2025.

Views of Responsible Officials: Over the past three (3) years, the organization has increased the skill set and capacity among teams for risk assessment and awards management. Subaward policies have been reviewed and all subaward recipients are required to complete pre-award surveys (which include the risk assessment unless the subrecipients are pre-approved by USAID and exempted from such policies). The Associate Director of Grants and Compliance continues to work with members of the Program team to monitor all subrecipient awards for full compliance with 2 CFR 200.516(a). After the FY2022 findings, Astraea sought documentation from federal agencies where risk assessment exemptions applied. The inception of some of these subawards predated FY2022. While we had intended to perform new retroactive risk assessments, the suspension of the federal awards as of January 24, 11:59PM and subsequent termination of the awards had clear instructions to stop work, and therefore made such requests impossible.

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored. Management Response: The agency agrees with the finding. During state fiscal year 2024, the division was in the process of implementing controls for subrecipient determination or contractors, required reporting, risk assessment, and monitoring plan. Since this period, the division has fully implemented the internal controls to ensure compliance with the federal requirements as identified in prior audits. The division recognizes that there are opportunities to strengthen the controls for subrecipient contractor determination, risk assessments and monitoring activities are accurate, complete, and documented and will refine these tools. The division also recognizes the opportunity to continue to improve controls that ensure that corresponding disbursements of federal funds are appropriately reported. The division will collaborate with agency financial services to develop enhanced controls that will ensure prevention, detection, and correction of payment reporting. Contact Person: Mick Kincaid Business Operations Manager Behavioral Health Division

2024-009 Oregon Health Authority Continue to implement and strengthen controls to ensure subrecipients are appropriately identified and monitored. Management Response: The agency agrees with the finding. During state fiscal year 2024, the division was in the process of implementing controls for subrecipient determination or contractors, required reporting, risk assessment, and monitoring plan. Since this period, the division has fully implemented the internal controls to ensure compliance with the federal requirements as identified in prior audits. The division recognizes that there are opportunities to strengthen the controls for subrecipient contractor determination, risk assessments and monitoring activities are accurate, complete, and documented and will refine these tools. The division also recognizes the opportunity to continue to improve controls that ensure that corresponding disbursements of federal funds are appropriately reported. The division will collaborate with agency financial services to develop enhanced controls that will ensure prevention, detection, and correction of payment reporting. Contact Person: Mick Kincaid Business Operations Manager Behavioral Health Division

Federal Agency: U.S. Department of Housing and Urban Development Program/Cluster: Housing Voucher Cluster Federal Assistance Listing Number: 14.871, 14.879 Pass‐through: n/a – direct award Award No. and Year: CA131, 2023/2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Instance of Noncompliance Views of Responsible Officials and Corrective Action Plan: Due to the subrecipient’s low-risk status, another site visit is not due until FY2025/26. When that visit takes place, the County will formally document and communicate the results of the site visit. The department has created a subrecipient monitoring checklist to be completed quarterly which includes review of quarterly reports and will serve as documentation. Additionally, the department has a standing quarterly meeting with the subrecipient and will add an agenda item for quarterly report review discussion. The department will begin taking meeting minutes for documentation. Responsible Individual(s): James Bezek, Director of Resources Management Anticipated Completion Date: June 30, 2025

Subrecipient Monitoring Non-compliance with its inconsistent documented monitoring procedures. Corrective Action Plan: AMHD will review and revise their monitoring procedures to ensure that subrecipient expenditures are monitored and single audit reports are reviewed, as applicable. Implementation Date: July 1, 2025 Responding Official: Chanel Daluddung, Performance, Information, Evaluation and Research Branch Chief, Adult Mental Health Division

CORRECTIVE ACTION PLAN State Fiscal Year Ended June 30, 2024 21.027 Coronavirus State and Local Fiscal Recovery Funds State Agency: NH Governor’s Office of Emergency Relief and Recovery Audit Contact: Michele Thibault Title: Director of Finance and Compliance Telephone: (603)-271-7951 E-mail address: Michele.Z.Thibault-G@goferr.nh.gov Audit Report Reference: 2024-011 – Procurement Anticipated Completion Date: April 30, 2025 View of Responsible Officials: The State’s vendor determination policy is consistently applied across all Department’s within the State. The State’s vendor determination policy does not identify or vary for subrecipient, beneficiary, or contractor payments, however, federal reporting requirements dictate stratification of subawards as defined within 2 CFR 200. Accordingly, state agencies utilize various methods to differentiate payments to subrecipients from payments made to beneficiaries or contractors. Although there may be requirements to stratify beneficiary payments from procurement contracts specific to individual program requirements, there is no unifying requirement for States to otherwise stratify these populations within uniform grant guidance codified within 2 CFR 200. For this reason sampling of payment data to differentiate beneficiaries from contractors can be difficult for test work purposes. As stated in 2 CFR 200.331, the State is responsible for making a case-by-case determination to determine whether the entity receiving federal funds is a subrecipient or a contractor. As such, the State has provided training and documentation to all Departments to utilize for determining if a program/project is for a subrecipient or contractor. While this determination will not impact the procurement process in the State, it does impact the monitoring process for subrecipients versus contractors and the State has followed the procedures to ensure the proper determination for oversight. Per 2 CFR section 200.303, the State has established and maintained effective internal control over federal awards to provide reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award by providing Departments training, information and processes for Departments to determine if federal funds are utilized for a subrecipient or contractor and how the use of those funds shall be monitored. The State will review the selections determined to be misclassified per 2 CFR 200.331 to evaluate their classification and where necessary make adjustments to considerations made in the application of the specified criteria of 200.331

Department of Public Instruction Response/Corrective Action Plan: DPI agrees with the finding. We have split the duties of subrecipient review among two employees. One person does the administrative functions and responses to subrecipients who have no findings. The other employee works on the more complex audit reviews. We feel that this change along with the increase to the audit threshold and the end of the COVID related federal funding will allow us to stay in compliance of federal regulations. Contact Person: Jamie Mertz, CFO Anticipated Completion Date: This was implemented January 2, 2025

Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance (Modified Opinion) Condition: Kansas Division of Emergency Management (Management) did not issue subawards to subrecipients until after the fiscal year ended. Recommendation: We recommend that Management reviews and enhances its internal controls and procedures to ensure that subawards are issued timely to subrecipients, and that subawards include all required federal award information. Views of responsible officials: Management partially agrees with this finding. Although the 2023 2 CFR § 200.332 does state that the award letters should be sent at the time of the award, there needs to be some reasonableness to the interpretation of this regulation. KDEM currently has 13 open disasters with over 100 open projects and more being written. It is not reasonable to interpret that the award letters be sent on the date that the award is granted. Action taken in response to finding: Management will utilize the report run for FFATA to send award letters to sub-recipients. Name(s) of the contact person(s) responsible for corrective action: Jennifer Deal, Fiscal & Grants Management Section Chief Planned completion date for corrective action plan: Ongoing

Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance (Modified Opinion) Condition: Subawards issued by the Kansas Department of Health and Environment (Department) did not include all required subaward information. Recommendation: We recommend that the Department develop a subaward template that includes all required federal award information and update its procedures and internal controls to ensure that all required federal award information is included in subawards at the time of issuance. Views of responsible officials: Management disagrees with the finding. Multi-year subrecipient agreements executed prior to March 2024 did not include the Sub-Recipient Agreement Submission Form. The agreements were not re-executed after March 2024 to include the form. The audit findings should only pertain to agreements newly executed after March 2024; however, because the audit included agreements executed prior to March 2024, the audit found that information is missing. Action taken in response to finding: All subrecipient agreements executed after March 2024 include the Sub-Recipient Agreement Submission Form. Name(s) of the contact person(s) responsible for corrective action: Farah Ahmed and Sheri Tubach, Bureau of Epidemiology and Public Health Informatics Planned completion date for corrective action plan: Completed

Responsible Contact Person(s): Kimberly Boehme, OPGS Director Corrective Action Planned: Policies and procedures for grant management - to include subrecipient monitoring and FFATA reporting - will be revised. Oversight responsibilities will be determined for the Office of Grant Management, Office of Purchasing and General Services, and Office of Financial Management. Employees responsible for managing grants and subrecipients will receive training on the new process. Estimated Completion Date: 12/31/2025

Finding: 2024-002 - Subrecipient Monitoring Auditor Description of Condition and Effect: We noted that the Organization did not compile any risk assessments or perform adequate subrecipient monitoring during the fiscal year. The lack of monitoring failed to provide reasonable assurance that the subrecipients complied with the provisions of the grant. Auditor Recommendation: We recommend that the Organization create a subrecipient policy to ensure that all subrecipient grant awards are monitored in compliance with the Uniform Guidance requirements. Corrective Action: Management will create and adopt a subrecipient monitoring policy that ensures compliance with the Uniform Guidance requirements by June 30, 2025. Responsible Person: Joe Sobieralski, President and CEO Anticipated Completion Date: June 30, 2025